Domain 2: Governance and Management of IT
How the board and management direct, control and measure IT so it supports business objectives and manages risk.
Revising? All of this domain's slides in one deck. When you're done, take the domain quiz.
Governance
- IT Governance vs. IT Management The difference between steering (governance) and rowing (management), what IT governance tries to achieve, and how to spot which one a question is about.
- Board and Senior Management Roles Who's responsible for what in IT governance, from the board down to the data owner, and why 'senior management support' is so often the right answer.
- IT Steering Committee The group that decides which IT projects go ahead and keeps them on track: who should be on it, what it does, how it differs from the IT strategy committee, and what the auditor checks.
- IT Strategy and Business Alignment Why IT strategy must grow out of business strategy, the difference between long-term and yearly IT plans, and how an auditor checks that they actually line up.
- Balanced Scorecard Measuring IT from four angles instead of just the budget, and why the board needs more than money figures to judge how IT is doing.
- COBIT ISACA's framework for governing and managing IT: the five domains and what lives in each, the components of a governance system, and how auditors use COBIT as a yardstick.
- ITIL The best-known guide to running IT as a set of services: where it fits next to COBIT and ISO 20000, and the practices (incident, problem, change and others) that keep turning up on the exam.
- ISO 27001/27002 The international standards for running information security: what an ISMS is, the difference between 27001 and 27002, the Statement of Applicability, and what a certificate does (and doesn't) prove.
- COSO: ERM and Internal Control The most widely used definition of internal control: its five components, why the control environment comes first, and how COSO's risk framework differs.
Organization and policy
- Policies, Standards, Procedures, Guidelines The four kinds of governance document, from broad intent to step-by-step instructions, who approves each, and how an auditor tells whether they actually work.
- IT Organizational Structure and Key Roles The IT jobs the exam expects you to know, what each one should and shouldn't do, and why where a role reports matters as much as what it does.
- Segregation of Duties in IT The IT-specific jobs that should never sit with one person, how to find conflicts in real system access, and what to do in a small IT team.
- Enterprise Architecture (Zachman, TOGAF) A map of the organisation's processes, data, applications and technology, used to steer IT investment. Plus the two frameworks the exam names.
Risk
- Risk Management Process How organisations find, rank and deal with IT risks, step by step, who owns each part, and the 'what comes first?' questions the exam loves.
- Qualitative vs. Quantitative Risk Assessment Two ways to size up a risk: descriptive ratings like high, medium and low, or money and probabilities. Includes the ALE formulas, worked through with real numbers.
- Risk Responses: Mitigate, Transfer, Avoid, Accept The four things you can do about a risk, when each makes sense, who gets to decide, and the exam's favourite misunderstandings about insurance and acceptance.
- Risk Appetite and Residual Risk How much risk an organisation is willing to take, how that differs from how much it could survive, and why the goal of controls is 'acceptable', not 'zero'.
Management
- Maturity Models (CMMI) Rating how well-run a process is on a scale from chaotic to continuously improving, what each CMMI level means, and why the right target isn't always the top.
- KPIs and KGIs Three kinds of indicator: did we reach the goal (KGI), is the process on track (KPI), and is risk growing (KRI). Plus what makes a metric actually useful.
- Outsourcing: Benefits and Risks Why organisations hand IT work to outside providers, what can go wrong, the controls that keep it safe, and the one rule the exam never lets go of: accountability stays with you.
- Vendor Selection, Contracts, SLAs, Right to Audit Choosing a vendor properly, what a good IT contract contains, how service level agreements work, and why 'right to audit' and 'escrow' matter.
- Cloud and Offshore Governance Who's responsible for what in the cloud, why data location matters, how to get assurance over a cloud provider, and the extra risks of offshore outsourcing.
- Portfolio and Resource Management Treating IT spending like an investment portfolio: choosing the best mix of projects, stopping the ones that no longer make sense, and managing people, budgets and software licences.
- HR: Hiring, Training, Termination The people controls that matter for IT and security: screening new staff, training, job rotation and mandatory leave, and removing access when people move or leave.
- Legal and Regulatory Compliance How an organisation keeps track of the laws, regulations and contracts that affect its IT, and how an auditor checks it's on top of them.
- Quality Management Making sure IT delivers consistently good results: quality management systems, ISO 9001, and the difference between quality assurance and quality control.