ACG CxA EXAM READY - VERIFIED QUESTIONS AND ANSWERS
- COMPREHENSIVE LATEST VERSION 2026/2027
What does ACG stand for in IT audit? Assurance, Compliance, and
Governance.
What is the primary objective of Governance? To align business
objectives with IT strategy and ensure stakeholder value.
What is the difference between Governance and Management?
Governance evaluates stakeholder needs and directs strategy;
Management executes the strategy under governance oversight.
What is the definition of IT Assurance? Confidence provided to
stakeholders that IT operations meet defined objectives and comply
with regulations.
What is the goal of IT Compliance? Ensuring IT systems and
processes adhere to laws, regulations, and internal policies.
What is a Control? A mechanism (policy, procedure, technology) that
mitigates risk and ensures objectives are achieved.
What is Risk in the context of ACG? The potential for an event to
negatively impact the achievement of business objectives.
What is Risk Appetite? The amount and type of risk an organization is
willing to accept in pursuit of its objectives.
What is Risk Tolerance? The acceptable variation in outcomes
relative to the achievement of objectives (often tighter than
appetite).
,What is the Three Lines Model in modern governance? First line
(Management), Second line (Risk/Compliance functions), Third line
(Independent Internal Audit).
What is the role of the First Line of Defense? Owning and managing
risks directly through operational controls.
What is the role of the Second Line of Defense? Overseeing risk and
providing frameworks, policies, and tools for the first line.
What is the role of the Third Line of Defense? Providing independent,
objective assurance to the board and senior management.
What is the role of the Audit Committee in ACG? Overseeing financial
reporting, internal/external audit functions, and risk management.
What is an Enterprise Risk Management (ERM) framework? A holistic
approach to identifying, assessing, and managing risks across the
entire organization.
What is a Control Environment? The set of standards, processes, and
structures that provide the basis for carrying out internal control
across the organization.
What is a Key Risk Indicator (KRI)? A metric used to provide an early
signal of increasing risk exposure in a particular area.
What is a Key Performance Indicator (KPI)? A metric used to evaluate
the success of an organization or a particular activity in meeting
objectives.
How do KRIs and KPIs differ? KPIs measure performance toward a
goal; KRIs measure the risk level that could impede that goal.
What is Residual Risk? The risk that remains after risk responses and
controls have been applied.
What is Inherent Risk? The natural level of risk present in an activity
or process before any controls are applied.
, What is a Risk Register? A centralized repository of all identified risks,
their severity, and their mitigation plans.
What is Control Self-Assessment (CSA)? A process where first-line
management assesses the effectiveness of their own controls.
What is the purpose of an IT Policy? To establish mandatory rules
and high-level directives for IT behavior and decision-making.
What is the purpose of an IT Standard? To provide mandatory
technical or operational requirements to enforce policies.
What is the purpose of an IT Procedure? Step-by-step instructions for
executing a standard or policy.
What is Segregation of Duties (SoD)? A control designed to prevent
fraud and errors by dividing critical tasks among multiple individuals.
What happens if SoD cannot be achieved due to limited staff?
Compensating controls must be implemented (e.g., enhanced
oversight, reconciliation).
What is IT Governance alignment? Ensuring IT investments directly
support and drive the business strategy.
What is a Governance Charter? A document that formally defines the
mission, structure, and authority of an IT governance body.
What is the difference between an IT Strategy and an IT Plan?
Strategy is the long-term vision; the plan is the short-to-medium-
term roadmap to achieve it.
What is IT Portfolio Management? The process of managing IT
investments (projects and ongoing services) as a portfolio to
maximize value.
What is Value Delivery in IT governance? Ensuring IT delivers
promised benefits on time and within budget.
- COMPREHENSIVE LATEST VERSION 2026/2027
What does ACG stand for in IT audit? Assurance, Compliance, and
Governance.
What is the primary objective of Governance? To align business
objectives with IT strategy and ensure stakeholder value.
What is the difference between Governance and Management?
Governance evaluates stakeholder needs and directs strategy;
Management executes the strategy under governance oversight.
What is the definition of IT Assurance? Confidence provided to
stakeholders that IT operations meet defined objectives and comply
with regulations.
What is the goal of IT Compliance? Ensuring IT systems and
processes adhere to laws, regulations, and internal policies.
What is a Control? A mechanism (policy, procedure, technology) that
mitigates risk and ensures objectives are achieved.
What is Risk in the context of ACG? The potential for an event to
negatively impact the achievement of business objectives.
What is Risk Appetite? The amount and type of risk an organization is
willing to accept in pursuit of its objectives.
What is Risk Tolerance? The acceptable variation in outcomes
relative to the achievement of objectives (often tighter than
appetite).
,What is the Three Lines Model in modern governance? First line
(Management), Second line (Risk/Compliance functions), Third line
(Independent Internal Audit).
What is the role of the First Line of Defense? Owning and managing
risks directly through operational controls.
What is the role of the Second Line of Defense? Overseeing risk and
providing frameworks, policies, and tools for the first line.
What is the role of the Third Line of Defense? Providing independent,
objective assurance to the board and senior management.
What is the role of the Audit Committee in ACG? Overseeing financial
reporting, internal/external audit functions, and risk management.
What is an Enterprise Risk Management (ERM) framework? A holistic
approach to identifying, assessing, and managing risks across the
entire organization.
What is a Control Environment? The set of standards, processes, and
structures that provide the basis for carrying out internal control
across the organization.
What is a Key Risk Indicator (KRI)? A metric used to provide an early
signal of increasing risk exposure in a particular area.
What is a Key Performance Indicator (KPI)? A metric used to evaluate
the success of an organization or a particular activity in meeting
objectives.
How do KRIs and KPIs differ? KPIs measure performance toward a
goal; KRIs measure the risk level that could impede that goal.
What is Residual Risk? The risk that remains after risk responses and
controls have been applied.
What is Inherent Risk? The natural level of risk present in an activity
or process before any controls are applied.
, What is a Risk Register? A centralized repository of all identified risks,
their severity, and their mitigation plans.
What is Control Self-Assessment (CSA)? A process where first-line
management assesses the effectiveness of their own controls.
What is the purpose of an IT Policy? To establish mandatory rules
and high-level directives for IT behavior and decision-making.
What is the purpose of an IT Standard? To provide mandatory
technical or operational requirements to enforce policies.
What is the purpose of an IT Procedure? Step-by-step instructions for
executing a standard or policy.
What is Segregation of Duties (SoD)? A control designed to prevent
fraud and errors by dividing critical tasks among multiple individuals.
What happens if SoD cannot be achieved due to limited staff?
Compensating controls must be implemented (e.g., enhanced
oversight, reconciliation).
What is IT Governance alignment? Ensuring IT investments directly
support and drive the business strategy.
What is a Governance Charter? A document that formally defines the
mission, structure, and authority of an IT governance body.
What is the difference between an IT Strategy and an IT Plan?
Strategy is the long-term vision; the plan is the short-to-medium-
term roadmap to achieve it.
What is IT Portfolio Management? The process of managing IT
investments (projects and ongoing services) as a portfolio to
maximize value.
What is Value Delivery in IT governance? Ensuring IT delivers
promised benefits on time and within budget.
