Internal audit is evaluating an organization’s IT portfolio management.

The best answer is A.

ISACA portfolio-management guidance emphasizes that portfolios exist at the organizational level and should be managed in line with strategic objectives. Portfolio managers are expected to determine the optimal mix of initiatives and resources to achieve organizational goals while honoring strategic constraints. That makes grouping related projects into portfolios and assessing them against strategic objectives the strongest recommendation.

Option B is too narrow because infrastructure availability is only one possible value driver. Option C is also too narrow because risk reduction alone should not dominate the whole portfolio. Option D includes business value factors, but it is still narrower than full alignment to enterprise strategy. ISACA’s framing of portfolio management is broader: balance the portfolio and align it to strategic objectives.

References (Official ISACA):

ISACA, Portfolio, Program and Project Management Using COBIT 5.

ISACA Journal, Essential Frameworks and Methodologies to Maximize the Value of IT.

ISACA Journal, The Power of IT Investment Risk Quantification and Visualization: IT Portfolio Management.