IPA IP 2026 Question 41
A question IPA Japan published in 令和8年度 ITパスポート試験 公開問題 問41, translated into English. ITPEC is based on the same exams.
In the activities of IT governance, which of the following is the most appropriate description of a risk concerning the leadership of the board of directors, etc.?
Explanation
Without norms set and followed by the board, ethical behavior does not take hold — in IT governance the board of directors, etc. leads by example, and failing to do so is a leadership risk.
IT governance (ISO/IEC 38500, and in Japan METI's System Management Standards built on it) puts the board of directors, etc. in charge of evaluating, directing and monitoring the organization's use of IT. Its leadership role includes setting the norms (a code of conduct) for IT use and being the first to observe them. If the board does not, staff see that the rules are not taken seriously, and ethical behavior is not instilled in the organization: that is the risk in (c).
Answer (c)
Why not others:
- •(a) — authority can be delegated, but accountability cannot: the board stays finally responsible for the IT strategy it had prepared, so handing the final responsibility to the department is the mistake, not the safeguard
- •(b) — the board should take part in setting the expected performance of the organization; leaving it out is what weakens governance
- •(d) — a clear IT governance policy from the board is what keeps IT from being run by the information systems department alone; the risk is the board failing to state it
Key rule: In IT governance the board of directors cannot delegate accountability, and it leads by setting the policy and norms and observing them first.
System Audit · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.