IPA IP 2021 Question 49

Management — in IT governance, management evaluates the use of IT and ensures that it serves the objectives of the business.

The description follows ISO/IEC 38500 (JIS Q 38500 in Japan), the international standard for the governance of IT, under which the governing body of an organization evaluates, directs and monitors the use of IT. Evaluating the current and future use of IT and ensuring that it is aligned with the business's objectives is therefore the role of management, who lead the organization and are accountable for its results. IT governance is established and led by management, not delegated to the IT department.

Answer (c)

Why not others:

• •(a) Shareholders — they own the company and hold management to account through corporate governance, but they do not evaluate the company's use of IT themselves
• •(b) Auditors — an auditor, such as a system auditor, checks IT controls independently and reports on them; this supports IT governance, but evaluating and directing the use of IT is management's role
• •(d) Person responsible for information systems — carries out the IT strategy that management directs; responsibility for IT governance lies with management as a whole, not with the IT function

Key rule: IT governance is management's responsibility: it evaluates, directs and monitors the use of IT so that IT serves the objectives of the business.

System Audit · AI-written, may contain errors