IT Governance And Risk

At its simplest, IT governance is a decision-making framework for IT investments that is designed to maximize the return or benefits while managing risk to acceptable levels. But what exactly is meant by "acceptable levels"? The answer is that it differs from one organization to the next. Some organizations are conservative and risk-averse, while others are willing to accept greater risks in the pursuit of greater returns. To address this, an IT governance framework should clearly define the strategic context of IT risk as it pertains to IT risk appetite and IT risk tolerance. With such a framework in place, you can compare individual decisions to an in-place standard and more easily identify, consider, and manage deviations from the standard.