CISA Domain 2 — IT Governance and Management (18%, ~27 questions)

What this domain is really testing

Domain 2 tests whether you can tell the difference between governance and management, and whether you instinctively answer at the right organisational level. Every question here is really asking one of four things: (1) who is accountable, (2) does this align with business strategy and risk appetite, (3) is the control designed and documented before it is operated, and (4) what should the auditor do (assess, advise, report — never decide or operate). The domain rewards candidates who know the frameworks (COBIT 2019, ISO/IEC 38500, COSO ERM, NIST CSF, ISO 27001/31000) well enough to recognise vocabulary, but who ultimately choose the answer that puts accountability with the board and business, defines risk ownership with the business, and keeps internal audit independent. Most wrong answers are not factually false — they are true statements placed at the wrong level of the organisation or attributed to the wrong role.

How the exam asks it

Answer-selection heuristics: if two answers are both technically valid, choose the one that is higher-level in accountability, earlier in the process, or more aligned to business objectives. ISACA almost never chooses "implement a tool" as a first answer.

A. IT Governance

Governance vs Management

• Governance is the board's job and cannot be delegated — it can be assigned to a committee but accountability remains with the board.
• ISO/IEC 38500 = corporate governance of IT. EDM = Evaluate, Direct, Monitor is its core model.
• ISO/IEC 38500 principles: Responsibility, Strategy, Acquisition, Performance, Conformance, Human behaviour. Mnemonic: "Really Smart Acquirers Perform Conformance Happily".
• Outsourcing does not transfer accountability. Even fully outsourced IT stays on the board's risk register; the organisation must retain governance, contract management, and right-to-audit.

COBIT 2019 — structure

5 domains, 40 objectives:

Mnemonic for counts: 5 – 14 – 11 – 6 – 4 = 40.

6 governance system principles (COBIT 2019):

1. Provide stakeholder value
2. Holistic approach
3. Dynamic governance system
4. Governance distinct from management
5. Tailored to enterprise needs
6. End-to-end governance system

7 governance system components (enablers):

1. Processes
2. Organisational structures
3. Information flows
4. People, skills and competencies
5. Culture, ethics and behaviour
6. Services, infrastructure and applications
7. Principles, policies and frameworks

Mnemonic: "Please Organise Information, People, Culture, Services, Policies".

Goals cascade: Stakeholder needs → Enterprise goals → Alignment goals → Governance/management objectives → Components. This is the exam's favourite way to test "why does IT exist?" — IT goals derive from enterprise goals, which derive from stakeholder needs.

Capability and maturity

IT strategy and organisational structure

• IT strategy must be derived from business strategy — never the reverse. Review the business strategy first, then assess whether IT strategy supports it.
• IT steering committee: senior business + IT representation; approves IT strategy, prioritises projects, allocates resources, resolves conflicts, monitors performance. Its value is business representation, not technical depth. If the exam asks who prioritises competing IT projects from a business perspective, the answer is the steering committee.
• Board's role: sets risk appetite, approves strategy, ensures IT risk is managed, receives reporting. The board does not approve individual projects or select technology.
• CIO — IT strategy, delivery, alignment with business; CTO — technology direction/architecture/infrastructure; CISO — security programme, policy, risk, incident reporting; DPO — privacy compliance, DPIA, regulator contact, independent of IT where possible; Data owner — business accountability for data; Data steward/custodian — day-to-day operational data management.

Three lines of defence

• Why audit must be 3rd line: independence and objectivity. If audit owned or designed controls, it would be auditing its own work — a self-review threat.
• Internal audit reports functionally to the audit committee/board so that findings cannot be suppressed by the management it audits.

Policies, standards, procedures, guidelines

• Hierarchy: Policy → Standard → Procedure, with guidelines as advisory alongside.
• Policies are business documents because they express business intent, risk appetite and compliance obligations — that is also why they must be approved above IT.
• Every policy needs an owner, review cycle, exception process and communication/training plan — an uncommunicated policy provides no control.

Enterprise architecture (EA)

Architecture domains: Business → Data → Application → Technology. Business architecture drives the rest.

• EA must be business-driven and owned above IT — business architecture defines needed capability; technology follows.
• EA's purpose: reduce duplication, integrate systems, standardise technology, enable change and manage technical debt.
• An auditor reviewing EA asks: does it exist, does it link to strategy, does it govern project decisions, is it actually used?
• TOGAF ADM is iterative — Phase H feeds back to Phase A; Requirements Management applies throughout.

