I85PREP
⌘ K
ISO/IEC 38500 IT Governance Manager study materials
ISO/IEC 38500 IT Governance Manager study resources

ISO/IEC 38500 IT Governance Manager practice questions

One question at a time. Build your ISO/IEC 38500 IT Governance Manager understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance and IT Governance Concepts

In ISO/IEC 38500, which body is held accountable for governing the organisation's use of IT?

  1. The external IT audit provider
  2. The software vendor community
  3. The IT service desk team
  4. The governing body of the organisation Correct answer.

Explanation

ISO/IEC 38500 places responsibility for governance of IT with the governing body, such as a board of directors. Directors direct and control IT use rather than delegating accountability to suppliers or operational teams.

Question 2Governance and IT Governance Concepts

According to the ISO/IEC 38500 model, governance of IT is exercised through which three activities?

  1. Identify, Protect and Detect
  2. Evaluate, Direct and Monitor Correct answer.
  3. Plan, Build and Run
  4. Design, Deploy and Decommission

Explanation

The standard's model describes the governing body evaluating options and proposals, directing plans and policies, and monitoring performance and conformance. These three activities form the core governance cycle.

Question 3Governance and IT Governance Concepts

What does the principle of 'responsible' require of the governing body in ISO/IEC 38500?

  1. Outsourcing all IT decisions to a managed service provider
  2. Defining roles and responsibilities so that IT use is clearly owned Correct answer.
  3. Minimising the number of IT policies in force
  4. Restricting IT governance to the finance function

Explanation

The responsible principle requires clear assignment of responsibility for IT and for the decisions taken about it. Individuals must know what they own, and accountability must be traceable through defined roles.

Question 4Governance and IT Governance Concepts

Which ISO/IEC 38500 principle requires that IT strategy and business strategy are aligned and mutually supportive?

  1. Strategy Correct answer.
  2. Conformance
  3. Acquisition
  4. Performance

Explanation

The strategy principle states that the organisation's business and IT plans should be integrated, with IT direction derived from and feeding business direction. It addresses alignment rather than procurement or control.

Question 5Governance and IT Governance Concepts

What is the primary distinction between governance of IT and management of IT in ISO/IEC 38500?

  1. Governance is voluntary; management is legally mandated
  2. Governance is performed by auditors; management is performed by directors
  3. Governance applies to cloud services; management applies to on-premises systems
  4. Governance evaluates and directs; management plans, builds and runs Correct answer.

Explanation

ISO/IEC 38500 separates governance, the evaluation and direction of IT by the governing body, from management, the operational execution of plans and delivery of services. Governance sets direction and monitors; management implements.

Question 6Governance and IT Governance Concepts

An organisation's board approves an IT investment framework that requires business cases before major spending. Which ISO/IEC 38500 principle does this most directly demonstrate?

  1. Acquisition Correct answer.
  2. Human behaviour
  3. Performance
  4. Conformance

Explanation

The acquisition principle requires IT investments to be made for valid reasons, on the basis of appropriate and ongoing analysis, with clear and transparent decision-making. A mandatory business case is a typical control supporting it.

Question 7Governance and IT Governance Concepts

A governance review finds that IT risks are managed but that staff are not consulted when new systems change working practices. Which ISO/IEC 38500 principle is most clearly breached?

  1. Responsible
  2. Strategy
  3. Human behaviour Correct answer.
  4. Acquisition

Explanation

The human behaviour principle requires IT to respect current and evolving needs of the people involved, including consultation and consideration of working practices. Ignoring staff impact when systems change directly contradicts it.

Question 8Governance and IT Governance Concepts

Which output does the 'monitor' activity of the ISO/IEC 38500 model primarily produce?

  1. A staff training curriculum for developers
  2. A procurement contract for hardware
  3. A detailed technical design for new systems
  4. Assurance that IT performance and conformance meet expectations Correct answer.

Explanation

Monitoring uses performance measurement, audit and reporting to confirm that IT is delivering as directed and conforming to obligations. Its output is assurance and corrective direction, not technical artefacts.

