Chapter 9 Governance of the Information Systems

Chapter 9, Governance of the Information Systems Organization Multiple Choice 1. This is an IT governance framework that is consistent with COSO controls. a) HIPPA b) COBIT c) SoX d) ISACA e) ISO Ans: b (Medium) Response: See page 202 2. The Sarbanes-Oxley Act of 2002 was primarily aimed at which functional unit of a corporation? a) Marketing b) Production c) Sales d) IT e) Finance Ans: e (Medium) Response: See pages 200-201 3. All of the following are frameworks for implementing Sarbanes-Oxley compliance EXCEPT: a) COSO b) BCP c) COBIT d) ITIL e) Committee for Sponsoring Organization of the Treadway Commission Ans: b (Medium) Response: See page 201-203 4. All of the following are mechanisms that can be created to ensure good IT governance EXCEPT: a) b) c) d) e) Policies Review boards Steering Committees Consultants IT Governance Council Ans: d (Medium) Response: See page 195 5. After Intel faced strong shifts in technologies, such as cloud services, social networking, mobile devices, etc., Intel realized that it needed to establish better governance, creating a _______________. a) Employee boards b) Customer boards c) Security committees d) Information governance boards e) Higher control framework Ans: d (Medium) Response: See page 192 6. This is a balanced approach to managing a company’s IT organization. a) Centralization b) Decentralization c) Federalism d) Joint-Control e) Business Centricity Ans: c (Medium) Response: See page 193 7. This type of organization management is where IT controls most of its IT infrastructure in one location. a) Distributed IS organization b) Decentralized IS organization c) Federalism d) Joint-Control IS organization e) Centralized IS organization Ans: e (Easy) Response: See page 193 8. Most companies would like to obtain the advantages derived from both centralized and decentralized organizational paradigms. What type of IT governance model would best help them to achieve this goal? a) Distributed Control b) Decentralized c) Federalism d) Joint-Control e) Centralized Ans: c (Medium) Response: See pages 193-194 9. IT organizations implement powerful information systems like ERP and SCM that provide centralized data repositories. In addition, business units have tools for their particular units that individuals can use to report on and analyze collected data. This IT governance approach is best described as: ________. a) Distributed Control b) Decentralized c) Federalism d) Joint-Control e) Centralized Ans: c (Hard) Response: See page 194 10. ________ of the 1960’s dictated a centralized approach to IT governance. a) Servers b) Mainframes c) Networks d) PCs e) The WWW Ans: b (Medium) Response: See page 193 11. ________ of the 1980’s allowed computing power to spread and gave rise to a decentralized approach to IT governance. a) Servers b) Mainframes c) Networks d) PCs e) The WWW Ans: d (Medium) Response: See page 193 12. ______________ organizations scatter IT components in different locations to address local business needs. a) Distributed Control b) Decentralized c) Federalism d) Joint-Control e) Centralized Ans: b (Medium) Response: See page 193 13. The IT Governance Council reports directly to the board of directors or the ________. a) CIO b) CTO c) CEO d) COO e) CFO Ans: c (Medium) Response: See page 199 14. IT governance has two major components: the assignment of decision-making authority and responsibility, and the __________________________. a) cost considerations b) decision rights c) business plan d) capability maturity model e) decision-making mechanisms Ans: e (Hard) Response: See page 199 15. The archetype that is represented by a group of business executives that might or might not include the CIO is: a) IT monarchy b) Feudal c) Federal d) Business monarchy e) IT duopoly Ans: d (Medium) Response: See page 197 16. The archetype that is represented by IT executives and one other group is: a) IT monarchy b) Feudal c) Federal d) Business monarchy e) IT duopoly Ans: e (Medium) Response: See page 197 17. IT decisions have been categorized by Peter Weill and Jeanne Ross. These categories include all of the following EXCEPT: a) IT principles b) IT architecture c) IT infrastructure d) Business application needs e) IT security Ans: e (Hard) Response: See page 195 18. The decision about approval and justification of new technologies would fall into which one of the five major IT decision categories? a) IT principles b) IT architecture c) IT infrastructure d) Business application needs e) IT investment and prioritization Ans: e (Hard) Response: See page 196 19. The decisions that determine how IT assets are structured fall into which one of the five major IT decision categories? a) IT principles b) IT architecture c) IT infrastructure d) Business application needs e) IT investment and prioritization Ans: b (Hard) Response: See page 196 20. This IT governance archetype consists of IT individuals or groups of IT executives. a) Business monarchy b) IT monarchy c) Feudal d) Federal e) IT Duopoly Ans: b (Medium) Response: See page 197 21. This IT governance archetype consists of C-level executives and at least one other business group. An IT executive may be an additional participant. a) Business monarchy b) IT monarchy c) Feudal d) Federal e) IT Duopoly Ans: d (Hard) Response: See page 197 22. A steering committee works especially well with this particular IT governance archetype. a) Business monarchy b) IT monarchy c) Feudal d) Federal e) IT Duopoly Ans: d (Hard) Response: See page 199 True/False 23. A steering committee