Governance and Management of IT
Governance versus management
IT governance is the board's and executives' responsibility: setting direction through leadership, organizational structure and processes so that IT sustains and extends business strategy. Management executes that direction. COBIT is the reference framework; when the question's actor is “the board,” prefer governance-level (evaluate, direct, monitor) answers over operational ones.
Key mechanisms include the board audit or risk committee, an IT strategy/steering committee, the CIO's reporting line, and the IT balanced scorecard. Respect the document hierarchy: a policy states what and why (mandatory, management-approved), a standard specifies mandatory requirements, a procedure gives step-by-step instructions.
Roles and segregation
Data owner - business-side, accountable, classifies data and authorizes access. Data custodian - implements and operates the controls. Data user - uses data per policy. Information security administrators run the technical mechanisms. Segregation of duties separates authorization, custody, recording and reconciliation; in small organizations, compensating controls (supervisory review, independent log review) are the correct answer.
Risk and resources
Enterprise risk management links IT risk to business risk; the board sets risk appetite. Resource management covers sourcing, staff competency, and third-party management: due diligence, right-to-audit clauses, SLAs and a defined exit strategy.
Traps
Board sets policy, management implements. The steering committee prioritizes projects and resolves conflicts - it does not do technical design. Independence traps: the CIO should not unilaterally appraise the security function.
Rule of thumb
When asked who should act, choose the highest-level body competent for that decision.