I85PREP
⌘ K
CISA study materials
CISA study resources

CISA practice questions

One question at a time. Build your CISA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Systems Auditing Process

What is the primary purpose of an IS audit charter?

  1. To list the technical certifications held by each audit team member
  2. To define the audit function's authority, scope and reporting lines Correct answer.
  3. To record the specific tests planned for the current annual audit cycle
  4. To document the detailed audit procedures to be performed in each engagement

Explanation

The charter is approved by senior management and the audit committee and grants the audit function its mandate, including authority to access records and personnel, the scope of its activities and its reporting relationships. It is a standing governance document rather than an engagement-level working document.

Question 2Information Systems Auditing Process

Audit risk in an IS audit is best described as:

  1. The risk that the audit engagement exceeds its approved budget and timeline
  2. The risk that client personnel provide misleading answers during audit interviews
  3. The risk that the auditor gives an inappropriate opinion on the subject matter Correct answer.
  4. The risk that a control fails to prevent or detect a material error

Explanation

Audit risk is the risk that the auditor concludes the subject matter is fairly stated when it is in fact materially misstated, or vice versa, and therefore issues an inappropriate conclusion. It is a function of inherent risk, control risk and detection risk.

Question 3Information Systems Auditing Process

Which of the following provides the most reliable audit evidence?

  1. A screenshot of a configuration screen provided by the system administrator
  2. The auditor's own observation of a backup restoration test Correct answer.
  3. An internal memo describing the backup process
  4. A verbal confirmation from the IT manager

Explanation

Evidence obtained directly by the auditor through observation or inspection is more reliable than evidence supplied by the auditee, because it has not passed through the auditee's filter. Reliability increases when the evidence is obtained from an independent source or by the auditor personally.

Question 4Information Systems Auditing Process

Audit workpapers prepared during an IS audit are:

  1. documents the auditee may inspect but that the audit function destroys once the report is issued
  2. confidential records owned by the audit organization and retained per policy Correct answer.
  3. the property of the auditee, who may request their return after reporting
  4. optional records created only when a finding is contested by management

Explanation

Workpapers are the property of the audit organization, are treated as confidential and are retained according to the organization's record retention policy and applicable professional standards. They document the work performed and support the conclusions reached.

Question 5Information Systems Auditing Process

An audit designed to determine whether an organization adheres to laws, regulations and internal policies is called:

  1. A forensic audit
  2. A financial statement audit
  3. An operational audit
  4. A compliance audit Correct answer.

Explanation

A compliance audit tests whether the entity follows applicable laws, regulations, standards and internal policies. The other audit types address different objectives, such as efficiency of operations, fair presentation of financial information or investigation of suspected wrongdoing.

Question 6Information Systems Auditing Process

In audit planning, materiality refers to:

  1. the number of findings that must be escalated to the audit committee
  2. the size of an error that could change a decision made by report users Correct answer.
  3. the total cost of the audit procedures planned for the engagement
  4. the level of technical detail required in the audit workpapers

Explanation

Materiality is the threshold at which an omission or misstatement is large enough to influence the decisions of users of the audit report. It guides the auditor in determining what to test and what to report.

Question 7Information Systems Auditing Process

To preserve independence, the IS audit function should report primarily to:

  1. the external audit firm
  2. the chief information officer
  3. the IT operations manager
  4. the audit committee of the board Correct answer.

Explanation

Reporting to the audit committee, which sits above operational management, keeps the audit function free from the influence of the areas it audits. The audit committee also approves the charter and the audit plan.

Question 8Information Systems Auditing Process

Why is inquiry alone generally insufficient as audit evidence?

  1. It can only be applied in financial statement audits
  2. It requires specialized software that is often unavailable
  3. It relies on the knowledge and honesty of the person questioned Correct answer.
  4. It produces evidence that is too costly to document

Explanation

Inquiry relies on the accuracy and openness of the respondent and produces no corroborating proof by itself. Auditors therefore use it to obtain information and then corroborate the responses with inspection, observation, reperformance or confirmation.

Question 9Information Systems Auditing Process

When developing the annual IS audit plan, an audit manager should allocate the most resources to:

  1. areas with the highest assessed risk and weakest controls Correct answer.
  2. systems supplied by the newest technology vendor
  3. areas explicitly requested by the IT department
  4. systems that were audited most recently

Explanation

A risk-based audit plan prioritizes areas where the combination of impact and likelihood is highest and where controls are least effective. Resource allocation should follow that assessment rather than convenience or management preference.

