Certified Information Systems Auditor (CISA) — Question 666

Which of the following is the PRIMARY objective of baselining the IT control environment?

Answer options

• A. Define process and control ownership.
• B. Ensure IT security strategy and policies are effective.
• C. Align IT strategy with business strategy.
• D. Detect control deviations.

Correct answer: D

Explanation

The primary objective of baselining the IT control environment is to detect control deviations, which allows organizations to identify any discrepancies from the established standards. The other options, while important, focus on different aspects of IT governance rather than the main goal of monitoring controls.