CISA Governance and Management of IT: 522 practice questions

12 of the 522 Governance and Management of IT questions in the Certsqill CISA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISA? Take the free 5-min readiness check →

1. A current approved file lists each applicable requirement: Which provides the strongest basis for concluding t

1. A current matrix maps applicable requirements to controls, owners, evidence, exceptions, review status, and remediation tracking.

   The matrix is useful but lacks the approved file’s documented test results and rationale.
2. A current approved file lists each applicable requirement, mapped control, test result, owner, exception rationale, and remediation status. ✓

   This source traces requirements through controls, testing, ownership, exceptions, and remediation.
3. Training records show completion, acknowledgment, refresher participation, manager review, and corrective action for affected staff.

   Training evidence supports awareness but does not establish process compliance comprehensively.
4. A policy cites several standards.

   Policy references alone do not demonstrate implemented and tested compliance.

The approved file most completely traces requirements, controls, testing, ownership, and remediation.

2. No accountable executive coordinates dependencies: Which gap is most consequential for governance and IT strat

1. Project teams use inconsistent terminology for virtual-care capabilities.

   Terminology inconsistency is less consequential than absent accountable decision rights.
2. The network has not standardized every technology platform across departments and regions.

   Architecture should align dependencies, not maximize standardization regardless of business need.
3. No accountable executive coordinates dependencies and decision rights supporting the approved strategy. ✓

   Absent accountability leaves strategic dependencies unmanaged despite governing-body direction.
4. The network lacks a single dashboard reporting project completion percentages and milestones.

   Reporting visibility matters, but does not address strategic accountability or dependency alignment.

The central gap is missing accountability for aligning technology decisions with strategy.

3. Test whether current access requests follow the approved: What should the auditor do next?

1. Accept the policy because documented requirements already establish the expected control.

   Documented requirements establish design, not operating effectiveness in practice.
2. Recommend immediate disciplinary action against users of the outdated procedure.

   Discipline is management’s decision and does not establish the control’s implementation.
3. Test whether current access requests follow the approved policy and standard. ✓

   Testing actual requests determines whether the control operates as documented.
4. Rewrite the procedure so staff can follow the current standard.

   Rewriting procedures is management’s responsibility, not the auditor’s.

The next step is testing current transactions against approved requirements and procedures.

4. Require documented analysis of identity: What should occur before approval?

1. Reject it permanently because separate identity services are unacceptable regardless of business need or risk.

   Architecture decisions should consider business needs and risks, not unsupported prohibitions.
2. Require documented analysis of identity, data, application, and technology dependencies before approval. ✓

   Dependency analysis determines alignment with enterprise architecture and business requirements.
3. Require a deployment schedule before deciding on architectural approval.

   A schedule does not resolve identity, data, application, or technology dependencies.
4. Approve it because speed and lower cost outweigh identified architecture concerns.

   Cost and speed alone do not establish architectural alignment or acceptable dependencies.

Management should analyze cross-domain dependencies before approving the proposed architecture.

5. Report reduction: How should the auditor interpret these results?

1. Accept the treatment as validated.

   Auditor validation cannot transfer residual-risk acceptance responsibility from management.
2. Report reduction; require owner review. ✓

   The auditor reports partial reduction while management evaluates residual exposure.
3. Declare treatment ineffective because dependencies remained uncovered.

   A treatment may reduce exposure without eliminating every residual dependency.
4. Declare treatment effective because disruption decreased.

   Measured improvement does not establish acceptable residual risk or complete coverage.

Report reduced exposure and require management to reconsider residual risk.

6. Operating effectiveness is unproven: Which conclusion is best?

1. Operating effectiveness is unproven. ✓

   Design evidence exists, but operating evidence for deletion is missing.
2. Encryption should replace retention testing because it protects participant data.

   Encryption does not demonstrate retention compliance or deletion effectiveness.
3. The control is ineffective because documented privacy purposes are unnecessary.

   Documented purpose supports design and remains relevant to privacy governance.
4. Privacy governance is fully effective because access controls exist.

   Access controls do not prove purpose limitation, retention, or deletion operation.

The control appears designed, but operation cannot be confirmed without deletion evidence.

