Which of the following findings from an IT governance review should be of GREATEST concern?

 IT value analysis has not been completed is a finding from an IT governance review that should be of greatest concern. IT value analysis is a process of measuring and demonstrating the contribution of IT to the organization’s goals and objectives. An IS auditor should be concerned about the lack of IT value analysis, as it may indicate that the IT investments and resources are not aligned with the business needs and expectations, or that the IT performance and outcomes are not monitored and evaluated. The other options are less critical findings that may not have a significant impact on the IT governance. References:

CISA Review Manual (Digital Version), Chapter 5, Section 5.11

CISA Review Questions, Answers & Explanations Database, Question ID 218