In organizational governance, which statement best explains its relationship to risk management and strategy?

• A. Governance is solely about policy creation, with no impact on risk management.
• B. Governance handles only regulatory compliance, ignoring risk or strategy.
• C. Governance ensures IT strategy aligns with business objectives and incorporates risk management practices throughout the organization.
• D. Governance is only concerned with day-to-day operations, not long-term strategy.

Answer: (C)

Governance is about setting direction, providing oversight, and ensuring accountability across the organization, including how risk is managed and how strategy is carried out. When governance covers IT or enterprise strategy, it pushes for IT initiatives to support the business’s objectives while embedding risk management into planning, decision-making, and ongoing operations. This means risk considerations aren’t an afterthought; they are part of how goals are chosen, how resources are allocated, and how performance is monitored. In short, governance coordinates strategy with risk appetite and controls, ensuring that the organization acts in a coordinated, risk-aware way.

This makes the chosen statement the best fit because it captures both alignment with business goals and the integration of risk management throughout the organization, rather than treating governance as merely policy writing or a compliance checkbox, or focusing only on day-to-day activities. The other options fall short because governance is not limited to policies alone, does not exist solely for regulatory compliance, and is not restricted to routine operations; it guides long-term strategy with risk-aware governance.