Review questions — Enterprise governance and decision rights

Integrated summary: Enterprise governance and decision rights

Information security governance begins with a decision question: which business outcome is protected, and who may accept the remaining risk? The board and executive leadership set direction and delegation limits, while the security manager presents evidence, options, and consequences. An organization chart alone cannot establish accountability. Link each decision to an owner and escalation threshold, and distinguish the operator of a control from the owner of the business risk. In a digital service launch, schedule pressure may encourage a temporary exception. Before approval, state its customer and compliance impact, expiry, compensating measure, and authorized decision maker. If authority is unclear, escalate. Judge governance through traceable decisions and exceptions closed or renewed with reasons, rather than committee counts. When business priorities or risk appetite change, revisit delegation and policy, then communicate the decision in terms stakeholders can use.