I85PREP
⌘ K
ICAB PL IT Governance study materials
ICAB PL IT Governance study resources

ICAB PL IT Governance practice questions

One question at a time. Build your ICAB PL IT Governance understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1IT Governance Fundamentals

Which statement best describes the primary purpose of IT governance within an organisation?

  1. Replacing executive management with an IT steering committee
  2. Directing and controlling IT so that it supports and extends business objectives Correct answer.
  3. Guaranteeing that all IT risks are eliminated before systems go live
  4. Ensuring every IT project is delivered by the internal audit function

Explanation

IT governance is the responsibility of the board and executives; it sets direction, decision rights and accountability so that IT creates value and manages risk in line with business goals. It is a framework of leadership and control, not an operational delivery or assurance function.

Question 2IT Governance Fundamentals

In governance terms, who ultimately remains accountable for IT-related decisions even when IT activities are outsourced?

  1. The external auditor engaged by the vendor
  2. The IT service desk supervisor
  3. The board and executive management of the organisation Correct answer.
  4. The outsourcing vendor's account manager

Explanation

Accountability for IT cannot be outsourced. The board and executive management retain responsibility for setting direction and overseeing risk, while the vendor is only responsible for performing contracted activities.

Question 3IT Governance Fundamentals

Which pair of concepts is most central to the distinction between governance and management?

  1. Governance runs operations; management sets policy
  2. Governance builds systems; management evaluates outcomes
  3. Governance audits controls; management reports to auditors
  4. Governance evaluates and directs; management plans, builds and runs Correct answer.

Explanation

Governance activities are evaluate, direct and monitor, performed by the board and senior executives. Management executes the plan-build-run-monitor cycle within the direction set by governance.

Question 4IT Governance Fundamentals

Which element is a recognised component of an enterprise governance of IT framework?

  1. Structures, processes and relational mechanisms Correct answer.
  2. The organisation's marketing plan
  3. A single outsourced helpdesk contract
  4. A list of approved hardware vendors

Explanation

Enterprise governance of IT is typically described as comprising structures (decision-making bodies), processes (formalised practices) and relational mechanisms (communication and shared understanding). These three work together to embed governance into behaviour.

Question 5IT Governance Fundamentals

What is the main role of an IT steering committee?

  1. Writing application source code for critical systems
  2. Performing independent audits of IT controls
  3. Managing day-to-day incident tickets
  4. Prioritising IT investments and resolving cross-functional IT issues Correct answer.

Explanation

A steering committee is a governance structure that aligns IT initiatives with business strategy, prioritises investment and arbitrates competing demands. It provides direction rather than performing operational or assurance work.

Question 6IT Governance Fundamentals

Which statement correctly reflects the principle of segregation of duties in IT governance?

  1. The same person should approve, execute and record a transaction to save time
  2. Conflicting tasks should be split so that no single person controls a whole process Correct answer.
  3. Segregation applies only to financial systems, not to IT operations
  4. Duties should be segregated only when an auditor requests it

Explanation

Segregation of duties divides incompatible responsibilities, such as authorisation, custody and recording, so that one individual cannot both perpetrate and conceal an error or fraud. In IT this commonly separates development, testing and production access.

Question 7IT Governance Fundamentals

What does the term 'decision rights' refer to in an IT governance context?

  1. The copyright ownership of internally developed code
  2. The rights of employees to use personal devices
  3. The authority to make specific IT decisions and who holds it Correct answer.
  4. The legal right to resell software licences

Explanation

Decision rights define which roles or bodies are authorised to make particular IT decisions, such as architecture standards or funding approval. Clarifying them prevents both decision paralysis and unaccountable unilateral action.

Question 8IT Governance Fundamentals

Which of the following is an example of a relational mechanism in enterprise governance of IT?

  1. A formal IT investment approval committee
  2. A configuration baseline recorded in the CMDB
  3. A documented change management procedure
  4. Regular dialogue between business and IT managers to build shared understanding Correct answer.

