CISA Domain 2A-2 Practice Test 002

This practice test covers Domain 2 (Governance & Management of IT) Subdomain A-2 (Organizational Structure, IT Governance, and IT Strategy) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2A-2 Organizational Structure, IT Governance, and IT Strategy Practice Test 002

10 questions • Single best answer

Question 1

A logistics company's audit committee asks internal audit for assurance that the new three-year IT strategy will support planned regional expansion. The IS auditor learns the CIO drafted and approved the strategy without input from business unit leaders or executive management. Which finding is MOST significant?

A. The strategy does not include detailed cost estimates for each of the planned initiatives B. Business leadership did not participate in developing or approving the IT strategy C. The strategy was not benchmarked against IT strategies of comparable competitors D. The strategy does not identify preferred technology vendors for key initiatives

Question 2

A small credit union with eight IT staff cannot hire additional personnel due to budget constraints. An IS auditor finds that the database administrator also performs security administration, including creating user accounts and assigning privileges on the institution's core banking system. Which recommendation is MOST appropriate?

A. Transfer security administration duties to the application development team lead B. Require the database administrator to sign an annual conflict-of-interest and acceptable-use attestation C. Accept the risk because the organization is too small to segregate these duties D. Implement independent review of the administrator's privileged activity and account changes

Question 3

An IS auditor at a state transportation department is evaluating whether IT investments support the agency's published five-year mission goals. IT management states that alignment is discussed informally in leadership meetings but is not documented. Which of the following would provide the BEST evidence of strategic alignment?

A. A documented mapping of IT initiatives to agency goals, approved and tracked by the steering committee B. A list of active IT projects showing their current budgets, delivery schedules, and assigned project managers C. A signed memo from the CIO affirming that all IT initiatives support the agency's mission D. An IT budget report showing year-over-year growth in spending on strategic technology programs

Question 4

During a review of a pharmaceutical manufacturer, an IS auditor examines the IT steering committee charter. The committee prioritizes the IT project portfolio and approves major technology investments, but its membership consists entirely of the CIO and IT department directors. Which is the auditor's GREATEST concern?

A. The committee lacks a documented escalation path to the board of directors B. The committee charter does not define a minimum meeting frequency or quorum C. Investment priorities may not reflect business needs because business representation is absent D. IT directors may lack the technical expertise needed to evaluate emerging and specialized technologies

Question 5

A mid-sized insurance company outsourced its entire IT operation to a managed service provider and eliminated all internal IT management positions to reduce costs. An IS auditor reviewing IT governance notes that contract performance is monitored only by the procurement department. Which risk is MOST significant?

A. No internal function retains accountability for IT strategy, risk, and oversight of the provider B. The procurement department may not negotiate the most favorable contract renewal terms C. The provider may not maintain adequate documentation of its internal operating procedures D. Service level reports submitted by the provider may be delivered later than contractually required

Question 6

An IS auditor reviewing the IT governance framework of a national retail chain finds that board members spend most IT-related agenda time approving individual system change requests and hardware purchases. The board has not reviewed the IT strategy or IT risk appetite in three years. Which recommendation is MOST appropriate?

A. Require the CIO to submit more detailed technical justifications with each change request B. Establish a change advisory board to review requests before they reach the board of directors C. Increase the frequency of board meetings so that both operational and strategic items are covered D. Refocus the board on strategy and risk oversight, delegating operational decisions to management

Question 7

A regional water utility has asked its internal audit team to evaluate whether the IT strategy adequately supports the utility's modernization objectives. The IS auditor has obtained the IT strategy document, the current project portfolio, and the IT budget. What should the IS auditor do FIRST?

A. Assess whether the IT project portfolio is on schedule and within budget B. Obtain an understanding of the utility's business strategy and objectives C. Compare the IT strategy against a recognized governance framework such as COBIT D. Interview IT management to identify the rationale behind each strategic initiative

Question 8

A hospital system's IT governance policy requires steering committee approval for every IT project exceeding $500,000. An IS auditor wants to determine whether this control operated effectively throughout the audit period, during which several large clinical system projects were launched. Which testing approach provides the BEST assurance?

A. Interview steering committee members to confirm they review all qualifying project proposals B. Review committee minutes and verify that each approved project had a supporting business case C. Select projects over the threshold from financial records and trace each to a documented committee approval D. Examine the governance policy and committee charter to confirm the approval threshold is clearly defined and communicated

Question 9

A prior audit at a telecommunications provider recommended establishing an IT governance committee to oversee technology investment and risk. During follow-up, management reports the committee was formed six months ago and provides its approved charter. Which additional evidence would BEST demonstrate the finding has been effectively remediated?

A. A roster confirming that senior business and IT executives were formally appointed as voting committee members B. A communication from the CEO announcing the committee's formation to all company employees C. Management's written representation that the committee is functioning as intended D. Meeting minutes showing the committee regularly reviews IT risk and makes prioritization decisions

Question 10

Following the merger of two healthcare payers, each former company's business units continue operating their own IT teams, selecting technologies and approving projects independently. An IS auditor notes duplicate systems, inconsistent security standards, and no enterprise view of IT spending. Which recommendation would BEST address the root cause?

A. Define an enterprise IT governance structure that sets decision rights between central IT and business units B. Consolidate all business unit IT teams into a single centralized department under the combined CIO C. Conduct an enterprise-wide inventory of all systems to identify and retire duplicated applications D. Adopt a single set of information security standards and require all business units to comply

Related Posts

Leave a Comment Cancel Reply