CISA Certified Information Systems Auditor Study Guide

Appendix BAnswers to Review Questions

Chapter 1: IT Governance and Management

1. C. IT governance is the mechanism through which IT strategy is established, controlled, and monitored through the balanced scorecard. Long-term and other strategic decisions are made in the context of IT governance.
2. A. Outsourcing is an opportunity for the organization to focus on its core competencies. When an organization outsources a business function, it no longer needs to be concerned about training employees in that function. Outsourcing does not always reduce costs, because cost reduction is not always the primary purpose for outsourcing in the first place.
3. D. The external auditor can only document the finding in the audit report. An external auditor is not in a position to implement controls.
4. D. An organization that opens a business office in another country and staffs the office with its own employees is insourcing, not outsourcing. Outsourcing is the practice of using contract labor, which is clearly not the case in this example. In this case, the insourcing is taking place at a remote location.
5. B. Conducting interviews with IT personnel and end users is the most appropriate initial action because it directly addresses the human factors contributing to high turnover, long wait times, and user discontentment. Interviews provide qualitative insights into the specific problems faced by both IT staff and end users, allowing for a more comprehensive understanding of the underlying issues. ...