I85PREP
⌘ K
CRISC study materials
CRISC study resources

CRISC practice questions

One question at a time. Build your CRISC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Corporate IT Governance

Which statement best describes IT governance?

  1. Structures and processes that direct and control the enterprise's use of IT Correct answer.
  2. The annual allocation of the IT budget across business units
  3. The day-to-day operation of IT infrastructure and service delivery
  4. The technical standards used to configure network and server hardware devices

Explanation

IT governance is concerned with evaluating, directing and monitoring the use of IT so that it supports the enterprise's objectives and stays within acceptable risk. It sets direction and accountability, whereas execution of IT work belongs to management.

Question 2Corporate IT Governance

In an effective governance structure, who holds ultimate accountability for ensuring that IT risk is managed within acceptable levels?

  1. The chief information officer
  2. The internal audit function
  3. The board of directors Correct answer.
  4. The IT risk manager

Explanation

Ultimate accountability for risk oversight rests with the board, which sets direction and monitors whether management keeps risk within appetite. Executives are responsible for managing risk and internal audit supplies independent assurance.

Question 3Corporate IT Governance

Which description best characterises COBIT?

  1. A framework of governance and management objectives for enterprise IT Correct answer.
  2. A certification programme for individual IT auditors
  3. A contractual template for outsourcing cloud services
  4. A technical standard for securing network perimeter devices and firewalls

Explanation

COBIT provides an internationally used framework of governance and management objectives that links IT activities to enterprise goals and to risk. It is technology- and vendor-independent, so it is neither a technical standard nor a certification scheme.

Question 4Corporate IT Governance

Which individual should be designated as the owner of an identified IT risk?

  1. The manager accountable for and empowered to manage the risk Correct answer.
  2. The internal auditor who tests the related controls
  3. The board committee that reviews the corporate risk register
  4. The vendor that supplies the affected technology

Explanation

Risk ownership requires both accountability for the outcome and the authority to act, so the owner can accept, mitigate or transfer the risk within defined limits. Ownership must sit where decisions and resources can actually influence the exposure.

Question 5Corporate IT Governance

Which document type states a mandatory high-level requirement without prescribing detailed implementation steps?

  1. Procedure
  2. Guideline
  3. Baseline configuration
  4. Policy Correct answer.

Explanation

A policy expresses management's intent and mandatory requirements, leaving the detailed 'how' to standards, procedures and baselines. This separation lets the policy remain stable while implementation detail evolves.

Question 6Corporate IT Governance

What is the primary purpose of an IT steering committee?

  1. Prioritise and approve IT investments against business objectives Correct answer.
  2. Negotiate individual software licences with vendors
  3. Administer production changes and configuration baselines across the estate
  4. Perform independent testing of IT general controls

Explanation

A steering committee is a governance forum that directs IT investment and prioritisation so that it matches enterprise priorities, and it monitors delivery of expected value. It does not execute operational or assurance activities.

Question 7Corporate IT Governance

Which body is normally responsible for approving the enterprise's overall risk appetite?

  1. The board of directors Correct answer.
  2. The IT operations manager
  3. The external auditor
  4. The project sponsor

Explanation

Risk appetite expresses how much risk the enterprise is willing to accept in pursuit of its objectives, so it must be set at the top and approved by the board. Management proposes and then operates within that approved appetite.

Question 8Corporate IT Governance

Why is segregation of duties an important element of IT governance?

  1. It increases the speed of routine transaction processing across the business
  2. It stops one person from causing and concealing an error Correct answer.
  3. It transfers residual risk to an external insurance provider
  4. It removes the need for periodic access reviews by management

Explanation

Segregation of duties splits incompatible tasks so that no single individual can both create and hide a problem, which reduces the likelihood of error and fraud. It is a preventive control that must be supported by monitoring and access review.

Question 9Corporate IT Governance

The board declares that no critical system may experience more than four hours of unplanned downtime in any quarter. This statement is best described as:

  1. A risk tolerance threshold Correct answer.
  2. An estimate of residual risk exposure
  3. A risk appetite statement
  4. A risk capacity limit

Explanation

Risk appetite is the broad level of risk the enterprise is willing to pursue, while tolerances translate that appetite into measurable boundaries that can be monitored. A specific quantified limit such as four hours of downtime is therefore a tolerance threshold.

Question 10Corporate IT Governance

In the Three Lines Model, how is the internal audit function best characterised?

