Information Architecture

Information Architecture in CGEIT: Governance of Enterprise IT Guide

Introduction
Information Architecture is a key concept within Domain 1 (Governance of Enterprise IT) of the ISACA CGEIT certification. It sits inside the wider topic of Enterprise Architecture (EA). To answer exam questions well, you need to see it the way a governance professional does: as a strategic tool for aligning information assets with business objectives, enabling value delivery and managing risk.

What is Information Architecture?
Information Architecture (IA) is the structured design, organization and management of an enterprise's information assets. It defines:
• what information the enterprise needs;
• where that information resides;
• how it flows between processes, systems and stakeholders;
• who owns it and who is accountable for it;
• how it is classified, protected, retained and disposed of.

In frameworks such as TOGAF, Information Architecture is part of the Information Systems Architecture, together with Application Architecture. It also links closely to Business Architecture and Technology Architecture. In COBIT 2019, it is addressed mainly through:
• APO03 (Managed Enterprise Architecture);
• APO14 (Managed Data);
• the Information component of the governance system.

In short, IA is the blueprint that turns raw data into reliable, accessible and secure information that supports decision making.

Why is Information Architecture Important?
• Strategic alignment: Information investments directly support business goals and strategy.
• Value delivery: Well-structured information improves decision quality, reduces duplication and supports innovation, analytics and digital transformation.
• Risk optimization: Clear ownership, classification and data flows support security, privacy and regulatory compliance (for example GDPR and SOX) and business continuity.
• Resource optimization: It removes redundant data stores, inconsistent definitions and costly integration problems.
• Performance measurement: Consistent, trusted data allows meaningful KPIs and reporting to the board.
• Interoperability and agility: Common data models and standards make mergers, system replacements and cloud adoption easier.
• Information as an asset: Governance bodies increasingly treat information as a strategic asset that must be governed like financial or human capital.

Key Components of Information Architecture
• Data models: Conceptual, logical and physical models that describe entities, attributes and relationships.
• Data dictionary and metadata: Standard definitions that ensure a common understanding across the enterprise.
• Data classification scheme: Levels such as public, internal, confidential and restricted, based on business value and sensitivity.
• Data ownership and stewardship: Business owners are accountable for data. Data stewards and custodians (often IT) manage it day to day.
• Information life cycle: Plan, design, build or acquire, use and operate, monitor, dispose (the COBIT information life cycle).
• Data flows and integration: How information moves between applications, partners and stakeholders.
• Information quality criteria: Accuracy, completeness, timeliness, consistency, relevance, accessibility and security. COBIT groups these as intrinsic, contextual and security/accessibility quality.
• Master data and reference data management: A single, trusted source of truth for core entities such as customers, products and suppliers.
• Standards and policies: Data governance policies, naming conventions, retention schedules and privacy rules.

How Information Architecture Works in a Governance Context
1. Understand business strategy and requirements: The board and executive management set direction, and IA starts with the information the business needs to achieve its goals.
2. Define the current (baseline) state: Inventory the information assets, data stores, flows, owners and quality issues.
3. Define the target state: Design the future information architecture that is aligned with strategy and EA principles.
4. Perform gap analysis: Identify the differences and build a roadmap of initiatives, prioritised by value and risk.
5. Establish governance structures: This includes:
  • an Architecture Review Board;
  • a data governance council;
  • clearly defined roles (data owners, stewards, custodians);
  • RACI charts.
6. Implement policies and standards: Cover classification, quality, retention, privacy and security.
7. Integrate with portfolio management: New investments are checked for compliance with the architecture before approval.
8. Monitor and evaluate: Use metrics such as data quality scores, the number of architecture exceptions, compliance findings and the level of reuse of shared data services.
9. Continuously improve: Update the architecture as strategy, regulation and technology change.

This follows the governance pattern of Evaluate, Direct and Monitor (EDM):
• the board evaluates information needs;
• the board directs through principles and policies;
• the board monitors compliance and performance.

Roles and Responsibilities
• Board and executive management: Approve information principles and strategy, and accept residual information risk.
• Enterprise/Chief Architect: Develops and maintains the architecture.
• Chief Data Officer: Leads the data governance program, where this role exists.
• Business data owners: Accountable for classification, access approval and data quality.
• Data custodians (usually IT): Implement the controls, backups and storage.
• Data stewards: Maintain definitions and quality on a day-to-day basis.

Common Challenges
• Siloed data and inconsistent definitions across business units.
• Lack of business ownership, where IT is wrongly treated as the data owner.
• Architecture seen as an IT-only exercise with no executive sponsorship.
• Shadow IT and uncontrolled cloud data stores.
• Overly complex architecture documents that nobody uses.

Exam Tips: Answering Questions on Information Architecture
• Think like a board advisor, not a technician. CGEIT rewards answers about strategic alignment, value, risk and accountability. Avoid technical detail such as database design choices.
• Business owns the data. If a question asks who is accountable for classifying data or approving access, the answer is the business or data owner, not IT, the DBA or the security officer.
• Start with business strategy and requirements. When asked about the FIRST step in developing an information architecture, choose the option about understanding business objectives or information needs. Do not pick tool selection or technical design.
• Look for the governance answer. Prefer options about establishing principles, policies, frameworks and governance structures over operational fixes.
• Most important benefit: Usually alignment of information with business goals, or enabling consistent, high-quality information for decision making.
• Link to Enterprise Architecture. IA is part of EA. Questions may test that new projects should comply with architecture standards and that exceptions go through a formal review board.
• Gap analysis is central. Baseline, then target, then gaps, then roadmap. If a question asks how to prioritise information initiatives, choose value and risk to the business.
• Know the COBIT references. APO03 covers Enterprise Architecture, APO14 covers data management, and Information is one of the seven governance components.
• Classification drives protection. Controls should match classification. Classification must come before selecting security controls.
• Watch for distractors. Answers that are technically correct but operational (for example, implement encryption or buy an MDM tool) are often wrong when a governance-level option exists.
• Words like BEST, MOST, PRIMARY and FIRST matter. Eliminate answers that are true but not the highest-level or earliest step.
• Stakeholder involvement. The architecture succeeds when business stakeholders participate. Answers that involve executive sponsorship and business engagement are usually strong.
• Metrics. Good IA metrics are business-relevant: data quality levels, reduction in redundant data, compliance with architecture standards and time to deliver information.

Sample Question
An enterprise is struggling with inconsistent customer data across multiple systems. Which of the following should the IT governance committee recommend FIRST?
A. Purchase a master data management tool
B. Define data ownership and enterprise-wide information standards
C. Consolidate all databases into a single platform
D. Increase data entry training

Answer: B. Establishing ownership and standards is the governance foundation. Tools, consolidation and training follow later.

Summary
Information Architecture is the governance-driven blueprint for managing information as a strategic asset. It aligns information with business strategy, assigns clear ownership, ensures quality and protection, and supports value delivery and risk management. In the exam, always favour business-driven, principle-based, accountability-focused answers over technical or operational ones.