CISA Governance & Management of IT: Organizational Structure and Roles — Complete Study Guide

Most CISA candidates study organizational structure like it's an HR exam, memorizing job titles and drawing org charts. This is a fatal mistake. The exam is designed to fail candidates who can define "Data Custodian" but can't spot the unacceptable risk created when that custodian also audits their own system's access logs.

Key facts

• Exam Domain: Governance & Management of IT (Domain 2)
• Domain 2 Weighting: 17% of the total exam score (per the 2024 CISA Job Practice)
• Official Body: ISACA (Information Systems Audit and Control Association)
• Passing Score: 450 on a scaled score of 200 to 800
• Typical Study Hours: 150-200 total hours for the full exam
• Pass Rate: ISACA does not publish official pass rates, but the pass rate is widely estimated to be between 50-55%.

Why Organizational Structure Is a Test of Risk Judgment, Not HR Knowledge

This topic is a core component of CISA Domain 2, "Governance & Management of IT." It focuses on how an enterprise arranges its people and responsibilities to achieve its objectives securely. For you, the CISA candidate, this is purely a risk assessment exercise.

ISACA expects you to analyze a scenario and determine if the structure supports strategic alignment, manages risk, and delivers value. This means looking for clear lines of authority, appropriate segregation of duties, and defined accountability for information assets.

The most common trap is rote memorization. Candidates learn the textbook definition of a "Data Owner" but fail to spot the risk when the person in that role lacks the actual authority to make decisions. The exam punishes this surface-level knowledge.

Your job is to think like an examiner: where can this structure fail? Who has conflicting duties? Where is accountability unclear? Answering these questions correctly is how you pass this section. You can test your judgment on SoD scenarios with VoraPrep's adaptive CISA practice questions.

What Key Organizational Concepts Are Tested on the CISA Exam?

To master this topic, you must understand the underlying control principles, not just the vocabulary. These are the concepts that will appear repeatedly in exam questions.

Data Governance Framework and Key Roles

Data governance is the overall management of the availability, usability, integrity, and security of an enterprise's data. A strong governance structure is the foundation. The exam will test your understanding of who is responsible for what.

• Governance Committees: Beyond a single committee, a mature organization has several. The IT Steering Committee aligns IT with business strategy. An Audit Committee provides oversight of financial reporting and internal controls, while a Risk Committee oversees enterprise-wide risk management. An auditor must verify these committees are active and effective.
• Data Owner: A senior business manager ultimately accountable for the business value and risk associated with a specific data set (e.g., the VP of Marketing owns customer data). They approve data classification and define access rules but don't manage the tech.
• Data Custodian: The IT team responsible for the technical implementation of the data owner's rules. This includes managing backups, applying security patches, and maintaining the database. They are responsible for the "how."
• Data Steward: A role focused on data quality, metadata management, and ensuring data conforms to policies. They work on behalf of the owner to maintain the integrity of the data asset.
• Data Producer/Creator & Consumer: These roles may also appear. The producer creates the data, and the consumer uses it. An auditor checks for controls at both the point of creation and consumption.

Segregation of Duties (SoD)

This is the single most important concept in this topic. SoD is a preventive control designed to prevent one person from having the ability to commit and conceal fraud or error. The classic model separates three key functions:

1. Authorization: Approving a transaction or activity.
2. Execution/Custody: Performing the action or having physical control of the asset.
3. Recording/Reporting: Documenting the transaction or reviewing its logs.

No single individual should control more than one of these functions for a given process.

Conflicting Functions	Example of a Control Failure	Correct Control
Development & Production	A developer can write code and push it directly to the live production environment without oversight.	All code changes must be moved to production by a separate release management team after testing and approval.
User Access Admin & Approval	A help desk analyst who creates user accounts can also approve the access levels for those accounts.	A business manager must approve all access requests before the help desk can create or modify the account.
System Operations & Security Monitoring	A system administrator is also responsible for reviewing their own system's security logs.	A separate security team must be responsible for monitoring and reviewing all system logs for critical systems.

When perfect SoD isn't practical (e.g., in a small IT shop), the exam will look for strong compensating controls. These are often detective controls, such as mandatory independent reviews, detailed audit trail analysis, and heightened supervision.

Human Resources and Personnel Controls

The auditor's interest in HR is about managing information systems risk related to people.

• Skills Management: The organization must periodically assess if its staff has the skills needed for current and future technology (skills gap analysis). A lack of skills is an operational risk.
• Key-Person Dependency: If a critical employee leaves suddenly, operations must continue. The primary control to mitigate this is cross-training, ensuring multiple people are skilled in critical functions. Documented procedures are also essential.
• Onboarding & Offboarding: Formal processes must exist to grant access to new hires and, critically, revoke all access immediately upon termination.
• Mandatory Vacations: The primary objective of forcing employees in sensitive roles to take vacations is to detect fraud or errors. When another person must perform their duties, they may uncover irregularities that the original employee was concealing.

Worked Example: How to Dissect an SoD Question

Let's walk through a typical CISA scenario. This is where you move from theory to application.

> 💡 Worked example: > An IS auditor is reviewing the IT department of FinSecure, a regional bank. The auditor discovers that the lead Database Administrator (DBA), John, is responsible for creating and maintaining the production databases. Due to his expertise, John is also tasked with performing the quarterly user access reviews for these same databases and reporting the results directly to the IT Steering Committee. Which of the following is the MOST significant concern for the IS auditor? > > A) The IT Steering Committee may not have the technical expertise to interpret the access review reports. > B) The user access review process is only performed quarterly, which is not frequent enough for a financial institution. > C) John may have excessive privileges, but this is an acceptable risk given his seniority and expertise. > D) There is an inadequate Segregation of Duties, as the DBA is reviewing access controls they are also responsible for implementing.