Question 10Information Systems Auditing Process

A generalized audit software (GAS) tool is most useful for:

  1. designing new application controls for a system under development
  2. replacing professional judgment when forming audit conclusions
  3. testing a full population by recalculating and extracting exceptions Correct answer.
  4. documenting interviews with system administrators

Explanation

GAS tools let the auditor read and analyze entire data files directly, performing recalculations, matches, stratifications and exception extraction across the full population. This improves coverage and allows the auditor to test 100 percent of transactions rather than a sample.

Question 11Information Systems Auditing Process

An auditor testing whether purchase orders are approved before payment should use:

  1. variable sampling to estimate the total dollar value of payments
  2. discovery sampling to locate a single fraudulent transaction
  3. attribute sampling to estimate the deviation rate from the control Correct answer.
  4. judgmental sampling limited to the largest transactions

Explanation

The question is whether a control operated, which is a yes-or-no characteristic, so attribute sampling is the appropriate method for estimating the rate of deviation. Variable sampling is used when the auditor needs to estimate a monetary amount.

Question 12Information Systems Auditing Process

A primary benefit of control self-assessment (CSA) is that it:

  1. removes the need for periodic internal audits of the process
  2. transfers responsibility for control design to the audit function
  3. provides independent assurance equivalent to an audit opinion
  4. engages process owners in evaluating and improving their own controls Correct answer.

Explanation

CSA workshops and questionnaires make operating management active participants in assessing control effectiveness, which raises awareness and ownership of risk. The audit function may facilitate and use the results but must still obtain its own assurance where needed.

Question 13Information Systems Auditing Process

An IS auditor comparing the number of terminated employees in HR records with the number of active network accounts in the directory is performing:

  1. a reperformance of a programmed control
  2. a confirmation with an independent third party
  3. an analytical procedure comparing independent data sets Correct answer.
  4. a physical inspection of assets

Explanation

The auditor is evaluating relationships between separate data sources to identify anomalies that warrant investigation, which is an analytical procedure. It is efficient for highlighting potential access-control weaknesses but must be followed up with detailed testing.

Question 14Information Systems Auditing Process

Which set of elements describes a complete audit finding?

  1. scope, budget, timeline and staffing
  2. criteria, condition, cause, effect and recommendation Correct answer.
  3. charter, plan, program and report
  4. risk, likelihood, impact and mitigation

Explanation

A well-structured finding states the criteria (what should be), the condition (what is), the cause (why it happened), the effect (the risk or impact) and a recommendation. This structure allows management to understand and act on the issue.

Question 15Information Systems Auditing Process

The auditor's assessment of detection risk is used to determine the:

  1. fee charged for the audit engagement
  2. number of auditors assigned to the engagement
  3. nature, timing and extent of substantive testing Correct answer.
  4. need for a qualified audit opinion

Explanation

Detection risk is the risk that the auditor's procedures fail to detect a material misstatement, so the auditor manages it by adjusting the nature, timing and extent of testing. Higher acceptable detection risk permits less testing, while lower acceptable detection risk requires more.

Question 16Information Systems Auditing Process

Which statement best describes the IS auditor's follow-up responsibility?

  1. follow-up is limited to confirming that management received the report
  2. the auditor should verify that agreed corrective actions were implemented timely Correct answer.
  3. follow-up is performed only when requested by the audit committee
  4. follow-up replaces the need for a future audit of the same area

Explanation

Follow-up is a standard phase of the audit process in which the auditor determines whether management implemented the agreed remedial actions within the committed timeframe. Unresolved issues are escalated to senior management and the audit committee.

Question 17Information Systems Auditing Process

The main purpose of an exit meeting with auditee management is to:

  1. announce the scope of the next audit engagement
  2. confirm the factual accuracy of findings and agree on corrective actions Correct answer.
  3. obtain the auditee's approval of the audit budget
  4. decide whether the audit report will be made public

Explanation

The exit meeting gives management the opportunity to validate facts, provide additional context and commit to remediation before the report is finalized. This reduces the risk of later disputes over accuracy.

