Corporate Governance, Risk Management and IT Controls
What the exam tests
This domain tests board and management responsibilities for IT, enterprise risk management, internal control and the design of IT general and application controls. Expect COSO, COBIT, the three lines model, segregation of duties and change control.
Core rules and concepts
- Governance sets direction, oversight and accountability; management executes. The board should understand IT risk appetite and major dependencies.
- COSO ERM covers governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting.
- Risk management identifies, assesses likelihood and impact, treats by avoiding, reducing, transferring or accepting, then monitors. A risk register is a tool, not the process.
- IT general controls cover access, change management, operations, backup and network controls. Application controls cover input, processing and output.
- Controls may be preventive or detective, manual or automated. Segregation of duties prevents one person from initiating, approving and recording a transaction.
Worked example
A finance clerk can both create a vendor master record and approve payment. This is a segregation-of-duties conflict. The fix is to split master-data creation from payment approval, restrict system roles, and add a monthly review of vendor changes. Reasoning: the conflict creates fraud and error risk. The automated role restriction is preventive; the review is detective. Testing the control after go-live is needed because design alone does not prove operation.
Traps that cost marks
Do not say IT controls are only the IT department's job; business process owners own many controls. A risk register is not risk management. More controls are not always better; controls have cost and can create new risks. Disaster recovery plans that are never tested provide false assurance.
Key points
- The board sets risk appetite and oversight; management operates controls.
- COSO ERM links risk to strategy and performance.
- IT general controls support reliable application controls.
- Segregation of duties addresses fraud and error risk.
- Preventive controls stop errors; detective controls find them later.