IT Governance Flashcards

Question 1

What is IT governance and how does it differ from IT management?

Accepted Answer

IT governance is the framework of responsibilities that directs how technology creates value and manages risk. It sets priorities and accountability, while IT management plans, builds, and runs technology to carry out that direction. Governance asks whether the right things are done, while management ensures things are done right.

Question 2

Why do organizations need a formal approach to IT governance?

Accepted Answer

Organizations need IT governance because technology spending is large, technology failures can halt operations, and technology decisions affect strategy, legal obligations, and customer trust. A formal approach ensures that investments match business goals, that risks are understood, and that someone is clearly accountable when outcomes fall short.

Question 3

What outcomes should effective IT governance deliver for an organization?

Accepted Answer

Effective IT governance should deliver alignment between technology and business strategy, value from IT investments, appropriate management of risk, efficient use of resources, and reliable measurement of performance. These outcomes guide how decisions are evaluated. Governance succeeds when the organization can show clear benefits from its technology spending.

Question 4

What does the term stakeholder mean in IT governance?

Accepted Answer

In IT governance, a stakeholder is any person or group with an interest in or influence over technology decisions and outcomes. Examples include executives, board members, business unit leaders, customers, employees, regulators, and IT staff. Good governance identifies stakeholders early, understands their expectations, and balances their sometimes competing needs when setting priorities.

Question 5

What is meant by accountability in IT governance, and why does it matter?

Accepted Answer

Accountability means that a specific person or role is answerable for a decision or outcome, including explaining results to those above them. It matters because technology initiatives often span many teams, and without a single accountable owner, problems fall between departments. Clear accountability encourages careful decisions and makes it possible to learn from failures.

Question 6

What is the difference between effectiveness and efficiency in IT governance?

Accepted Answer

Effectiveness asks whether technology delivers the right results for the business. Efficiency asks whether those results are achieved with minimal waste of time, money, and resources. A service can be efficient yet ineffective if it is cheap and fast but does not solve the problem it was built to address. Good governance seeks both.

Question 7

Why is alignment between IT and business strategy considered a central governance principle?

Accepted Answer

Alignment matters because technology investments are only valuable when they support what the organization is trying to achieve. If IT projects pursue goals that differ from business priorities, money and effort are wasted and opportunities are missed. Governance keeps alignment visible through regular portfolio reviews against strategic objectives.

Question 8

What does it mean to say IT governance is a shared responsibility?

Accepted Answer

Shared governance means responsibility is spread across the board, executives, business leaders, and IT staff rather than resting only with the technology department. The board sets oversight and risk appetite, executives make strategic choices, business owners define needs, and IT delivers systems. Success depends on each group understanding its role and talking with the others.

Question 9

What is a governance framework, and what role does it play in IT?

Accepted Answer

A governance framework is a structured set of principles, processes, and practices that helps an organization direct and control its IT activities. It gives leaders a common language, a set of expected practices, and a way to assess maturity. Frameworks do not replace judgment, but they reduce guesswork by showing what good governance includes.

Question 10

What does COBIT provide to organizations pursuing IT governance?

Accepted Answer

COBIT is a widely used framework that organizes IT governance and management into governance objectives and management objectives, with supporting practices and control guidance. It helps organizations link IT goals to business goals, define responsibilities, and measure process capability. Organizations often use it to structure audits, evaluate controls, and communicate expectations to executives and regulators.

Question 11

What is ITIL and how does it relate to IT governance?

Accepted Answer

ITIL is a widely adopted set of best practices for IT service management, covering areas such as incident and change management. It focuses mainly on how IT services are delivered and supported, so it complements governance rather than replacing it. Governance sets policies and priorities, while ITIL provides operational processes to carry them out.

Question 12

What is the purpose of ISO international standards for IT governance?

Accepted Answer

International standards for IT governance, such as the ISO standard on governance of IT, give organizations a recognized model for directing technology use. They define principles such as responsibility, strategy, acquisition, performance, conformance, and human behavior that boards can apply. Adopting such a standard signals to customers and partners that governance is taken seriously.

Question 13

Why do organizations often combine several frameworks instead of relying on only one?

Accepted Answer

Organizations often combine frameworks because each one emphasizes different areas, such as governance, service delivery, or security. A governance framework may set direction, a service management framework may guide operations, and a security standard may define controls. Combining them covers the full lifecycle, but leaders must avoid duplicated effort and conflicting processes.

Question 14

How does a maturity model help evaluate IT governance practices?