Explanation

Relational mechanisms are the informal and communication-based practices, such as dialogue, training and shared incentives, that connect business and IT people. Structures and processes are the formal bodies and documented procedures.

Question 9IT Governance Fundamentals

An organisation's board wants IT risk appetite to guide project approvals. Which action best applies IT governance principles?

  1. Delegate risk appetite setting to the external software vendor
  2. Approve the risk appetite at board level and require projects to be assessed against it Correct answer.
  3. Let each project manager set their own risk tolerance independently
  4. Set risk appetite only after all projects have been delivered

Explanation

Risk appetite is a governance statement of how much risk the organisation is willing to accept in pursuit of value. It should be approved at the top and then applied consistently in decision-making such as project approval.

Question 10IT Governance Fundamentals

A company discovers that the IT manager approves changes, performs them in production and also reconciles the change log. Which governance weakness does this most directly illustrate?

  1. Excessive reliance on relational mechanisms
  2. Absence of a technology radar
  3. Insufficient segregation of duties Correct answer.
  4. Poor user acceptance testing coverage

Explanation

Approval, execution and reconciliation are incompatible duties; combining them lets one person introduce and conceal unauthorised changes. Segregation of duties requires these to be assigned to different roles, with independent review of production changes.

Question 11IT Governance Fundamentals

A multinational has separate IT functions in each region, each choosing its own ERP platform, causing duplicated cost and integration failures. Which governance response addresses the root cause?

  1. Allow regions to continue independently and reconcile data annually
  2. Define enterprise architecture decision rights and standards centrally Correct answer.
  3. Outsource each region's IT to a different vendor
  4. Increase the number of regional IT committees

Explanation

The root cause is unclear decision rights and absent enterprise standards, so platforms proliferate. Centralising architecture decisions and standards, with defined input from regions, restores coherence while preserving appropriate local autonomy.

Question 12IT Governance Fundamentals

Which statement best explains why IT governance should be integrated with overall corporate governance?

  1. It ensures IT risk and value are considered alongside other enterprise risks and objectives Correct answer.
  2. It transfers accountability for IT to the finance department
  3. It allows IT to avoid reporting to the audit committee
  4. It removes the need for IT performance measurement

Explanation

IT is embedded in almost every business process, so IT risk and value are enterprise matters. Integrating them into corporate governance ensures consistent oversight, reporting and prioritisation alongside other business risks.

Question 13IT Governance Fundamentals

What is the principal function of an IT governance charter?

  1. To document the technical specification of the network
  2. To define the mandate, scope, membership and reporting lines of a governance body Correct answer.
  3. To list all software licences held by the organisation
  4. To record individual employee training attendance

Explanation

A charter establishes a governance body's authority, remit, composition and reporting relationships so that its decisions carry legitimacy. It is an enabling document for direction and oversight, not a technical or asset record.

Question 14IT Governance Fundamentals

An organisation wants business units to have input into IT priorities while retaining enterprise-wide standards. Which governance archetype best fits this aim?

  1. Fully decentralised, with each unit deciding independently
  2. Centralised, with all decisions made by the CIO alone
  3. Federated, with shared decision rights between centre and business units Correct answer.
  4. Anarchic, with no formal decision rights at all

Explanation

A federated model allocates decision rights between corporate IT and business units, balancing local responsiveness with enterprise consistency. It is suited to organisations needing both standardisation and business input.

Question 15IT Governance Fundamentals

Which measure is the most meaningful indicator that IT governance is delivering value?

  1. The number of meetings held by the IT steering committee
  2. The count of servers installed in the data centre
  3. The average length of IT policy documents
  4. The percentage of IT investment traceable to approved business objectives Correct answer.

Explanation

Governance effectiveness is judged by whether IT investment and activity demonstrably support business objectives. Traceability of spend to approved goals shows alignment, whereas activity counts measure effort rather than outcome.

