An independent consultant has been hired to conduct an ad hoc audit of an enterprise's information security office with results reported to the IT governance committee and the board. Which of the following is MOST important to provide to the consultant before the audit begins?

The IT program manager does not see the value of conducting risk assessments for a new major IT project.
The manager is reluctant to cooperate with internal auditors and the newly formed steering committee. Midway through the project, program requirements were changed because the CEO is a friend of a vendor and wants to implement this vendor's new technology. This decision will cause the current IT program budget to be insufficient and will be shown as overspending, After the requirement change request, the IT program manager should FIRST:

The BEST way to manage continuous improvement of governance-related processes is to:

Before an IT strategy committee can approve an IT risk assessment framework, which of the following is MOST important to have established?

Which of the following functions of HR department is liable for policy creation, policy communication, record creation, and HR information systems?