Who is PRIMARILY responsible for the design of IT controls to meet control objectives?

According to ISACA guidance, governance bodies establish business objectives and risk appetite, but IT management is charged with “planning, building, running and monitoring” the processes and related controls that enable those objectives. Thus, the IT manager (as part of IT management) has primary responsibility for designing the specific IT controls—logical, technical and procedural—that will satisfy the control objectives defined by the business and risk management. Auditors only assess the adequacy, and risk/business functions merely specify requirements; they do not engineer the controls themselves.

A. Risk management identifies and prioritises risks, but does not engineer or configure the control mechanisms.

B. Business management sets objectives and approves resources; it delegates technical control design to IT management.

D. Internal auditors provide independent assurance on control effectiveness; they must remain separate from design activities to maintain objectivity.

1. ISACA

CISA Review Manual

27th ed.

2023

Chapter 2 “Governance and Management of IT

” p. 97

para 3: “IT management is responsible for the design

implementation and maintenance of information system controls.”

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives

Section 1.3

p. 11: “Management plans

builds

runs and monitors activities in alignment with the direction set by the governance body.”

3. ISACA

COBIT 2019

APO 01.02 “Establish and maintain the management system

” RACI chart

p. 23 – role ‘Management’ marked Responsible for ‘Design and implement control environment’.

4. University of Minnesota

Carlson School of Management

“IT Governance & Control” course notes (2022)

Lecture 4 slides 6–7: “Operational (IT) management designs and operates controls; governance sets objectives; audit evaluates.”

5. ISACA

Risk IT Practitioner Guide

Sect. 4.3

p. 42: “Risk owners ensure controls are in place; process owners and IT implement the control solutions.”