Enterprise Risk Management (ERM)

• Risk treatment options: Avoid, Mitigate/Reduce, Transfer/Share, Accept. (ISACA also refers to exploit/pursue for opportunity risk.) Terminate/avoid = stop the activity.
• Risk acceptance must be by the business owner, of the level owning the risk, formally documented, time-bound and revisited. IT cannot accept business risk. Audit cannot accept risk at all.
• The auditor cannot own or accept risk — doing so destroys independence and objectivity. Audit identifies, evaluates and reports.
• KRIs vs KPIs vs KGIs: KRI = risk exposure trend, leading/warning ("number of unpatched critical servers"); KPI = performance achieved ("patch compliance %"); KGI = whether the goal was met ("no patch-related breaches this year").
• Qualitative risk assessment (expert judgement, likelihood/impact scales, risk matrices) = fast, judgemental, good for governance. Quantitative (ALE = SLE × ARO, Monte Carlo) = monetary, needs reliable data. Use both; quantitative is generally preferred for cost-benefit justification where data exists.

COSO ERM 2017 — 5 components, 20 principles

Mnemonic: Governance & Culture, Strategy & Objective-Setting, Performance, Review & Revision, Information/Communication/Reporting → "GSPRI". Note COSO ERM 2017 is risk-focused; COSO ICIF 2013 is the separate internal-control framework (5 components: Control Environment, Risk Assessment, Control Activities, Information & Communication, Monitoring Activities; 17 principles).

• ISO 31000 — risk management principles, framework and process; communication & consultation, scope/context, identification, analysis, evaluation, treatment, monitoring & review, recording & reporting. Deliberately generic (not certifiable).
• Risk assessment steps: identify → analyse → evaluate → treat → monitor/communicate.

Laws, regulations and industry standards

• Regulations are mandatory and externally enforceable; standards may be voluntary unless made mandatory by contract, regulation or law. PCI DSS is the classic example of contractual compulsion.
• An auditor tests compliance with the applicable law in each jurisdiction where the organisation operates or processes data — not just where it is headquartered.

Data privacy programmes and principles

• Core privacy principles to memorise: notice/transparency, choice/consent, purpose limitation, data minimisation, accuracy, storage limitation, security, accountability, access/participation, transfer limitation.
• Privacy by design and default — build privacy in at design time, not as an afterthought.
• DPIA — required for high-risk processing; identifies risks and mitigations before implementation. The auditor reviews whether DPIA was performed and whether recommendations were actioned.
• Breach notification — regulatory and contractual deadlines (GDPR: 72 hours to the authority, and to data subjects without undue delay where high risk).
• Data subject access requests (DSAR) — the organisation needs a tracked, time-bound process; auditors test completeness and timeliness.
• Privacy programme components: governance/DPO, policies, data inventory and mapping, classification, consent management, third-party/processor management, training, monitoring, incident response, breach reporting.

Data governance and classification

• Data classification levels (typical): Public → Internal → Confidential → Restricted. The classification scheme must be approved by the business and drive the control baseline.
• Why classification drives the control baseline: controls (encryption, access rights, retention, handling, sharing) are selected according to sensitivity — so misclassification is the root-cause finding, not the missing control.
• Data quality dimensions: accuracy, completeness, timeliness, validity, uniqueness, consistency. Poor master data causes systemic reporting errors.
• Metadata = data about data (definitions, lineage, ownership) — needed for consistent reporting and auditability.
• Master data management (MDM) = single authoritative source for core entities (customer, product, vendor, employee).
• Data lifecycle: create/acquire → store → use/share → archive → dispose. Retention schedule must reflect legal, regulatory and business requirements; disposal must be verifiable (certificates of destruction, secure wipe).
• Data sovereignty = data is subject to the laws of the jurisdiction where it resides; cross-border transfer requires a lawful transfer mechanism (adequacy, contractual clauses, consent, security assessment), and cloud location must be contractually known.
• Privacy/records requirements can conflict across jurisdictions — resolve via a documented legal review and a transfer mechanism, not by ignoring one.

B. IT Management

IT resource management

• Resources = people, applications, information, infrastructure (COBIT EDM04/APO07 focus).
• Human resources: hiring with background screening proportional to role sensitivity, defined competency requirements, continuous training, succession planning, and documented job descriptions.
• Segregation of duties (SoD): no single person controls all stages of a transaction or process (authorisation, custody, recording, reconciliation). It is a preventive control. Where SoD cannot be achieved, use compensating controls (supervisory review, monitoring, dual control).
• Mandatory vacation and job rotation: detective anti-fraud controls. An employee who must take leave and hand over duties cannot indefinitely conceal a fraud; rotation surfaces irregularities. They are detective because they reveal concealment after it occurs — the exam frequently tests this classification.
• Sourcing models: insourced, fully outsourced, selective/partial outsourcing, cloud (IaaS/PaaS/SaaS), managed service, shared service centre. Selection criteria: cost, control, core competency, risk, compliance.
• Key principle: core/strategic competencies and accountability (governance, risk, data ownership, contract management) generally should not be outsourced.

