Corporate IT Governance
Governance sets direction, not controls
Corporate IT governance is the framework of structures, roles, and processes through which the board and senior leadership direct IT and ensure IT risk is managed within agreed limits. It is distinct from IT management: governance decides what level of risk is acceptable and who is accountable, while management decides how to achieve it. Candidates should know COBIT (governance and management objectives, goals cascade), ISO 31000 (risk principles, framework, process), and the Three Lines Model (operational management; risk and compliance oversight; independent internal audit). Also know the escalation path linking the board, audit committee, CRO, CISO, and business risk owners, and the document hierarchy: policy (board-approved intent) to standard (specific mandatory requirements) to procedure (step-by-step instructions).
Three terms are tested repeatedly. Risk appetite is the amount and type of risk the enterprise is willing to pursue. Risk tolerance is the acceptable variation around that appetite. Risk capacity is the maximum risk the enterprise could bear before failure. A fourth, risk culture, is reflected in behavior and incentives, not in documents.
Traps
Questions blur governance with management, so "the CISO sets the enterprise risk appetite" is wrong: the board or its risk committee approves appetite, while the CISO proposes and implements. Another trap treats internal audit as a control owner; the third line must stay independent. Watch also for "tone at the top" items where the answer is leadership behavior and culture, not a new tool.
Rule of thumb
Ask: who is accountable versus who executes? The board approves appetite and policy; the risk owner accepts residual risk; internal audit gives independent assurance.
Worked example. A board states the enterprise will absorb at most $2 million of annual loss from IT outages. IT engineers recovery targets to that limit and each business unit's risk owner documents acceptance of residual outage risk inside the stated appetite: governance above, execution below.