Align IT Strategy With Business Objectives - CPA Isc

SECTION 1

Historical Context & Motivation

For decades, information technology operated as a back-office utility — processing payroll, maintaining ledgers, and automating repetitive tasks with little connection to an organization's competitive strategy. As enterprises grew more dependent on digital infrastructure during the 1990s and 2000s, a troubling pattern emerged: massive IT spending that failed to deliver measurable business value. Research from the Standish Group's CHAOS Reports consistently found that fewer than one-third of IT projects succeeded on time, on budget, and with full functionality. The root cause was not technical incompetence but a fundamental misalignment between IT initiatives and business objectives. This recognition catalyzed the development of formal alignment frameworks that CPA candidates — particularly those sitting for the ISC discipline — must understand thoroughly.

1993 • Henderson & Venkatraman's Strategic Alignment Model

MIT researchers publish the Strategic Alignment Model (SAM), establishing the foundational theory that IT strategy and business strategy must co-evolve through four domains of strategic choice.

1996 • COBIT 1.0 Released by ISACA

The first edition of Control Objectives for Information and Related Technologies provides a governance framework linking IT controls to business requirements, becoming foundational for auditors and CPAs.

2004 • IT Governance Institute & Val IT

ISACA introduces Val IT, a framework specifically designed to measure the business value of IT investments through portfolio management, directly linking IT expenditures to strategic outcomes.

2012 • COBIT 5 Integrates Business and IT Governance

COBIT 5 merges IT governance with enterprise governance, formalizing the principle that IT exists solely to create stakeholder value — a perspective now central to CPA ISC exam content.

2019 • COBIT 2019 & Digital Transformation Era

The latest COBIT framework adapts to cloud computing, AI, and agile methodologies, emphasizing continuous alignment rather than periodic strategic planning cycles.

The central question this lesson addresses is: How do organizations systematically ensure that every IT decision, investment, and operational process contributes to — rather than detracts from — the enterprise's strategic business objectives? For CPA candidates preparing for the ISC exam, this question is not merely academic; it sits at the intersection of governance, risk management, internal controls, and financial reporting — all domains where a CPA adds value by evaluating whether IT resources are deployed effectively.

SECTION 2

Core Principles of IT-Business Alignment

IT-business alignment rests on several foundational principles that govern how technology governance structures, investment decisions, and operational metrics are designed. These principles emerge from the convergence of strategic management theory, enterprise governance frameworks, and the practical realities of managing complex information systems within competitive markets. Understanding these principles equips a CPA to evaluate whether an organization's IT governance is functioning as intended or exposing the enterprise to strategic, operational, or financial risk.

Strategic Integration

IT strategy must be derived from — and continuously synchronized with — the organization's mission, vision, and strategic plan. Technology decisions are not made in isolation but are evaluated against their contribution to specific business outcomes such as revenue growth, cost efficiency, or regulatory compliance.

Value Delivery

Every IT investment should produce demonstrable value measured through financial metrics (ROI, NPV), operational metrics (process cycle time, error rates), or strategic metrics (market share, customer satisfaction). The Val IT framework formalizes this through investment portfolio governance.

Risk Management

IT risks — including cybersecurity threats, system failures, and data integrity issues — must be assessed relative to business impact, not merely technical severity. Risk appetite is set at the board level and cascades into IT risk tolerance thresholds.

Resource Optimization

Finite IT resources (budget, personnel, infrastructure capacity) must be allocated to initiatives that maximize enterprise value. This requires portfolio management disciplines similar to capital budgeting in corporate finance.

Performance Measurement

Alignment is not a one-time achievement but a dynamic state requiring continuous monitoring through balanced scorecards, KPIs, and maturity models. The IT Balanced Scorecard translates Kaplan & Norton's framework into IT-specific dimensions.

✦

KEY TAKEAWAY

Think of IT-business alignment like an investment portfolio managed by a CFO. Just as a CFO would never let a portfolio manager buy securities without reference to the firm's risk tolerance and return targets, an aligned organization never approves an IT project without tracing it to a strategic objective. The IT steering committee functions like an investment committee — vetting proposals, monitoring performance, and reallocating resources when market conditions change. Misalignment is the IT equivalent of style drift in asset management: technically active but strategically directionless.

SECTION 3

Visual Explanation — The Strategic Alignment Model

The Strategic Alignment Model (SAM) developed by Henderson and Venkatraman identifies four domains that must be harmonized for true alignment: Business Strategy, IT Strategy, Organizational Infrastructure, and IT Infrastructure. The model posits two fundamental types of fit — strategic fit (vertical alignment between strategy and infrastructure) and functional integration (horizontal alignment between business and IT domains). The following diagram illustrates these relationships.

