IT Governance & Risk Management Flashcards

Which of the following best describes the concept of 'risk appetite' in IT governance?

Answer: The total level of risk an organization is willing to accept in pursuit of its objectives

Risk appetite defines the broad level of risk an organization is willing to tolerate in pursuit of value, distinct from risk capacity (maximum survivable risk) and residual risk.

A CTO implements a new policy requiring quarterly IT risk reviews. Which governance principle does this MOST directly support?

Answer: Performance principle

ISO/IEC 38500's Performance principle requires that IT supports the organization effectively and that its performance is monitored and reviewed regularly.

When using a quantitative risk analysis approach, what does Annual Loss Expectancy (ALE) represent?

Answer: The expected monetary loss from a risk over a one-year period

ALE is calculated as Single Loss Expectancy (SLE) multiplied by Annual Rate of Occurrence (ARO), representing the expected yearly financial impact of a risk.

A regulated financial technology firm must comply with both SOX and PCI DSS. Where do these frameworks MOST commonly overlap in IT governance requirements?

Answer: Access controls and audit logging for sensitive systems

Both SOX (Section 404 IT controls) and PCI DSS require robust access controls and comprehensive audit logging for systems handling sensitive financial data.

In IT governance, what is the role of an IT steering committee compared to an IT governance board?

Answer: The steering committee coordinates ongoing IT initiatives at a tactical level; the governance board provides strategic oversight

IT steering committees typically operate at a management/tactical level coordinating projects and resources, while governance boards provide strategic direction and board-level oversight.

Which risk response is being used when an organization decides to discontinue a business process that introduces unacceptable cybersecurity risk?

Answer: Risk avoidance

Risk avoidance eliminates the risk entirely by not engaging in the activity or business process that creates the risk exposure.

A CTO wants to establish an IT governance maturity model baseline. Which tool is MOST appropriate for measuring IT governance capability maturity?

Answer: COBIT Performance Management (CPM)

COBIT Performance Management (formerly the Process Capability Model based on ISO/IEC 15504) is specifically designed to measure and benchmark IT governance and management process maturity.