IT Governance and Risk Management
IT governance and risk management are central to the ISC discipline on the CPA exam. CPAs must understand how organizations align IT strategy with business objectives, manage IT-related risks, and ensure compliance with regulatory requirements.
IT Governance Frameworks
- COBIT (Control Objectives for Information and Related Technologies): Developed by ISACA, COBIT provides a comprehensive framework for IT governance and management. It defines processes across governance and management domains including Evaluate, Direct and Monitor (EDM); Align, Plan and Organize (APO); Build, Acquire and Implement (BAI); Deliver, Service and Support (DSS); and Monitor, Evaluate and Assess (MEA).
- ITIL (Information Technology Infrastructure Library): A set of best practices for IT service management (ITSM). ITIL covers service strategy, service design, service transition, service operation, and continual service improvement.
- ISO/IEC 27001: International standard for information security management systems (ISMS). Specifies requirements for establishing, implementing, maintaining, and continually improving information security.
- COSO Internal Control Framework: While not IT-specific, COSO's five components (control environment, risk assessment, control activities, information and communication, monitoring) apply directly to IT controls.
IT Risk Assessment
IT risk assessment identifies, analyzes, and evaluates technology-related risks:
| Step | Activity | Key Considerations |
|---|---|---|
| Identify | Catalog IT assets and threats | Hardware, software, data, people, processes; internal and external threats |
| Analyze | Assess likelihood and impact | Qualitative (high/medium/low) or quantitative (ALE = SLE x ARO) analysis |
| Evaluate | Prioritize risks against risk appetite | Risk heat maps, risk registers, risk tolerance thresholds |
| Treat | Select risk response strategy | Accept, mitigate (implement controls), transfer (insurance, outsourcing), or avoid |
IT General Controls (ITGCs)
ITGCs are policies and procedures that support the effective functioning of application controls:
- Access controls: Logical access (authentication, authorization, password policies, MFA) and physical access (server room security, badge access). Principle of least privilege ensures users have only the minimum access necessary.
- Program change controls: Change management processes ensure modifications are properly authorized, tested, approved, and implemented. Segregation between development, testing, and production environments is critical.
- Program development controls: SDLC controls ensure new systems are properly designed, developed, tested, and implemented through defined phases.
- Computer operations controls: Job scheduling, backup and recovery, incident management, and business continuity/disaster recovery planning.
Vendor and Third-Party Risk Management
Organizations increasingly rely on third-party service providers. CPAs must understand:
- Due diligence: Evaluating vendor security practices, financial stability, and regulatory compliance before engagement
- SOC reports: SOC 1 (financial reporting controls), SOC 2 (security, availability, processing integrity, confidentiality, privacy), SOC 3 (general-use summary). Type I reports assess design; Type II reports assess design and operating effectiveness over a period.
- Service Level Agreements (SLAs): Contractual commitments for uptime, response times, data handling, and breach notification procedures
- Ongoing monitoring: Regular assessment of vendor performance, security posture, and compliance status throughout the relationship
Business Continuity and Disaster Recovery
Business continuity planning ensures critical functions continue during and after a disruption:
- Business Impact Analysis (BIA): Identifies critical business processes, acceptable downtime (Recovery Time Objective, or RTO), and acceptable data loss (Recovery Point Objective, or RPO)
- Hot site: Fully equipped and operational recovery facility; fastest recovery but highest cost
- Warm site: Partially equipped facility; moderate recovery time and cost
- Cold site: Empty facility with basic infrastructure; longest recovery time but lowest cost
- Testing: Regular testing of DR plans through tabletop exercises, walkthroughs, simulations, and full interruption tests
Master IT governance with CPA flashcards and ISC mini exams. Start free to access all study materials.