Roles and Responsibilities in IT Governance

Effective IT governance requires clearly defined roles and responsibilities at every level of the organization. For CISA candidates, understanding who is responsible for what in the governance structure is critical for answering exam questions about accountability, oversight, and control.

The Board of Directors

The board of directors holds ultimate responsibility for IT governance. Their key responsibilities include:

Setting the strategic direction for IT and approving the IT strategy
Ensuring that IT risks are managed within the organization's risk appetite
Overseeing IT investment decisions and monitoring value delivery
Ensuring adequate IT resources are available
Reviewing and approving IT governance policies

The board delegates day-to-day governance activities but retains accountability for outcomes.

The Audit Committee

The audit committee is a subcommittee of the board with specific oversight responsibilities:

Overseeing internal and external audit activities, including IS audits
Reviewing the effectiveness of internal controls, including IT controls
Ensuring the independence of the audit function
Reviewing and approving the annual audit plan
Receiving and acting on significant audit findings

Senior Management

Chief Executive Officer (CEO)

The CEO is responsible for executing the board's strategic direction and ensuring that IT governance is embedded in organizational management practices.

Chief Information Officer (CIO)

The CIO leads IT strategy, planning, and operations. Key responsibilities include:

Developing and implementing the IT strategic plan
Managing IT resources and budgets
Ensuring IT service delivery meets business requirements
Reporting to senior management and the board on IT performance

Chief Information Security Officer (CISO)

The CISO is responsible for the organization's information security program:

Developing and maintaining information security policies and standards
Managing the information security risk assessment process
Overseeing security incident response and monitoring
Ensuring compliance with security-related regulations
Reporting on security posture to senior management

Chief Risk Officer (CRO)

The CRO oversees enterprise risk management, including IT risk, ensuring that risks are identified, assessed, and managed consistently across the organization.

IT Steering Committee

The IT steering committee bridges business and IT leadership:

Prioritizing IT projects and investments based on business value
Resolving conflicts between IT and business priorities
Monitoring major IT project progress and risks
Ensuring IT resources are allocated effectively

The committee should include representatives from both business units and IT leadership.

IT Management

IT managers and directors are responsible for implementing governance decisions:

Managing day-to-day IT operations
Implementing controls and security measures
Monitoring system performance and availability
Ensuring compliance with IT policies and standards

Data Owners, Custodians, and Users

Data owners: Business managers responsible for classifying data and defining access requirements
Data custodians: IT personnel responsible for implementing and maintaining controls over data as directed by data owners
Data users: Individuals who access and use data in the course of their job responsibilities

CISA Exam Tips

The exam frequently tests the distinction between data owners and data custodians. Remember that data owners (business side) make classification and access decisions, while data custodians (IT side) implement the technical controls. Also note that the board cannot delegate its ultimate accountability for IT governance, even though it delegates execution to management.