L6 · IT Governance
How IT is directed and controlled at board level: strategy, the steering committee, plans, performance, reengineering, and continuity. Maps to Domain 2 (Governance & Management of IT), with the continuity half in Domain 4.
Exam relevance. D2 is 18%. Governance questions test who decides and who is accountable — not which technology is deployed. The continuity material (BCP/DR, backup types) is D4 and heavily examined.
What IT governance is
IT governance provides a structure for aligning IT strategy with business strategy. By following a formal framework, organisations can produce measurable results toward achieving their strategies and goals.
- It specifies the level of integration and control.
- The value of IT must be fully incorporated into every aspect of the business.
- Auditing IT governance therefore reaches the highest levels of organisational management and crosses internal boundaries between divisions and departments.
Trap: IT governance is not the IT department's governance. It is the board's direction of IT, and it is audited upward — into the executive layer.
Strategy in organisational control
| Term | Definition from the lecture |
|---|---|
| Strategy | An adaptation of behaviour or structure, with an elaborate and systematic plan of action |
| Corporate governance | The ethical behaviour of corporate executives toward shareholders and stakeholders, to maximise the return on financial investment |
| Directional strategy | Selected progress focused on client needs and how to fulfil that market — achieved through critical success factors and designed marketing initiatives |
Management must define a strategy and provide for effective corporate governance. Two high-level objectives the auditor verifies:
- A monitoring process for assurance practices — senior executives must understand what is actually happening in the organisation.
- Strategic alignment between IT and enterprise objectives — proper planning deploys resources in the right place for the right reason.
And the commercial rule the slides state plainly: every business exists to make money, and should be neither hampered by a particular technology nor tied to a particular vendor.
The IT Steering Committee
Also called the IT Strategy Committee. It conveys current business requirements from business executives to the IT executive. It should have a formal charter designating each member's participation and granting responsibility and authority — conceptually similar to an audit charter.
Lack of a steering committee → lack of formal controls. That sentence is the exam answer.
Seats at the table and what each brings
| Function | What they contribute |
|---|---|
| Marketing | Attracts buyers; the finest product is irrelevant without a steady stream of purchasers |
| Manufacturing / software development | Aligns production effort to sales effort |
| Sales | Converts prospects into closed sales; wants technology that facilitates more sales |
| Finance | Financial guidance and budgeting; approves projects and obtains funding |
| Legal | Ensures legal compliance; protects against excessive liability or undue risk from control failure |
| Quality control | Consistency in operations, manufacturing, risk mitigation; QC failure damages market image or creates liability |
| R&D | Creates and improves products that generate future revenue |
| Project management | Advises on current and proposed projects |
| Information technology | Listens to business ideas and acts as liaison to facilitate IT involvement |
| Human resources | Compliance with local labour standards — non-compliance carries penalties |
| Labour management | Executive representative of the labour organisation (union) |
| Administration | Bookkeeping, record keeping, paperwork — every executive is handicapped without it |
The decision flow
- Steering committee reviews ideas and opportunities, and makes recommendations.
- Recommendation goes to the board of directors for review.
- If approved, steering committee executives perform a final review comparing total cost and benefit to determine go / no-go.
- On approval, resources are allocated for project planning — project charters, funds, project plan.
Three types of policy
| Type | What it does | Example |
|---|---|---|
| Advisory | Explains the condition to be prevented, and gives notice of the consequences of failure. The interested party may be an employee | Acceptable use of the Internet |
| Regulatory | Indicates the policy is mandated by law; failure results in criminal liability | Statutory record-keeping |
| Informational | Informs the public of the organisation's operating policies | Customer privacy policy, refund policy, exchange policy |
Trap: the tell is the audience and consequence. Advisory = internal behaviour + consequence; regulatory = law + criminal liability; informational = public-facing.
The IT Strategy Plan and its children
The IT strategy plan must be created to aid fulfilment of long- and short-term business objectives. The IT plan should correlate to a specific organisational goal — e.g. expand e-commerce, improve operating speed through better software integration, implement a new CRM.
| Plan | Covers |
|---|---|
| Data plan | Supports the organisation's intended use of data (e.g. a customer-survey system, database marketing). Once intended use is recognised, define the application that manipulates the data |
| Application management plan (software management plan) | Applications must be tailored to client needs. Software is not an advantage if competitors run the same package — unless implementation is unique and highly customised. Account for required knowledge, lead time and additional cost |
| Technology plan | The technical environment: the types of hardware and software to be used |
| Facilities plan | Location of data applications and related technology; who manages the environment; increased control, insourcing, outsourcing or a hybrid |
Sequencing question the slides pose: software requirement → hardware requirement, or hardware → software? Requirements drive acquisition: define what the business needs, then the platform that satisfies it.
"Follow the sun"
A delivery model where work passes between time zones so that development or support continues around the clock. It buys elapsed-time speed at the cost of coordination, handover quality and communication risk.
Oversight, tactics and performance
- Executive performance review — done by the audit committee. An effective committee advises individual executives with an opinion on possible solutions to internal problems.
- Independent auditors are hired by the audit committee to give an independent opinion on the status of internal controls.