Question 9Governance and IT Governance Concepts

Why does ISO/IEC 38500 describe its principles as applying to both the use of IT today and the organisation's plans for future IT?

  1. Because future systems are exempt from regulatory compliance
  2. Because governance must consider current operations and forward strategy together Correct answer.
  3. Because legacy systems fall outside governance scope
  4. Because only planned systems require board approval

Explanation

Governance of IT covers the organisation's present use of IT and its future direction, since both carry risk and value implications. Evaluating and directing plans is as much a governance concern as monitoring live services.

Question 10Governance and IT Governance Concepts

In the ISO/IEC 38500 model, which activity involves setting policies, assigning responsibility and authorising plans?

  1. Direct Correct answer.
  2. Audit
  3. Monitor
  4. Evaluate

Explanation

Directing covers the assignment of responsibility, approval of policies and plans, and the instructions that translate evaluation into action. Evaluation precedes it and monitoring follows.

Question 11Governance and IT Governance Concepts

A board wants confidence that its IT function complies with data protection law. Which ISO/IEC 38500 principle is most directly engaged?

  1. Strategy
  2. Acquisition
  3. Conformance Correct answer.
  4. Human behaviour

Explanation

The conformance principle requires IT to comply with legislation, regulation, contracts and internal policies. Legal compliance with data protection law sits squarely within it.

Question 12Governance and IT Governance Concepts

Which statement best captures the meaning of the ISO/IEC 38500 performance principle?

  1. IT should be procured at the lowest possible price
  2. IT should be fit for purpose and deliver the required quality of service Correct answer.
  3. IT should be developed only by internal staff
  4. IT should be replaced on a fixed five-year cycle

Explanation

The performance principle requires IT to be fit for purpose, delivering the capabilities and service quality the business needs when required. It concerns effectiveness and service quality rather than cost minimisation alone.

Question 13Governance and IT Governance Concepts

A director argues that because IT is outsourced, the board no longer needs an IT governance framework. How should this be assessed under ISO/IEC 38500?

  1. The argument is correct because suppliers carry all IT risk
  2. The argument is correct if the contract includes service levels
  3. The argument is flawed because accountability for governance of IT stays with the governing body Correct answer.
  4. The argument is flawed only if the supplier is offshore

Explanation

Outsourcing transfers execution and some risk allocation but never the governing body's accountability for the organisation's use of IT. The board must still evaluate, direct and monitor outsourced arrangements.

Question 14Governance and IT Governance Concepts

Which pairing of ISO/IEC 38500 model activity with a typical board action is correct?

  1. Evaluate: authorise the IT security policy
  2. Monitor: approve the IT risk appetite statement
  3. Evaluate: assess a proposed cloud migration against strategic and risk criteria Correct answer.
  4. Direct: review last quarter's service level reports

Explanation

Evaluation is the assessment of proposals, options and risks before decisions are taken, so weighing a cloud migration against strategy and risk fits. Directing concerns approving policies and plans, and monitoring concerns reviewing performance reports.

Question 15Governance and IT Governance Concepts

An organisation defines IT governance as the system by which IT is directed and controlled. Which addition best completes a definition consistent with ISO/IEC 38500?

  1. Including how IT evaluates, directs and monitors its own performance and conformance Correct answer.
  2. Including only the IT department's internal procedures
  3. Including only the annual audit opinion
  4. Including only the technical configuration of infrastructure

Explanation

A complete definition covers direction and control exercised through evaluation, direction and monitoring of performance and conformance. Narrowing governance to technical configuration, departmental procedure or audit alone omits the governing body's role.

Question 16Governance and IT Governance Concepts

Which characteristic distinguishes a principle-based governance standard such as ISO/IEC 38500 from a prescriptive process standard?

