IT Steering vs. Strategy Committee Roles in CISA

CISA By islever Editorial Last updated

Short answer

A The IT steering committee acquires and assigns appropriate resources for projects to ensure successful implementation and delivery.

Question

An organization has both an IT strategy committee and an IT steering committee. When reviewing the minutes of the IT steering committee, an IS auditor would expect to find that the committee:
  1. acquired and assigned appropriate resources for projects. Correct Answer
  2. compared the risk and return of IT investments.
  3. reviewed the achievement of the strategic IT objective.
  4. assessed the contribution of IT to the business.

Key Takeaways

Tests the functional distinction between executive oversight bodies, where candidates often confuse tactical project resourcing with long-term strategic investment appraisal.

Distinguishes between IT steering and strategy committees in CISA governance frameworks. This page establishes that the steering committee focuses on tactical resource allocation and project execution.

Common mistake: Option B/C/D because candidates frequently conflate the steering committee’s operational mandate with the strategy committee’s portfolio and alignment responsibilities.

Expert Analysis

Why the Answer Is Correct

The IT steering committee operates at a tactical level to oversee project execution and ensure operational continuity. According to ISACA governance frameworks, its primary mandate includes prioritizing initiatives, securing necessary funding, and assigning personnel to deliver agreed-upon outputs. Option A accurately reflects this responsibility, as the committee actively acquires and allocates resources to guarantee that projects remain viable and on schedule. This hands-on oversight distinguishes it from purely advisory or long-range planning bodies.

Why the Other Options Are Wrong

Options B, C, and D describe functions that belong to the IT strategy committee rather than the steering committee. Comparing risk and return profiles, measuring progress against strategic objectives, and evaluating how IT contributes to broader business goals are all forward-looking activities focused on portfolio management and alignment. These strategic assessments require board-level or executive-level deliberation outside the scope of day-to-day project steering. Conflating these duties creates a common governance structure error on certification exams.

Community Comment Notes

Multiple examinees emphasize the clear division between execution-focused and vision-focused oversight groups. As RS66 noted, the steering committee directly manages project delivery and resource distribution to maintain momentum. PurpleParrot confirmed this hierarchy by stating 'option A as per CRM 100%', underscoring that tactical assignment supersedes strategic appraisal. This consistent breakdown reinforces why resource allocation remains the definitive steering committee function.

Exam Strategy

When distinguishing governance committees, map 'steering' to execution, prioritization, and resource allocation, while reserving 'strategy' for long-term vision, investment appraisal, and alignment metrics.

Frequently Asked Questions

Why is comparing risk and return not the steering committee's role?

Risk-return analysis belongs to the IT strategy committee, which evaluates long-term investment portfolios rather than day-to-day project execution.

Can the steering committee review strategic IT objectives?

No, tracking strategic objective achievement falls under the strategy committee's purview. The steering committee focuses on tactical delivery and resource assignment.

More CISA FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. [Removed] 👍 1
    IT Steering committee is an executive management level committee that assists in the delivery of the IT Strategy, oversees day-to-day management of IT Service delivery and IT projects, and focuses on implementation aspects while IT Strategy Committee is primarily accountable for managing the portfolios of IT Enabled investments, IT Services, and other IT Resources (CISA review Manual). Based on this I'd think D is the appropriate answer.
  2. 4dfe785 👍 1 Answered A
    The IT Steering Committee is responsible for overseeing the implementation and management of IT projects. This includes ensuring that projects have the necessary resources, such as budget, personnel, and technology, to be executed successfully. The committee monitors the progress of projects and makes adjustments as necessary to address resource needs and operational challenges.
  3. RS66 👍 1 Answered A
    A. acquired and assigned appropriate resources for projects.
  4. joehong 👍 1 Answered A
    B C D is more aligned with the IT strategy committee’s role
  5. PurpleParrot 👍 1 Answered A
    option A as per CRM 100%

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Greatest Fraud Risk: Mandatory Leave vs Access Reviews

S-grade

Environmental Detector Placement Risks in Data Centers

S-grade

Next Step When Periodic Access Reviews Are Missing | CISA

S-grade

Best Backup Scheme for Rapid Data Restoration?

S-grade

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide