ITPEC IP April 2018 Question 64
Which of the following is the most appropriate phrase to be inserted in blank A in the description below concerning IT control in a company?
A company formulates an effective IT strategy, aiming to A of the organization according to its business strategy, and establishes the life cycle of planning, development, operation, and maintenance of the information systems on the basis of this IT strategy. In order to reduce the risks surrounding the information systems, IT controls are implemented and operated.
Explanation
Implement IT governance — a company forms an IT strategy aligned with its business strategy in order to govern IT across the organization.
IT governance is the organization's ability to direct and control its use of IT so that IT follows the business strategy: forming the IT strategy, running the life cycle of planning, development, operation and maintenance on that basis, and putting IT controls in place to manage risk. The passage describes exactly that chain, from business strategy to IT strategy to controls, so the blank is the purpose of the whole: implementing IT governance.
Answer (a)
Why not others:
- •(b) implement system audit — a system audit independently checks whether the controls work; it evaluates governance but is not what the IT strategy aims at
- •(c) establish information literacy — the ability of individuals to find and use information; a personal skill, not an organization-wide control structure
- •(d) establish software development standards — covers only the development phase, not the whole life cycle and its controls
Key rule: IT governance means directing IT by the business strategy and controlling it through the life cycle; the system audit is the independent check on it.
System Audit · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.