  1. It sets outcomes and behaviours for the governing body rather than mandating specific processes Correct answer.
  2. It requires certification before any IT investment can proceed
  3. It applies only to publicly listed companies
  4. It specifies detailed technical controls for each system

Explanation

ISO/IEC 38500 is deliberately principle-based, describing what the governing body should achieve and how it should behave, leaving process design to the organisation. Prescriptive standards instead mandate defined processes and controls.

Question 17Governance and IT Governance Concepts

A board delegates IT oversight to an audit committee. Under ISO/IEC 38500, what must remain true?

  1. The delegation removes the need for monitoring
  2. The delegation transfers accountability to external auditors
  3. The governing body retains ultimate accountability and receives assurance on the delegated work Correct answer.
  4. The audit committee becomes solely accountable for all IT outcomes

Explanation

Delegation of oversight work is permitted, but accountability for governance of IT remains with the governing body. It must therefore define the mandate and receive assurance that the delegated oversight is effective.

Question 18Governance and IT Governance Concepts

Which situation best illustrates a failure of the ISO/IEC 38500 strategy principle?

  1. The IT roadmap pursues a platform the business has decided to exit Correct answer.
  2. A system fails a regulatory compliance test
  3. A supplier invoice exceeds the contracted rate
  4. The IT service desk misses its response time target

Explanation

The strategy principle requires IT direction to align with business direction. Continuing to invest in a platform the business is abandoning shows misalignment between IT plans and business strategy.

Question 19Governance and IT Governance Concepts

How does ISO/IEC 38500 relate governance of IT to corporate governance?

  1. Governance of IT is independent and reports only to IT management
  2. Governance of IT replaces corporate governance for technology firms
  3. Governance of IT applies only after a security incident
  4. Governance of IT is a subset of corporate governance, reported through the same accountability lines Correct answer.

Explanation

ISO/IEC 38500 positions governance of IT within the wider corporate governance system, with the same accountability lines to the governing body. It is not a parallel or competing regime.

Question 20Governance and IT Governance Concepts

A board evaluates two competing proposals for replacing a core system. Which combination of model activities is it performing when it compares risk, cost and strategic fit and then approves one option with conditions?

  1. Evaluate followed by Direct Correct answer.
  2. Audit followed by Evaluate
  3. Direct followed by Monitor
  4. Monitor followed by Evaluate

Explanation

Comparing options against risk, cost and strategic criteria is evaluation, and approving one with conditions is direction. Monitoring would follow later as delivery and benefits are tracked.

Question 21Governance and IT Governance Concepts

Which statement about the ISO/IEC 38500 responsible principle is accurate?

  1. It requires that IT risks are transferred to insurers
  2. It requires that all IT decisions are made by the CIO alone
  3. It requires that IT staff report only to the finance director
  4. It requires that both the responsibility and the authority for IT decisions are defined and understood Correct answer.

Explanation

The responsible principle calls for clear definition of responsibility and authority so that decisions can be taken and accounted for. It is about clarity of ownership, not concentrating decisions in one role.

Question 22Governance and IT Governance Concepts

An organisation measures IT against agreed service levels, benchmarks costs and reports results to the board. Which principle and model activity does this primarily serve?

  1. Acquisition principle, exercised through evaluating
  2. Performance principle, exercised through monitoring Correct answer.
  3. Conformance principle, exercised through directing
  4. Human behaviour principle, exercised through directing

Explanation

Measuring service delivery and cost against agreed targets and reporting to the board is monitoring in support of the performance principle. Conformance, acquisition and human behaviour address different concerns.

Question 23Governance and IT Governance Concepts

What does ISO/IEC 38500 mean by 'conformance' in the context of IT governance?

  1. Compliance with mandatory legislation plus adherence to internal policies and accepted practices Correct answer.
  2. Conformity of hardware to a vendor's reference architecture
  3. Consistency of software versions across the estate
  4. Agreement of IT staff to work overtime when required

Explanation

Conformance covers both external obligations such as laws and regulations and internal obligations such as policies and professional standards. It is broader than technical standardisation.