  1. The third line, because it gives independent assurance to the board Correct answer.
  2. The second line, because it sets risk frameworks and policies
  3. The governing body, because it approves the annual internal audit plan and budget
  4. The first line, because it owns and operates the controls

Explanation

The model places risk ownership and control operation in the first line, oversight and challenge in the second line, and independent assurance in the third line, which is internal audit. Independence from management is what makes third-line reporting credible to the board.

Question 11Corporate IT Governance

Which activity is a governance activity rather than a management activity?

  1. Setting IT investment priorities against strategy Correct answer.
  2. Applying operating system patches to production servers
  3. Processing user access requests through the IT service desk queue
  4. Executing the disaster recovery plan during a major systems outage

Explanation

Governance is concerned with evaluating options, directing the enterprise and monitoring outcomes, which includes setting priorities and investment direction. Planning, building and running systems are management activities carried out under that direction.

Question 12Corporate IT Governance

An enterprise builds a five-year IT roadmap without input from business unit leaders, and several business initiatives later stall for lack of system support. Which governance weakness does this illustrate?

  1. IT strategy not aligned with enterprise strategy and stakeholder needs Correct answer.
  2. Insufficient technical standards for system builds
  3. Excessive reliance on key risk indicators by the steering committee
  4. Inadequate segregation of duties between IT operations and change teams

Explanation

Effective IT governance requires that the IT strategy be derived from, and continuously reconciled with, enterprise strategy and stakeholder requirements. Producing the roadmap in isolation breaks that alignment and results in investments that do not serve business priorities.

Question 13Corporate IT Governance

Which observation provides the strongest evidence of a mature risk culture?

  1. The risk committee meets twice a year to approve the risk register
  2. The risk register is updated quarterly by the risk function alone
  3. Staff raise emerging risks and challenge assumptions without fear of blame Correct answer.
  4. All employees complete an annual computer-based risk awareness training module

Explanation

Risk culture is demonstrated by behaviour: open escalation, constructive challenge and shared accountability for risk at every level. Training completion, meeting frequency and process ownership are structural indicators that do not by themselves show how people actually behave.

Question 14Corporate IT Governance

Which of the following is a key risk indicator rather than a key performance indicator?

  1. IT operating cost as a percentage of revenue
  2. Critical vulnerabilities unpatched for more than 30 days Correct answer.
  3. Percentage of IT projects delivered within the approved schedule
  4. Average time to resolve service desk tickets

Explanation

Key risk indicators measure exposure or the drivers of loss and are used to monitor whether risk remains within tolerance. The other measures describe delivery efficiency or cost performance and therefore belong to performance reporting.

Question 15Corporate IT Governance

Each business unit rates its reliance on a common outsourced provider as low risk, yet a provider outage would halt all of them at the same time. This situation highlights the need for:

  1. Delegating risk acceptance to each business unit
  2. Aggregating risk at the enterprise level Correct answer.
  3. Transferring the risk to an insurance provider
  4. Reducing the number of entries in the risk register

Explanation

Individual unit assessments cannot reveal concentration and correlated exposure, so risk must be aggregated and viewed across the enterprise. Enterprise-level aggregation is what exposes single points of failure and interdependencies.

Question 16Corporate IT Governance

Which arrangement best supports the effectiveness of a chief risk officer?

  1. Reporting to the IT service delivery manager
  2. Reporting to the CEO with direct access to the board risk committee Correct answer.
  3. Serving concurrently as the head of internal audit
  4. Reporting to the head of sales to keep risk aligned with revenue targets

Explanation

The risk function must be independent of the activities it oversees and must be able to escalate concerns to the top, so senior reporting with direct board access is essential. Combining the role with an operational or assurance role creates a conflict of interest.

Question 17Corporate IT Governance

A system owner formally accepts a residual risk that exceeds the stated tolerance, and nobody else is informed. What is the most significant governance deficiency?

  1. The risk register was not reviewed by internal audit
  2. Risk acceptance limits and escalation paths were not enforced Correct answer.
  3. The system owner lacked technical knowledge of the vulnerability
  4. Controls were not tested before the decision was taken

Explanation

Governance requires that risk acceptance authority be defined by level and that anything beyond a manager's limit be escalated to the appropriate body. Where such limits and escalation routes are absent or unenforced, decisions are taken by people without the mandate to take them.

Question 18Corporate IT Governance

Which reporting approach best enables a board to oversee IT risk effectively?

