Certified Information Systems Auditor (CISA) Governance and Management of IT Syllabus

Governance and Management of IT syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Governance and Management of IT in Certified Information Systems Auditor (CISA), not a summary of it.

1. 1

   IT Governance Frameworks

   5 topics

   • Enterprise governance of IT (EGIT) concepts
   • COBIT framework principles and components
     • Governance vs. management objectives
     • Goals cascade and design factors
   • Board and executive responsibilities for IT
   • IT balanced scorecard and performance metrics
   • Aligning IT strategy with business objectives
2. 2

   IT Strategy, Policies, and Standards

   4 topics

   • IT strategic and tactical planning
   • Policies, standards, procedures, and guidelines hierarchy
   • IT steering committee and decision rights
   • Enterprise architecture management
3. 3

   Organizational Structure and HR Management

   4 topics

   • IT roles, responsibilities, and reporting lines
   • Segregation of duties within IT
     • Conflicting duties and compensating controls
   • Human resource controls
     • Hiring, background checks, and onboarding
     • Job rotation, mandatory vacation, and termination procedures
   • Sourcing strategies and outsourcing governance
4. 4

   Risk Management

   4 topics

   • Risk management lifecycle
     • Identification, assessment, response, and monitoring
   • Risk appetite, tolerance, and capacity
   • Risk treatment options
     • Avoid, mitigate, transfer, and accept
   • Maintaining a risk register and KRIs
5. 5

   Third-Party and Vendor Management

   4 topics

   • Vendor selection and due diligence
   • Service level agreements and contract management
     • Right-to-audit clauses and penalties
   • Ongoing monitoring of service providers
   • Cloud and managed service governance considerations
6. 6

   Compliance, Privacy, and Performance Management

   4 topics

   • Legal, regulatory, and contractual compliance management
   • Privacy program governance and data protection laws
     • GDPR, CCPA/CPRA, and sectoral US regulations
   • Maturity models and process capability assessment
   • Quality management systems for IT

Governance and Management of IT flashcards for Certified Information Systems Auditor (CISA)

25 of 69 cards from the Governance and Management of IT deck — real questions with worked answers.

1. What is Enterprise Governance of IT (EGIT)?

   A governance framework, integrated into overall corporate/enterprise governance, that ensures IT enables and sustains the enterprise's strategy and objectives by directing and controlling IT decisions, value delivery, and risk.

2. What is the primary difference between IT governance and IT management?

   Governance (the board's responsibility) evaluates, directs, and monitors to set direction and ensure objectives are met; management (executives) plans, builds, runs, and monitors activities in alignment with that direction. Governance ensures the right things happen; management makes them happen.

3. What are the five governance objectives that make up the value proposition delivered by EGIT?

   Strategic alignment, value delivery, risk management, resource management (optimization), and performance measurement.

4. What is COBIT and who publishes it?

   COBIT (Control Objectives for Information and Related Technologies) is a comprehensive framework for the governance and management of enterprise IT, published by ISACA.

5. In COBIT 2019, what is the key distinction between Governance and Management objectives?

   Governance objectives are in the EDM domain (Evaluate, Direct, Monitor) and are the board's responsibility; Management objectives (APO, BAI, DSS, MEA) are the responsibility of executive management who plan, build, run, and monitor.

6. Name the five domains of COBIT 2019.

   EDM (Evaluate, Direct and Monitor); APO (Align, Plan and Organize); BAI (Build, Acquire and Implement); DSS (Deliver, Service and Support); and MEA (Monitor, Evaluate and Assess).

7. What are the six governance system principles in COBIT 2019?

   1) Provide stakeholder value; 2) Holistic approach; 3) Dynamic governance system; 4) Governance distinct from management; 5) Tailored to enterprise needs; 6) End-to-end governance system.

8. What is a COBIT 2019 'governance/management objective' and how does it map to components?

   Each objective is supported by a process and a set of related components (such as organizational structures, information flows, policies, culture, skills, services/infrastructure) needed to achieve the objective.

