Which of the following should an IS auditor review to gain an understanding of the effectiveness of
controls over the management of multiple projects?

A.
Project database

B.
Policy documents

C.
Project portfolio database

D.
Program organization

Explanation:

A project portfolio database is the basis for project portfolio management. It includes project data,
such as owner, schedules, objectives, project type, status and cost. Project portfolio management
requires specific project portfolio reports. A project database may contain the above for one
specific project and updates to various parameters pertaining to the current status of that single
project. Policy documents on project management set direction for the design, development,
implementation and monitoring of the project. Program organization is the team required (steering
committee, quality assurance, systems personnel, analyst, programmer, hardware support, etc.) to
meet the delivery objective of the project.