Question 18Information Systems Auditing Process

Before beginning fieldwork, an IS auditor should first:

  1. issue the final report to the audit committee
  2. select the sample of transactions to be tested
  3. define the audit objectives and scope for the engagement Correct answer.
  4. test the operating effectiveness of key controls

Explanation

Objectives and scope determine what evidence is needed and therefore must be established before any testing begins. Sampling and control testing follow from those objectives and from the understanding of the area gained during planning.

Question 19Information Systems Auditing Process

A review of audit workpapers by the engagement supervisor should occur:

  1. after the final report has been issued
  2. only if a finding is disputed by the auditee
  3. at the sole discretion of the individual auditor
  4. before the audit report is issued, as part of quality control Correct answer.

Explanation

Supervisory review is a quality control step that confirms the work performed supports the conclusions and that documentation is complete, and it must take place before the report is released so that deficiencies can be corrected.

Question 20Information Systems Auditing Process

During an audit, management explains that a control failure was a one-time event. The auditor should:

  1. accept the explanation because management is responsible for controls
  2. expand the scope only if the client agrees to fund the extra work
  3. remove the issue from the report to avoid conflict with management
  4. corroborate the explanation with independent evidence before accepting it Correct answer.

Explanation

Professional skepticism requires the auditor to treat management explanations as assertions that need corroboration. Testing additional items or reviewing logs and incident records provides evidence about whether the failure was isolated or systemic.

Question 21Information Systems Auditing Process

Sampling risk is best described as the risk that:

  1. the audit team lacks the technical skills required to interpret results
  2. the selected sample includes transactions that cannot be located
  3. a conclusion drawn from a sample differs from the conclusion from the population Correct answer.
  4. the population data provided by the client is incomplete or inaccurate

Explanation

Sampling risk arises because the auditor examines only part of the population, so the sample result may not represent the population as a whole. It can be controlled by increasing sample size or by choosing an appropriate sampling method.

Question 22Information Systems Auditing Process

An IS auditor finds that an application has high inherent risk and weak controls. The most appropriate response is to:

  1. defer the audit to the following audit cycle
  2. reduce the scope to keep the audit within budget
  3. rely on management's self-assessment of the control
  4. increase the extent of substantive testing to reduce detection risk Correct answer.

Explanation

Where inherent and control risk are high, the auditor must lower detection risk by performing more or better substantive procedures to keep overall audit risk at an acceptable level. Reducing scope or deferring work would leave the risk unaddressed.

Question 23Information Systems Auditing Process

Before relying on work performed by the internal audit function, an IS auditor should primarily evaluate:

  1. the size of the internal audit budget
  2. the competence and objectivity of the internal auditors Correct answer.
  3. the number of reports issued in the prior year
  4. the software tools used by the internal audit team

Explanation

Reliance on another audit function is justified only when that function is sufficiently competent and objective, and when its work was properly planned, documented and reviewed. These attributes determine whether the prior work can be trusted as evidence.

Question 24Information Systems Auditing Process

An organization outsources payroll processing. When obtaining assurance over the provider's controls, the IS auditor should first:

  1. assume the controls are effective because the contract includes penalties
  2. review the scope, period and opinion in the provider's independent assurance report Correct answer.
  3. rely on the provider's marketing materials and certifications
  4. perform a full audit of the service provider's data center

Explanation

The auditor must confirm that the provider's assurance report covers the relevant systems, the period of intended reliance, the control objectives tested and the auditor's opinion. Scope limitations or a period that does not cover the reliance period reduce the report's usefulness.

Question 25Information Systems Auditing Process

Which statement best reflects the IS auditor's responsibility for fraud?

  1. the auditor considers fraud risk throughout the audit but does not guarantee detection Correct answer.
  2. fraud risk is considered only if an allegation has been received
  3. fraud detection is solely the responsibility of the external auditor
  4. the auditor must detect all fraud before issuing an opinion

Explanation

The auditor is required to consider the risk of fraud when planning and performing the engagement and to maintain professional skepticism, but an audit provides reasonable, not absolute, assurance. Prevention and detection of fraud remain management's responsibility.

