The correct answer is B. Metrics were defined without key stakeholder input.

The greatest concern is that the metrics may not reflect what the organization’s key stakeholders actually need to know. IT process performance reporting should support governance, decision-making, accountability, and alignment with business objectives. If metrics are created without stakeholder input, the reports may measure technical activity but fail to measure business value, service quality, risk, control effectiveness, or strategic alignment.

Option A is a concern because KPIs should be monitored consistently. However, even consistently monitored KPIs may be ineffective if they were not defined with stakeholder requirements in mind. Option C is a reporting-quality issue, but technical language can be improved. Option D is less important because industry benchmarking can be useful, but internal stakeholder needs and organizational objectives are more important than external comparison.

ISACA’s CISA Exam Candidate Guide includes monitoring and analyzing KPIs, KRIs, and KCIs, and reporting relevant risk and control information to stakeholders to facilitate risk-based decision-making. ( ISACA ) ISACA’s CISA Exam Content Outline also places IT performance monitoring and reporting under Governance and Management of IT. ( ISACA )