I85PREP
⌘ K
ICAB CL Management Information study materials
ICAB CL Management Information study resources

ICAB CL Management Information: Information Technology Governance and Control

ICAB CL Management Information · Work through your exam, one topic at a time.

All guide sections

Information Technology Governance and Control

Governance is about direction and accountability

IT governance is the set of structures, processes and relationships that ensure IT sustains and extends the organisation's strategy. Candidates should distinguish governance (who decides, who is accountable, how performance is monitored) from management (executing the decisions). A useful frame is to ask five questions: who makes IT decisions, what decisions are made, how they are made, how they are monitored, and how accountability is evidenced.

Concepts to master

  • Board and committee structure: board risk or audit committee, IT steering committee, chief information officer, and the separation of the IT function from the business units it serves.
  • Frameworks: COBIT for governance objectives and maturity; ITIL for service management; ISO/IEC 27001 for information security management; ISO/IEC 38500 for governing IT. Know which framework answers which question.
  • Control types: preventive, detective and corrective; automated versus manual; key versus compensating controls.
  • Three lines model: operational management owns controls, a risk and compliance function provides oversight, internal audit provides independent assurance.
  • Policies, standards, procedures and guidelines: descending order of obligation.
  • Performance and conformance: benefits realisation, resource optimisation, risk optimisation, plus transparency and stakeholder reporting.

Traps in questions

  1. Selecting an audit-focused framework when the question asks about service delivery, or vice versa.
  2. Assuming internal audit may design and operate the controls it later audits; independence forbids it.
  3. Treating a policy as a procedure. A policy states intent and is mandatory; a procedure states steps.
  4. Believing a steering committee should approve every change; it sets priorities and investment, not operational tickets.

Worked rule of thumb

For any control described in a scenario, ask three questions in order: What risk does it address? Is it preventive or detective? Who is accountable for it? If the scenario cannot name the accountable role, the control is not governed, however well designed it looks.