Question 26Information Systems Auditing Process

In the audit risk model, inherent risk is best described as:

  1. The risk that the auditor will express an inappropriate opinion overall
  2. The susceptibility of an area to error before considering related controls Correct answer.
  3. The risk that audit procedures will fail to detect a material error
  4. The risk that controls will not prevent or detect an error on a timely basis

Explanation

Inherent risk reflects the exposure of an area or process to error or misstatement assuming no related controls exist. It is assessed during planning to direct attention to inherently risky areas before control effectiveness is considered.

Question 27Information Systems Auditing Process

An IS auditor is engaged to assess whether a data center's operations are efficient and aligned with business objectives. This engagement is best described as:

  1. A financial statement audit
  2. An integrated audit
  3. A compliance audit
  4. An operational audit Correct answer.

Explanation

An operational audit evaluates the efficiency and effectiveness of operations and their alignment with organizational objectives. Compliance audits test adherence to rules, financial audits address financial reporting, and an integrated audit combines financial and operational or control elements.

Question 28Information Systems Auditing Process

An IS auditor assesses control risk as high for a key application. The effect on the audit approach is that the auditor should:

  1. Increase the extent of substantive testing of transactions Correct answer.
  2. Reduce the amount of evidence gathered from the application
  3. Rely on the application's automated controls without testing them
  4. Lower the assessed level of inherent risk for the application

Explanation

When controls are assessed as unreliable, the auditor must rely less on them and expand substantive procedures to keep audit risk at an acceptable level. Control risk and the extent of substantive testing move in the same direction.

Question 29Information Systems Auditing Process

During an audit, management refuses to allow access to system logs needed to complete a key test. The auditor's most appropriate action is to:

  1. Accept management's verbal assurance that the logs contain no errors
  2. Issue an unqualified report noting the issue only in a footnote
  3. Extend the engagement timetable until access is eventually granted
  4. Report the scope limitation to the audit committee and adjust the conclusion Correct answer.

Explanation

A refusal of access is a scope limitation that must be escalated to those charged with governance and reflected in the audit conclusion. The auditor cannot issue a clean opinion on an area where sufficient appropriate evidence was not obtained.

Question 30Information Systems Auditing Process

An IS auditor is asked to design and implement the access control procedures for a system that will be audited next year. The auditor should:

  1. Decline, because auditors are prohibited from advising management at all
  2. Accept, provided the work is reviewed by another auditor
  3. Decline, because designing controls impairs objectivity in a later audit Correct answer.
  4. Accept, since access controls are within the auditor's technical expertise

Explanation

Objectivity is impaired when an auditor later audits controls that the auditor personally designed or implemented, because the auditor would effectively be reviewing their own work. Advisory services must be separated from assurance work on the same subject matter.

Question 31Information Systems Auditing Process

An IS auditor receives a legal subpoena requiring disclosure of client audit workpapers. The auditor should:

  1. Refuse to disclose because client information is confidential
  2. Destroy the workpapers to protect the client's information
  3. Provide the workpapers only if the client's chief executive approves
  4. Comply with the subpoena after consulting legal counsel Correct answer.

Explanation

Confidentiality obligations yield to legal requirements, but the auditor should obtain legal advice before disclosing so that the response is proper and limited in scope. Client approval is not required when a valid legal demand exists.

Question 32Information Systems Auditing Process

The primary purpose of performing a walkthrough of a business process is to:

  1. Provide statistical evidence that controls operated all year
  2. Replace the need for testing a sample of transactions
  3. Satisfy the requirement to report all deficiencies to the board
  4. Confirm the auditor's understanding of the process and its controls Correct answer.

Explanation

A walkthrough traces one or a few transactions through the process to validate the auditor's documented understanding of how the process and its controls actually operate. It is a qualitative procedure and does not provide statistical assurance about the population.

Question 33Information Systems Auditing Process

Before relying on the work of an IT security specialist engaged to assess firewall configurations, the IS auditor should primarily evaluate the specialist's:

  1. Competence, objectivity and understanding of the audit objectives Correct answer.
  2. Willingness to accept the auditor's conclusions
  3. Employment history and length of service with the organization
  4. Commercial relationship with the firewall vendor

Explanation

The auditor remains responsible for the conclusion and must confirm that the specialist has the necessary skills, is independent of the area being reviewed, and understands the objectives and scope of the work. The adequacy of the specialist's work and its basis must also be reviewed.

