I85PREP
⌘ K
CPA ISC study materials
CPA ISC study resources

CPA ISC practice questions

One question at a time. Build your CPA ISC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1IT Governance and Risk Management

Which framework is designed primarily to help boards and management govern and manage enterprise IT?

  1. ITIL 4
  2. COBIT Correct answer.
  3. COSO ERM
  4. ISO/IEC 27001

Explanation

COBIT (Control Objectives for Information and Related Technologies) is ISACA's framework for the governance and management of enterprise IT, linking IT objectives to business goals. The other frameworks listed address enterprise-wide risk, service management, or information security management rather than IT governance as a whole.

Question 2IT Governance and Risk Management

An organization's IT steering committee is primarily responsible for which of the following?

  1. Approving the annual financial statement audit plan
  2. Designing the technical architecture of the data center
  3. Prioritizing IT investments against business strategy Correct answer.
  4. Performing daily backup verification procedures

Explanation

A steering committee is a cross-functional governance body that sets IT direction, prioritizes and funds IT initiatives, and monitors IT performance against business objectives. Technical design and routine operational tasks are delegated to IT staff within approved standards.

Question 3IT Governance and Risk Management

Risk appetite is best described as which of the following?

  1. The number of risk events recorded during the fiscal year
  2. The set of controls management has implemented to reduce exposure
  3. The maximum loss an entity could absorb if every control failed
  4. The risk an entity is willing to accept to pursue its goals Correct answer.

Explanation

Risk appetite is the broad amount and type of risk an entity is willing to accept in pursuit of its objectives, and it is set by the board and senior management. Capacity is the maximum risk the entity could bear, while controls are a response to risk rather than a statement of appetite.

Question 4IT Governance and Risk Management

Which combination of access rights creates a segregation-of-duties conflict in a financial application?

  1. Creating a vendor record and approving payment to it Correct answer.
  2. Entering new employees and printing the payroll register
  3. Reviewing system logs and investigating flagged transactions
  4. Approving timecards and reviewing payroll exception reports

Explanation

Creating a vendor master record and approving payments lets one person set up a fictitious vendor and release payment to it, enabling fraud that is difficult to detect. Those two duties should be assigned to different individuals, ideally in different departments.

Question 5IT Governance and Risk Management

Which document type typically states mandatory, specific requirements that must be met to comply with management's overall IT direction?

  1. An IT strategic plan
  2. A guideline
  3. A procedure
  4. A standard Correct answer.

Explanation

Policies state management's intent, standards set mandatory and measurable requirements such as minimum password length, procedures give step-by-step instructions, and guidelines are recommended practices. Standards are therefore the level at which mandatory specific requirements are documented.

Question 6IT Governance and Risk Management

An entity buys a cyber liability insurance policy to cover the financial impact of a possible data breach. This is an example of which risk response?

  1. Risk acceptance
  2. Risk sharing Correct answer.
  3. Risk avoidance
  4. Risk reduction

Explanation

Insurance transfers part of the financial consequence of a risk to a third party, which is classified as risk sharing or transfer. Avoidance eliminates the activity, reduction lowers likelihood or impact through controls, and acceptance retains the risk without further action.

Question 7IT Governance and Risk Management

Ultimate responsibility for overseeing the entity's IT-related risks rests with which of the following?

  1. The IT operations manager
  2. The board of directors Correct answer.
  3. The external auditor
  4. The data center supervisor

Explanation

Governance places ultimate oversight of risk, including IT risk, with the board, which often delegates detailed oversight to the audit or risk committee. Management implements and monitors controls, while the external auditor expresses an opinion but does not govern.

Question 8IT Governance and Risk Management

Which plan focuses primarily on restoring IT infrastructure, applications, and data at an alternate site after a disruptive event?

  1. The disaster recovery plan Correct answer.
  2. The incident response plan
  3. The business continuity plan
  4. The IT strategic plan

Explanation

The disaster recovery plan addresses restoring technology components and data after a major disruption, while the business continuity plan addresses keeping critical business processes operating. The two must be coordinated so that technology recovery priorities follow business needs.

Question 9IT Governance and Risk Management

In the three lines of defense model, which group provides independent assurance on the effectiveness of IT controls?

  1. Internal audit Correct answer.
  2. Operational IT management
  3. The external auditor
  4. The risk and compliance function

Explanation

The first line is operational management that owns and manages risk, the second line is a risk and compliance function that monitors and advises, and the third line is internal audit, which provides independent assurance to the board. The external auditor sits outside the model and opines on the financial statements.

