Define IT Governance, list the three main governance tasks in the ISO/IEC 38500 model, enumerate the four domains of COBIT 5, and state the formula for ALE.

Here are the answers to Question One:

a) IT Governance definitions:

• According to Gartner, IT Governance is "the processes that ensure the effective and efficient use of IT in enabling an organization to achieve its goals."
• ISACA defines IT Governance as "the responsibility of the board of directors and executive management. It is an integral part of enterprise governance and consists of the leadership and organizational structures and processes that ensure that the organization's IT sustains and extends the organization's strategies and objectives."

b) The three main governance tasks according to the ISO/IEC 38500 model are:

• Evaluate: Assessing current and future use of IT.
• Direct: Guiding the preparation and implementation of IT policies and plans.
• Monitor: Checking compliance with policies and performance against plans.

c) The four domains of COBIT®5 Management processes are:

• Align, Plan and Organise (APO)
• Build, Acquire and Implement (BAI)
• Deliver, Service and Support (DSS)
• Monitor, Evaluate and Assess (MEA)

d) The formula for calculating Annualized Loss Expectancy (ALE) is:

$$\text{ALE} = \text{SLE} \times \text{ARO}$$

Where:

• ALE = Annualized Loss Expectancy: The expected monetary loss for an asset due to a risk over a one-year period.
• SLE = Single Loss Expectancy: The expected monetary loss each time a risk event occurs. It is calculated as Asset Value $\times$ Exposure Factor.
• ARO = Annualized Rate of Occurrence: The estimated frequency with which a threat is expected to occur within a year.

e) Five symptoms of poor IT Governance:

• IT projects consistently run over budget or behind schedule.
• Lack of alignment between IT strategy and overall business objectives.
• Frequent security breaches or compliance failures.
• Inefficient use of IT resources and technology investments.
• Lack of clear accountability for IT decisions and outcomes.