IT vendor management

• SLA vs OLA vs UC: SLA = agreement with the customer defining service and targets; OLA = internal agreement between internal teams supporting the SLA; UC = underpinning contract with an external supplier supporting the SLA.
• Right to audit clause is essential: without it the organisation cannot obtain assurance over the vendor.
• Third-party assurance reports:

• When relying on a SOC report, check: period covered (does it cover the audited period?), scope (does it include the specific system/process?), opinion type (unqualified/qualified), complementary user entity controls (CUECs) that the organisation must implement, and subservice organisations.
• Fourth-party / subprocessor risk: the vendor's own suppliers create inherited risk — flow-down requirements, subcontractor disclosure and approval.
• Supply chain risk: hardware/software provenance, counterfeit and tampered components, insecure update channels, concentration risk.
• Why the auditor reviews the contract rather than re-performing the vendor's audit: the contracting organisation relies on the vendor's independent assurance; the organisation's own control is contract management and assurance evaluation. Audit verifies that the contract contains the required clauses, that assurance reports were obtained and reviewed, and that CUECs were implemented — re-performing the vendor's testing exceeds scope and duplicates assurance.

IT performance monitoring and reporting

• Metrics must be tied to business objectives — otherwise they measure activity, not value.
• Leading indicators predict (e.g., % staff trained, mean time to patch); lagging indicators report outcomes (e.g., incidents in the period, availability achieved).
• Balanced scorecard perspectives: Financial, Customer, Internal process, Learning & growth. The IT scorecard translates these into IT measures including contribution to business value.
• Dashboards should be role-appropriate: board wants risk, value, and trend; IT management wants operational detail.
• Good metrics are SMART, few, stable, and comparable over time; gaming risk arises if metrics drive rewards without quality checks.

Quality assurance and quality management

• Quality assurance (QA) = process-oriented, preventive, builds quality into how work is done. Quality control (QC) = product/outcome-oriented, detective, inspects and tests deliverables.
• PDCA (Plan-Do-Check-Act) = the continuous improvement cycle underlying ISO 9001, ISO 20000 and ISO 27001.
• ISO 9001 = quality management system; ISO 20000 = IT service management; CMMI maturity levels 1–5: 1 Initial, 2 Managed, 3 Defined, 4 Quantitatively Managed, 5 Optimising.
• Six Sigma — data-driven defect reduction (DMAIC: Define, Measure, Analyse, Improve, Control); targets very low defect rates.
• Cost of quality:

• Investment logic: prevention and appraisal reduce internal and especially external failure costs — and external failure is the most expensive, which is why ISACA prefers prevention.

TRAPS

1. Level mismatch. Governance answers = board, audit committee, IT steering committee. Management answers = CIO, CISO, IT managers. Read the verb: "approve strategy / set risk appetite / prioritise" = governance; "implement / operate / monitor" = management.
2. The auditor advises and reports — never decides, designs or operates. Any answer where the auditor "approves", "implements", "owns the risk", "selects the vendor" or "designs the control" is wrong.
3. Risk is owned by the business. Not by audit, not by IT. If the question asks who accepts a residual risk, the answer is the business process owner, documented and formal.
4. Governance ≠ management in COBIT. Only EDM is governance. APO/BAI/DSS/MEA are management domains — a question about "which domain" is often decided by this single distinction.
5. Outsourcing never transfers accountability. The board still governs; the organisation still owns the risk and needs right-to-audit and exit provisions.
6. Policy vs procedure. Policy = mandatory, business-level, states intent, approved above IT. Procedure = mandatory, step-by-step, operational. If the question mentions "who approves the policy", prefer the business/board level.
7. Guidelines are not mandatory — an answer that treats a guideline as enforceable, or that cites "breach of guideline" as a finding, is usually wrong.
8. Mandatory vacation and job rotation are detective, not preventive. SoD and access controls are preventive.
9. SOC reports: Type 2 > Type 1 for reliance (operating effectiveness over a period). Always check period covered, scope and CUECs; a clean opinion outside the audit period proves nothing.
10. Do not re-perform the vendor's audit. Review the contract, obtain and evaluate the vendor's assurance report, verify CUECs. Testing the vendor yourself is not the organisation's control.
11. PCI DSS is contractual, not a law. If an answer says "PCI compliance is a legal requirement", it is wrong.
12. Classification drives controls. When asked what should determine the control baseline for data, the answer is the business-approved classification, not IT's technical preference.
13. GDPR fines: up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher — do not confuse the two tiers.
14. Risk appetite vs tolerance: appetite = willing to pursue; tolerance = acceptable deviation. A question about "how much deviation is acceptable" is tolerance.
15. KRIs warn, KPIs measure performance, KGIs confirm goal achievement. Don't swap them.
16. Requirement comes before design. If asked what an auditor does FIRST when reviewing a new system, the answer is to verify that business requirements were defined and aligned to strategy — not to test controls.
17. COSO ERM 2017 (5 components, 20 principles, risk) ≠ COSO ICIF 2013 (5 components, 17 principles, internal control over reporting). Keep them separate.
18. EA is business-driven and owned above IT. An EA "owned by the infrastructure team" is a finding.
19. Third line of defence = internal audit only. Risk/compliance is 2nd line. Don't place internal audit in the 2nd line because it "monitors".
20. Reporting to the audit committee, not to the CIO, protects audit independence — the reverse structure is a significant finding.
21. Metrics not linked to business objectives are the classic performance-management finding — the problem is alignment, not the reporting tool.
22. External failure is the most costly category of quality cost — prevention investment is justified on that basis.