Question 10IT Governance and Risk Management

Which characteristic makes a metric most useful as a key risk indicator (KRI)?

  1. It is set once at implementation and not revised
  2. It measures the profitability of the IT function
  3. It is reported only after a loss event has been realized
  4. It moves ahead of the risk it is meant to signal Correct answer.

Explanation

A useful KRI is predictive, measurable, and tied to a specific risk so that its movement warns management before the risk materializes. Lagging indicators report after the fact, and thresholds must be reviewed as the risk environment changes.

Question 11IT Governance and Risk Management

Before engaging a critical cloud service provider, management's most appropriate first step is to:

  1. Perform due diligence and review independent assurance reports Correct answer.
  2. Rely only on the provider's published marketing statements about security
  3. Delegate the vendor selection decision to the help desk supervisor
  4. Sign the contract and assess the provider's risk after go-live

Explanation

Third-party risk management requires due diligence before contracting, including review of the provider's controls, independent assurance reports such as SOC reports, and contractual security and right-to-audit terms. Assessing risk after go-live defeats the purpose of due diligence and leaves little leverage.

Question 12IT Governance and Risk Management

Under the COSO enterprise risk management framework, which component addresses the entity's core values, desired behavior, and understanding of risk?

  1. Review and revision
  2. Strategy and objective-setting
  3. Performance
  4. Governance and culture Correct answer.

Explanation

The governance and culture component covers board oversight, operating structures, defined culture, and commitment to core values, including how risk is understood across the entity. Strategy and objective-setting addresses business context and risk appetite, while performance addresses identifying and assessing risk.

Question 13IT Governance and Risk Management

Which entry is most essential in a risk register used to manage IT risks?

  1. The vendor roadmap for every affected system
  2. Assessed likelihood, impact, and an assigned risk owner Correct answer.
  3. The name of the employee who first noticed the risk condition
  4. The date the register file was last backed up

Explanation

A risk register records each risk with its assessed likelihood and impact, a designated owner, existing controls, and planned responses so that management can monitor and report exposure. Without an owner and a risk score, the register becomes a list rather than a management tool.

Question 14IT Governance and Risk Management

In an IT balanced scorecard, which perspective focuses on the IT function's contribution to business value?

  1. Customer perspective
  2. Internal process perspective
  3. Learning and growth perspective
  4. Corporate contribution Correct answer.

Explanation

The IT balanced scorecard adapts the four perspectives to IT as corporate contribution, user orientation, operational excellence, and future orientation. Corporate contribution measures how IT delivers value aligned with business strategy.

Question 15IT Governance and Risk Management

A programmer who writes application code also has unrestricted ability to deploy that code into production. The greatest governance concern is that:

  1. The programmer may be paid overtime for additional work
  2. Unauthorized code could reach production without review Correct answer.
  3. The programmer will require additional data storage space
  4. The programmer may lack training on the new development tools and languages used

Explanation

Separating development from production deployment ensures that changes are independently tested and approved before they affect live data. Combined access allows an individual to move unauthorized or untested code into production and to conceal the change.

Question 16IT Governance and Risk Management

To preserve independence, the chief audit executive responsible for IT audit should report functionally to:

  1. The chief information officer
  2. The audit committee of the board Correct answer.
  3. The external audit partner
  4. The IT operations director

Explanation

Functional reporting to the audit committee gives internal audit the standing and access needed to report findings objectively, including findings about IT management. Reporting to the CIO or the operations director creates a conflict because those areas are being audited.

Question 17IT Governance and Risk Management

Which of the following lists the five core functions of the NIST Cybersecurity Framework?

  1. Plan, execute, monitor, control, close
  2. Identify, protect, detect, respond, recover Correct answer.
  3. Governance, risk, compliance, audit, report
  4. Confidentiality, integrity, availability, privacy, safety

Explanation

The NIST CSF organizes cybersecurity activities into the five functions identify, protect, detect, respond, and recover, providing a common structure for managing cyber risk. Plan-execute-monitor-control-close is a project lifecycle, and the other lists are program areas or security objectives.

Question 18IT Governance and Risk Management

In an infrastructure-as-a-service (IaaS) arrangement, which of the following is a customer responsibility?

  1. Managing the provider's network backbone
  2. Patching the provider's hypervisor platform
  3. Patching the guest operating system Correct answer.
  4. Maintaining physical security of the data center

Explanation

Under the shared responsibility model, an IaaS provider secures the physical facility, hardware, and virtualization layer, while the customer secures the guest operating system, middleware, applications, and data. Governance should document this split so that no control is assumed to belong to the other party.