This question is designed with tempting distractors. Let's break it down.

Step 1: Identify the core functions and roles

• Role: Lead Database Administrator (John)
• Function 1 (Execution/Custody): Creates and maintains production databases. This means he grants, modifies, and revokes user access.
• Function 2 (Recording/Review): Performs user access reviews to ensure access is appropriate.
• Function 3 (Reporting): Reports findings to the IT Steering Committee.

Step 2: Analyze the relationships for conflicts

The critical conflict is between Function 1 and Function 2. John is responsible for implementing access controls and then auditing his own work. He has the ability to grant himself inappropriate access and then conceal that fact during the review. This is a classic SoD violation.

Step 3: Evaluate the tempting wrong answers

This is where unprepared candidates lose points.

• (A) The IT Steering Committee may not have the technical expertise... This is a plausible concern, but it's secondary. The primary issue is the integrity of the information being presented to the committee. If the report is fundamentally flawed because of the SoD conflict, the committee's expertise is irrelevant.
• (B) The user access review process is only performed quarterly... Another valid point. For a bank, monthly might be better. However, a review process with a fundamental integrity flaw (the SoD violation) is useless whether it's done quarterly or daily. The SoD issue is the root cause and therefore more significant.
• (C) John may have excessive privileges, but this is an acceptable risk... This is the "trust the expert" fallacy. An auditor must never accept a control weakness based on a single person's tenure or perceived trustworthiness. The core issue isn't just "excessive privileges"; it's the toxic combination of implementation and review duties, which defines the SoD conflict.

Step 4: Confirm the correct answer

• (D) There is an inadequate Segregation of Duties... This directly identifies the root cause of the risk. John's ability to both implement and review access controls creates an unmitigated conflict of interest. An independent person or group must perform the user access review. This is the most significant concern because it undermines the entire control's effectiveness.

How to Approach Organizational Structure Questions on Exam Day

When you see a question about roles and responsibilities, slow down and think like a risk consultant.

Draw the Lines: Mentally (or on your scratchpad), map the functions. Who can authorize? Who can execute? Who can review? If one person is doing more than one of these for the same process, you've likely found the problem. Prioritize the Root Cause: CISA questions often present multiple valid but unequal risks. Always choose the answer that addresses the most fundamental control failure. A broken SoD is almost always more critical than the frequency of a review or the format of a report. Connect to Other Domains: This topic directly impacts others. Poor SoD in development (Domain 2) creates massive risks in change management (Domain 3). Unclear data ownership (Domain 2) makes effective data classification impossible (Domain 5). Our guide to CISA Data Classification and Handling explores this link further.

Frequently asked questions

How many questions on Organizational Structure and Roles appear on the CISA exam? Domain 2, "Governance & Management of IT," constitutes 17% of the exam. You can expect approximately 5-10 questions that directly test organizational structure, roles, responsibilities, and especially Segregation of Duties. What is the best way to study Organizational Structure and Roles for CISA? The most effective method is applying concepts to scenario-based practice questions. Use a tool like VoraPrep's CISA question bank to work through realistic problems on SoD and data governance, focusing on the detailed explanations to understand the why behind each answer. Is Organizational Structure and Roles tested in simulations or only MCQs? The CISA exam consists entirely of multiple-choice questions (MCQs). There are no simulations. However, the MCQs are heavily scenario-based, requiring you to analyze a situation and make a judgment, which feels like a mini-case study. How to study Organizational Structure and Roles for CISA? Allocate roughly 17% of your total study time (about 25-35 hours) to Domain 2. Focus on understanding the principles behind the roles, not just memorizing titles. Use practice questions to test your ability to identify SoD conflicts in different IT contexts, from development to database administration.

Related Resources

• CISA Information Systems Acquisition & Development: Project Governance — Complete Study Guide, Master CISA Project Governance for Domain 3. This complete 2026 study guide covers key concepts, a worked example, pract
• CISA Information Systems Operations & Resilience: Backup and Recovery Strategies — Complete Study Guide, Master CISA Backup and Recovery by learning the #1 judgment trap candidates fall into. This guide breaks down RPO vs. RT
• CISA Information Systems Auditing Process: Computer-Assisted Audit Techniques — Complete Study Guide, An auditor we coached, we'll call him David, was confident about Computer-Assisted Audit Techniques. He knew his SQL que
• CISA Protection of Information Assets: Adversarial Attacks — Complete Study Guide, Ace CISA Domain 5's Adversarial Attacks. This guide uses worked examples of BEC, zero-days, and APTs to teach the audito
• CISA Information Systems Auditing Process: Audit Objectives and Scope — Complete Study Guide, Pass CISA Domain 1 by mastering Audit Objectives and Scope. Our expert guide covers the audit charter, risk acceptance,
• CISA Governance & Management of IT: Risk Identification — Complete Study Guide, Stop picking the wrong 'greatest risk' on the CISA exam. This guide dissects Domain 2's Risk Identification with expert

Official resources and references

• ISACA Certified Information Systems Auditor (CISA): The official page for the CISA credential and exam blueprint.
• COBIT Framework from ISACA: The governance framework that underpins many CISA concepts on roles and responsibilities.
• NIST Special Publications (SP 800 Series): Provides detailed guidelines on security and privacy controls relevant to CISA.

--- Ready to Pass Your CISA Exam?

Stop guessing and start improving. VoraPrep's adaptive learning platform uses over 2,300 practice questions to identify your weak spots and create a personalized study plan. With detailed explanations for every question and our 24/7 tutor, Vory, you'll learn to think like the examiner.

Visit voraprep.com to get started.

Start Your Free 14-Day Trial at voraprep.com →