Aligning IT strategy with business strategy primarily helps an organization to optimize investments in IT. This is because alignment ensures that IT resources and capabilities are aligned with the business goals and priorities, and that IT delivers value to the business in terms of efficiency, effectiveness, innovation, and competitive advantage12. By aligning IT strategy with business strategy, an organization can avoid wasting money and time on IT projects or services that do not support or contribute to the business outcomes3. Alignment also helps to identify and prioritize the most critical and valuable IT initiatives that can create or optimize business value4.
Therefore, the correct answer to your question is A. optimize investments in IT.

A strongQA functionrequires anindependentreview of changes toavoid biasandensure objectivity.
Option A (Correct):Ifdevelopers review their own changes, there is ahigh risk of biasand overlooking issues, making this the greatest concern. This violatesseparation of dutiesandbest practices for quality assurance.
Option B (Incorrect):Peer reviews within the same teamreduce risksincefresh eyesreview the changes, though it is not as strong as an external review.
Option C (Incorrect):Havingdevelopers from a separate teamreview the code providesbetter objectivityand reduces risks associated withself-review.
Option D (Incorrect):Whilenon-developers may lack technical expertise, their review ensuresindependence, making it a stronger control than self-review.
Reference:ISACA CISA Review Manual -Domain 3: Information Systems Acquisition, Development, and Implementation- Coversquality assurance, code reviews, and segregation of duties.

A balanced scorecard is a framework that translates the IT strategy into measurable objectives, indicators, targets, and initiatives across four perspectives: financial, customer, internal process, and learning and growth.
A balanced scorecard helps to monitor and evaluate how well the IT function is delivering value to the organization, achieving its strategic goals, and improving its capabilities and competencies. The other options are not the primary uses of a balanced scorecard, because they either focus on specific aspects of IT rather than the overall performance, or they are not directly related to the IT strategy.

The best answer is C. Qualitative risk analyses have not been updated.
ISACA guidance describes the risk register as a living document that should be regularly reviewed and amended so management has an up-to-date picture of risk when making decisions. If qualitative risk analyses are not updated, the project may be working from outdated assumptions about probability, impact, and priority, which undermines the entire risk management process.
Option A is a concern, but issue tracking is not as central to project risk management as keeping risk analysis current. Option B is not inherently a weakness because effective risk management does not depend on a specific software tool. Option D is a governance concern, but stale risk analysis more directly damages the organization's ability to identify, assess, prioritize, and respond to project risk.
References (Official ISACA):
* ISACA Journal, Mitigating Technical Vulnerabilities With Risk Assessment - the risk register is a living document that should be regularly reviewed and amended.
* ISACA, Making Risk Management for Agile Projects Effective - risk registers are updated throughout the project lifecycle.

The correct answer is C. Business case.
The business case is the most important document for determining whether an IT investment aligns with organizational objectives. It explains why the investment is being made, what business need it addresses, what benefits are expected, what costs and risks are involved, and how the investment supports strategic or operational goals.
ISACA defines a business case as documentation of the rationale for making a business investment, used both to support the decision to proceed and to support management of the investment through its full economic life cycle. ISACA's CISA Exam Content Outline also specifically includes Business Case and Feasibility Analysis under Domain 3 and includes the task of evaluating whether business cases related to information systems meet business objectives.
Option A is not the best answer because a project risk register identifies and tracks risks, but it does not primarily justify business alignment. Option B is not the best answer because the steering committee charter defines oversight authority and responsibilities, but it does not prove that a specific investment supports organizational objectives. Option D is too narrow because ROI focuses on financial return, while alignment with organizational objectives may include regulatory, operational, strategic, risk reduction, customer service, and resilience objectives.
This maps mainly to Information Systems Acquisition, Development and Implementation because project governance, business case review, feasibility analysis, and investment justification are part of acquisition and development governance.
References: ISACA CISA Exam Content Outline, Domain 3; ISACA Interactive Glossary, "Business case."