Question

An organization has decided to adopt a widely recognized IT governance framework to structure its IT-related processes. During the planning phase, the CIO proposes implementing every process, control objective, and metric described in the framework exactly as published. What is the IS auditor's BEST recommendation regarding this approach?

Accepted Answer

The framework should be tailored to the organization's size, risk profile, and business objectives rather than adopted in full without adaptation

Answer

The framework must be implemented completely and without modification to preserve its integrity and ensure compliance

Answer

The organization should defer adoption until a regulatory requirement mandates the specific framework

Answer

The framework should be replaced with a set of internally developed controls to avoid licensing constraints