Question 16IT Governance Fundamentals

A new regulation requires customer data to be stored domestically. Which governance action should occur first?

  1. Purchase additional storage hardware immediately
  2. Wait for the regulator to issue a penalty before acting
  3. Assess the compliance obligation and assign accountability for meeting it Correct answer.
  4. Delegate the obligation entirely to the cloud provider

Explanation

Governance begins with understanding the obligation, assessing its impact and assigning clear accountability for compliance. Execution decisions, such as architecture changes, follow once responsibility and requirements are established.

Question 17IT Governance Fundamentals

Which practice best demonstrates that a governance body is monitoring IT performance rather than merely directing it?

  1. Appointing a new CIO
  2. Approving the annual IT budget once a year
  3. Reviewing a balanced scorecard of IT delivery, risk and value metrics each quarter Correct answer.
  4. Issuing a policy that IT must be secure

Explanation

Monitoring involves the ongoing review of performance information against agreed objectives, closing the loop on direction. A recurring balanced scorecard covering delivery, risk and value shows that oversight is evidence-based.

Question 18IT Governance Fundamentals

What distinguishes a governance control from a management control?

  1. Governance controls apply only to finance, while management controls apply only to IT
  2. Governance controls are always automated, while management controls are manual
  3. Governance controls are set at the top to direct and constrain the organisation; management controls execute within that direction Correct answer.
  4. Governance controls are optional, while management controls are mandatory

Explanation

Governance controls establish direction, boundaries and accountability at the top of the organisation. Management controls are the operational mechanisms that implement and enforce that direction in day-to-day activity.

Question 19IT Governance Fundamentals

An organisation's policies forbid shadow IT, yet business units keep buying SaaS tools directly. Which governance diagnosis is most plausible?

  1. The organisation has excessive relational mechanisms
  2. The IT steering committee meets too infrequently
  3. The organisation has too few software licences
  4. Decision rights and procurement channels do not meet business needs, so users bypass them Correct answer.

Explanation

Shadow IT usually signals that formal channels are too slow, unclear or unresponsive to business needs. Governance should review decision rights and provide a fast, visible path to acquire tools within policy rather than only tightening prohibitions.

Question 20IT Governance Fundamentals

A board delegates IT oversight to an audit committee but never defines what information it should receive. Which governance principle is most directly breached?

  1. The principle that IT budgets must be zero-based
  2. The principle that all IT staff must be certified
  3. The principle that software must be open source
  4. The principle that reporting requirements and accountability should be explicitly defined Correct answer.

Explanation

Delegation is only effective when the scope, reporting content, frequency and escalation paths are specified. Without defined information requirements, the committee cannot discharge its oversight role or demonstrate accountability.

Question 21IT Governance Fundamentals

Two business units claim authority to approve a new customer data platform, and the project stalls. Which governance mechanism most directly resolves this?

  1. Escalating to the vendor to choose the platform
  2. Increasing the project budget to absorb delay
  3. A defined decision rights matrix with an escalation path to the executive sponsor Correct answer.
  4. Commissioning a second parallel project

Explanation

Conflicts over authority are resolved by clear decision rights and an agreed escalation route to a sponsor empowered to decide. This produces a timely, accountable resolution rather than prolonged ambiguity.

Question 22IT Governance Fundamentals

An organisation adopts a framework but its governance maturity does not improve. Which explanation is most consistent with governance theory?

  1. Frameworks only work for large organisations
  2. Frameworks must be replaced annually
  3. The framework was implemented as documentation without changing decision rights or behaviour Correct answer.
  4. Maturity always declines after adopting a framework

Explanation

Governance frameworks add value only when they change how decisions are made and how people behave, not merely how documents are written. Implementing structures and processes without embedding relational mechanisms leaves practice unchanged.

Question 23IT Governance Fundamentals

A regulator asks who authorised an exception to the data retention policy. Which governance artefact should provide that evidence?