Question 34Information Systems Auditing Process

An organization wants audit tests to run automatically against transactions as they are processed. This is best achieved through:

  1. A larger sample of transactions selected at year end
  2. A post-implementation review of the application
  3. Embedded audit modules that monitor transactions in real time Correct answer.
  4. A monthly extract of transactions reviewed manually

Explanation

Embedded audit modules are code built into the application that capture and test transactions continuously as they occur, supporting a continuous auditing approach. Manual extracts, post-implementation reviews and year-end samples are periodic and cannot monitor processing in real time.

Question 35Information Systems Auditing Process

Which of the following describes an appropriate practice for IS audit documentation?

  1. Workpapers are kept only until the draft report is issued
  2. Workpapers are the personal property of the individual auditor
  3. Workpapers are destroyed once management agrees with the findings
  4. Workpapers are retained per policy and support the conclusions reached Correct answer.

Explanation

Audit documentation must be sufficient to allow an experienced auditor with no prior connection to the engagement to understand the work performed and the basis for the conclusions. It remains subject to the organization's retention policy and is not the personal property of the auditor.

Question 36Information Systems Auditing Process

An IS auditor cannot obtain sufficient appropriate evidence on a matter that is both material and pervasive to the area examined. The auditor should:

  1. Issue a qualified opinion limited to the affected transactions
  2. Issue a disclaimer of opinion on the area examined Correct answer.
  3. Issue an unqualified opinion with a note describing the gap
  4. Withdraw from the engagement without further communication

Explanation

When a scope limitation is both material and pervasive, the auditor cannot form an opinion and issues a disclaimer rather than an opinion. A qualified opinion is used only when the limitation is material but not pervasive.

Question 37Information Systems Auditing Process

An IS auditor plans to reduce substantive testing by relying on a key automated control. Which condition must be met first?

  1. The application must have been implemented within the last year
  2. Management must confirm in writing that the control is reliable
  3. The control must be tested and found to be operating effectively Correct answer.
  4. The control must be tested once at the end of the audit period

Explanation

Reliance on controls is only justified when tests of control show that the control operated effectively throughout the period of intended reliance. Otherwise the auditor must set control risk at the maximum and expand substantive procedures.

Question 38Information Systems Auditing Process

An attribute sample of 60 payments reveals 5 deviations, while the auditor's tolerable deviation rate is 3 percent. The auditor should conclude that:

  1. The control cannot be relied upon and substantive testing should increase Correct answer.
  2. The population is acceptable because deviations were only about 8 percent
  3. The control can be relied upon because 55 of 60 items complied
  4. The sample result can be disregarded as it falls within sampling risk

Explanation

When the observed deviation rate exceeds the tolerable rate, the auditor cannot conclude that the control operated effectively and must reduce reliance on it. The response is to increase substantive procedures to obtain assurance from another source.

Question 39Information Systems Auditing Process

The authority of an IS audit function to access an organization's systems, records, and personnel is derived primarily from:

  1. the IT operations manual maintained by systems management
  2. the annual audit plan prepared by the audit team
  3. an audit charter approved by the board or audit committee Correct answer.
  4. the seniority of the chief audit executive within the IT organization

Explanation

An audit charter is the formal document, approved at the highest governance level, that establishes the audit function's purpose, authority, and responsibility, including rights of access to records, systems, and personnel. Without such a mandate, access depends on the goodwill of management being audited. The audit plan and operational manuals do not confer authority.

Question 40Information Systems Auditing Process

An IS auditor finds that database backups are never restore-tested, although the organization's backup standard requires quarterly restore tests. In the audit finding, the requirement for quarterly restore tests represents which element?

  1. Effect
  2. Criteria Correct answer.
  3. Cause
  4. Condition

Explanation

A finding is structured around criteria (the requirement or expectation), condition (what was actually observed), cause (why the gap occurred), and effect (the resulting risk or impact). The documented standard mandating quarterly restore tests is the benchmark against which the observed state is measured, so it is the criteria. The absence of testing is the condition.

Question 41Governance and Management of Information Technology

Which body typically provides oversight of IT strategy and ensures that it remains aligned with business objectives?

  1. An IT steering committee Correct answer.
  2. The service desk supervisor
  3. The data center operations team
  4. The internal audit function

Explanation

An IT steering committee is the governance forum in which senior business and IT management set IT direction, prioritize investments and monitor performance against business objectives. Audit provides independent assurance, and operational teams execute rather than govern.

