IT Governance, Risk, and Compliance
What this domain tests
How the board directs and controls IT, how risk is identified, evaluated and treated, and how legal and regulatory obligations are evidenced. Items test principle names, role allocation and the correct step in the risk process.
Core rules
- ISO/IEC 38500: six principles - responsibility, strategy, acquisition, performance, conformance and human behaviour - delivered through three tasks: evaluate, direct, monitor. Governance sets direction; management executes it.
- COBIT 2019 builds its governance system from seven components: processes; organisational structures; policies and procedures; information; culture and ethics; people, skills and competencies; services, infrastructure and applications.
- Three lines model: management owns and controls risk in the first line; a risk and compliance function provides independent oversight in the second; internal audit gives independent assurance in the third.
- Risk process (ISO 31000): establish context → identify → analyse → evaluate → treat → monitor and review, with communication and consultation throughout.
- Risk = likelihood × impact. Treat with the four options: tolerate, treat, transfer, terminate. Distinguish risk appetite (how much risk the board wants to take), risk tolerance (acceptable deviation from appetite) and risk capacity (maximum it could bear).
- Compliance: map each obligation to a control, retain evidence (logs, approvals, audit trails), and test the control rather than only documenting it.
Worked example
A payroll system runs on an unsupported database. Likelihood and impact are both high: the exposure sits above appetite. Termination by decommissioning is impossible within the pay cycle, so the team treats it - isolate the server, add monitoring and compensating controls, and schedule migration next quarter. Transfer is rejected because insurers will not cover a known unsupported platform. The residual risk is formally accepted by the business owner, recorded in the risk register with an owner and review date.
Traps that cost marks
- Naming the CIO as accountable for every risk - business owners own business risk; IT owns technology controls.
- Confusing appetite, tolerance and capacity in the answer.
- Treating a written policy as evidence of compliance rather than testing it.
- Placing risk treatment before risk evaluation, or skipping monitoring and review.
- Assuming third-line audit manages risk rather than assuring it.
- Forgetting that outsourcing transfers activity, not accountability.