  1. Aggregated IT risk reports in business terms compared with appetite Correct answer.
  2. Weekly extracts of the full technical vulnerability scan output for all systems
  3. Ad hoc briefings only when a major incident occurs
  4. Annual summaries of help desk ticket volumes

Explanation

Boards need concise, aggregated and forward-looking information that expresses IT risk in business terms and shows it against the approved appetite. Excessive technical detail obscures the picture, while infrequent or reactive reporting prevents timely direction.

Question 19Corporate IT Governance

Which governance mechanism best ensures that approved IT investments deliver the benefits stated in their business cases?

  1. Assigning benefit owners who review realised benefits post-implementation Correct answer.
  2. Requiring the IT department to own all benefits
  3. Approving investments only when the lowest-cost option is selected
  4. Extending the steering committee's remit to approve every system change

Explanation

Benefits realisation requires that named business owners be accountable for outcomes and that actual benefits be measured after delivery and compared with the case. Without ownership and post-implementation review, approval becomes an end in itself.

Question 20Corporate IT Governance

Placing internal audit under the direction of the audit committee rather than executive management primarily achieves:

  1. Broader coverage of technical controls
  2. Independence from the functions it assesses Correct answer.
  3. Faster remediation of audit findings by management
  4. Reduced cost of running the internal audit function

Explanation

Audit committee oversight protects internal audit from management influence over what it examines and reports, which is the foundation of credible assurance. Remediation speed, cost and coverage are outcomes that follow from, but are not the purpose of, that reporting line.

Question 21Corporate IT Governance

ISO/IEC 38500 provides principles for the corporate governance of IT. Which of the following is one of those principles?

  1. Least privilege
  2. Availability
  3. Conformance Correct answer.
  4. Confidentiality

Explanation

ISO/IEC 38500 sets out six principles for governing IT: responsibility, strategy, acquisition, performance, conformance and human behaviour. The other options are information security attributes or access design concepts rather than governance principles.

Question 22Corporate IT Governance

In the COBIT framework, which domain contains the objectives through which the governing body evaluates stakeholder needs, sets direction and monitors performance?

  1. Evaluate, Direct and Monitor (EDM) Correct answer.
  2. Align, Plan and Organise (APO)
  3. Build, Acquire and Implement (BAI)
  4. Deliver, Service and Support (DSS)

Explanation

COBIT separates governance from management: EDM contains the governance objectives of evaluating options, directing the enterprise and monitoring outcomes. APO, BAI and DSS are management domains covering planning, building and running IT.

Question 23Corporate IT Governance

An enterprise converts its board-approved risk appetite into specific, measurable limits for each business line. This practice is best described as:

  1. Performing a bottom-up risk assessment
  2. Cascading appetite into tolerances and limits Correct answer.
  3. Defining the enterprise's risk capacity
  4. Transferring risk to third parties

Explanation

Risk appetite is made operational by cascading it downward into tolerances and then into specific limits that business lines can monitor and report against. This top-down translation is what allows escalation to be triggered when a limit is breached.

Question 24Corporate IT Governance

How should IT risk management relate to enterprise risk management (ERM)?

  1. It should be integrated into ERM, with IT risk expressed in business terms Correct answer.
  2. It should be owned exclusively by the internal audit function
  3. It should operate independently so technical risk is assessed on technical criteria
  4. It should replace ERM in organisations whose operations are largely digital

Explanation

IT risk is a subset of enterprise risk and must be assessed, aggregated and reported alongside other risk types in language the business understands. Treating it as a separate technical discipline prevents the enterprise from seeing combined exposure and prioritising consistently.

Question 25Corporate IT Governance

A board delegates IT risk oversight to a board-level risk committee. What is the most important requirement for this delegation to be effective?

  1. The inclusion of the chief information officer as a voting member
  2. A documented charter defining its authority and reporting lines Correct answer.
  3. Reliance on management's self-assessment without independent input
  4. Meeting only when management requests a review

Explanation

Delegation preserves board accountability only when the mandate, decision rights and reporting obligations of the committee are formally defined. A clear charter ensures the full board continues to receive the information it needs to exercise oversight.

Question 26Corporate IT Governance

ISO/IEC 38500 describes the governance of IT in terms of three tasks that the governing body performs. Which set of tasks is correct?

