CISA Governance and Management of IT: What an Auditor Evaluates

What does CISA Domain 2 ask an auditor to evaluate?

Evaluate how IT priorities, assigned responsibilities, and oversight support the organization's business objectives. ISACA's CISA outline places Governance and Management of IT in Domain 2, weighted 18% as checked November 3, 2026, with tasks addressing alignment, policies, resources, and risk ownership.

The domain also covers subjects such as enterprise architecture, vendor management, and performance management. The case below develops one connected governance problem; it does not represent every Domain 2 topic or carry its own published exam weight. Use the CISA domain map to place it within the wider syllabus.

ISACA's glossary, checked November 5, 2026, describes governance in terms of setting direction and monitoring performance. For study, turn that into a practical question: can you follow an approved business objective through to a relevant measure and an oversight decision?

For review across the wider syllabus, full ISACA CISA prep planned for launch covers five domains. Start this lesson by separating what an organization intended from what its records demonstrate.

How do business goals connect to an IT decision?

Consider Northstar Service, a fictional organization. This is an original teaching case, not a recalled exam item or a required ISACA audit procedure. Its business objective is to reduce overdue customer service requests while maintaining its stated approval control.

Northstar's approved proposal funds a request-routing tool. Its charter assigns operational decisions to the service manager and names a separate executive as the person authorized to accept the specified service risk. A policy defines the required approval record.

The remaining documents create the problem. The first performance report counts completed requests but gives no request ages, overdue counts, or comparison with the business objective. Oversight minutes record receipt of that report, without a conclusion about overdue requests or an assigned follow-up. An exception log records an unapproved bypass; the supplied packet contains no risk-owner decision about it.

Follow the evidence in this order:

The approved proposal supports intended alignment: the organization selected an IT initiative for a stated business purpose. It does not establish that the initiative achieved that purpose. Keep both findings in your notes.

Who owns the risk and who evaluates the evidence?

ISACA's glossary defines a risk owner through assigned authority and accountability for risk decisions. The title alone is insufficient; in this case, the charter identifies the relevant authority.

The service manager's operational role does not, by itself, establish authority to accept the risk created by the bypass. Equally, the auditor cannot infer acceptance from the fact that work continued. Look for evidence of the decision by the assigned authority.

ISACA's ethics code emphasizes objectivity and professional care. Applying that principle does not mean an auditor can never advise; here it means an audit conclusion should not silently become a management decision. The CISA versus CISM comparison addresses credential choice separately.

For broader concept review, full ISACA CISA prep planned for launch includes 500 flashcards. In this case, test your understanding by identifying the authority in the charter before deciding what the missing record should show.

What can policy and oversight records establish?

Each document answers a different question. Northstar's policy establishes the expected approval record. It does not prove that every request followed that requirement. The exception log supplies evidence of an unapproved bypass, but the packet does not establish what decision followed it.

The performance report has a different limitation. A completion count describes reported activity. Without ages, overdue counts, or a comparison with the stated objective, it cannot answer whether overdue requests decreased. More copies of the same completion count would not repair that mismatch.

Oversight minutes must also be read precisely. Receipt of a report supports the conclusion that receipt was recorded. Those minutes alone do not establish that oversight evaluated overdue requests or decided what to do next. The conclusion should be about the supplied evidence, not a claim that no discussion ever occurred.

NIST SP 800-53A Revision 5, checked November 3, 2026, offers useful supplementary vocabulary: examine records, interview people, and test behavior when appropriate to the objective. These are explanatory methods, not an exclusive CISA answer framework or a requirement to use every method for every question. The audit-evidence guide develops that distinction.

For Northstar, identify the gap before requesting more evidence: performance against the objective, approval handling, the risk decision, or oversight follow-up.

How would you work through a governance audit case?

Use the following editorial exercise. You need to evaluate Northstar's stated objective and the handling of its approval exception. Which additional evidence would address each unresolved question?

Now compare two proposed requests: another completion-count report, or an aged-request report that identifies overdue work. The second addresses the performance gap more directly. It would still need to be assessed for relevance to the review period and objective; receiving it would not automatically prove success.

For the bypass, write the precise unresolved question: What evidence shows whether the assigned risk owner made a decision about this exception? That wording leaves room to discover a record absent from the initial packet.

Try the 20 free CISA practice questions and explain what fact supports each conclusion you choose. If selecting among plausible responses is the difficulty, use the separate CISA best-answer reasoning guide.

What should your conclusion say and leave to management?

A defensible conclusion for the supplied Northstar packet is:

The proposal and charter document the intended IT priority and assigned responsibilities. The supplied performance and oversight records are insufficient to conclude that overdue requests decreased. The packet also lacks evidence of the assigned risk owner's decision about the recorded bypass. Relevant performance, exception, risk-decision, and oversight records are needed before extending those conclusions.

That statement preserves the positive evidence and the limitations. It does not declare that the business objective failed, that risk acceptance never occurred, or that all governance is ineffective. Management determines its response within the authority assigned in the scenario; the auditor evaluates and communicates the evidence gap.

Use the free CISA study plan to reserve a session for explaining this chain without looking at the table. Credential eligibility is a separate planning task, covered in CISA requirements and cost.

For broader practice after topic review, full ISACA CISA prep planned for launch includes 1,350 questions. Your next step is to write one supported conclusion and one unresolved question from the case, naming the record that would help answer it.