Which of the following observations should be of GREATEST concern to an IS auditor reviewing an organization's enterprise architecture (EA) program?

The correct answer is B. IT application owners have sole responsibility for architecture approval. IT application owners having sole responsibility for architecture approval is of greatest concern because it introduces the risk of inconsistent architecture decisions, lack of enterprise-wide alignment, and insufficient oversight from other key stakeholders (e.g., security…

Submitted by hassan_iq· Apr 18, 2026Information Security Governance

Question

Options

AInformation security requirements are reviewed by the EA program.
BIT application owners have sole responsibility for architecture approval.
CThe architecture review board is chaired by the CIO.
DThe EA program governs projects that are not IT-related.

How the community answered

(36 responses)

A
3% (1)
B
75% (27)
C
6% (2)
D
17% (6)

Explanation

IT application owners having sole responsibility for architecture approval is of greatest concern because it introduces the risk of inconsistent architecture decisions, lack of enterprise-wide alignment, and insufficient oversight from other key stakeholders (e.g., security, operations, compliance). Architecture approval should be collaborative and governed by a formal review board to ensure consistency and strategic alignment.

Topics

#Enterprise Architecture#IT Governance#Architecture Review#Roles and Responsibilities

Community Discussion

No community discussion yet for this question.

Full CISM Practice