IT Governance and IT Risk Management
Domain 1 examines whether you can separate governance from management, connect IT objectives to business strategy, and judge whether risk is identified, measured and held inside the appetite the board has set. Questions here are usually judgement-based: you are given a scenario and asked what the auditor should conclude, report or escalate.
Governance versus management
- Governance is evaluate, direct and monitor (the EDM domain in COBIT 2019); management is plan, build, run and monitor (APO, BAI, DSS, MEA).
- The board sets direction and appetite; executives own and accept risk; internal audit gives independent assurance and must not design the controls it later audits.
- Good evidence: charter, committee terms of reference, minutes showing real challenge, IT strategy mapped to business objectives, and performance reporting that reaches the board.
Risk concepts that get tested
- Risk is uncertainty affecting objectives, scored as likelihood x impact, before (inherent) and after (residual) controls.
- Appetite is the broad amount of risk the organisation will pursue; tolerance is acceptable variation around a specific objective; capacity is the maximum loss it could absorb.
- Responses are avoid, reduce, share/transfer and accept. Acceptance belongs to the accountable executive, never the auditor.
- KRIs are forward-looking thresholds with escalation triggers; KPIs report past performance.
- A register is only credible if entries have owners, link to objectives, use consistent scales, carry dated treatment plans and are refreshed.
Worked example
A retailer's register scores ransomware at 5x5 after controls. The board's tolerance for order-entry outage is four hours; the last disaster recovery test restored service in 36 hours. The residual score is not defensible, because residual impact should reflect tested capability, not design intent. The gap between 36 hours and the four-hour tolerance is an appetite breach. The auditor does not simply re-score the register; the finding is escalated with a dated remediation plan or a documented, executive-level risk acceptance.
Traps that cost marks
- Treating a residual score as evidence. It is a management assertion; corroborate it against test results.
- Assuming audit owns or accepts risk.
- Recommending improve risk culture or raise awareness. Untestable, and not a control.
- Missing the reporting line: the chief audit executive reports functionally to the audit committee and administratively to the CEO.