is geared only towards the highest level of the organization and reports directly to the board of directors or the CEO. Ans: False (Medium) Response: See page 199 24. As a result of Sarbanes-Oxley, IT managers are now required to manage the level of controls needed to mitigate risk in business processes. Ans: True (Medium) Response: See pages 200-201 25. The global nature of business today makes complete centralization impossible. Ans: True (Medium) Response: See page 193 26. IT plays a major role in ensuring the accuracy of financial data. Ans: True (Medium) Response: See pages 200-201 27. As a result of Sarbanes-Oxley Act, the CEO, CFO and CIO must certify financial accounting records. Ans: False (Medium) Response: See page 200 28. There were pressures for centralizing IT back when mainframes ruled, but today’s use of “consumerized” technologies have provided strong pressure, by IT people, for decentralization. Ans: False (Medium) Response: See pages 191-192 29. Federal IT provides for strong centralization, like the U.S. Federal Government. Ans: False (Medium) Response: See page 195 Short Answer 30. What act was passed in 2002 in response to the rogue accounting activities of major global corporations such as Enron, Worldcom and their accounting firm Arthur Andersen? Ans: Sarbanes-Oxley Act (SoX) Response: See page 193 31. This is a committee that is formally designated to approve, monitor and review specific topics that ensure IT governance. Ans: review board Response: See page 199 32. This is the act through which behavior is aligned with business goals through empowerment and monitoring. Ans: Governance Response: See page 192 33. The combinations of people to whom decision rights are allocated are classified by various IT governance ________. Ans: archetypes Response: See pages 195-197 34. This IT governance archetype consists only of business unit leaders, key process owners, or their delegates. Ans: Feudal Response: See page 197 35. This is a highly specific measurement used to indicate whether business process goals are being met. Ans: Key performance indicator Response: See page 202 36. This term is used to describe the increasingly powerful tools available to consumers that are impacting corporations. Ans: consumerization of technology Response: See page 191 Essay 37. Explain how federalism is able to capture the benefits of centralized and decentralized IT governance while eliminating the drawbacks of each. 38. Why is it recommended that the IT governance archetype for an organization’s information security strategy be business monarch? 39. Explain the value steering committees offer the IT organization. 40. Define federalism as it pertains to organizational structures. How does it improve on the centralized model? 41. Explain the role the IT organization has in ensuring a company’s Sarbanes-Oxley compliance. 42. Detail the 3 stages of business continuity planning. Matching 43. Review the description of 3 different IT organizations and map the organization's design to the IT governance model it best represents. Federalism Decentralized Centralized Strong IT vision and leadership; business units have ownership Flexible IT; lacks synergy and integration Highly structured IT; does not meet the needs of all business units 44. Match the advantages below as either being associated with a centralized IT governance approach or a decentralized IT governance approach. Centralized Centralized Centralized Decentralized Decentralized Decentralized Global standards and common data Economies of scale Better control of security and databases Technology customized to local business needs Greater flexibility Closer relationship between IT and business units 45. Match the disadvantages below as either being associated with a centralized IT governance approach or a decentralized IT governance approach. Centralized Centralized Centralized Decentralized Decentralized Decentralized Technology may not meet the needs of the business units Poor relations between the business units and the IT organization Slow support for strategic initiatives Duplication of staff and data Higher infrastructure costs Difficulty negotiating preferential supplier agreements 46. Match the organization with the IT governance approach it has chosen. Centralized Decentralized Decentralized Federalism UPS and its standardized IT environment FedEx and its focus on localized innovation VeriFone and its globally distributed employees Home Depot and its hybrid approach to governance Centralized Zara and its technology-supported structure that coordinates all actions 47. Match the allocation of decision rights below with the IT governance archetype it represents. Business monarchy IT monarchy Feudal Federal IT Duopoly The CEO, COO and CFO decide to expand the SCM information system to support manufacturing’s growth in China. The CIO and the data center manager decide to outsource server maintenance. The Marketing department decides to implement a new social business strategy. The CFO, CEO and CIO focus energies to ensure SoX compliance globally. IT works the Sales department to roll out a new social networking marketplace. 48. Match the SoX compliance methodology with its description. COBIT COSO ITIL An IT governance framework that links IT processes, IT resources, and information to the company’s strategies and objectives. A non-IT specific control framework for managers and auditors to use to mitigate risk. A globally adopted set of concepts and techniques for maintaining information technology infrastructure, development, and operations.