Accepted Answer

A maturity model describes levels of capability, often from ad hoc or initial practices up to optimized, managed, and continuously improved processes. It helps an organization assess where it stands, identify gaps, and set realistic targets for improvement. Maturity models are most useful when applied honestly, since inflated self-assessments hide real gaps.

Question 15

What is the difference between a framework and a standard in governance?

Accepted Answer

A framework is a broad structure of concepts, processes, and guidance that organizations adapt to their own needs. A standard is usually a more formal, specific document that defines requirements or a recognized way of doing something. Frameworks guide thinking, while standards often specify what must be met.

Question 16

Why should a framework be tailored rather than adopted exactly as written?

Accepted Answer

Frameworks are designed as general references for many organizations, so they rarely fit every industry, size, or risk profile exactly. Tailoring means selecting the practices that address real business goals and dropping or adjusting those that add cost without value. Successful adoption treats the framework as a guide, not a checklist to complete mechanically.

Question 17

What is a decision right in IT governance?

Accepted Answer

A decision right is the authority to make a specific type of decision, such as approving an investment or accepting a security risk. Clarifying decision rights answers the question of who decides, who must be consulted, and who is informed. When decision rights are unclear, projects stall, duplicate work appears, and accountability becomes disputed.

Question 18

What does a RACI matrix show, and when is it useful?

Accepted Answer

A RACI matrix maps each task or decision to the roles that are Responsible for doing the work, Accountable for the outcome, Consulted for input, and Informed of progress. It is useful when several teams share a process and people need to know who does what. Each task should have exactly one Accountable role.

Question 19

What is the role of a board of directors in IT governance?

Accepted Answer

The board of directors provides oversight of how technology supports strategy and manages risk on behalf of owners or shareholders. Board members ask whether IT investments are justified, whether major risks are understood, and whether management has appropriate controls. The board delegates operations to executives but remains responsible for governance itself.

Question 20

What is the purpose of an IT steering committee?

Accepted Answer

An IT steering committee brings together senior business and technology leaders to set priorities, approve major investments, and resolve conflicts between competing demands. Its members usually represent different business units, so decisions reflect enterprise needs rather than the interests of one department. It also reviews project portfolios and checks whether spending and benefits match approvals.

Question 21

What is the typical responsibility of a chief information officer in governance?

Accepted Answer

A chief information officer usually leads the planning, delivery, and operation of technology and serves as the main link between executives and IT staff. In governance, the CIO translates business strategy into technology plans, reports on performance and risk, and recommends investments. Responsibilities vary by organization, so the CIO's authority should be defined clearly.

Question 22

What is a governance committee charter and why is it useful?

Accepted Answer

A charter is a written document that states a committee's purpose, membership, authority, decision rights, meeting frequency, and reporting obligations. It is useful because it prevents confusion about what the committee can and cannot decide. A clear charter also helps new members understand their role and gives auditors evidence that governance activities are organized.

Question 23

Why is separation of duties important in IT governance?

Accepted Answer

Separation of duties means that no single person controls all parts of a critical process, such as requesting, approving, and recording a payment. This reduces the chance of error, fraud, or unauthorized change going undetected. Governance sets these boundaries in policy, and access controls in systems enforce them.

Question 24

How do governance roles change when an organization outsources IT services?

Accepted Answer

When IT services are outsourced, the organization transfers day-to-day delivery to a provider but keeps accountability for outcomes, risk, and compliance. Governance roles shift toward vendor selection, contract oversight, service level monitoring, and managing the relationship. Leaders must ensure that performance metrics, data protection, and exit terms are defined clearly in the agreement.

Question 25

What is IT risk in the context of governance and risk management?

Accepted Answer

IT risk is the possibility that technology-related events will harm the organization's objectives through loss of data, disruption, or poor decisions. Governance addresses IT risk by defining how much risk is acceptable, who owns each risk, and how risks are monitored and reported. Risk is managed, not eliminated.

Question 26

What is the difference between a risk appetite and a risk tolerance?

Accepted Answer

Risk appetite is the general amount and type of risk an organization is willing to accept in pursuit of its objectives. Risk tolerance is the acceptable variation around a specific target, such as acceptable downtime for a system. Appetite sets the broad direction, and tolerance provides measurable limits for daily decisions.

Question 27

What are the common ways an organization can respond to an identified IT risk?

Accepted Answer

Common responses include avoiding the risk by not pursuing the activity, reducing it through controls, transferring it through insurance or contracts, and accepting it when the cost of response exceeds the likely impact. Each response needs a named owner. Accepting a risk is valid only when someone with authority decides knowingly.

Question 28

What is a control in IT governance and risk management?

