IT Governance and Control Frameworks

1. Why IT Governance and Control Frameworks Matter

Almost every strategic, operational, financial, and compliance objective in a modern organization depends on technology. Revenue systems, customer data, supply chains, financial reporting, and regulatory compliance all run on IT. If IT is poorly governed, the organization cannot reliably achieve its objectives, protect its assets, or demonstrate accountability to stakeholders. This is why the IIA treats IT governance as an integral component of organizational governance rather than a separate technical topic.

For the CRMA candidate, the subject is important for three reasons:
- It is explicitly required by the Standards. The IIA Standards (Standard 2110.A2 in the 2017 framework, and the governance-related requirements carried forward into the Global Internal Audit Standards) state that the internal audit activity must assess whether the information technology governance of the organization supports the organization's strategies and objectives.
- IT risk is enterprise risk. Cyber threats, data privacy breaches, system outages, failed IT projects, third-party and cloud dependencies, and emerging technologies (AI, robotic process automation) are consistently among the top risks reported by boards. Risk management assurance that ignores IT is incomplete.
- Frameworks give you a shared language. Control frameworks such as COBIT, ISO/IEC 27001, NIST, ITIL, and COSO allow risk managers, auditors, IT, and the board to evaluate maturity and control adequacy against recognized benchmarks rather than personal opinion.

2. What IT Governance Is

IT governance is the system by which the current and future use of IT is directed and controlled. It consists of the leadership, organizational structures, and processes that ensure IT sustains and extends the organization's strategies and objectives. Key points to remember:
- It is a board and senior management responsibility, not just the responsibility of the Chief Information Officer. The board sets direction, approves IT strategy and risk appetite, and holds management accountable.
- It is a subset of enterprise governance. The IIA defines governance as the combination of processes and structures implemented by the board to inform, direct, manage, and monitor the activities of the organization toward achieving its objectives. IT governance applies that same definition to technology.
- It is distinct from IT management. Governance is about evaluating, directing, and monitoring (deciding what should be done and whether it is being done); management is about planning, building, running, and monitoring (actually doing it). COBIT makes this distinction explicitly.

The commonly cited five focus areas of IT governance are:
1. Strategic alignment - IT plans support and are integrated with business plans.
2. Value delivery - IT delivers the promised benefits on time and within budget.
3. Risk management - IT risks are identified, assessed, and treated within the organization's risk appetite.
4. Resource management - people, applications, infrastructure, information, and funding are optimized.
5. Performance measurement - metrics, balanced scorecards, and reporting track IT outcomes.

3. What IT Control Frameworks Are

A control framework is a structured set of principles, practices, and control objectives that an organization can adopt to design, implement, and evaluate controls. In the IT space the most frequently examined frameworks are:

COBIT (Control Objectives for Information and Related Technologies) - published by ISACA. It is the most comprehensive governance and management framework for enterprise IT. COBIT 2019 is built on six governance system principles (provide stakeholder value, holistic approach, dynamic governance system, governance distinct from management, tailored to enterprise needs, end-to-end governance system) and organizes 40 governance and management objectives into domains: Evaluate, Direct and Monitor (EDM) for governance, and Align/Plan/Organize (APO), Build/Acquire/Implement (BAI), Deliver/Service/Support (DSS), and Monitor/Evaluate/Assess (MEA) for management. COBIT also provides a capability and maturity model used to assess how well processes are performed.

ISO/IEC 27001 and 27002 - international standards for information security management systems (ISMS). ISO 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS and is certifiable. ISO 27002 provides the catalogue of security controls (organizational, people, physical, technological) and implementation guidance. Uses the Plan-Do-Check-Act approach.

NIST Cybersecurity Framework (CSF) - a risk-based framework from the U.S. National Institute of Standards and Technology organized around core functions: Govern (added in CSF 2.0), Identify, Protect, Detect, Respond, and Recover. Widely used as a plain-language structure for discussing cyber risk with boards. NIST SP 800-53 provides detailed security and privacy controls.

