Which of the following IT governance actions would be the BEST way to minimize the likelihood of IT failures jeopardizing the corporate value of an…

An IT risk management framework provides the most comprehensive and structured approach to proactively manage threats that could lead to IT failures. This governance mechanism ensures that risks are identified, analyzed, evaluated, and treated in alignment with the organization's risk appetite and business objectives. By systematically addressing the root causes and potential impacts of IT failures, a risk management framework directly minimizes the likelihood that such events will jeopardize corporate value. It is a foundational governance action that enables the integration of risk considerations into all strategic and operational IT activities, thereby safeguarding the IT-dependent organization.

B. An IT continuous monitoring solution is a tactical tool used to detect failures as they occur; it is a component of risk management, not the overarching strategic framework itself.

C. Defining IT performance measures is important for assessing efficiency and effectiveness, but it primarily tracks outcomes rather than proactively managing the underlying risks of failure.

D. Benchmarking IT strategy is a comparative analysis tool for strategic planning; it does not directly implement the processes and controls needed to mitigate the risk of IT failures.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 3: Risk Optimization

emphasizes that a primary goal of IT governance is to ensure that IT risk is managed effectively. Task Statement 3.2 states the need to "Ensure that IT risk is managed to an acceptable level." Implementing a framework is the primary mechanism to achieve this systematically and ensure risks do not jeopardize enterprise value. (Domain 3

Section 3.2

pp. 113-114).

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The governance objective APO12

"Managed Risk

" has the purpose of integrating IT-related risk management with overall Enterprise Risk Management (ERM) to protect enterprise value. The implementation of a framework is central to achieving this objective. (APO12 Managed Risk

p. 115).

3. Alan Calder

Steve G. Watkins

IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002

7th Edition. Chapter 5

"Risk Management

" explains that a formal risk management framework is essential for an organization to understand and treat the risks to its information assets

which is fundamental to protecting corporate value in an IT-dependent environment. (Kogan Page

2019

pp. 67-69).