Information Technology Governance
Domain 1 covers Information Technology Governance. CITP questions here test whether you can evaluate how an entity directs, controls, and monitors IT so technology supports strategy and stays inside risk appetite. Expect board, audit-committee, and CIO scenarios that ask you to spot a governance gap, choose the right framework, or judge whether a control is designed and operating effectively.
Governance is not management
COBIT 2019 separates the two. Governance is the board's role: evaluate stakeholder needs, direct through strategy and policy, and monitor performance and compliance. Management plans, builds, runs, and monitors IT within that direction. COBIT expresses this as 40 objectives in five domains, but only the five EDM objectives are governance; APO, BAI, DSS, and MEA are management. If the CIO is running service management, that is management; if the board sets IT risk appetite and approves the IT strategy, that is governance.
Frameworks to tell apart
- ISO/IEC 38500: six principles for corporate governance of IT - responsibility, strategy, acquisition, performance, conformance, human behaviour.
- COBIT 2019: IT governance and management objectives plus five components - processes, organizational structures, information flows, people and skills, culture and behaviour.
- COSO 2013: internal control over financial reporting, five components and 17 principles; IT general controls support it, but COSO is not an IT framework.
- ITIL: service management practices such as incident, problem, and change, not a governance framework.
Worked example
A retailer's IT steering committee meets twice a year, is chaired by the CIO, and reviews only project budgets. The board has no IT expertise and no IT risk appetite statement; business leaders say IT priorities are unclear.
Reasoning: this is a governance failure, not a technical one. The committee is management-dominated and focused on budget approval, so it cannot evaluate or direct. Recommendations: add IT expertise to the board or audit committee; approve an IT strategy tied to business objectives; document IT risk appetite; have a business executive chair the steering committee with authority to prioritize the portfolio; and monitor with KPIs such as benefits realized and KRIs such as aging vulnerabilities.
Traps
- Treating governance as the IT department's job.
- Assuming a SOC 1 report covers security; SOC 2 addresses security, availability, processing integrity, confidentiality, and privacy.
- Citing COSO as the IT governance framework.
- Accepting that the board receives an IT report as monitoring without asking what is measured and acted on.