Governance and Management of IT practice questions

When management directs and evaluates itself, governance is missing and alignment with enterprise objectives is not assured.

In the scenario the CIO both makes and judges IT decisions, so the evaluate-direct-monitor role of governance is absent. The main consequence is that IT priorities and investments may drift from what the enterprise needs, and no one would notice. Platform skills, staff compliance with standards and the pace of spending are narrower management issues; they could exist with or without board oversight and are not what the finding points to.

1. Notice who sets, approves and evaluates IT direction in the scenario.
2. Recognise that the same party doing all three means governance oversight is missing.
3. Ask what risk follows from missing oversight: misalignment with enterprise goals.
4. Reject options that describe narrower operational or budgeting issues.

Exam tip: Without board oversight, the biggest IT governance risk is misalignment with enterprise objectives.

Board-level IT reporting must answer governance questions — value delivery and risk against appetite — not just operational performance.

Governance monitors whether IT delivers the value expected and stays within the risk the board has accepted. Uptime, tickets and milestones are management metrics: useful for running IT, but they do not tell directors whether investments are paying off or whether risk is acceptable. Two facts decide the item: the content must be governance content (value realized, risk against appetite), and it must reach the body accountable for governance (the board). An incident heat map looks like a risk view but is operational; sending value and risk reports to the steering committee has the right content in the wrong place; benchmarks add context to the wrong metrics.

1. Identify the board's actual questions: is IT worth it, and is risk acceptable?
2. Classify the current metrics, and any incident or SLA view, as operational management measures.
3. Keep governance reporting with the board, which remains accountable.
4. Choose reporting that links investments to value and shows risk against appetite.

Exam tip: Report to the board on value delivered and risk against appetite, not on activity.

An IT strategy is aligned only when it is built with, and traces to, the business's objectives.

Strategic alignment means the IT plan supports what the enterprise and its business units are trying to achieve. A plan written and approved entirely within IT has no mechanism to capture those priorities, so the most significant risk is misalignment. Unusable technology, budget conflicts and architecture conflicts are narrower issues; the architecture one is especially unlikely, because IT itself owns those standards.

1. Note who wrote and approved the plan and who was left out.
2. Ask what only the excluded party could contribute: business priorities.
3. Pick misalignment with business priorities as the root risk.
4. Treat technology, budget and architecture issues as secondary.

Exam tip: An IT strategy built without the business risks missing the business's priorities.

Alignment is evidenced by traceability: IT initiatives map to business objectives and are owned by the business.

To show alignment, the auditor needs evidence connecting what IT does to what the business is trying to achieve. A trace from each major initiative to a business objective, with a business sponsor accountable for the benefit, is that connection. A consultant's endorsement, spending that matches the business plan's budget and on-time delivery each look reassuring, but they measure plan quality, cost level and execution, not whether IT is pointed at the right goals.

1. Define alignment: IT activity serving business objectives.
2. Look for evidence that links the two directly rather than measuring IT in isolation.
3. Recognise traceability plus business sponsorship as that link.
4. Reject endorsement, benchmark and delivery evidence as indirect.

Exam tip: The best evidence of IT-business alignment is initiatives traced to business objectives with business sponsors.

The IT steering committee (executive level) prioritizes and monitors IT investments; the IT strategy committee (board level) advises the board on IT direction.

The IT steering committee is made up of senior executives from the business and IT; it prioritizes IT investments and projects, allocates resources and monitors delivery against business needs. It works within the direction and risk appetite the board sets (with advice from a board-level IT strategy committee), so approving strategy and appetite on the board's behalf is not its job. Approving detailed designs is too low-level for it, and independent assurance must come from audit, not from management.

1. Place the steering committee at executive (management) level.
2. Keep strategy approval and risk appetite with the board.
3. Pick prioritizing and monitoring IT investments and projects.
4. Exclude design approval and independent assurance as other functions' jobs.

Exam tip: Steering committee: prioritize and monitor IT projects. Strategy committee: advise the board on IT direction.

An IT steering committee needs senior business representation; without it, IT priorities reflect IT's views rather than the business's.

The finding has one root cause: the committee that sets IT priorities contains no business representatives, so business needs are not weighed when decisions are made. Adding senior business executives as members gives the business decision rights. Informal consultation before meetings looks similar but leaves the decisions with IT. Replacing the committee with a board strategy committee changes the level of the body but not the job of project prioritization, and extra CIO approval keeps the decisions inside IT.

1. Identify why business projects are delayed: no business voice in prioritization.
2. Separate being consulted from having a vote on priorities.
3. Keep the committee at the right level for project prioritization.
4. Choose business membership as the root-cause fix.

Exam tip: A steering committee without business members cannot align IT priorities with the business.