Governance and Management of IT · Topic 2 of 5
IT Policies, Procedures and Enterprise Architecture
IT policies, standards, procedures and guidelines, top-down and bottom-up policy, and enterprise architecture frameworks such as Zachman and TOGAF.
- 3 min
- Policy is intent; standards and procedures are mandatory detail; guidelines are optional.
- Senior management approves policies; review them regularly.
- Top-down is consistent; bottom-up is practical.
What it is
Policies, standards, procedures and guidelines turn governance decisions into rules people can follow. Enterprise architecture (EA) describes how the organization's business processes, data, applications and technology fit together today and how they should look in the future, so investments move the organization in one coherent direction.
How it works
The document hierarchy
| Document | Nature | Example |
|---|---|---|
| Policy | High-level statement of management intent; mandatory; approved by senior management | "All access to customer data must be authorized and logged" |
| Standard | Mandatory specific requirement supporting a policy | Minimum password length, approved encryption algorithms |
| Procedure | Detailed, mandatory steps to carry out a task | How to create a user account |
| Guideline | Recommended practice, not mandatory | Tips for choosing passphrases |
| Baseline | Minimum configuration for a system type | Hardened server build |
Policies change rarely; procedures change as technology changes.
Developing policies
| Approach | How | Strength | Risk |
|---|---|---|---|
| Top-down | Starts from corporate policy, cascades to lower levels | Consistent with business objectives | May not fit operational realities |
| Bottom-up | Starts from operational needs and risk assessments | Practical and relevant | May be inconsistent with the corporate view |
What the auditor checks
- Policies are approved by senior management, communicated and acknowledged by staff.
- They are reviewed periodically and after major changes.
- Procedures match what actually happens; observation and testing confirm it.
- Exceptions are documented, approved and time-limited.
A policy that exists but is not followed gives no control. A procedure that contradicts the policy is a finding.
Enterprise architecture
EA documents the current state (as is) and the target state (to be), and a road map between them. It covers four common layers: business, data, applications and technology.
| Framework | Idea |
|---|---|
| Zachman Framework | A matrix of perspectives (planner, owner, designer, builder and others) against questions (what, how, where, who, when, why) |
| TOGAF | The Open Group Architecture Framework, with its Architecture Development Method (ADM) for building and governing architecture |
Why EA matters to the auditor
- Without EA, systems duplicate each other, interfaces multiply and data is inconsistent.
- New projects should be checked against the target architecture before approval.
- Architecture decisions affect security, resilience and cost for years.
When a question describes several departments buying overlapping systems that cannot share data, the governance answer is usually an enterprise architecture with project review against it.
How the exam asks about this
- "Which document is mandatory and gives specific technical requirements?" A standard.
- "Procedures do not match practice." Find out why; the gap is a finding even if the policy itself is sound.
- "What is the main benefit of enterprise architecture?" Aligning IT investment with business strategy and avoiding duplication.
What to remember for the exam
- Policy is intent; standards and procedures are mandatory detail; guidelines are optional.
- Senior management approves policies; review them regularly.
- Top-down is consistent; bottom-up is practical.
- EA maps current and target states across business, data, applications and technology.
- Zachman is a matrix; TOGAF has the ADM.
Granting a policy exception without an end date or risk acceptance by the right owner turns the exception into an unmanaged permanent gap.
Common mistakes
Calling a guideline mandatory. Policies, standards, baselines and procedures are mandatory; guidelines are not.
Auditing the document instead of the practice. Test that the policy is followed.
Treating EA as a technical diagram only. It starts from the business layer.
Check yourself
What is the difference between a standard and a guideline?
A standard is mandatory and specific; a guideline is recommended practice.
What is the risk of a purely bottom-up policy approach?
Policies may be inconsistent with each other and with corporate objectives.
What two states does enterprise architecture document?
The current (as is) state and the target (to be) state, with a road map between them.
Topic 2 of 5 in Governance and Management of IT
Test yourself on Governance and Management of IT
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.