Full Access Isaca CISA Tutorials

The correct answer is D. Create an interdisciplinary IT steering committee to oversee IT prioritization and spending.

The issue is not just poor documentation; it is weak IT governance. Projects are being managed informally and separately by isolated project managers. This indicates a lack of centralized prioritization, oversight, accountability, and alignment with business objectives. An interdisciplinary IT steering committee would help ensure that IT initiatives are reviewed, prioritized, funded, monitored, and aligned with enterprise strategy.

ISACA’s glossary defines an IT steering committee as an executive-management-level committee that assists in delivering IT strategy, oversees day-to-day management of IT service delivery and IT projects, and focuses on implementation aspects. This directly addresses the problem described in the question.

Option A is too extreme. Stopping all projects could harm the organization and is not a mature governance response unless there is an immediate critical risk. Option B is weak because a follow-up audit only checks later whether improvement occurred; it does not create governance now. Option C may improve documentation, but a project management tool alone does not establish governance, prioritization, or business accountability.

This question maps to Governance and Management of IT because the concern is IT governance maturity, project oversight, prioritization, and spending. ISACA’s CISA Exam Content Outline includes organizational structure, IT governance, IT strategy, IT resource management, and evaluation of IT project management alignment with organizational objectives.

The role of a document owner when implementing a data classification policy in an organization is to classify documents to correctly reflect the level of sensitivity of information they contain. A document owner is the person who is ultimately responsible for the creation, maintenance, and protection of a document, usually a member of senior management or a business unit1. A data classification policy is a plan that defines how the organization categorizesits data based on its value, risk, and regulatory requirements, and how it handles and secures each data category2.

According to the data classification policy template by Netwrix3, one of the roles and responsibilities of the document owner is to assign data classification labels based on the data’s potential impact level. Data classification labels are tags or markings that indicate the sensitivity level of the data, such as public, internal, confidential, or restricted. The document owner should apply the data classification labels to the documents that contain the data, either manually or automatically, using tools and methods such as metadata, watermarks, headers, footers, or encryption. The document owner should also review and update the data classification labels periodically or whenever there is a change in the data’s sensitivity level.

By classifying documents to correctly reflect the level of sensitivity of information they contain, the document owner can help to ensure that the documents are handled in accordance with the data classification policy. This means that the documents are stored, accessed, shared, transmitted, and disposed of in a secure and appropriate manner, based on the rules and controls defined for each data category. This can also help to prevent data loss, leakage, or breach incidents that may cause harm or damage to the organization or its stakeholders.

Therefore, option A is the correct answer.

A governing body monitors IT performance most effectively when IT performance metrics are aligned with business goals. ISACA’s COBIT-based governance guidance consistently emphasizes that metrics should help leadership and governing bodies monitor the achievement of enterprise business goals and related IT goals. Metrics are useful for governance only when they are connected to what the enterprise is trying to achieve.

Option D is correct because a governing body is responsible for oversight at the strategic level. Strategic oversight depends on understanding whether IT is supporting business objectives, not just whether technical measures are being collected. ISACA states that metrics help management monitor achievements of business-related and IT-related goals.

Option A is useful at an operational or service management level, but it is narrower than business alignment. Service delivery objectives matter, yet the governing body’s concern is broader enterprise value and strategic alignment.

Option B is not the best answer because manufacturer recommendations may help establish technical asset baselines, but they do not ensure metrics support governance needs or enterprise performance oversight.

Option C is attractive because automated, quantitative data improves reliability and efficiency, but automation alone does not guarantee the metrics are the right ones. Governance requires relevant metrics tied to business outcomes, not just easily measured data.

Therefore, D is the best answer because proper alignment between business goals and IT performance metrics is what most enables a governing body to monitor IT performance meaningfully.

References (Official ISACA):

ISACA Journal, Performance Measurement Metrics for IT Governance — metrics help management monitor achievement of business-related and IT-related goals.

ISACA Journal, How to Construct a Governance System From the Board Level to the Code Level — enterprise goals are cascaded into IT alignment goals, metrics and results.

ISACA, Charting the Course of IT Governance — performance measurement involves defining and monitoring KPIs for IT and communicating performance to stakeholders.

ISACA, Seven Key Features, Lessons and Tips From a COBIT Journey of 27 Years — COBIT uses goals, metrics and capabilities at enterprise and IT levels.