Question 24Governance and IT Governance Concepts

Which behaviour by a governing body best demonstrates the ISO/IEC 38500 expectation that directors exercise informed judgement?

  1. Approving all IT proposals to avoid delaying projects
  2. Delegating approvals to suppliers to save meeting time
  3. Relying solely on vendor marketing material for decisions
  4. Requiring evidence-based assurance before approving significant IT change Correct answer.

Explanation

Informed judgement requires directors to base decisions on evidence, assurance and appropriate analysis rather than assumption or pressure. Requesting assurance before approving significant change reflects this.

Question 25Governance and IT Governance Concepts

Which term describes the governing body's setting of the organisation's tolerance for IT-related risk within ISO/IEC 38500's direction activity?

  1. Capacity plan
  2. Service catalogue
  3. Configuration baseline
  4. Risk appetite Correct answer.

Explanation

Setting risk appetite is part of directing, because it tells management how much IT risk the organisation is willing to accept. Service catalogues, baselines and capacity plans are management artefacts.

Question 26Governance and IT Governance Concepts

Which ISO/IEC 38500 principle requires that IT assets be used in a way that is appropriate to their purpose and at a cost the organisation considers worthwhile?

  1. Acquire
  2. Responsible
  3. Performance Correct answer.
  4. Conformance

Explanation

The performance principle addresses whether IT is fit for purpose and delivering value at an acceptable cost, so it covers both appropriateness of use and value for money. Acquire concerns valid acquisition and renewal, not ongoing value delivery.

Question 27Governance and IT Governance Concepts

In the ISO/IEC 38500 model, the governing body's activities are organised into which three groups?

  1. Direct, evaluate, monitor Correct answer.
  2. Align, invest, assure
  3. Identify, assess, treat
  4. Plan, build, run

Explanation

The model describes governance through the activities of evaluating the organisation's use of IT, directing preparation and implementation of plans, and monitoring conformance and performance. Plan-build-run and identify-assess-treat belong to delivery and risk management frameworks, not to the 38500 governance model.

Question 28Governance and IT Governance Concepts

Which statement best describes the scope of ISO/IEC 38500?

  1. It certifies individual IT managers against a competence scheme.
  2. It specifies detailed technical controls for securing IT infrastructure.
  3. It provides a framework of principles for governing bodies to direct and control the use of IT. Correct answer.
  4. It prescribes software development lifecycles for enterprise applications.

Explanation

ISO/IEC 38500 is a high-level, principle-based standard addressed to those who direct and control the use of IT, including the board. It deliberately avoids technical controls, lifecycle prescriptions and personal certification schemes.

Question 29Governance and IT Governance Concepts

A governing body wants a single principle that addresses how it should assign accountability for IT decisions across the organisation. Which ISO/IEC 38500 principle applies?

  1. Conformance
  2. Strategy
  3. Responsible Correct answer.
  4. Acquire

Explanation

The responsible principle requires that IT-related responsibilities be clearly established and that individuals understand and accept their accountability. It is the principle that speaks to assignment and acceptance of responsibility.

Question 30Governance and IT Governance Concepts

Which of the following is an example of an IT governance mechanism rather than an IT management activity?

  1. Configuring firewall rules for a new network segment
  2. Approving the IT investment portfolio and its delegated decision rights Correct answer.
  3. Resolving a severity-one incident on the service desk
  4. Patching the production database servers each month

Explanation

Governance mechanisms establish decision rights, accountability and oversight, such as approving an investment portfolio and defining who may authorise spending. Patching, incident resolution and firewall configuration are operational management tasks.

Question 31Governance and IT Governance Concepts

What is the primary purpose of establishing an IT governance framework in an organisation?

  1. To remove the need for IT management to report to executives
  2. To guarantee that no IT project will ever exceed its budget
  3. To transfer all IT decision-making to external suppliers
  4. To ensure IT supports and extends the organisation's objectives with clear direction and control Correct answer.

