IT Governance and Risk Management
Frameworks and accountability
IT governance is the set of structures and processes that direct and control IT so it supports strategy, delivers value, and keeps risk within appetite. Know which framework answers which question: COBIT for governance and control objectives, ISO/IEC 27001 for an information security management system, ITIL for service management, and the COSO framework (including its ERM version) for internal control and enterprise risk. Accountability sits with the board and audit committee; management designs and operates controls. Distinguish data owners (accountable, set classification and access rules), data custodians (operate the systems), and data stewards (day-to-day quality). Use the three lines of defense: operations, risk/compliance, internal audit.
Risk process
Identify, assess, respond, monitor. Compare inherent risk (before controls) with residual risk (after controls). Responses are avoid, mitigate, transfer/share, or accept - acceptance must be documented at the right authority level. Risk appetite is the amount of risk the entity is willing to pursue; risk tolerance is the acceptable variance around it. A business impact analysis drives recovery objectives: RTO is the maximum tolerable downtime for a process, RPO is the maximum tolerable data loss measured in time. Questions routinely swap these two.
Third-party assurance
A service organization's controls are reported under SOC 1 (relevant to the user entity's internal control over financial reporting) or SOC 2 (trust services criteria: security, availability, processing integrity, confidentiality, privacy). A Type 1 report covers design at a point in time; a Type 2 report covers design and operating effectiveness over a period.
Rule of thumb: name the objective first - governance, security, service, or financial reporting - then the framework and report type follow.