Which of the following components of a policy BEST enables the governance of enterprise IT?

The governance of enterprise IT (GEIT) is fundamentally concerned with establishing clear accountability and decision-making authority to ensure that IT aligns with and supports enterprise objectives. The policy component that BEST enables this is the definition of roles and responsibilities. This component explicitly assigns accountability for outcomes and responsibility for actions, creating the organizational structure necessary for effective direction and control. By clarifying who has the authority to make decisions, who must be consulted, and who is accountable, this component translates high-level governance principles into an operational and enforceable framework, which is the essence of governance.

A. Disciplinary actions are an enforcement mechanism for policy non-compliance, not a primary component that enables governance direction and control.
B. Regulatory requirements are external drivers that inform the content of a policy, rather than being an internal component that enables its governance.
D. Terms and definitions are crucial for clarity and consistent interpretation but do not establish the accountability and decision-making structures central to governance.

1. ISACA, CGEIT Review Manual, 8th Edition (2020). Domain 1, Section 1.7, "Governance Components," emphasizes that organizational structures, which include defined roles and responsibilities, are a key component of a governance system. It states that for governance to be effective, accountability must be clearly assigned.

2. ISACA, COBIT 2019 Framework: Introduction and Methodology (2018). Page 31, Figure 4.1, "Components of a Governance System," lists "People, Skills and Competencies" as a core component, which is directly tied to defining roles, responsibilities, and decision-making levels within the enterprise.

3. ISACA, COBIT 2019 Framework: Governance and Management Objectives (2018). The governance process EDM01, "Ensured Governance Framework Setting and Maintenance," explicitly includes the key practice of defining "organizational structures, roles and responsibilities" to establish clear lines of accountability and decision-making authority (p. 24).