Question 19IT Governance and Risk Management

A stage-gate approach to IT project governance primarily provides:

  1. A method for depreciating IT hardware over its useful life
  2. A technique for shortening the monthly financial close
  3. A guaranteed on-time and on-budget project delivery
  4. Management review and funding decisions at defined checkpoints Correct answer.

Explanation

Stage-gate governance requires a project to pass review at defined checkpoints where management reassesses the business case, risk, and funding before the next phase begins. It improves oversight and discipline but cannot guarantee delivery outcomes.

Question 20IT Governance and Risk Management

During a major security incident, the incident response team's most important governance-related action is to:

  1. Disable all logging to improve system performance
  2. Escalate to executive management per the communications plan Correct answer.
  3. Post technical details on public social media channels
  4. Wait until the root cause is fully identified before notifying anyone

Explanation

Approved escalation and communication protocols ensure that decision-makers are informed, regulatory and legal notification obligations are met, and external messaging stays consistent. Waiting for a complete root cause delays required notifications and key response decisions.

Question 21IT Governance and Risk Management

An entity's overall appetite permits moderate operational risk, but management sets a limit of no more than $2 million of annual loss from operational disruption. The $2 million limit best represents:

  1. Inherent risk
  2. Control risk
  3. Risk tolerance Correct answer.
  4. Risk capacity

Explanation

Risk tolerance is the acceptable variation around the risk appetite, expressed as measurable limits that management monitors. Capacity is the maximum risk the entity could bear, and inherent risk is the exposure before controls are applied.

Question 22IT Governance and Risk Management

A risk is scored 16 (high) before controls and re-scored at 6 after management implements and tests prevention controls. The score of 6 is the:

  1. Inherent risk score
  2. Risk appetite
  3. Control deficiency
  4. Residual risk score Correct answer.

Explanation

Inherent risk is assessed before considering controls, and residual risk is the remaining exposure after controls are applied and tested. Reporting both scores lets management see how much risk the controls actually address.

Question 23IT Governance and Risk Management

Business units purchasing SaaS tools without IT involvement creates which primary governance risk?

  1. Stronger alignment of IT investments with strategy
  2. Reduced reliance on third-party providers
  3. Unmanaged data exposure and spending outside IT oversight Correct answer.
  4. Assurance that security standards are applied consistently

Explanation

Shadow IT bypasses architecture review, security assessment, and procurement controls, so data may be stored in unapproved locations and costs may be duplicated or invisible. Typical governance responses include approved self-service catalogs and discovery of unsanctioned cloud usage.

Question 24IT Governance and Risk Management

A multinational entity stores customer data in several countries. The most appropriate governance approach is to:

  1. Prohibit all cross-border data transfers permanently
  2. Apply the least restrictive jurisdiction's rules to all locations
  3. Rely on IT staff to interpret privacy law without legal input
  4. Map data flows and apply each jurisdiction's applicable requirements Correct answer.

Explanation

Data governance requires knowing where data is collected, processed, and stored, then applying the legal requirements of each relevant jurisdiction with legal counsel interpreting the obligations. Applying one lenient standard or banning all transfers ignores legitimate business needs without satisfying local law.

Question 25IT Governance and Risk Management

An IT governance maturity assessment rates the entity at level 2 of a 5-level model. This most likely indicates that:

  1. No governance processes exist and outcomes are ad hoc
  2. Processes are continuously optimized using quantitative metrics
  3. Practices are repeatable but not standardized enterprise-wide Correct answer.
  4. Processes are fully documented and standardized across the entire enterprise

Explanation

In capability maturity models, level 1 is ad hoc, level 2 is repeatable or managed at the unit level, level 3 is defined and standardized, level 4 is quantitatively managed, and level 5 is optimized. A level 2 rating therefore means practices exist and repeat but are not yet applied consistently across the entity.

Question 26IT Governance and Risk Management

The primary purpose of IT governance is to:

  1. Ensure that all IT projects are completed within their approved budgets
  2. Guarantee that IT systems are free from technical defects before release
  3. Minimize the total cost of the IT function relative to peer organizations
  4. Direct and control IT so that it supports the achievement of enterprise objectives Correct answer.

Explanation

IT governance comprises the structures, processes and relational mechanisms by which IT is directed and controlled so that it sustains and extends the entity's strategy and objectives. Budget adherence, cost minimization and defect-free delivery are operational or project-level outcomes rather than the purpose of governance.