Question 42Governance and Management of Information Technology

What is the primary objective of IT governance?

  1. Resolving end-user password reset requests
  2. Negotiating volume discounts for hardware purchases on behalf of business units
  3. Ensuring IT is aligned with and supports the organization's strategies and objectives Correct answer.
  4. Managing daily server backup schedules

Explanation

IT governance exists to ensure that IT sustains and extends the organization's strategy and objectives through evaluation, direction and monitoring. Operational tasks such as backups and password resets are management activities, not governance.

Question 43Governance and Management of Information Technology

Who is normally accountable for determining the classification and quality requirements of a business data set?

  1. The information security administrator
  2. The database administrator who maintains the tables
  3. The accountable business data owner Correct answer.
  4. The external auditor

Explanation

Accountability for data rests with the business data owner, who understands the data's purpose and sensitivity and therefore sets classification and quality requirements. IT roles such as database and security administrators act as custodians implementing those requirements.

Question 44Governance and Management of Information Technology

Which of the following best describes an IT standard?

  1. A high-level statement of management intent
  2. A documented approval to deviate from a requirement
  3. A mandatory specification that supports a policy and must be met Correct answer.
  4. A step-by-step description of how a specific operational task is carried out

Explanation

Standards are mandatory, measurable specifications that translate a policy into concrete requirements, such as approved platforms or configuration baselines. Policies state intent, procedures describe task steps, and exceptions are separately approved deviations.

Question 45Governance and Management of Information Technology

Why should incompatible duties be separated within an IT function?

  1. It reduces the number of staff required to operate and support the system
  2. It speeds up the deployment of changes into production
  3. It prevents one person from both causing and concealing errors Correct answer.
  4. It removes the need to maintain detailed audit trails

Explanation

Segregation of duties ensures that no single individual controls all stages of a transaction, so errors or fraud require collusion to remain hidden. It increases rather than reduces staffing needs and does not replace audit logging.

Question 46Governance and Management of Information Technology

The IT balanced scorecard commonly uses four perspectives: corporate contribution, user orientation, operational excellence and which other?

  1. Improvement in cash flow
  2. Future orientation Correct answer.
  3. Growth in market share
  4. Reduction in staff turnover

Explanation

The IT balanced scorecard adapts the classic model to IT with four perspectives: corporate contribution, user orientation, operational excellence and future orientation. The future orientation perspective addresses the readiness of IT to meet coming business needs.

Question 47Governance and Management of Information Technology

Which composition is most appropriate for an IT steering committee?

  1. Only senior IT managers
  2. Senior business managers together with senior IT managers Correct answer.
  3. Representatives of the main technology vendors
  4. Only members of the internal audit team

Explanation

Effective IT governance requires shared ownership, so the steering committee must include senior business managers as well as senior IT managers. An IT-only body cannot prioritize investments by business value, and vendors are not part of the organization's governance.

Question 48Governance and Management of Information Technology

Which of the following is a key deliverable of the IT strategic planning process?

  1. A long-range IT plan aligned with business goals Correct answer.
  2. Monthly backup success reports
  3. The most recent disaster recovery test log
  4. A list of unresolved help desk tickets

Explanation

IT strategic planning produces a forward-looking plan that maps technology direction, investments and capabilities to business goals. Operational reports such as ticket lists, test logs and backup results are execution artefacts.

Question 49Governance and Management of Information Technology

Who should approve a major new IT investment?

  1. The vendor supplying the hardware and software
  2. The project manager responsible for delivering the solution
  3. The board or its delegated investment committee Correct answer.
  4. The IT operations supervisor on duty

Explanation

Significant IT investments require approval at a level with authority over enterprise resources, normally the board or a committee to which it delegates that authority, acting on a documented business case. Delivery staff, suppliers and operational supervisors cannot authorize enterprise spending.

Question 50Governance and Management of Information Technology

In the CMMI staged representation, which maturity level is characterized by standardized, documented processes that are not yet quantitatively measured?

  1. Quantitatively managed
  2. Initial
  3. Optimizing
  4. Defined Correct answer.

Explanation

At the Defined level, processes are standardized, documented and deployed across the organization, but performance is not yet controlled with statistical measures. Quantitative measurement begins at the next level, and continuous improvement characterizes the highest level.