ITPEC IP October 2020 Question 65

Directors — building and promoting IT governance is the responsibility of the company's management, the board of directors.

IT governance is the organizational ability to direct and control IT so that the IT strategy supports the business strategy. It is part of corporate governance: in ISO/IEC 38500 the governing body evaluates the use of IT, directs the plans and policies, and monitors performance and conformance. Only the directors have the authority to set IT strategy, decide who makes IT decisions and allocate resources across the whole company, so they can delegate the work but not the responsibility.

Answer (b)

Why not others:

• •(a) Shareholders — own the company and hold the directors accountable through the general meeting, but they do not build the company's internal mechanism for directing IT
• •(c) Employees — follow the policies and rules that IT governance sets and carry out the work under them
• •(d) Information system department members — carry out the IT strategy within the framework the directors set; IT governance spans the whole company, beyond one department

Key rule: Management establishes governance, departments carry it out, and auditors independently evaluate it; keep the three roles apart.

System Audit · AI-written, may contain errors