Question 27IT Governance and Risk Management

An entity decides to discontinue a legacy application because the risk of continued operation cannot be reduced to an acceptable level. This risk response is best described as:

  1. Risk avoidance Correct answer.
  2. Risk sharing
  3. Risk acceptance
  4. Risk mitigation

Explanation

Risk avoidance eliminates the activity or asset that gives rise to the exposure, so the risk no longer exists for the entity. Mitigation reduces exposure while continuing the activity, sharing transfers a portion of the loss, and acceptance retains the risk without further action.

Question 28IT Governance and Risk Management

Within an IT governance framework, which document establishes mandatory, high-level direction and is approved by senior management or the board?

  1. Policy Correct answer.
  2. Procedure
  3. Standard
  4. Guideline

Explanation

A policy states mandatory high-level principles and requires approval at the top of the organization so that it carries authority across the entity. Standards translate policy into specific mandatory requirements, procedures describe how tasks are performed, and guidelines are advisory.

Question 29IT Governance and Risk Management

The primary role of an IT steering committee is to:

  1. Develop application code according to approved specifications
  2. Operate the entity's data center and network infrastructure
  3. Prioritize IT initiatives and align IT investment with business strategy Correct answer.
  4. Perform independent audits of IT general controls

Explanation

An IT steering committee is a cross-functional governance body of senior business and IT leaders that sets IT priorities, approves and funds initiatives, and monitors alignment with strategy. Audit, operations and development are separate functions with their own accountabilities.

Question 30IT Governance and Risk Management

Commonly recognized focus areas of IT governance include strategic alignment, value delivery, resource management, performance measurement and:

  1. Risk management Correct answer.
  2. Software licensing
  3. Hardware procurement
  4. Help desk staffing

Explanation

IT governance frameworks commonly identify strategic alignment, value delivery, resource management, risk management and performance measurement as the areas that governance must address. The other choices are discrete operational tasks performed inside the IT function.

Question 31IT Governance and Risk Management

Data classification within an IT governance program primarily enables the entity to:

  1. Reduce the volume of data reported to the board
  2. Eliminate the need for encryption of stored data
  3. Apply controls proportionate to the sensitivity and value of information Correct answer.
  4. Transfer legal liability for data loss to third-party processors

Explanation

Classifying information by sensitivity and criticality allows the entity to apply proportionate handling, access, retention and protection requirements. Classification does not remove protection requirements, shift liability to others, or change board reporting obligations.

Question 32IT Governance and Risk Management

Assigning a named risk owner for each entry in the IT risk register primarily ensures that:

  1. Internal audit will not need to test the related controls
  2. Accountability for monitoring and treating the risk is clearly established Correct answer.
  3. The risk will be eliminated within the current fiscal year
  4. The risk is automatically transferred to an insurer

Explanation

A named risk owner accepts accountability for monitoring the risk, executing the agreed response and reporting on its status. Ownership is an accountability mechanism and does not by itself eliminate risk, replace audit testing or transfer the risk.

Question 33IT Governance and Risk Management

A right-to-audit clause in a critical vendor contract gives the customer entity the ability to:

  1. Assume ownership of the vendor's source code without payment
  2. Examine the vendor's controls and records relevant to the services provided Correct answer.
  3. Exempt itself from regulatory requirements applicable to the data
  4. Set the vendor's selling prices for its other customers

Explanation

A right-to-audit clause preserves the customer's ability to obtain evidence about the vendor's controls, typically through on-site review or acceptance of independent assurance reports. It does not affect the vendor's pricing, ownership of its intellectual property, or the customer's regulatory obligations.

Question 34IT Governance and Risk Management

A risk assessment rates a threat as highly likely and its impact as severe. On a likelihood-by-impact heat map, this risk would normally be:

  1. Accepted without further action because it is inherent
  2. Delegated to the vendor that supplies the affected system
  3. Recorded only if it materializes into an actual incident
  4. Escalated for immediate treatment by senior management Correct answer.

Explanation

In a likelihood-by-impact assessment, a risk combining high likelihood with severe impact falls in the high-risk zone and requires escalation so that a treatment decision is made at the appropriate level. Inherent risk still requires a response, and risks are recorded whether or not they have materialized.

Question 35IT Governance and Risk Management

Which of the following best describes an enterprise-wide approach to IT risk management?