  1. Evaluate, direct and monitor Correct answer.
  2. Plan, build and run
  3. Identify, assess and treat risk
  4. Align, prioritize and fund

Explanation

ISO/IEC 38500 frames governance of IT as the governing body's evaluation of the organization's use of IT, direction of IT in line with business objectives, and monitoring of conformance and performance. These three tasks define the governance role independently of day-to-day delivery work.

Question 27Corporate IT Governance

A platform owner delegates day-to-day operation of a payment system to an infrastructure manager. Which statement reflects how accountability works in IT governance?

  1. It is shared jointly, so both parties answer for outcomes.
  2. It moves to the CIO's supervisor once delegation is recorded.
  3. It transfers to the manager along with the tasks.
  4. It stays with the platform owner, who answers for outcomes. Correct answer.

Explanation

Delegation transfers tasks and the authority needed to perform them, but accountability for the asset or process stays with the person who answers for its outcomes. This is why named accountability is a foundation of IT governance structures.

Question 28Corporate IT Governance

An IT security policy requires that all data at rest be encrypted. Which type of document would most appropriately specify the approved cryptographic algorithms and key lengths?

  1. A guideline
  2. A standard Correct answer.
  3. A procedure
  4. A charter

Explanation

Standards translate a policy statement into mandatory, measurable requirements such as approved algorithms and minimum key lengths. Procedures then describe how staff perform the task, while guidelines are advisory rather than binding.

Question 29Corporate IT Governance

In a large enterprise the CIO reports to the CFO rather than to the CEO. What is the most significant IT governance concern arising from this reporting line?

  1. Financial controls over IT spending will be weakened.
  2. The IT budget will be prepared later than other budgets.
  3. IT may be framed as a cost to minimize rather than a value driver. Correct answer.
  4. The CIO will lack authority over third-party contracts.

Explanation

Reporting lines shape how IT is positioned in the enterprise. Under a CFO, IT is often treated primarily as a cost centre, which can weaken strategic alignment and the CIO's ability to argue for business-driven value from IT.

Question 30Corporate IT Governance

What is the primary governance purpose of establishing an enterprise architecture?

  1. To specify the technical skills required by the IT operations team
  2. To document the current inventory of applications and servers
  3. To reduce the number of software licenses the organization purchases
  4. To constrain investment to a coherent target state and standards Correct answer.

Explanation

Enterprise architecture defines a target state and the standards that guide investment, so that individual projects build toward a coherent future environment rather than creating fragmented, duplicative solutions. The architecture is a governance instrument because it constrains what may be funded and built.

Question 31Corporate IT Governance

An enterprise introduces mandatory stage gates into its IT investment lifecycle. What governance benefit does this primarily provide?

  1. It lets failing investments be stopped or re-scoped. Correct answer.
  2. It removes the need for a separate steering committee.
  3. It guarantees delivery within the original budget.
  4. It shifts delivery accountability to project managers.

Explanation

Stage gates create formal decision points at which the business case is reassessed and the investment can be continued, re-scoped or terminated. This is the core portfolio control that prevents funds from continuing to flow to initiatives whose benefits no longer justify them.

Question 32Corporate IT Governance

Which statement correctly distinguishes risk capacity from risk appetite?

  1. Capacity is approved annually by the audit committee; appetite is approved quarterly by management.
  2. Capacity applies only to financial risk; appetite applies to all categories of risk.
  3. Capacity is the most risk the enterprise can bear; appetite is what it chooses to take. Correct answer.
  4. Capacity is a forward-looking limit; appetite is a historical measure of losses.

Explanation

Capacity is the maximum level of risk the enterprise can withstand given its capital, obligations and stakeholder expectations, while appetite is the amount and type of risk it is willing to pursue to meet its objectives. Tolerance then expresses the acceptable variation around the appetite.

Question 33Corporate IT Governance

Who is best placed to own the IT risk entries associated with a specific business process?

  1. The IT service desk team that supports the process
  2. The enterprise risk manager who maintains the risk register
  3. The internal audit manager responsible for auditing the process
  4. The manager accountable for the performance of that process Correct answer.

Explanation

Risk ownership belongs to the person accountable for the process outcomes that generate the risk, because that person is empowered to decide how the risk is treated. The risk function maintains the register but does not own business risks.

Question 34Corporate IT Governance

Business units have begun using unsanctioned SaaS tools to meet urgent needs. Which governance response is most effective?

  1. Require each business unit to keep its own tool inventory.
  2. Offer a fast approval path and sanctioned alternatives. Correct answer.
  3. Block all unapproved cloud services at the network perimeter.
  4. Refer the matter to internal audit for investigation.

