Governance and Management of IT
What this domain tests
Domain 2 asks whether IT is directed and controlled as a board-level responsibility: strategy alignment, organisational placement of IT, decision rights, policy architecture, performance measurement, risk appetite, and oversight of third parties. The auditor's question is always whether the structure gives the right people the right information at the right time.
Oversight structures
Ultimate accountability sits with the board. The audit committee oversees assurance and the relationship with internal/external audit; a board-level IT strategy committee sets direction and risk appetite; an IT steering committee (executive, business-led) prioritises projects, allocates funding and resolves cross-functional conflicts. A steering committee chaired solely by the CIO and composed only of IT managers is a governance weakness, not a strength. Segregation of duties applies at management level too: the same function should not authorise, execute and review the same activity.
Policy architecture
Policies state mandatory management intent; standards set mandatory specific requirements (e.g., AES-256); procedures give step-by-step instructions; guidelines are recommended, non-binding advice. Policies are worthless without approval, communication, and an exception process with expiry dates.
Measurement and risk
Frameworks such as COBIT define governance objectives and maturity levels; the IT balanced scorecard translates strategy into measurable perspectives. Monitor with KPIs and compare against targets, and align IT risk management with the enterprise risk management framework and stated risk appetite. Third-party arrangements need due diligence, contractual right-to-audit, defined SLAs and periodic reassessment.
Worked example
Business units at a retailer each buy SaaS tools directly with corporate cards, with no IT or security review. The finding is not 'cloud is risky' - it is that procurement decision rights and third-party risk oversight are undefined. The recommendation is a procurement policy requiring IT/security review above a threshold, a register of third-party arrangements, and steering committee visibility of the spend. The auditor recommends; management designs and implements.
Traps
Recommendations that redesign the organisation chart rather than fix the control gap; confusing the audit committee (assurance) with the steering committee (prioritisation); treating COBIT as a certifiable standard rather than a framework; and auditing IT governance without ever tracing a decision to the minutes that authorised it.