IT Governance
What this domain tests
How the board and senior management direct and control IT: strategy, risk appetite, committee structure, roles, performance and compliance. Expect questions on the difference between governance and management, the three lines of defence, and RBI expectations for board oversight.
Core rules
- The board approves the IT strategy and IT policy, sets IT risk appetite, reviews IT performance and cyber risk at least annually, and ensures IT is aligned with business strategy.
- Typical structure: board-level IT Strategy Committee (or risk committee), executive IT Steering Committee chaired by a senior business executive, CIO for delivery, CISO for security, and an independent IS audit function.
- Three lines of defence: business and IT own controls; risk and compliance monitor; internal audit provides independent assurance. The board does not delegate accountability to the CIO.
- COBIT is a useful governance framework: evaluate, direct and monitor (EDM) at board level; align, plan and organise; build, acquire and implement; deliver, service and support; monitor, evaluate and assess.
- Governance artefacts include IT balanced scorecard, project approval and prioritisation, IT investment business cases, service level reporting and risk registers.
Worked example
A bank proposes moving its CRM to the public cloud. Governance answer: the CIO presents a business case with data classification, regulatory data-localisation assessment, vendor due diligence, exit plan and risk assessment to the IT Steering Committee; the board or its IT committee approves the policy exception and risk acceptance; internal audit reviews vendor access controls later. The wrong answer is for the CIO to sign alone because it is "only a CRM".
Traps that cost marks
- Confusing IT governance with day-to-day IT management.
- Assuming the board must approve every IT purchase.
- Treating the CISO as the owner of all business risk.