  1. IT risks are assessed and aggregated against a common risk appetite across the entity Correct answer.
  2. Each business unit manages its own IT risks using its own definitions and scales
  3. IT risks are addressed only after an incident has been reported to the board
  4. IT risks are managed exclusively by the internal audit function

Explanation

An enterprise approach aggregates IT risk across the entity against a shared appetite, using common scales and definitions so that exposures can be compared and prioritized. Siloed unit-level management, reactive handling after incidents, and delegation to internal audit all fragment or misplace risk ownership.

Question 36IT Governance and Risk Management

An emergency change must be implemented to restore a failed production system at 2 a.m. The best governance practice is to:

  1. Apply the change under a documented emergency process with retrospective review Correct answer.
  2. Wait until the next scheduled change advisory board meeting
  3. Allow the developer to implement and approve the change alone
  4. Bypass testing and documentation because the system is already down

Explanation

Emergency change procedures permit rapid action under defined authority while requiring documentation, testing where feasible, and a retrospective review after the event. Governance does not require delaying restoration, and segregation of duties and documentation are not suspended in an emergency.

Question 37IT Governance and Risk Management

Which control best mitigates the risk that a departing employee retains access to financial applications?

  1. Annual review of the IT strategic plan
  2. Timely notification from human resources to IT triggering prompt access removal Correct answer.
  3. Quarterly review of software license utilization
  4. Monthly review of the data center environmental controls

Explanation

Prompt and reliable notification from human resources to IT is a preventive control that triggers timely deprovisioning of access. Reviews of strategy, environmental controls or license usage do not address whether terminated users still hold system access.

Question 38IT Governance and Risk Management

Before migrating a core system to a public cloud provider, the entity's governance process should most importantly require:

  1. A documented exit strategy covering data retrieval and service transition Correct answer.
  2. A guarantee that the provider will never change its pricing
  3. That the provider's auditors report to the entity's audit committee
  4. That all entity data be stored in a single data center

Explanation

An exit strategy addresses data portability, extraction in usable formats, transition assistance and termination terms, which mitigates lock-in and continuity risk. Pricing guarantees and single-site storage are neither realistic nor desirable, and a provider's auditors never report to a customer's audit committee.

Question 39IT Governance and Risk Management

Management implements a vendor SLA that includes availability targets and service credits. To make the SLA an effective governance tool, the entity should:

  1. Review the SLA only once, at the time the contract is signed
  2. Waive service credits whenever the vendor provides a verbal apology
  3. Rely on the vendor to self-report performance without verification
  4. Monitor and report actual performance against the targets on a regular basis Correct answer.

Explanation

A service level agreement governs behavior only when performance is measured, reported and compared with the agreed targets, with remedies applied when targets are missed. Self-reporting without verification, waiving remedies, and a one-time review leave the arrangement unmonitored.

Question 40IT Governance and Risk Management

Periodic recertification of user access rights is most effective when it is:

  1. Performed once at the time of system implementation
  2. Replaced entirely by automated password expiration
  3. Performed by business managers who confirm each user's continued need Correct answer.
  4. Performed by the IT administrator who granted the access

Explanation

Recertification is effective when business managers, who understand the job requirements, confirm that each user still needs the access; the administrator who granted the access lacks objectivity. A one-time review and password expiry do not validate continuing business need.

Question 41IT Governance and Risk Management

An entity plans to launch a new customer analytics platform that processes personal information. A privacy impact assessment should be performed:

  1. Before the platform is approved and implemented Correct answer.
  2. Only after a complaint has been filed by a customer
  3. Only if the data is stored outside the entity's home country
  4. Only after the platform has been in production for one year

Explanation

A privacy impact assessment identifies and mitigates privacy risks before a new process, system or use of data is approved, so that design changes can still be made. Performing it after launch, after complaints, or only for cross-border transfers defeats its preventive purpose.

Question 42IT Governance and Risk Management

When developing the annual IT audit plan, the chief audit executive should primarily base coverage on:

  1. The prior year's audit plan without modification
  2. An equal rotation of all systems regardless of risk
  3. A risk assessment of IT processes and systems Correct answer.
  4. Requests from the IT department managers

Explanation

The audit plan is risk-based, directing coverage to the IT processes and systems with the greatest risk and significance to the entity. Management requests, equal rotation and unmodified prior plans are not risk-driven and may leave significant exposures unreviewed.

