Section: Protection of Information Assets
Explanation:
Financial results have traditionally been the sole overall performance metric. The IT balanced scorecard (BSC) is an IT business governance tool aimed at monitoring IT performance evaluation indicators other than financial results. The IT BSC considers other key success factors, such as customer satisfaction, innovation capacity and processing.

After a tabletop exercise has been performed, the next step would be a functional test, which includes the mobilization of staff to exercise the administrative and organizational functions of a recovery. Since the IT part of the recovery has been tested for years, it would be more efficient to verify and optimize the business continuity plan (BCP) before actually involving IT in a full-scale test. The full-scale test would be the last step of the verification process before entering into a regular annual testing schedule. A full-scale test in the situation described might fail because it would be the first time that the plan is actually exercised, and a number of resources (including IT) and time would be wasted. The walk-through test is the most basic type of testing. Its intention is to make key staff familiar with the plan and discuss critical plan elements, rather than verifying its adequacy. The recovery of applications should always be verified and approved by the business instead of being purely IT-driven. A disaster recovery test would not help in verifying the administrative and organizational parts of the BCP which are not IT-related.

Section: The process of Auditing Information System
Explanation:
The keyword INCORRECTLY is used in the question. You need to find out an option which incorrectly describes the traditional approach.
For your exam you should know the information below about control self-assessment and traditional approach:
The traditional approach can be summarized as any approach in which the primary responsibility for analyzing and reporting on internal control and risk is assigned to auditor and to lesser extent, controller department and outside consultants.
Control self-assessment is an assessment of controls made by the staff and management of the unit or units involved. It is a management technique that assures stakeholders, customers and other parties that the internal controls of the organization are reliable.
Benefits of CSA
Early detection of risk
More efficient and improved internal controls
Creation of cohesive teams through employee involvement
Developing a sense of ownership of the controls in the employees and process owners, and reducing their resistance to control improvement initiatives Increased employee awareness of organizational objectives, and knowledge of risk and internal controls Highly motivated employees Improved audit training process Reduction in control cost Assurance provided to stakeholders and customers Traditional and CSA attributes Traditional Historical CSA Assign duties/supervises staff Empowered/accountable employees Policy/rule driven Continuous improvement/learning curve Limited employee participation Extensive employee participation and training Narrow stakeholders focus Broad stakeholders focus Auditors and other specialist Staff at all level, in all functions, are the primary control analysts The following answers are incorrect:
The other options specified are correctly describes about traditional approach.
Reference:
CISA review manual 2014 page number 61, 62 and 63

Comprehensive and Detailed Step-by-Step Explanation:
Ifmeasurable benefitswerenot defined, the organizationcannot assess whether the system achieved its intended goals, making it the mostcriticalissue.
* Measurable Benefits Not Defined (Correct Answer - D)
* No clear KPIs or success metricsmeans no way toevaluate ROI.
* Example:A company implementsan ERP systembut has no performance indicators to measure success.
* No Lessons Learned (Incorrect - A)
* Important but doesnot impact system effectiveness.
* Missing Dashboard Deliverables (Incorrect - B)
* A reporting issue,not a strategic failure.
* Budget Overrun (Incorrect - C)
* A financial concern butnot as critical as system success measurement.
References:
* ISACA CISA Review Manual
* COBIT 2019 (Project Governance)