ICAB PL IT Governance flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

IT Governance Definition

The responsibilities and practices of the board and executives to give strategic direction, confirm objectives are met, verify risk is managed and resources are used responsibly.

Evaluate Direct Monitor

The three governance tasks in ISO/IEC 38500: evaluate current and future IT use, direct plans and policies, and monitor conformance and performance against those directions.

Governance Versus Management

Governance sets direction, evaluates options and monitors outcomes; management plans, builds, runs and monitors day-to-day activities within the direction governance sets.

Accountability Cannot Be Delegated

Even when IT work or decisions are delegated to committees or suppliers, the board remains answerable for the resulting outcomes and must retain oversight.

IT Steering Committee Role

A cross-functional executive group that prioritises IT investments, resolves conflicts between business units, and monitors delivery, risk and performance against agreed objectives.

Three Lines Model

An assurance structure: management owns and controls risk, a risk and compliance function oversees it, and internal audit provides independent assurance to the board.

Policy Standard Procedure Guideline

A hierarchy of direction: policy states mandatory intent, standards give measurable requirements, procedures describe execution steps, and guidelines offer recommended but optional practice.

Strategic Alignment Definition

The mutual fit between business strategy and IT strategy, where IT capabilities support business goals and IT options also shape which business goals are feasible.

Alignment Maturity Levels

Luftman's progression from ad hoc to optimised alignment, where higher levels show shared goals, formal governance, clear communication and measured IT contribution to business value.

Business Case Components

A decision document stating costs, expected benefits, risks, assumptions, options considered and the accountable owner who must realise the stated benefits.

Run Grow Transform

Three IT investment categories: run sustains current operations, grow extends existing capability, and transform creates new business models or markets.

Enterprise Architecture Layers

Four aligned views of an organisation: business processes and capabilities, data, applications, and technology infrastructure, each with current and target states.

Service Level Agreement

A contract between a service provider and customer that states measurable service targets such as availability, response time and resolution time, plus remedies for misses.

Demand Management

The practice of collecting, consolidating and prioritising requests for IT work so that limited capacity is directed to the highest business value and risk reduction.

Portfolio Balancing

Distributing investment across risk levels, time horizons and change types so the portfolio is not concentrated in a single category or dependent on one initiative.

IT Strategy Traceability

The ability to link every funded initiative upward to a strategic objective and downward to delivered outcomes, enabling pruning of work with no traceable contribution.

Inherent Versus Residual Risk

Inherent risk is exposure before controls are applied; residual risk is exposure remaining after controls, and it is compared with the stated risk appetite.

Risk Treatment Options

Four responses to assessed risk: mitigate by adding controls, transfer through insurance or contracts, avoid by stopping the activity, or accept with documented owner approval.

Control Categories

Controls are classified by timing as preventive, detective or corrective, and by nature as administrative, technical or physical; layering types reduces single points of failure.

Risk Appetite And Tolerance

Risk appetite is the amount of risk an organisation is willing to accept in pursuit of goals; tolerance is the acceptable variation around that level for a specific objective.

ISO IEC 27001 Purpose

An international standard specifying requirements for establishing, operating, monitoring and continually improving an information security management system within an organisation.

Segregation Of Duties Conflict

A situation where one person can both initiate and approve, or both develop and deploy, allowing error or fraud to occur without independent detection.

Third Party Risk Due Diligence

Pre-contract assessment of a supplier's security, financial stability and compliance, followed by contractual audit rights, ongoing monitoring and a documented exit plan.

Incident Response Phases

A sequence of prepare, detect and analyse, contain, eradicate, recover, and post-incident review, where lessons learned feed back into risk assessment and control design.

Compliance Obligation Register

A record of each legal, regulatory, contractual and policy obligation, listing its owner, the control providing evidence of compliance, and the review frequency.

IT Resource Categories

The assets governance must steward: people and skills, applications, information, infrastructure and facilities, each requiring an owner, capacity plan and lifecycle rules.

Showback Versus Chargeback

Showback reports IT costs to business units for awareness without transferring budget; chargeback actually bills those costs using an agreed usage-based driver.

Key Goal Versus Performance Indicator

Key goal indicators measure whether outcomes were achieved; key performance indicators measure the process drivers that enable those outcomes, and both are needed.

Balanced Scorecard For IT

A measurement framework using financial, customer, internal process, and learning and growth perspectives so performance is not judged on cost or availability alone.

Benefits Realisation

Confirmation that the benefits stated in a business case actually occurred after delivery, measured against a baseline by an accountable business owner.

Capacity Management

Modelling current utilisation, forecasting demand growth, setting thresholds, and planning acquisition or optimisation before thresholds are breached and service degrades.

Competency Inventory

A record of the skills and proficiency levels held by IT staff, compared with the capabilities the target architecture requires, to expose gaps for training or recruitment.