  1. A decision log recording the approver, rationale and date Correct answer.
  2. The network topology diagram
  3. The vendor's marketing brochure
  4. The employee handbook

Explanation

Accountability requires an auditable record of who approved an exception, when and why. A decision log provides that evidence and supports later review of whether the exception remains justified.

Question 24IT Governance Fundamentals

Which situation best shows that IT governance is aligned with the organisation's strategy?

  1. IT investment proposals must state which strategic objective they support Correct answer.
  2. IT priorities are set by the loudest business unit
  3. IT refresh cycles are driven solely by hardware age
  4. IT reports only to the technology vendor

Explanation

Alignment exists when IT decisions are explicitly linked to strategic objectives and can be justified on that basis. Requiring proposals to state their strategic contribution makes the link visible and testable.

Question 25IT Governance Fundamentals

What is the most appropriate role of internal audit in relation to IT governance?

  1. To make IT investment decisions on behalf of the board
  2. To provide independent assurance that governance and controls operate effectively Correct answer.
  3. To set the IT risk appetite
  4. To operate the production change process

Explanation

Internal audit provides independent, objective assurance on the design and operation of governance and controls. To preserve that independence it must not take on decision-making or operational responsibilities.

Question 26IT Governance Fundamentals

Which statement best defines IT governance?

  1. The process of writing software applications for internal business units
  2. The daily management of servers, networks and service desks to keep systems available
  3. The set of responsibilities and practices used to direct and control IT so that it supports enterprise objectives Correct answer.
  4. The annual audit of financial statements prepared using IT systems

Explanation

IT governance is about direction and control: who decides, what is decided, and how performance is monitored so that IT supports enterprise objectives. It is a leadership and accountability concern rather than an operational or technical activity. Operational management and software development are carried out within the boundaries that governance establishes.

Question 27IT Governance Fundamentals

Which of the following best describes the scope of enterprise governance of IT?

  1. Only technology purchased from external suppliers
  2. The whole enterprise's use of IT, including business-owned and outsourced technology Correct answer.
  3. Only the IT department's internal processes and staffing decisions
  4. Only systems that process financial transactions

Explanation

Enterprise governance of IT covers how the entire organisation uses technology, including systems owned by business units, shadow IT and outsourced services. Limiting the scope to the IT department or to particular suppliers leaves significant technology risk and value outside the governance framework. The enterprise-wide view is what makes governance effective.

Question 28IT Governance Fundamentals

Which outcome is the primary purpose of implementing IT governance in an organisation?

  1. Standardising the programming languages used by developers
  2. Eliminating the need for external audits of technology controls
  3. Reducing the number of IT staff required to run operations
  4. Ensuring IT delivers value and manages risk in line with enterprise objectives Correct answer.

Explanation

IT governance exists to align technology investment and risk-taking with what the enterprise is trying to achieve. Value delivery and risk optimisation are the central outcomes, supported by resource optimisation and performance measurement. Cost reduction, audit avoidance and technical standardisation may occur but are not the purpose.

Question 29IT Governance Fundamentals

In an IT governance structure, what is the role of the board of directors?

  1. Setting direction, approving risk appetite and holding management accountable for IT Correct answer.
  2. Selecting the database product for each application
  3. Operating the IT service desk during peak periods
  4. Reviewing individual code changes before deployment

Explanation

The board provides direction and oversight: it approves strategy and risk appetite and holds executive management accountable for results. It does not perform operational or technical tasks itself. This separation keeps the board focused on enterprise-level outcomes rather than delivery detail.

Question 30IT Governance Fundamentals

Which document typically authorises an IT steering committee to make prioritisation decisions?

  1. A vendor contract for a cloud subscription
  2. An application user manual
  3. A terms of reference that defines its mandate, membership and decision authority Correct answer.
  4. A disaster recovery test report

Explanation

A terms of reference establishes a committee's mandate, composition, quorum and the decisions it is empowered to make. Without such a mandate, a committee's decisions can be challenged or ignored. Contracts, test reports and manuals are operational artefacts that do not confer authority.