ITIL (Information Technology Infrastructure Library) - a set of best practices for IT service management (incident, problem, change, release, service level, and configuration management). ITIL is about delivering IT services effectively rather than governance per se, but its change and incident processes are key sources of IT general controls.

COSO Internal Control - Integrated Framework and COSO ERM - not IT-specific but foundational. COSO's five components (control environment, risk assessment, control activities, information and communication, monitoring) and 17 principles include Principle 11: the organization selects and develops general control activities over technology. COBIT is often described as the IT-level framework that maps to COSO at the entity level.

IIA GTAGs (Global Technology Audit Guides) - IIA supplemental guidance on topics such as IT governance, change management, identity and access management, cybersecurity, and auditing IT general controls. These are practical references for auditors and frequently reflected in exam content.

Other frameworks you may see referenced: PCI DSS (payment card data), the ISO 31000 risk management standard, ISO 38500 (corporate governance of IT), and privacy regulations such as GDPR that drive control requirements.

4. How IT Governance and Controls Work in Practice

Structures. Typical structures include the board (often through an audit, risk, or technology committee), an IT steering committee of senior business and IT executives that prioritizes investments, the CIO or CTO, a Chief Information Security Officer (CISO), data owners and data stewards, and an IT risk function. Enterprise architecture and project/portfolio management offices support alignment.

Processes. Governance processes include IT strategic planning, investment approval and benefits realization, IT risk assessment integrated with ERM, policy setting (acceptable use, information security, data classification, change management), and performance reporting through dashboards, KPIs, and KRIs.

Controls. IT controls are usually grouped into two layers:
- IT General Controls (ITGCs) apply across the IT environment and support the reliability of all applications. Core categories are: logical access and security (provisioning, deprovisioning, privileged access, authentication, segregation of duties), change management (authorization, testing, approval, and migration of program changes), computer operations (job scheduling, backup and recovery, incident management), and system development/acquisition (SDLC). Weak ITGCs undermine confidence in every application control.
- Application Controls are embedded in specific business applications and ensure completeness, accuracy, validity, and authorization of transactions: input controls (edit checks, validation, field formats), processing controls (control totals, reasonableness checks, interface reconciliations), and output controls (report distribution, review, reconciliation). Application controls can be automated or manual (IT-dependent manual controls).

Risk management integration. Good IT governance embeds IT risk into the enterprise risk management process: risk appetite statements include technology and cyber tolerances; risk registers include IT risks with owners; the three lines model applies, with IT operations as the first line, IT risk/security/compliance functions as the second line, and internal audit as the third line providing independent assurance. Third-party and cloud providers introduce additional risk requiring SOC 1 / SOC 2 reports, right-to-audit clauses, and vendor risk management.

Maturity and capability assessment. Frameworks allow management and auditors to rate processes on a scale (for example, COBIT capability levels 0 to 5, or ad hoc / repeatable / defined / managed / optimized). Assurance providers compare the current state to the target state set by the board and report gaps as governance or control deficiencies.

5. The Role of Internal Audit and Risk Management Assurance

In the CRMA context the key question is: how does the internal auditor provide assurance over IT governance? Remember these points:
- Internal audit must assess IT governance (Standard 2110.A2) and should include IT governance in the risk-based audit plan. The assessment considers whether structures, strategy, risk management, and performance measurement for IT support organizational objectives.
- Internal audit should evaluate the design and operating effectiveness of ITGCs and application controls, usually as part of integrated audits of business processes.
- Internal audit should assess whether IT risk assessment is comprehensive, aligned with enterprise risk appetite, and updated for emerging technology, cyber threats, and third parties.
- Internal audit remains independent: it may advise and facilitate, but management owns IT risk and controls. Internal audit should not set IT risk appetite, implement controls, or make management decisions.
- Internal audit must possess or obtain sufficient competency in IT (Standard 1210.A3 requires knowledge of key IT risks and controls and available technology-based audit techniques; the CAE must obtain competent advice when staff lack the skills).
- Frameworks are used as criteria. When no internal criteria exist, auditors use recognized frameworks such as COBIT, ISO 27001, or NIST as the benchmark for evaluating adequacy.