60-second recall

• Governance = Evaluate, Direct, Monitor; Management = Plan, Build, Run, Monitor.
• ISO/IEC 38500 principles: Responsibility, Strategy, Acquisition, Performance, Conformance, Human behaviour.
• COBIT 2019 = 5 domains / 40 objectives: EDM 5, APO 14, BAI 11, DSS 6, MEA 4.
• 6 governance system principles; 7 components: processes; organisational structures; information flows; people/skills/competencies; culture/ethics/behaviour; services/infrastructure/applications; principles/policies/frameworks.
• Goals cascade: stakeholder needs → enterprise goals → alignment goals → governance/management objectives.
• Capability levels 0–5: Incomplete, Performed, Managed, Established, Predictable, Optimising; ratings N/P/L/F.
• Board is accountable for IT governance even when IT is outsourced.
• Three lines of defence: operations = 1st, risk & compliance = 2nd, internal audit = 3rd (independence).
• Steering committee = business + IT, prioritises and approves IT strategy and projects.
• Document hierarchy: policy (mandatory, business, states intent) → standard (mandatory, specific) → procedure (mandatory, step-by-step) → guideline (recommended).
• TOGAF ADM: Preliminary + A–H, Requirements Management at the centre, iterative.
• Zachman: What/How/Where/Who/When/Why × Planner/Owner/Designer/Builder/Subcontractor/Functioning enterprise.
• EA domains: Business, Data, Application, Technology — business-driven.
• Risk appetite vs tolerance vs capacity; inherent vs residual.
• Risk treatment: avoid, mitigate/reduce, transfer/share, accept — acceptance by the business owner, documented.
• Audit never owns risk.
• COSO ERM 2017: Governance & Culture, Strategy & Objective-Setting, Performance, Review & Revision, Information/Communication/Reporting (20 principles).
• SOX 302 = CEO/CFO certification; 404 = management assessment + auditor attestation of ICFR; 906 = criminal certification.
• GDPR: lawful basis, DSRs, DPO, DPIA, 72-hour breach notification, controller vs processor, fines up to EUR 20m or 4% of global turnover.
• PDPO (HK), Cap. 486: 6 Data Protection Principles; regulator = PCPD.
• PCI DSS = contractual, not law; 12 requirements; CDE scope.
• NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover.
• KRI warns / KPI measures performance / KGI confirms the goal.
• Data owner = business, accountable; steward/custodian = operational; IT = custody only.
• Classification: Public, Internal, Confidential, Restricted — drives the control baseline.
• SoD is preventive; mandatory vacation and job rotation are detective anti-fraud controls.
• SLA = customer; OLA = internal; UC = external supplier contract.
• SOC 1 = financial reporting; SOC 2 = trust services; Type 2 covers operating effectiveness over a period. Check period, scope, CUECs.
• QA is preventive/process; QC is detective/product.
• Cost of quality: prevention, appraisal, internal failure, external failure — external failure costs most.
• PDCA underpins ISO 9001 / 20000 / 27001; CMMI levels 1–5 = Initial, Managed, Defined, Quantitatively Managed, Optimising.