Question 31IT Governance Fundamentals

What does accountability mean in an IT governance context?

  1. Answering for a decision or outcome to a higher authority Correct answer.
  2. Delegating a task without retaining any responsibility
  3. Sharing every decision equally among all IT staff
  4. Documenting technical specifications in detail

Explanation

Accountability means being answerable to a higher authority for a decision or result, even when the work is delegated. Delegation transfers responsibility for performing tasks but accountability remains with the person who owns the outcome. This principle underpins clear governance roles.

Question 32IT Governance Fundamentals

Which pair correctly matches an IT governance domain with its focus?

  1. Resource management and the optimisation of IT investment and capability Correct answer.
  2. Resource management and the physical security of data centres
  3. Risk optimisation and the writing of security policies by auditors
  4. Performance measurement and the recruitment of developers

Explanation

Resource management concerns optimising IT investment, people and infrastructure to deliver value. Physical security and policy authorship sit with other functions, and recruitment is an operational HR activity. Matching domains to their focus is essential for assigning governance responsibilities correctly.

Question 33IT Governance Fundamentals

Which statement correctly describes a governance framework such as COBIT?

  1. It is a structured set of good practices that organisations tailor to their context Correct answer.
  2. It is a software product that automates all governance decisions
  3. It is a mandatory law that every organisation must adopt unchanged
  4. It is a certification awarded to individual IT managers

Explanation

Frameworks provide structured good practices and reference models that organisations adapt to their size, sector and risk profile. They are guidance, not legislation, and they are not software or personal certifications. Tailoring is expected because a framework applied unchanged rarely fits an organisation's context.

Question 34IT Governance Fundamentals

An organisation has no IT steering committee and projects are approved by whoever shouts loudest. Which governance gap does this represent most directly?

  1. Excessive investment in performance measurement
  2. Inadequate definition of decision-making structures and authority Correct answer.
  3. Over-reliance on independent assurance
  4. Insufficient technical documentation of applications

Explanation

Approvals driven by advocacy rather than defined authority indicate that decision-making structures and decision rights are missing. Governance requires explicit forums, criteria and authority for investment decisions. Measurement, assurance and documentation are separate concerns that do not address the absence of a decision structure.

Question 35IT Governance Fundamentals

A board receives quarterly IT reports containing only uptime statistics. Which improvement would best strengthen governance oversight?

  1. Reporting on IT value delivery, risk exposure and progress against strategic objectives Correct answer.
  2. Delegating all reporting to the network operations team
  3. Removing the reports to save administrative effort
  4. Adding more detailed server capacity charts

Explanation

Effective oversight requires information on value, risk and strategic alignment, not just operational availability. Uptime is an operational indicator that says little about whether IT is delivering enterprise objectives. Broader reporting enables the board to challenge and steer rather than merely observe.

Question 36IT Governance Fundamentals

An organisation's IT strategy is written by the CIO with no reference to the corporate plan. Which governance weakness is most evident?

  1. Excessive delegation of authority to business units
  2. Insufficient technical standards for coding
  3. Absence of alignment between IT direction and enterprise objectives Correct answer.
  4. Overinvestment in disaster recovery testing

Explanation

When IT strategy is produced in isolation, there is no mechanism linking technology direction to enterprise goals. Alignment is a core governance outcome and requires deliberate connection between corporate and IT planning cycles. The other options describe issues not evidenced in the scenario.

Question 37IT Governance Fundamentals

A company wants to ensure that IT investment proposals are evaluated consistently. Which governance mechanism is most appropriate?

  1. Approving proposals in the order they are submitted
  2. A defined investment appraisal process with agreed criteria and an approving body Correct answer.
  3. Relying on vendor business cases supplied with proposals
  4. Allowing each department to choose its own evaluation method

Explanation

Consistent evaluation requires an agreed process, explicit criteria and a body empowered to approve or reject proposals. This makes trade-offs transparent and comparable across the portfolio. Departmental discretion or submission order produces inconsistent, advocacy-driven outcomes.

