IT Governance & Risk Management Flashcards

What is the primary objective of IT general controls (ITGCs) in the context of SOX compliance?

Answer: To provide a foundation of reliability for application controls by governing the IT environment

ITGCs (covering change management, access controls, and operations) establish the control environment that application controls depend upon, making them foundational to SOX IT audit.

A healthcare IT organization experiences a ransomware attack. Under HIPAA, what is the FIRST governance action the CTO should initiate?

Answer: Activate the incident response plan and conduct a breach risk assessment to determine notification obligations

HIPAA requires a risk assessment to determine if PHI was compromised and whether the incident qualifies as a reportable breach before notification obligations are triggered.

Which approach to IT risk assessment involves assigning numerical values to threat likelihood and impact to calculate risk scores?

Answer: Quantitative risk assessment

Quantitative risk assessment assigns numerical probabilities and financial values to risks, enabling calculation of metrics like ALE and ROI on security controls.

A CTO is implementing a governance structure for a multinational organization where IT decisions need local flexibility but global consistency. Which model BEST supports this?

Answer: Federated IT governance

Federated IT governance balances central standards and policies with local autonomy, allowing regional units to adapt within globally set boundaries.

In the context of IT control frameworks, what is the difference between preventive and detective controls?

Answer: Preventive controls stop unwanted events from occurring; detective controls identify events that have already occurred

Preventive controls (e.g., access restrictions) block incidents before they occur, while detective controls (e.g., audit logs, IDS) identify incidents after they have taken place.

Which COSO component addresses how an organization identifies and responds to business risks, including IT risks, in achieving its objectives?

Answer: Risk assessment

The COSO Risk Assessment component requires organizations to identify risks to achieving objectives and analyze them to determine how they should be managed.

A CTO is asked to demonstrate IT governance value to the board. Which metric BEST illustrates the effectiveness of IT risk management over time?

Answer: Trend in residual risk scores across the IT risk register quarter-over-quarter

Tracking residual risk trends over time demonstrates whether risk management activities are actually reducing exposure, which directly shows governance effectiveness to the board.