9. What are the seven components (formerly 'enablers') of a COBIT governance system?

   1) Processes; 2) Organizational structures; 3) Principles, policies and frameworks; 4) Information; 5) Culture, ethics and behavior; 6) People, skills and competencies; 7) Services, infrastructure and applications.

10. What are 'design factors' in COBIT 2019?

    Factors (such as enterprise strategy, goals, risk profile, IT-related issues, threat landscape, compliance requirements, role of IT, sourcing model, and enterprise size) used to tailor and prioritize a customized governance system for the enterprise.

11. What is the board of directors' primary IT governance responsibility?

    To provide oversight and strategic direction—evaluating, directing, and monitoring IT to ensure it supports business objectives, delivers value, and that IT risk is managed within acceptable limits; the board sets the 'tone at the top.'

12. What is an IT balanced scorecard (BSC)?

    A performance management tool that translates IT strategy into measurable objectives across multiple perspectives, providing a balanced view beyond financial measures to evaluate IT's contribution to the business.

13. What are the four classic perspectives of an IT balanced scorecard?

    Corporate/business contribution (value), customer/user orientation, operational excellence (internal processes), and future orientation (learning, growth, innovation).

14. Why use a balanced scorecard instead of purely financial metrics for IT?

    Financial measures are lagging indicators; the BSC adds leading indicators across customer, process, and learning perspectives to give a forward-looking, balanced assessment of how IT creates value and supports strategy.

15. What is the difference between a Key Performance Indicator (KPI) and a Key Goal Indicator (KGI)?

    A KPI is a leading measure of how well a process is performing (likelihood of meeting a goal); a KGI is a lagging measure indicating whether a goal/outcome was actually achieved.

16. What does it mean to align IT strategy with business objectives (strategic alignment)?

    Ensuring the IT strategy, investments, and operations directly support and enable enterprise goals, so IT plans are derived from and traceable to the business strategy rather than developed in isolation.

17. What is the difference between IT strategic planning and IT tactical (operational) planning?

    Strategic planning is long-term (typically 3-5 years), sets overall IT direction aligned to business goals; tactical/operational planning is short-term (typically 1 year or less), detailing specific projects, budgets, and actions to execute the strategy.

18. Who is primarily responsible for ensuring IT strategy aligns with business strategy?

    The board and senior/executive management (often via an IT strategy committee at board level), with the CIO translating business strategy into IT strategy.

19. Define the hierarchy: policies, standards, procedures, and guidelines.

    Policies = high-level management intent/direction (mandatory 'what/why'); Standards = mandatory specific rules/technologies supporting policy ('what specifically'); Procedures = mandatory step-by-step instructions ('how'); Guidelines = recommended, non-mandatory best-practice advice.

20. Which of policies, standards, procedures, and guidelines are mandatory versus discretionary?

    Policies, standards, and procedures are mandatory; guidelines are discretionary (recommended, not enforced).

21. A security policy states passwords must be 'strong.' A document specifying minimum 12 characters with complexity is which type of document?

    A standard (it provides the mandatory, specific, measurable requirement that supports the policy).

22. What is the purpose of an IT steering committee?

    A management-level committee (cross-functional) that oversees major IT initiatives, prioritizes and approves IT investments/projects, allocates resources, and ensures IT operations align with business needs.

23. What is the difference between an IT strategy committee and an IT steering committee?

    The IT strategy committee operates at board level advising on strategic direction and governance; the IT steering committee operates at executive/management level overseeing implementation, project prioritization, and resource allocation.

24. What are 'decision rights' in IT governance?

    The formal assignment of who has authority and accountability to make and provide input on specific IT decisions (e.g., IT principles, architecture, infrastructure, business application needs, and investment/prioritization).

25. What is enterprise architecture (EA)?

    A holistic blueprint and discipline describing the structure and integration of an organization's business processes, information, applications, and technology infrastructure, used to guide IT toward the target (future) state in alignment with strategy.

See more Governance and Management of IT flashcards →

Planning Governance and Management of IT for Certified Information Systems Auditor (CISA)

Governance and Management of IT (Certified Information Systems Auditor (CISA)) FAQ