6. Exam Tips: Answering Questions on IT Governance and Control Frameworks

Tip 1 - Anchor on the Standards. If a question asks what internal audit must do regarding IT governance, the answer is assess whether it supports the organization's strategies and objectives. Avoid options that have internal audit designing, owning, or approving IT strategy or controls.

Tip 2 - Governance versus management. When an option describes evaluating, directing, and monitoring at the board level, it is governance. When it describes planning, building, running, and monitoring day-to-day activity, it is management. The exam tests this distinction, often using COBIT terminology.

Tip 3 - Match the framework to its purpose. COBIT = enterprise IT governance and management, broadest scope. ISO 27001 = information security management system, certifiable. NIST CSF = cybersecurity risk functions (Govern, Identify, Protect, Detect, Respond, Recover). ITIL = IT service management. COSO = entity-level internal control and ERM, with COBIT mapping underneath. If a question asks for the framework an organization would use to benchmark overall IT governance, choose COBIT; for information security certification, choose ISO 27001; for service management, choose ITIL.

Tip 4 - ITGCs come before application controls. If ITGCs over access or change management are weak, the auditor cannot rely on automated application controls. Questions that describe weak change management and ask about the impact on reliance should lead you to reduce reliance and expand substantive testing.

Tip 5 - Classify the control correctly. Edit checks, validation, control totals, and reconciliations are application controls. Password policies, user access reviews, change approval, and backups are general controls. Be able to identify preventive, detective, and corrective examples and whether a control is automated or manual.

Tip 6 - Think board first. Where a scenario describes IT projects misaligned with business strategy, cost overruns, or no IT risk appetite, the root cause is usually a governance failure at the board or steering committee level, not a technical issue. The best answer typically involves establishing or strengthening the IT steering committee, board oversight, or strategic alignment processes.

Tip 7 - Apply the three lines model. IT operations and business owners are the first line, information security and IT risk functions are the second line, and internal audit is the third line. Options that blur these lines (for example internal audit monitoring security alerts as a routine operational duty) are usually wrong.

Tip 8 - Use frameworks as criteria, not as rules. Recognized frameworks are tailored to the organization. An answer stating that an organization must implement every COBIT or ISO control regardless of size or risk is too absolute. The best answers emphasize risk-based tailoring and alignment with risk appetite.

Tip 9 - Watch for competency and independence cues. If the audit team lacks IT expertise, the correct response is for the CAE to obtain competent advice or co-source, not to decline the engagement or to rely solely on management's assertions.

Tip 10 - Eliminate extremes. Options containing words like always, never, all, or guarantee are usually incorrect. Prefer options that use risk-based, independent, objective, and aligned with organizational objectives.

Tip 11 - Read the question stem for the perspective. Determine whether the question is asked from the viewpoint of the board, management, the risk function, or the internal auditor. The best answer differs by role: the board sets direction and appetite, management designs and operates controls, and internal audit provides independent assurance.

7. Quick Review Summary

- IT governance is part of enterprise governance; it is a board responsibility and is distinct from IT management.
- Five focus areas: strategic alignment, value delivery, risk management, resource management, performance measurement.
- Internal audit must assess whether IT governance supports strategies and objectives, using recognized frameworks as criteria.
- COBIT (governance and management of enterprise IT), ISO 27001/27002 (information security), NIST CSF (cybersecurity), ITIL (service management), COSO (entity-level internal control and ERM), GTAGs (IIA guidance).
- ITGCs (access, change, operations, development) support application controls (input, processing, output).
- Three lines model applies to IT risk: operations, risk and security functions, and independent internal audit.
- Exam answers favor risk-based tailoring, board-level accountability, independence of internal audit, and correct framework-to-purpose matching.