Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISA 1.0 - ISACA > 2.4 IT Balanced Score Card (Doshi) > Flashcards

2.4 IT Balanced Score Card (Doshi) Flashcards

1
Q

What is the balanced Scorecard?

A

A management tool that is used to measure the performance and effectiveness of an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Key performance indicators of the IT balanced scorecard are:

A

(1) Financial,
(2) customer,
(3) internal process,
(4) innovation and
(5) learning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Key performance indicators of the Balanced scorecard are:

A

(1) Financial,
(2) Customer satisfaction,
(3) Internal process,
(4) Ability to innovate and learning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Standard IT Balanced Scorecard:

A

can be used to specifically measure IT organization performance and results.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Key perspectives of the Standard IT Balanced ScoreCard:

A

Establish, monitor and evaluate IT performance in terms of :

(1) business contribution
(2) future orientation
(3) operation excellence
(4) user orientation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In any given scenario, three indicators of IT balanced scorecard:

A

(1) customer satisfaction
(2) internal processes and
(3) ability to innovate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Why should the balanced scorecard be used?

A

Because it’s the most effective means to aid the IT strategy committee and management in achieving the IT governance through proper IT and business alignment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Success of IT Scorecard depends on:

A

Involvement of senior management in IT strategy planning.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Primary objective of IT balanced scorecard:

A

To optimize the performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What needs to be defined before implementing IT balanced scorecard?

A

Key performance indicators (KPI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Though financial performance is an indicator of generic balanced scorecard, it is

A

not part of IT balanced scorecard.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

In any given scenario, use of IT balanced scorecard is the most effective means to

A

aid the IT strategy committee and management in achieving the IT governance through proper IT & business alignment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

In any given scenario, success of IT scorecard depends upon

A

involvement of senior management in IT strategy planning.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In any given scenario, primary objective of IT balanced scorecard is

A

to optimize the performance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

In any given scenario, key performance indicators (KPIs) need to be defined

A

before implementing IT balanced scorecard.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Standard IT Balanced Scorecard

A
  • A process management evaluation technique that can be applied to the IT governance process in assessing IT functions and processes
  • Method goes beyond the traditional financial evaluation
  • One of the most effective means to aid the IT strategy committee and management in achieving IT and business alignment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Outcomes of security governance

A
  • Strategic alignment—align with business strategy
  • Risk management—manage and execute appropriate measures to mitigate risks
  • Value delivery—optimize security investments
  • Performance measurement – measure, monitor and report on information security processes
  • Resource management—utilize information security knowledge and infrastructure efficiently and effectively
  • Process integration – integration of management assurance processes for security
18
Q

Information security governance requires strategic direction and impetus from:

A
  • Boards of directors / senior management
  • Senior management
  • Steering committees
  • Chief information security officers
19
Q

Enterprise Architecture

A
  • Involves documenting an organization’s IT assets in a structured manner to facilitate understanding, management and planning for IT investments
  • Often involves both a current state and optimized future state representation
20
Q

Enterprise Architecture

A

The Basic Zachman Framework

21
Q

The Federal Enterprise Architecture (FEA) hierarchy:

A
  • Performance
  • Business
  • Service component • Technical
  • Data
22
Q

From an IS standpoint, strategic planning relates to

A

the long-term direction an organization wants to take in leveraging information technology for improving its business processes

23
Q

Effective IT strategic planning involves a consideration of the organization’s demand for IT and

A

its IT supply capacity

24
Q

The IS auditor should

A
  • Pay attention to the importance of IT strategic planning
  • Focus on the importance of a strategic planning process or planning framework
  • Consider how the CIO or senior IT management are involved in the creation of the overall business strategy
25
Q

Which of the following would be included in an IS strategic plan?

A. Specifications for planned hardware purchases
B. Analysis of future business objectives
C. Target dates for development projects
D. Annual budgetary targets for the IS department

A

B. Analysis of future business objectives ?

26
Q

Which of the following BEST describes an IT department’s strategic planning process?

A. The IT department will have either short-range or long-range plans depending on the organization’s broader plans and objectives.
B. The IT department’s strategic plan must be time- and project- oriented, but not so detailed as to address and help determine priorities to meet business needs.
C. Long-range planning for the IT department should recognize organizational goals, technological advances and regulatory requirements.
D. Short-range planning for the IT department does not need to be integrated into the short-range plans of the organization since technological advances will drive the IT department plans much quicker than organizational plans.

A

?

27
Q

Steering Committee

A
  • An organization’s senior management should appoint a planning or steering committee to oversee the IS function and its activities
  • A high-level steering committee for information technology is an important factor in ensuring that the IS department is in harmony with the corporate mission and objectives
28
Q

Maturity and Process Improvement Models

A
  • IDEAL model
  • CapabilityMaturityModelIntegration(CMMI)
  • Team Software Process (TSP)
  • Personal Software Process (PSP)
29
Q

Policies and Procedures reflect management guidance and direction in developing controls over:

A
  • Information systems
  • Related resources
  • IS department processes
30
Q

Policies

A
  • High level documents
  • Must be clear and concise
  • Set tone for organization as a whole (top down)
  • Lower-level policies – defined by individual divisions and departments
31
Q

Information Security Policy

A

• Defines information security, overall objectives and scope
• Is a statement of management intent
• Is a framework for setting control objectives including risk management
• Defines responsibilities for information security management
Acceptable Use Policy

32
Q

Procedures are detailed documents that:

A

Define and document implementation policies
• Must be derived from the parent policy
• Must implement the spirit (intent) of the policy statement
• Must be written in a clear and concise manner

33
Q

Risk Management is

A

The process of identifying vulnerabilities and threats to the information resources used by an organization in achieving business objectives.

34
Q

4 Processes in Risk Management

A
  • Avoid
  • Mitigate
  • Transfer
  • Accept
35
Q

To develop a risk management PROGRAM:

A

(1) Establish the purpose of the risk management program

(2) Assign responsibility for the risk management plan

36
Q

Risk Management Process

A

(1) Identification and classification of information resources or assets that need protection
(2) Assess threats and vulnerabilities and the likelihood of their occurrence
(3) Once the elements of risk have been established they are combined to form an overall view of risk
(4) Evaluate existing controls or design new controls to reduce the vulnerabilities to an acceptable level of risk
(5) Residual risk

37
Q

IT risk management needs to operate at multiple levels including:

A
  • The operational level
  • The project level
  • The strategic level
38
Q

Risk Analysis Methods

A

(1) Qualitative
(2) Semiquantitative
(3) Quantitative
– Probability and expectancy
– Annual loss expectancy method

39
Q

Risk Analysis Methods Management and IS auditors should keep in mind certain considerations:

A
  • Risk management should be applied to IT functions throughout the company
  • Senior management responsibility
  • Quantitative RM is preferred over qualitative approaches
  • Quantitative RM always faces the challenge of estimating risks
  • Quantitative RM provides more objective assumptions
  • The real complexity or the apparent sophistication of the methods or packages used should not be a substitute for commonsense or professional diligence
  • Special care should be given to very high impact events, even if the probability of occurrence over time is very low
40
Q

Human Resource Management

A
  • Hiring
  • Employee handbook
  • Promotion policies
  • Training
  • Scheduling and time reporting
  • Employee performance evaluations • Required vacations
  • Termination policies

CISA 1.0 - ISACA (51 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions