ITPEC IP April 2025 Question 63

Management — establishing IT governance is the responsibility of the company's management, the board and the executives.

IT governance is the organizational ability to direct and control IT so that the IT strategy supports the business strategy. It is part of corporate governance: in ISO/IEC 38500 the governing body evaluates the use of IT, directs the plans and policies, and monitors performance and conformance. Only management has the authority to set IT strategy, decide who makes IT decisions and allocate resources across the whole company, so it can delegate the work but not the responsibility.

Answer (b)

Why not others:

• •(a) Shareholders — own the company and hold management accountable through the general meeting, but they do not build the company's internal mechanism for directing IT
• •(c) System auditor — independently checks and evaluates whether IT governance and controls work; an auditor who established them would be auditing their own work
• •(d) Head of the systems department — carries out the IT strategy within the framework management sets; IT governance spans the whole company, beyond one department

Key rule: Management establishes governance, departments carry it out, and auditors independently evaluate it; keep the three roles apart.

System Audit · AI-written, may contain errors