7. Require the data owner to approve classifications: Which recommendation best addresses the underlying governan

1. Encrypt every repository without defining information categories or ownership.

   Encryption does not establish classification, ownership, or authorization decisions.
2. Replace custodians because inconsistent settings prove individual negligence.

   The evidence indicates missing governance, not necessarily individual misconduct.
3. Require the data owner to approve classifications and access rules. ✓

   Data owners should classify information and authorize appropriate access decisions.
4. Require custodians to choose classifications independently for each repository.

   Custodians implement controls but should not own classification decisions.

Establish owner-approved classification and authorization before directing custodial implementation.

8. The report gives incomplete assurance because its period: What limitation should the auditor emphasize?

1. Terminate outsourcing because the provider report is incomplete.

   A reporting limitation requires evaluation and response, not automatic outsourcing termination.
2. Accept the report while management separately defines missing provider controls.

   The auditor evaluates the limitation; management defines provider requirements and responses.
3. Treat the report as complete assurance because outsourcing transfers operational accountability and eliminates residual risk.

   Outsourcing transfers activity, not enterprise accountability or residual risk.
4. The report gives incomplete assurance because its period and subservice coverage do not match the contract. ✓

   Mismatched period and excluded subservices leave important outsourced activities unevaluated.

The report is limited by its shorter period and excluded subservice organization.

9. Assign a management service owner for outcomes: What should the auditor recommend?

1. Have procurement approve provider decisions because it administers the contract.

   Contract administration does not establish ownership of business service outcomes.
2. Ask the provider to accept accountability for the outsourced service outcome.

   Outsourcing activities does not transfer enterprise accountability to the provider.
3. Have the risk committee perform the provider’s daily service oversight.

   Governance oversight should not replace designated management service ownership.
4. Assign a management service owner for outcomes; the provider performs contracted activities. ✓

   Management retains outcomes while the provider performs delegated contractual activities.

Management retains accountability while the provider performs delegated contractual activities.

10. Validate customer-impacting availability: Which priority is best?

1. Average both companies’ availability percentages for a single board figure.

   Averaging incompatible measures conceals differing definitions and service populations.
2. Validate customer-impacting availability; report one comparable measure and exposure indicator. ✓

   This addresses customer risk while providing qualified, decision-useful reporting.
3. Publish the legacy company’s availability percentage immediately for executive visibility.

   Unreconciled legacy data may misstate merged-service performance.
4. Define a common availability measure and validate its underlying source data before reporting.

   Measurement design helps, but may overlook immediate customer exposure.

Risk-based reporting validates consequential data before presenting comparable merged-company performance.

11. Test retrospective review and assess residual risk: What should the auditor do next?

1. Accept the exception automatically because retrospective review covered sampled changes.

   Retrospective review may not fully compensate for missing preventive review.
2. Require management to eliminate every emergency change exception immediately.

   Controlled exceptions may be valid when documented, approved, and risk-assessed.
3. Test retrospective review and assess residual risk. ✓

   Testing consistency determines whether the compensating control operates effectively.
4. Declare the quality standard ineffective solely because approved emergency exceptions occurred.

   A documented exception does not inherently invalidate the underlying standard.

Evaluate compensating-control operation and residual risk before concluding on quality effectiveness.

12. Assign an owner to identify and map applicable: Which gap is most consequential?

1. Increase security training frequency for technical staff.

   Training expansion does not establish which requirements apply.
2. Obtain an additional external certification covering the provider's customer-information processes.

   Certification may provide evidence but does not assign requirements ownership.
3. Assign an owner to identify and map applicable requirements. ✓

   Without ownership, applicable obligations cannot be consistently identified or addressed.
4. Require vulnerability testing evidence from every delivery region.

   Testing evidence cannot replace systematic requirements identification and mapping.

Requirements ownership and mapping establish the basis for evaluating all applicable obligations.

Other CISA domains

• Information Systems Operations and Business Resilience — 754 questions →
• Protection of Information Assets — 754 questions →
• Information Systems Auditing Process — 522 questions →
• Information Systems Acquisition, Development and Implementation — 348 questions →
• All 2900 CISA questions →
• CISA certification: requirements, cost and exam format →