Question 38IT Governance Fundamentals

Which arrangement best illustrates the principle that IT governance is a responsibility of the board and executives rather than of IT alone?

  1. The CIO alone signs off the IT risk register each year
  2. IT staff vote on which projects to fund
  3. The service desk manager reports incidents directly to the board
  4. A board risk committee reviews technology risk alongside financial and operational risk Correct answer.

Explanation

Treating technology risk alongside other enterprise risks demonstrates that IT governance is embedded in corporate governance. Executive and board-level ownership ensures technology risk is weighed against the organisation's overall risk profile. Delegating the matter entirely to the CIO or to operational staff keeps it siloed.

Question 39IT Governance Fundamentals

An organisation defines IT policies but managers routinely approve exceptions verbally. Which governance weakness is most significant?

  1. Policies are too detailed for staff to read
  2. Exception authority and records are not controlled Correct answer.
  3. Too many staff are trained in policy requirements
  4. The organisation has adopted too many frameworks

Explanation

Verbal exceptions mean deviations are neither authorised by the right level nor recorded for later scrutiny. Governance requires defined exception authority and an auditable record so that risk acceptance is visible. Policy length, training volume and framework count are not the core issue here.

Question 40IT Governance Fundamentals

Which characteristic most distinguishes strategic IT governance from tactical IT management?

  1. It focuses on patching operating systems on schedule
  2. It focuses on resolving incidents within agreed service levels
  3. It focuses on the day-to-day allocation of developers to tasks
  4. It focuses on setting direction, boundaries and accountability for IT across the enterprise Correct answer.

Explanation

Strategic governance sets direction, defines boundaries and assigns accountability at enterprise level. Tactical management executes within those boundaries through incident resolution, resource allocation and maintenance tasks. The distinction is between setting the rules and operating within them.

Question 41IT Governance Fundamentals

A multinational wants its regional IT leaders to understand which decisions are reserved for head office. What should the governance documentation specify?

  1. The salary bands of regional IT managers
  2. A decision rights matrix showing reserved and delegated decisions Correct answer.
  3. The preferred brand of laptops for staff
  4. The network topology for each region

Explanation

A decision rights matrix clarifies which decisions are retained centrally and which are delegated, preventing both conflict and paralysis. It is the standard mechanism for allocating authority across a federated organisation. Network topology and procurement preferences are technical or operational details.

Question 42IT Governance Fundamentals

Which factor most strongly indicates that an organisation's IT governance is mature?

  1. It measures governance outcomes and continuously improves them Correct answer.
  2. It holds an annual awareness day for staff
  3. It owns a comprehensive set of written policies
  4. It has purchased an enterprise governance tool

Explanation

Maturity is demonstrated by measurement, feedback and continuous improvement rather than by the existence of documents or tools. Policies and tools are inputs; maturity depends on whether they are used, measured and refined. Awareness activities support culture but do not by themselves evidence maturity.

Question 43IT Governance Fundamentals

An organisation's governance committee meets quarterly but decisions are frequently reopened at the next meeting. Which weakness should be addressed first?

  1. The committee's agenda is circulated too early
  2. The committee meets too frequently for its workload
  3. The committee lacks clear decision rights and a documented decision log Correct answer.
  4. The committee has too many external members

Explanation

Reopened decisions usually signal unclear authority or an absent record of what was decided and why. Defining decision rights and maintaining a decision log gives decisions durability and traceability. Meeting frequency, membership mix and agenda timing do not explain decisions being revisited.

Question 44IT Governance Fundamentals

Which statement best explains the relationship between IT governance and regulatory compliance?