Explanation

Shadow IT usually grows where the approved route is slow or unsuitable. A rapid, low-friction approval path together with sanctioned alternatives channels demand into governed solutions that the enterprise can see and control.

Question 35Corporate IT Governance

In a data governance model, what is the data owner accountable for?

  1. Designing the backup and recovery procedures for the data
  2. Performing daily reconciliations of data against source systems
  3. Maintaining the physical storage infrastructure holding the data
  4. Deciding who may access the data and what quality it must meet Correct answer.

Explanation

The data owner is a business-accountable role that decides classification, access rights and quality requirements for a data domain. Custodians then implement and operate the technical controls on the owner's behalf.

Question 36Corporate IT Governance

A board wants to strengthen its oversight of cyber risk without becoming technical specialists. Which approach is most appropriate?

  1. Require the CISO to present a list of vulnerabilities at every board meeting.
  2. Receive regular plain-language briefings on cyber risk against appetite. Correct answer.
  3. Delegate all cyber matters to the IT department and receive an annual summary.
  4. Add a cybersecurity vendor representative as a non-voting board member.

Explanation

Effective board oversight depends on risk-based information expressed in business terms and tied to the approved appetite, so directors can challenge and direct. Technical detail in raw form does not support that judgement.

Question 37Corporate IT Governance

Why does an IT balanced scorecard include perspectives beyond financial measures?

  1. To show IT's contribution to customers, processes and capability Correct answer.
  2. To satisfy external auditors that IT costs are allocated correctly
  3. To demonstrate that IT has reduced its overall headcount over time
  4. To replace the need for service level reporting to business units

Explanation

A balanced scorecard combines financial measures with customer, internal process, and learning and growth perspectives, so governance can see whether IT delivers value rather than only whether it stays within budget. It links IT performance to enterprise objectives.

Question 38Corporate IT Governance

During due diligence for an acquisition, the acquiring firm's IT team focuses only on purchase price and license counts. What governance risk does this create?

  1. The deal team may lose the opportunity to negotiate a lower price.
  2. Regulatory approval of the deal may be delayed by the IT review.
  3. The acquired firm's staff may resist the new parent's IT policies.
  4. Integration costs and inherited IT risk may be understated. Correct answer.

Explanation

IT due diligence must surface integration cost, technical debt, licensing exposure, data issues and inherited cyber risk before the deal is approved. Limiting the review to price and license counts systematically understates what the acquirer is taking on.

Question 39Corporate IT Governance

A board delegates approval of IT capital projects below a threshold to an executive committee. What must accompany the delegation for it to remain effective governance?

  1. An agreement that the committee's decisions cannot be revisited.
  2. Defined limits, decision criteria and regular reporting back to the board. Correct answer.
  3. A requirement that the committee meets at least weekly.
  4. A statement that the board retains no further interest in those projects.

Explanation

Delegation is only a governance control when its scope, limits and decision criteria are explicit and when results are reported back so the board can oversee. Authority without reporting severs the board's line of sight.

Question 40Corporate IT Governance

What is the primary role of a change advisory board in IT governance?

  1. Assess change risk and authorize changes within limits. Correct answer.
  2. Approve the annual IT operating budget for change activity.
  3. Audit completed changes for compliance with policy.
  4. Perform the technical implementation of high-risk changes.

Explanation

The change advisory board evaluates the risk, impact and scheduling of proposed changes and authorizes them within its delegated authority. Implementation itself remains with the technical teams.

Question 41Corporate IT Governance

Who should certify that users still require their existing access during a periodic access review?

  1. The business or system owner responsible for the resource Correct answer.
  2. The identity administration team that provisions the accounts
  3. The internal auditor assigned to the access review
  4. The user's colleague in the same team

Explanation

Recertification is a decision about whether access remains justified for business reasons, so it belongs to the owner accountable for the resource. The provisioning team executes changes but does not judge business need.

Question 42Corporate IT Governance

An enterprise migrates a customer database to a cloud provider. How does this affect accountability for protecting that data?

  1. It stays with the enterprise, which remains accountable for the data. Correct answer.
  2. It is eliminated because the provider is contractually liable.
  3. It is shared equally and must be documented in the contract.
  4. It transfers to the provider because it operates the infrastructure.

Explanation

Under shared responsibility, the enterprise remains accountable for its data and for specifying the controls it requires; the provider is responsible for delivering the agreed controls. Accountability for the data cannot be outsourced.

