What are the four key components of an IT governance framework like ISO 38500?

• A. Responsibility, Strategy, Acquisition and Deployment, and Performance
• B. Security, Compliance, Privacy, Resilience
• C. Planning, Execution, Monitoring, Evaluation
• D. Governance, Risk, Audit, Control

Answer: (A)

In IT governance under ISO 38500, four areas guide decisions: Responsibility, Strategy, Acquisition and Deployment, and Performance. Responsibility assigns clear accountability for IT decisions, making sure there’s someone who owns each decision. Strategy ensures IT directions align with business goals and priorities, so IT investments support what the organization aims to achieve. Acquisition and Deployment covers how IT resources are obtained and put into operation, including how projects are selected, funded, and implemented, with an eye toward value and risk. Performance focuses on measuring and monitoring IT results to ensure outcomes meet expectations and deliver value.

These four areas together create a practical framework for decision-making and governance. (ISO 38500 also includes conformance and human behavior as additional principles to handle compliance and governance culture, but the four listed areas are the core decision-making domains.)