Question 43IT Governance and Risk Management

An advantage of control self-assessment performed by IT process owners is that it:

  1. Increases ownership of controls and identifies issues earlier Correct answer.
  2. Provides the same independence as an internal audit review
  3. Eliminates the need for independent assurance
  4. Guarantees that controls are designed effectively

Explanation

Control self-assessment engages process owners in evaluating their own controls, which strengthens ownership and surfaces issues sooner than periodic audit. Because it is performed by the process owners, it neither replaces independent assurance nor guarantees effective control design.

Question 44IT Governance and Risk Management

An entity estimates that a system outage would occur twice per year with a loss of $50,000 per occurrence. The annualized loss expectancy is:

  1. $50,000
  2. $200,000
  3. $25,000
  4. $100,000 Correct answer.

Explanation

Annualized loss expectancy equals single loss expectancy multiplied by the annualized rate of occurrence, so two occurrences at $50,000 each produce $100,000. The other amounts reflect only the single loss or an incorrect multiplication.

Question 45IT Governance and Risk Management

Following resolution of a major IT incident, the most valuable governance step is to:

  1. Suppress details of the incident to protect reputation
  2. Wait for the next external audit to review the incident
  3. Close the ticket and reassign staff immediately
  4. Conduct a root cause review and update controls and plans accordingly Correct answer.

Explanation

A post-incident review identifies root causes and drives improvements to controls, response plans and training, converting the event into reduced future risk. Closing the ticket, suppressing information, or deferring the review forfeits that learning opportunity.

Question 46IT Governance and Risk Management

A multinational group allows each regional business unit to select its own applications while a central team sets security standards and architecture principles. This governance model is best described as:

  1. Centralized, with all IT decisions made by the corporate function
  2. Decentralized, with no entity-wide standards imposed
  3. Outsourced, with decision rights transferred to a service provider
  4. Federated, balancing local responsiveness with central direction Correct answer.

Explanation

In a federated model, central functions set standards, architecture and policy while business units retain local decision rights over solutions. Centralized, decentralized and outsourced models allocate decision rights differently and do not combine central standards with local selection.

Question 47IT Governance and Risk Management

An entity's critical cloud provider subcontracts part of its processing to an unaffiliated data center operator. The entity's governance process should primarily ensure that:

  1. The provider assumes all regulatory responsibility for the entity's data
  2. The subcontractor's employees are covered by the entity's own code of conduct
  3. Subcontracting arrangements and related controls are disclosed, evaluated and contractually addressed Correct answer.
  4. The entity receives a share of the subcontractor's cost savings

Explanation

Subcontracting creates fourth-party risk, so the entity must know which subcontractors are used, obtain assurance over their controls, and address the arrangement in the contract. The entity's own code of conduct, legal responsibility and any cost sharing are not substitutes for that assurance.

Question 48IT Governance and Risk Management

Each business unit of an entity reports a moderate IT risk, but all of those risks depend on the same core network provider. From an enterprise risk perspective, the aggregate risk is:

  1. Unchanged, because each unit's rating was moderate
  2. Irrelevant, because vendor risk is transferred by contract
  3. Higher than the individual ratings suggest because of concentration Correct answer.
  4. Lower than the sum because diversification reduces exposure

Explanation

Risks sharing a common dependency are correlated, so a single provider failure could affect all units simultaneously and the combined exposure exceeds the impression created by individually moderate ratings. Contractual transfer does not eliminate concentration risk or service disruption.

Question 49IT Governance and Risk Management

When presenting an IT risk dashboard to the board, management best supports effective oversight by:

  1. Showing trends, thresholds and breaches alongside management's response plans Correct answer.
  2. Reporting only metrics that currently meet their thresholds
  3. Presenting raw system logs instead of summarized indicators
  4. Omitting trends so the board focuses on the current period

Explanation

Effective board reporting presents indicators with thresholds, trends and breaches together with management's planned response, so directors can judge whether risk is being managed within appetite. Reporting only favorable metrics, raw logs or isolated snapshots impairs oversight.

Question 50IT Governance and Risk Management

An entity retains all transaction records indefinitely 'just in case'. The greatest governance concern is that:

  1. Retention policies are prohibited by most records management frameworks
  2. Longer retention always improves the reliability of financial reporting
  3. Retention exposes the entity to unnecessary legal, privacy and storage risk Correct answer.
  4. Records retained longer than one year cannot be audited

Explanation

Retention should be driven by legal, regulatory and business requirements; keeping records indefinitely increases discovery exposure, privacy obligations and storage cost. Retention limits are a normal part of records management, and longer retention is not a safeguard for reliability.