Explanation

Governance frameworks exist so that IT is directed and controlled in line with organisational objectives, with defined decision rights and oversight. They do not eliminate reporting, guarantee budget outcomes or outsource accountability.

Question 32Governance and IT Governance Concepts

In ISO/IEC 38500 terms, who is the 'governing body'?

  1. The person or group responsible for directing and controlling the organisation Correct answer.
  2. The vendor supplying the enterprise resource planning system
  3. The team that operates the data centre
  4. The external auditor engaged to review financial statements

Explanation

The governing body is the individual or group accountable for directing and controlling the organisation, which may be a board, council or equivalent. Operational teams, auditors and suppliers support governance but are not the governing body.

Question 33Governance and IT Governance Concepts

Which pair correctly matches an ISO/IEC 38500 principle with the outcome it seeks?

  1. Performance - IT is procured only from the lowest-cost supplier
  2. Responsible - IT staff are never held accountable for failures
  3. Conformance - IT meets mandatory obligations and internal policies Correct answer.
  4. Strategy - IT plans are produced only after systems are retired

Explanation

Conformance means IT complies with legislation, regulation, contracts and internal policies, and that compliance is demonstrated. The other pairings misdescribe their principles in ways that contradict the standard's intent.

Question 34Governance and IT Governance Concepts

A board is reviewing whether its IT governance arrangements are proportionate to the size and risk profile of the organisation. Which consideration is most consistent with ISO/IEC 38500 guidance?

  1. Governance arrangements should be tailored to the organisation's circumstances rather than copied unchanged from a larger peer. Correct answer.
  2. Governance arrangements should be delegated entirely to the IT department.
  3. Governance arrangements should be minimised until an incident occurs.
  4. Governance arrangements must be identical across all organisations to be valid.

Explanation

ISO/IEC 38500 is principle-based and expects governing bodies to apply the principles in ways suited to their own size, sector and risk. It does not mandate a single uniform structure, and accountability cannot be delegated away to IT staff.

Question 35Governance and IT Governance Concepts

An organisation's board sets a rule that any IT initiative above a defined spending threshold must be approved by the board, while smaller initiatives may be approved by the CIO. Which governance concept does this illustrate?

  1. Delegated decision rights within an accountability framework Correct answer.
  2. Outsourcing of IT accountability to the CIO
  3. Elimination of the need for monitoring
  4. Substitution of management reporting for governance

Explanation

Defining who may authorise which level of spending is an exercise in assigning decision rights while retaining board accountability for the framework. Accountability for the arrangement stays with the governing body even though authority for smaller decisions is delegated.

Question 36Governance and IT Governance Concepts

A governing body receives quarterly reports on IT service availability, project delivery against milestones and the results of independent assurance reviews. Which governance activity is it primarily performing?

  1. Evaluating
  2. Directing
  3. Acquiring
  4. Monitoring Correct answer.

Explanation

Reviewing performance and conformance information against expectations is the monitoring activity of the model. Directing would involve assigning responsibility and authorising plans, while evaluating concerns assessing proposals and options.

Question 37Governance and IT Governance Concepts

A newly appointed director asks why the board should concern itself with IT governance when a capable CIO is already in place. Which response is most consistent with ISO/IEC 38500?

  1. The board's role is limited to approving the annual IT budget without further involvement.
  2. The board should step back entirely because IT governance is a technical specialism.
  3. The board's accountability for the organisation's use of IT cannot be delegated to the CIO, so it must direct and monitor that use. Correct answer.
  4. The board should take over day-to-day IT operations to demonstrate oversight.

Explanation

ISO/IEC 38500 places responsibility for governing IT with the governing body; competent management reduces effort but does not remove board accountability. The board directs and monitors rather than operating systems itself or limiting itself to a budget vote.

Question 38Governance and IT Governance Concepts

Which situation best demonstrates the ISO/IEC 38500 acquire principle being applied correctly?

  1. A department buys software because a competitor uses it.
  2. A system is renewed automatically each year without review.
  3. A business case shows whole-of-life costs and benefits before a major system is approved for purchase. Correct answer.
  4. A supplier is selected on the basis of a personal relationship with a manager.

