Governance and Management of IT · Topic 1 of 5
Laws, Standards, IT Governance and Strategy
Laws, regulations and standards for IT, governance versus management, COBIT, IT strategy, steering committees and segregation of duties in IT roles.
- 3 min
- Includes a diagram
- The board owns governance; management executes.
- COBIT: governance evaluates, directs and monitors.
- Strategy committee advises the board; steering committee prioritizes projects.
What it is
IT governance is how the board and executive management make sure IT supports the business, manages risk and uses resources responsibly. It sits inside enterprise governance and must also respect the laws, regulations and industry standards that apply to the organization. IT strategy turns business goals into a plan for IT.
How it works
Laws, regulations and standards
Organizations must identify which legal and regulatory requirements apply, such as data protection, financial reporting, sector rules and card payment rules, and build them into policies and controls. Industry standards and frameworks give good practice:
| Framework | Main use |
|---|---|
| COBIT | Governance and management of enterprise IT |
| ISO/IEC 27001 | Information security management system |
| ITIL | IT service management |
| ISO 9001 | Quality management |
The auditor checks that the organization has a process to identify applicable requirements and keep track of changes to them.
Governance versus management
COBIT separates the two:
| Governance | Management | |
|---|---|---|
| Who | Board and executives | Senior and IT management |
| Does what | Evaluate, direct and monitor | Plan, build, run and monitor |
| Output | Direction, priorities, risk appetite | Delivery of IT services and projects |
Committees and roles
| Body | Role |
|---|---|
| IT strategy committee | Board level; advises the board on IT strategy and alignment |
| IT steering committee | Executive level; prioritizes and oversees IT projects and investments, includes business representatives |
| Chief information officer (CIO) | Leads IT and links it to the business |
| Chief information security officer (CISO) | Leads information security |
An IT steering committee without business representation cannot ensure alignment.
IT strategy
A good IT strategy is approved by senior management, traces each initiative to a business objective, considers current capability and gaps, and is reviewed regularly. The auditor looks at whether project selection follows the strategy and whether benefits are measured.
Segregation of duties in IT
Incompatible duties must be split so that one person cannot both commit and conceal an error or fraud:
| Should be separated | Why |
|---|---|
| Development and production operations | A developer could deploy unauthorized code |
| Security administration and system use | An administrator could grant and use own access |
| Data entry and approval | One person could create and approve a payment |
| Database administration and application programming | Direct data changes could bypass application controls |
When separation is impossible, use compensating controls such as logging with independent review.
How the exam asks about this
- "Who is ultimately responsible for IT governance?" The board of directors.
- "What BEST ensures IT supports business objectives?" An IT strategy committee or steering committee with business involvement, and initiatives traced to business goals.
- "A programmer has access to production." Segregation of duties problem; remove access or add compensating controls.
What to remember for the exam
- The board owns governance; management executes.
- COBIT: governance evaluates, directs and monitors.
- Strategy committee advises the board; steering committee prioritizes projects.
- Every IT initiative should trace to a business objective.
- Segregate development, operations, security administration and data entry.
An IT strategy written only by the IT department, without business approval, is a red flag for alignment.
Common mistakes
Confusing the strategy committee with the steering committee. Board level versus executive and project level.
Treating governance as an IT department task. It is the board's responsibility.
Ignoring regulatory change. A compliance process must keep requirements current.
Check yourself
What are the three governance activities in COBIT?
Evaluate, direct and monitor.
Which body prioritizes IT projects and includes business representatives?
The IT steering committee.
Why should developers not have access to production?
They could introduce unauthorized or untested changes, so development and operations must be segregated.
Topic 1 of 5 in Governance and Management of IT
Test yourself on Governance and Management of IT
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.