- Tactical management — selecting a manoeuvre or technique that produces a better result. Goal: manage the return on investment for information systems. Requires collecting performance metrics. Tactical individuals support strategic objectives handed down from the top; director level is expected to fulfil them.
- Performance management — inform executives and stakeholders of progress using a fair and objective scoring system. KPIs represent a historical average of monitored events, so the score may indicate a problem too late to act.
Trap: a KPI is a lagging indicator. "KPI review replaces monitoring" is wrong — monitoring detects, KPIs summarise.
Business Process Reengineering
Definition: the fundamental rethinking and radical redesign of business processes to bring about dramatic improvements in critical measures of performance — reducing cost while increasing performance.
Drivers: business efficiency (learning curve), improved techniques, new requirements.
| Step | What happens |
|---|---|
| Envision | Envision a need, gain organisational sponsorship, define the areas to be reviewed |
| Initiate | Assign the BPR team, set goals, plan the projects |
| Diagnose | Document existing processes, identify new requirements and values |
| Redesign | Develop and document the new process, ensuring it meets strategic objectives |
| Evaluate | Monitor the new process to confirm it works and to establish improvement goals |
Auditor's stance on BPR: the auditor does not redesign the process (that is a self-review threat). The auditor evaluates whether the redesign was authorised, whether controls survived it, and whether the promised benefit was measured.
Disaster recovery vs business continuity
| Disaster recovery | Business continuity | |
|---|---|---|
| Focus | Rebuilding and recovering after a disaster | Revenue — capital, investors, customer payments |
| Question | How do we restore IT? | How does the business keep earning? |
IT governance requires continuity planning for systems and data.
Insurance is a corrective administrative control
It does not replace lost market share, and does not undo damage from unauthorised disclosure of confidential information. Insurance transfers financial loss, not accountability or reputation.
BCP phases (in order)
- Initiation — get a sponsor
- Risk analysis — document and prioritise current risks
- Business impact analysis — develop a low-level business process blueprint and determine what is needed to sustain the business
- Create strategy — use the risk analysis and BIA to formulate a strategy based on facts and evidenced assumptions
- Emergency response — integrate the planned strategy with the first responders
- Plan creation — create and organise the plan document
- Training — teach individuals the required functions of the BC/DR plan
- Maintain and test — keep practising; a change control system keeps the documentation current
- Communications — keep clients, investors, partners, employees and stakeholders informed
- Integrate with other organisations — business partners, suppliers, clients and agencies
Trap: a plan that is never tested is a document, not a control. Maintenance and testing come after training and are continuous.
Backup strategy — the classic comparison
| Type | What is copied | Restore needs | Trade-off |
|---|---|---|---|
| Full | Everything, every time | The last full backup alone | Simplest and fastest to restore; slowest and most storage-intensive to run |
| Incremental | Everything changed since the last backup of any kind | The last full plus every incremental in sequence | Fastest, smallest daily job; slowest and most fragile restore — one missing tape breaks the chain |
| Differential | Everything changed since the last full backup | The last full plus the latest differential | Middle ground: grows daily, but restore needs only two sets |
Decide by RTO/RPO: tight recovery time favours full or differential; tight backup window and storage budget favours incremental. Encryption of backups is a control, and off-site/offline copies are what survive ransomware.
Insurance types
| Policy | Covers |
|---|---|
| Property | Loss of or damage to physical property |
| Casualty | Legal liability for losses caused by injury to other people (e.g. robbery) |
| Fidelity | Protects the employer from theft by a dishonest employee |
| Omissions and errors | Administrative omissions and errors by corporate executives |
| Machines | Accidental loss to machinery and equipment |
| Business interruption | Consequential loss of earnings due to property loss |
TRAPS
- No steering committee = no formal controls.
- Steering committee recommends; the board approves; then cost-benefit decides go/no-go.
- Policy types: advisory (behaviour + consequence) · regulatory (law + criminal liability) · informational (public).
- IT governance is audited upward, into executive management.
- Insurance is corrective and administrative — and does not restore reputation or market share.
- Full / incremental / differential: restore chain length is the discriminator.
- BPR is radical redesign, not incremental improvement — and the auditor does not do the redesign.
- DR rebuilds IT; BC protects revenue.
- A KPI is historical — it reports the past.
- Business can be constrained by technology or vendor lock-in — both are governance findings.
60-second recall
- IT governance = structure aligning IT strategy with business strategy, with measurable results.
- Two auditor objectives: assurance monitoring for executives · IT–enterprise strategic alignment.
- Steering committee = IT Strategy Committee, needs a formal charter; absence = lack of formal controls.
- Decision flow: recommend → board review → cost/benefit → resources allocated.
- Policy types: advisory · regulatory · informational.
- Plans: IT strategy → data · application management · technology · facilities.
- Audit committee hires independent auditors and reviews executive performance.
- BPR: envision → initiate → diagnose → redesign → evaluate.
- DR rebuilds; BC protects revenue.
- BCP phases: initiation · risk analysis · BIA · strategy · emergency response · plan creation · training · maintain & test · communications · integration.
- Backups: full (one set) · incremental (chain) · differential (full + latest).
- Insurance: property · casualty · fidelity · omissions & errors · machines · business interruption.