Explanation

The acquire principle requires that IT acquisitions be made for valid reasons, on the basis of appropriate and ongoing analysis, with clear and transparent decision-making. A business case covering costs and benefits is the classic evidence of this.

Question 39Governance and IT Governance Concepts

A governing body wants assurance that its IT strategy remains aligned as business priorities shift during the year. Which approach best reflects the ISO/IEC 38500 strategy principle?

  1. Allow each business unit to pursue its own IT direction without coordination.
  2. Leave strategy to the IT department because alignment is a technical matter.
  3. Freeze the IT strategy for three years so that it cannot be altered.
  4. Review IT plans at defined intervals and when business priorities change, adjusting them through the governance process. Correct answer.

Explanation

Strategy requires that IT plans identify how IT will support and extend organisational objectives, and that they be responsive to changing business direction. Periodic and event-driven review through governance keeps alignment current.

Question 40Governance and IT Governance Concepts

Which characteristic best distinguishes governance of IT from management of IT?

  1. Governance is concerned with technology selection, while management is concerned with strategy.
  2. Governance and management are identical activities performed by the same people.
  3. Governance is performed only by external auditors, while management is performed internally.
  4. Governance sets direction, decision rights and accountability, while management executes within that framework. Correct answer.

Explanation

Governance establishes the framework of direction, authority and accountability within which management operates. Management then plans, builds and runs IT services inside that framework. The two are related but distinct layers of responsibility.

Question 41Governance and IT Governance Concepts

An organisation's internal audit function reports that IT staff routinely bypass change approval controls to meet deadlines. Which ISO/IEC 38500 principle is most directly engaged?

  1. Acquire
  2. Strategy
  3. Performance
  4. Conformance Correct answer.

Explanation

Bypassing established change controls is a failure to comply with internal policy, which is the concern of the conformance principle. Conformance covers adherence to internal rules as well as external obligations.

Question 42Governance and IT Governance Concepts

A board committee is asked to assess whether a proposed cloud migration is justified, and separately to confirm that the resulting service meets agreed obligations once live. Which sequence of model activities does this describe?

  1. Direct, then evaluate
  2. Monitor, then evaluate
  3. Evaluate, then monitor Correct answer.
  4. Monitor, then direct

Explanation

Assessing the justification of a proposal is evaluating; confirming that the live service meets obligations is monitoring. Direction would involve authorising plans and assigning responsibility between these steps.

Question 43Governance and IT Governance Concepts

Which behaviour by a governing body best reflects the expectation that directors exercise informed judgement about IT?

  1. Delegating all IT decisions to a single technology enthusiast on the board
  2. Approving proposals quickly to avoid delaying the business
  3. Relying solely on the CIO's verbal assurance for all IT matters
  4. Requesting independent assurance and challenging management's evidence before approving a major IT programme Correct answer.

Explanation

Informed judgement requires directors to seek reliable evidence, including independent assurance, and to test management's claims before deciding. Speed, single-source assurance and reliance on one interested director all weaken the quality of that judgement.

Question 44Governance and IT Governance Concepts

An organisation adopts ISO/IEC 38500 but its board continues to approve IT investments without any documented criteria. Which gap does this represent?

  1. The board has delegated too much authority to management.
  2. The organisation has adopted too many governance principles.
  3. The principles are acknowledged but not embedded in the board's decision-making practice. Correct answer.
  4. The organisation has confused governance with technical architecture.

Explanation

Adopting a standard on paper delivers nothing unless its principles shape actual behaviour, such as using defined criteria for investment decisions. The gap described is between stated adoption and embedded practice.

Question 45Governance and IT Governance Concepts

A regulator requires an organisation to demonstrate that its use of IT complies with data protection obligations and that this compliance can be evidenced. Which two ISO/IEC 38500 principles are most directly involved?

  1. Strategy and performance
  2. Strategy and acquire
  3. Performance and acquire
  4. Conformance and responsible Correct answer.

