IIA Exam IIA-CRMA Topic 3 Question 63 Discussion

Which of the following statements accurately describes the responsibility of the internal audit activity regarding IT governance?

1. The internal audit activity does not have any responsibility because IT governance is the responsibility of the board and senior management of the organization.

2. The internal audit activity must assess whether the IT governance of the organization supports the organization's strategies and objectives.

3. The internal audit activity may assess whether the IT governance of the organization supports the organization's strategies and objectives.

4. The internal audit activity may accept requests from management to perform advisory services regarding how the IT governance of the organization supports the organization's strategies and objectives.