Question 43Corporate IT Governance

Why does a board establish a confidential whistleblowing channel for IT and other staff?

  1. To provide an alternative route for submitting change requests.
  2. To reduce the number of issues raised directly with line management.
  3. To satisfy insurance conditions for cyber liability coverage.
  4. To surface misconduct and control failures that management may not report. Correct answer.

Explanation

A confidential channel gives the board an independent source of information about misconduct and control failures that may otherwise be filtered or suppressed as it travels up through management. It strengthens the board's ability to oversee and challenge.

Question 44Corporate IT Governance

An operations team records that a key risk indicator has breached its amber threshold for the third consecutive month. What is the most appropriate governance action?

  1. Wait until the next quarterly report before acting.
  2. Close the indicator and replace it with a new metric.
  3. Reduce the threshold so that the indicator returns to green.
  4. Escalate with a remediation plan as defined in policy. Correct answer.

Explanation

Threshold breaches should trigger the pre-defined escalation path together with a remediation plan, so risk owners and governance bodies are informed and can act. Repeated breaches indicate a persistent exposure that warrants attention.

Question 45Corporate IT Governance

Which characteristic best indicates that an IT governance process is institutionalized rather than ad hoc?

  1. The process was designed by an external consulting firm.
  2. It has an owner, documented steps and is applied consistently. Correct answer.
  3. The process is supported by a recently purchased tool.
  4. The process produced a favourable audit result in the last review.

Explanation

Institutionalization means the process has defined ownership, documented and repeatable steps, and is applied consistently across the enterprise. These attributes produce predictable outcomes rather than depending on individual effort.

Question 46Corporate IT Governance

Which arrangement best reflects sound governance of business continuity?

  1. The plan is kept confidential to a small group of technical staff.
  2. Business continuity is reviewed only after an actual disruption occurs.
  3. The IT department owns the continuity plans for all business units.
  4. Business units set priorities; senior management approves the plan. Correct answer.

Explanation

Continuity is a business responsibility because business units understand their processes and recovery priorities, while senior management approves the plan and recovery objectives. IT supports the plans but does not own business continuity.

Question 47Corporate IT Governance

An enterprise introduces a chargeback model in which business units see the cost of the IT services they consume. What governance outcome does this primarily support?

  1. It makes demand and cost trade-offs visible to the business. Correct answer.
  2. It guarantees that IT costs will fall in the following year.
  3. It transfers accountability for IT service quality to business units.
  4. It removes the need for an IT steering committee to prioritize demand.

Explanation

Transparency of consumption cost informs business decisions about demand and helps align IT spending with value. It supports governance by making trade-offs explicit rather than hidden in a central budget.

Question 48Corporate IT Governance

The head of a business unit also chairs the committee that grants exceptions to the IT security policy that applies to that unit. Why is this a governance weakness?

  1. The party taking the risk also judges its acceptability. Correct answer.
  2. It requires the committee to publish its minutes to shareholders.
  3. It slows down the exception process during peak business periods.
  4. It duplicates a responsibility already held by internal audit.

Explanation

Separating those who take risk from those who decide whether it is acceptable is a core governance principle. When both sit with the same person, exceptions can be approved for operational convenience rather than on an assessment of enterprise exposure.

Question 49Corporate IT Governance

Business units submit competing IT requests directly to different IT teams, and priorities change weekly. Which governance mechanism addresses this most directly?

  1. A larger IT budget to satisfy more of the requests.
  2. A single demand intake with prioritization against agreed criteria. Correct answer.
  3. Delegation of all prioritization to individual IT team leads.
  4. A rule that requests are handled in the order received.

Explanation

Consolidating demand through one intake with agreed prioritization criteria establishes clear decision rights and produces stable, defensible priorities. This is the mechanism that resolves competition for scarce IT capacity.

Question 50Corporate IT Governance

An enterprise outsources a critical payment service. Which contractual provision most directly preserves the enterprise's ability to govern the provider's controls?

  1. A right to audit and to receive independent assurance reports. Correct answer.
  2. A requirement that the provider holds ISO 27001.
  3. A clause permitting subcontracting with prior notice.
  4. Service credits for missed availability targets.

Explanation

A right to audit, combined with periodic independent assurance reports such as SOC reports, gives the enterprise ongoing evidence about the provider's control environment. That evidence is what allows the enterprise to oversee the outsourced risk.