Which of the following components of a policy BEST enables the governance of enterprise IT?

The governance of enterprise IT (GEIT) is fundamentally concerned with establishing clear accountability and decision-making authority to ensure that IT aligns with and supports enterprise objectives. The policy component that BEST enables this is the definition of roles and responsibilities. This component explicitly assigns accountability for outcomes and responsibility for actions, creating the organizational structure necessary for effective direction and control. By clarifying who has the authority to make decisions, who must be consulted, and who is accountable, this component translates high-level governance principles into an operational and enforceable framework, which is the essence of governance.

A. Disciplinary actions are an enforcement mechanism for policy non-compliance, not a primary component that enables governance direction and control.

B. Regulatory requirements are external drivers that inform the content of a policy, rather than being an internal component that enables its governance.

D. Terms and definitions are crucial for clarity and consistent interpretation but do not establish the accountability and decision-making structures central to governance.

1. ISACA

CGEIT Review Manual

8th Edition (2020). Domain 1

Section 1.7

"Governance Components

" emphasizes that organizational structures

which include defined roles and responsibilities

are a key component of a governance system. It states that for governance to be effective

accountability must be clearly assigned.

2. ISACA

COBIT 2019 Framework: Introduction and Methodology (2018). Page 31

Figure 4.1

"Components of a Governance System

" lists "People

Skills and Competencies" as a core component

which is directly tied to defining roles

responsibilities

and decision-making levels within the enterprise.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). The governance process EDM01

"Ensured Governance Framework Setting and Maintenance

" explicitly includes the key practice of defining "organizational structures

roles and responsibilities" to establish clear lines of accountability and decision-making authority (p. 24).