Which of the following should be of GREATEST concern to an IS auditor when auditing an organization's IT strategy development process?

Question

Options

• AThe IT strategy was developed before the business plan
• BA business impact analysis (BIA) was not performed to support the IT strategy
• CThe IT strategy was developed based on the current IT capability
• DInformation security was not included as a key objective in the IT strategic plan

• A
  83% (20)
• B
  4% (1)
• C
  4% (1)
• D
  8% (2)

Explanation

IT strategy must be derived from and aligned with the organization's business strategy - IT exists to enable business objectives. If the IT strategy was developed before the business plan (A), it cannot be aligned to business goals; instead, the business may end up being shaped around IT capabilities, which inverts the proper governance relationship and creates significant strategic misalignment risk. This is a fundamental process failure. A missing BIA (B) is a concern for continuity planning but does not represent a core strategic governance failure. Basing IT strategy on current capabilities (C) may limit ambition but is a common starting point. Omitting information security (D) from IT strategic objectives is a risk management gap but is less fundamental than the complete inversion of the strategy development sequence.

No community discussion yet for this question.