Exam CISA topic 1 question 287 discussion

D is correct

According to ISACA's guidance and best practices, D. The organization has not established a formal recertification process for the inventory data is the most significant concern. ISACA emphasizes the importance of regular reviews and updates to ensure that information related to IT assets, such as applications, remains accurate and relevant for effective risk management and decision-making. Without a formal recertification process, outdated or incorrect data could lead to misinformed decisions, unaddressed security risks, and compliance issues, making it the highest priority concern in managing an IT asset inventory.

A lack of recertification makes it difficult to verify the completeness and accuracy of the inventory during audits or reviews. It undermines the reliability of the inventory as a control mechanism for managing IT assets effectively.

Yes is C Because Application owner and contact information is critical in identifying who is responsible for the IT applications, how to contact them, and what business processes they support. If these fields are not required to be completed, it is likely that there will be incomplete and inaccurate information about the ownership and usage of the applications in the inventory. This could result in challenges in terms of maintaining and supporting the applications, as well as making informed decisions about future investments and risks.