Chapter 2 of 5 · ISACA CISA
Governance and Management of IT
Laws and standards, IT governance and strategy, policies, enterprise architecture, risk, privacy, data, vendors and performance.
- 5topics
- 16 minfast track
- 3diagrams and exhibits
- 18%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Laws, Standards, IT Governance and StrategyLaws, regulations and standards for IT, governance versus management, COBIT, IT strategy, steering committees and segregation of…Diagram3 min
- 2IT Policies, Procedures and Enterprise ArchitectureIT policies, standards, procedures and guidelines, top-down and bottom-up policy, and enterprise architecture frameworks such as…3 min
- 3Enterprise Risk, Privacy and Data GovernanceEnterprise risk management, risk appetite and treatment, privacy principles and impact assessments, and data ownership and…Diagram3 min
- 4IT Resource and Vendor ManagementManaging IT people, budgets and licenses, hiring and termination controls, outsourcing, vendor contracts, SOC reports and source…Diagram4 min
- 5IT Performance Monitoring and Quality ManagementMeasuring IT performance with KPIs, KRIs and the balanced scorecard, reporting to management, and quality assurance and quality…3 min
About this chapter
What this chapter covers
Governance and Management of IT is worth 18 percent of the CISA exam. It asks whether IT is directed by the business and managed well: whether IT strategy supports business goals, whether the right structures and policies exist, and whether resources, vendors, risk and performance are under control.
IT governance (2A) covers laws, regulations and industry standards, organizational structure, IT governance and IT strategy, IT policies, standards, procedures and practices, enterprise architecture, enterprise risk management, the privacy program and data governance and classification. IT management (2B) covers IT resource management, IT vendor management, IT performance monitoring and reporting and quality assurance and quality management of IT.
How the topics fit together
Governance sets direction and checks results; management plans, builds, runs and monitors within that direction. The auditor looks for alignment at every step: does what IT does trace back to what the business needs?
In governance questions, the right answer usually involves the board or senior management setting direction, and IT activity being justified by business objectives. An option that starts from technology rather than business need is usually a distractor.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.