Accepted Answer

A control is a policy, procedure, practice, or technical safeguard designed to reduce risk or ensure that objectives are met. Controls can be preventive, such as access restrictions, detective, such as log reviews, or corrective, such as restoring from backup. Effective governance requires controls that are proportionate to risk and tested regularly.

Question 29

What is compliance in IT governance, and where does it come from?

Accepted Answer

Compliance means meeting obligations set by laws, regulations, contracts, and internal policies. These obligations come from external sources such as government rules and industry agreements, as well as from the organization's own standards. Good governance treats compliance as a minimum baseline, not as the full measure of whether technology is well managed.

Question 30

What is a key performance indicator in IT, and how does it differ from a metric?

Accepted Answer

A key performance indicator is a measure tied directly to a critical objective, such as on-time project delivery. A metric is any measurable quantity, such as the number of tickets closed in a week. All KPIs are metrics, but only the few measures that show progress toward important goals deserve KPI status.

Question 31

Why is it important to link IT metrics to business outcomes rather than only technical output?

Accepted Answer

Technical output, such as uptime percentages or lines of code, can look positive while the business still struggles. Linking metrics to outcomes, such as revenue protected, customer satisfaction, or faster time to market, shows whether technology is creating value. Boards use outcome measures to guide investment and hold management accountable.

Question 32

What is an audit in IT governance, and what does it provide?

Accepted Answer

An IT audit is an independent examination of systems, processes, and controls to determine whether they are working as intended and comply with requirements. It provides objective assurance to boards and management, identifies control weaknesses, and recommends improvements. Audit findings are most valuable when they lead to tracked corrective action.

Question 33

How should an organization decide which IT projects to fund?

Accepted Answer

Organizations usually compare proposed projects against strategic priorities, expected benefits, costs, risks, and available capacity. A structured business case documents these factors so that decision makers can compare options consistently. Funding decisions are often made in a portfolio review, where projects are ranked, balanced across goals, and approved, deferred, or stopped.

Question 34

What is benefits realization, and why does governance monitor it after a project ends?

Accepted Answer

Benefits realization is the process of confirming that the value promised in a business case appears once a system or change is in use. Governance monitors it because many projects deliver their outputs on time but fail to produce expected results, such as cost savings or improved service. Reviewing benefits after delivery builds accountability.

Question 35

How can an organization govern agile or iterative software development without losing control?

Accepted Answer

Governance can focus on outcomes, funding guardrails, and transparency rather than detailed upfront plans. Teams can work in short cycles while leaders set clear objectives, review working results at regular intervals, and define limits for budget, security, and compliance. This keeps control through visibility and decision points rather than rigid sign-offs.

Question 36

What steps are typically involved in creating an IT governance policy?

Accepted Answer

Creating an IT governance policy usually begins with identifying the purpose, scope, and stakeholders. Next, the organization drafts clear statements of required behavior, assigns owners for each requirement, and reviews the draft with legal, risk, and operational leaders. The policy is then approved by the appropriate authority, communicated to staff, and reviewed periodically.

Question 37

How should an organization handle an IT governance exception request?

Accepted Answer

An exception request should describe the policy requirement being bypassed, the business reason, the risk created, and the compensating controls proposed. A named owner should review it, and an approver with authority to accept the risk should decide. Approved exceptions need an expiration date, a register entry, and review until the gap is closed.

Question 38

What should an organization do after a major IT incident to improve its governance?

Accepted Answer

After a major incident, the organization should conduct a structured review to establish what happened, why controls did not prevent or detect it, and how the response performed. Findings should be translated into actions with owners and deadlines, and progress should be reported to the appropriate governance body. This strengthens policies and oversight over time.

Question 39

How can IT governance support digital transformation initiatives?

Accepted Answer

Governance supports transformation by setting strategic goals, funding priority changes, and clarifying decision rights. It also ensures that new data uses, cloud services, and automated decisions are assessed for security, privacy, and ethical risk. Progress should be measured against business outcomes, not technology adoption counts.

Question 40

What is the main purpose of an IT governance review after a major change in business strategy?

Accepted Answer

The main purpose is to confirm that technology priorities, investments, roles, and risk tolerances still match the new strategy. A review checks whether existing projects should be continued, changed, or stopped, and whether decision rights need to shift. Without this step, organizations may keep funding initiatives that no longer support the chosen direction.

IT Governance Flashcards

1Core Concepts of IT Governance

2Frameworks and Standards

3Roles, Structures and Decision Rights

4Risk, Compliance and Performance

5Applied Governance in Practice

Learning Resources