  1. Governance provides the oversight structure within which compliance obligations are assigned and monitored Correct answer.
  2. Governance replaces the need for compliance monitoring
  3. Compliance requirements apply only to publicly listed companies
  4. Compliance is solely the responsibility of the internal audit function

Explanation

Governance supplies the structure of accountability, policy and monitoring through which regulatory obligations are translated into controls and evidenced. It does not replace compliance monitoring but makes it owned and visible. Compliance obligations apply across sectors and are not confined to listed companies.

Question 45IT Governance Fundamentals

An organisation wants assurance that its governance framework is operating as designed. Which arrangement best provides this?

  1. Vendors confirm that their products meet requirements
  2. The project management office approves its own governance reviews
  3. An independent function assesses governance processes and reports to the board Correct answer.
  4. The CIO self-certifies that all controls are effective

Explanation

Independent assessment reported to the board provides objective assurance that governance is operating as intended. Self-certification by the accountable executive lacks independence, and self-review by the PMO or vendor confirmation does not test the organisation's governance processes. Independence and appropriate reporting lines are the key features.

Question 46IT Governance Fundamentals

A new CIO wants to establish a governance baseline quickly. Which sequence is most sound?

  1. Select tools and processes simultaneously without stakeholder input
  2. Identify stakeholder needs and objectives, define governance processes, then select supporting tools Correct answer.
  3. Buy a tool, then define processes, then identify stakeholders
  4. Define processes only after the first audit finding

Explanation

Governance design should start from stakeholder needs and enterprise objectives, then define processes, and only then select enabling tools. Tools chosen first tend to shape processes around vendor features rather than organisational needs. Waiting for an audit finding delays necessary control.

Question 47IT Governance Fundamentals

An organisation's governance body approves IT strategy but has no mechanism to detect when execution diverges from it. Which governance component is missing?

  1. A performance measurement and reporting feedback loop Correct answer.
  2. A new enterprise architecture tool
  3. A revised procurement policy
  4. A larger IT budget

Explanation

Strategy approval without feedback leaves the governing body unable to detect or correct divergence. A measurement and reporting loop closes the cycle by comparing outcomes with intentions and triggering corrective action. Budget, procurement and tooling changes do not by themselves create that feedback.

Question 48IT Governance Fundamentals

Two executive committees both believe they own approval of major IT investments. Which governance design flaw is the most likely root cause?

  1. Insufficient technical architecture standards
  2. Too few investment proposals being submitted
  3. Excessive end-user training on IT systems
  4. Overlapping mandates without a single accountable owner Correct answer.

Explanation

When mandates overlap and no single owner is accountable, committees can both claim and defer authority, causing delay and conflict. Clear allocation of decision rights with one accountable owner resolves this. The other options do not explain competing claims of authority.

Question 49IT Governance Fundamentals

A regulated firm must demonstrate that technology risk decisions were made by appropriate authority. Which evidence is most persuasive?

  1. A statement from the CIO that decisions were appropriate
  2. An email from a vendor confirming the risk was low
  3. A copy of the risk policy without decision records
  4. Minutes recording the decision, the authority exercised and the rationale Correct answer.

Explanation

Persuasive evidence links a specific decision to the authority that made it and the reasoning behind it, which contemporaneous minutes provide. A general statement, an undated policy or vendor opinion does not demonstrate that the right authority decided. Traceability of decision, authority and rationale is the governance requirement.

Question 50IT Governance Fundamentals

An organisation adopts governance practices that satisfy auditors but slow every decision to a crawl. Which principle should guide rebalancing?

  1. Governance should maximise the number of approval steps to demonstrate rigour
  2. Governance should be proportionate, adding control where risk justifies it and enabling speed elsewhere Correct answer.
  3. Governance should apply identical controls to every decision regardless of risk
  4. Governance should be abandoned when it slows delivery

Explanation

Governance should be proportionate to risk so that controls concentrate where consequences are greatest and low-risk decisions proceed quickly. Uniform approval layers create delay without adding commensurate assurance. Abandoning governance in response to friction removes the protection entirely.