Explanation

Conformance addresses compliance with legal obligations and the ability to demonstrate it, while responsible addresses clear accountability for meeting those obligations. Together they cover both the requirement and who owns it.

Question 46Governance and IT Governance Concepts

A group board oversees several subsidiaries with differing IT estates and risk appetites. Which approach best reflects ISO/IEC 38500 when applying its principles across the group?

  1. Set common governance principles and accountability at group level while allowing subsidiaries to tailor implementation to their circumstances. Correct answer.
  2. Allow each subsidiary to define its own governance principles independently.
  3. Impose an identical IT operating model on every subsidiary regardless of scale.
  4. Centralise every IT decision at group level, including routine operational choices.

Explanation

The standard's principles are stable, but their implementation should suit local circumstances; a group can hold principles and accountability centrally while permitting tailored application. Uniform operating models, fragmented principles and over-centralisation all conflict with this balance.

Question 47Governance and IT Governance Concepts

An organisation can show strong IT performance metrics but cannot show who is accountable when IT decisions produce poor outcomes. Which interpretation is most consistent with ISO/IEC 38500?

  1. Strong metrics demonstrate that all principles are satisfied.
  2. The organisation should stop measuring performance until accountability is resolved.
  3. Good performance reporting does not substitute for the responsible principle, because accountability must also be clearly established. Correct answer.
  4. Accountability is unnecessary where performance is measured.

Explanation

The principles are complementary: performance addresses value and fitness for purpose, while responsible addresses clarity of accountability. Strong metrics alone do not satisfy the standard, and measurement should not be abandoned while accountability is clarified.

Question 48Governance and IT Governance Concepts

A board's IT committee meets quarterly and reviews a dashboard of risks, incidents and project status, but has no authority to change plans and must refer every matter upward. Which assessment best reflects ISO/IEC 38500?

  1. The committee should take over operational management to compensate for its limited authority.
  2. The committee's lack of authority is irrelevant because governance is advisory.
  3. The committee supports monitoring but lacks the directing authority needed for effective governance of IT. Correct answer.
  4. The committee fully satisfies the model because it reviews information regularly.

Explanation

Effective governance combines evaluating, directing and monitoring; a body that only reviews information performs monitoring without the direction needed to act on findings. Governance is more than an advisory review function, and it does not extend into operational management.

Question 49Governance and IT Governance Concepts

An organisation treats ISO/IEC 38500 as a checklist to be completed once and filed. Which critique is most consistent with the standard's intent?

  1. The principles require continual application and review as circumstances change, not a one-off compliance exercise. Correct answer.
  2. The standard requires certification before any principle can be applied.
  3. A single completion is sufficient provided the checklist is signed by the board.
  4. The standard is intended only for organisations above a certain revenue threshold.

Explanation

ISO/IEC 38500 describes principles to be applied continuously through the governing body's activities, adapting as the organisation and its use of IT evolve. Treating it as a one-time filing or a certification gate misreads its purpose.

Question 50Governance and IT Governance Concepts

Under ISO/IEC 38500, the governing body's duties are commonly summarised by the model 'Evaluate, Direct and Monitor'. Which description correctly captures what 'Direct' involves in that model?

  1. Delegating all IT decision rights to the CIO and endorsing whatever investment proposals management submits
  2. Commissioning independent assurance over IT controls and reviewing the resulting audit findings
  3. Collecting performance data on IT services so that the governing body can compare results with agreed targets
  4. Assigning responsibility and accountability for IT, setting policies and ensuring plans are prepared and resourced Correct answer.

Explanation

In the ISO/IEC 38500 model, 'Direct' concerns leadership: the governing body assigns accountability, sets direction through policies and plans, and ensures IT is organised and resourced to deliver. 'Evaluate' and 'Monitor' cover the assessment of proposals and the oversight of performance against expectations. Directing is therefore about shaping and authorising, not about collecting evidence or outsourcing decisions.