The SAM diagram shows four quadrants. Functional integration (horizontal arrows) ensures that business and IT domains speak the same language at each level, while strategic fit (vertical arrows) ensures that external strategies are operationalized through internal infrastructures.

In the diagram above, notice that alignment is not a single link but a network of relationships. A CPA evaluating IT governance should trace each IT initiative from the IT Infrastructure quadrant upward through IT Strategy, across through Business Strategy, and down through Organizational Infrastructure. If any link in this chain is weak — for example, if the IT department selects cloud architecture without reference to the firm's data residency requirements — the result is misalignment. The SAM framework provides the conceptual vocabulary for diagnosing where alignment breaks down and what governance mechanisms can repair it.

SECTION 4

How IT-Business Alignment Works in Practice

The COBIT Governance Cascade

While the SAM provides theory, the COBIT framework provides the operational mechanism. COBIT 2019 organizes IT governance through a governance cascade that translates stakeholder needs into enterprise goals, which cascade into alignment goals, and finally into specific governance and management objectives. This cascade ensures traceability — a critical concept for auditors. Each governance objective maps to measurable outcomes, creating an audit trail from boardroom strategy to server-room operations.

COBIT GOALS CASCADE

Stakeholder Needs → Enterprise Goals → Alignment Goals → Governance/Management Objectives → Components

Each arrow represents a mapping relationship. Stakeholder Needs include shareholder value, regulatory compliance, and risk optimization. Enterprise Goals are expressed in 13 categories across Financial, Customer, Internal, and Learning dimensions (following the Balanced Scorecard). Alignment Goals translate those into IT-specific targets. Components are the processes, structures, policies, and culture that execute the objectives.

The IT Balanced Scorecard

The IT Balanced Scorecard (IT BSC) adapts the traditional Balanced Scorecard — familiar from managerial accounting — into four IT-specific perspectives. Unlike financial metrics alone, the IT BSC captures the multidimensional nature of alignment by measuring corporate contribution, user orientation, operational excellence, and future orientation simultaneously.

IT BSC PERSPECTIVES

IT Alignment Score = f(Corporate Contribution, User Orientation, Operational Excellence, Future Orientation)

Corporate Contribution measures how IT creates business value (maps to Financial perspective). User Orientation measures internal customer satisfaction with IT services. Operational Excellence measures process efficiency and system availability. Future Orientation measures investment in innovation, training, and emerging technologies.

IT Investment Value Metrics

IT ROI CALCULATION

IT ROI = (Net Benefits from IT Investment − Total Cost of Ownership) ÷ Total Cost of Ownership × 100%

Net Benefits include revenue increases, cost savings, risk reductions (monetized), and productivity gains. Total Cost of Ownership (TCO) encompasses acquisition, implementation, training, maintenance, and eventual decommissioning costs. CPA candidates should recognize that TCO extends far beyond the initial purchase price.

SECTION 5

Governance Frameworks & Maturity Assessment

Several governance frameworks provide structured approaches to achieving and measuring IT-business alignment. For CPA candidates, the most critical are COBIT, ITIL, and the Strategic Alignment Maturity Model (SAMM) developed by Jerry Luftman. Each framework addresses alignment from a different angle — COBIT through governance processes, ITIL through service management, and SAMM through organizational capability maturity.

Luftman's SAMM evaluates alignment maturity across six criteria: communications, competency/value measurement, governance, partnership, technology scope, and skills. Each criterion is scored, and the composite determines the organization's maturity level from Level 1 (ad hoc) to Level 5 (optimized), where IT and business co-adapt in real time.

Maturity Level	Characteristics	CPA Audit Implications
Level 1 — Initial	IT operates in silos; no formal communication between IT and business leadership; IT budgets are cost-centered.	High risk of IT control deficiencies; IT general controls (ITGCs) likely lack documentation and consistency.
Level 2 — Committed	Executive awareness exists; ad hoc coordination; IT projects sometimes reference business goals.	Some ITGCs exist but are inconsistently applied; management override risk is moderate.
Level 3 — Established	Formal governance structures (IT steering committees); IT strategy documented and reviewed; shared KPIs.	ITGCs are documented and testable; control environment supports reliance on automated controls.
Level 4 — Managed	Enterprise-wide governance; IT portfolio managed with business metrics; shared risk management.	Strong control environment; integrated IT risk assessment enhances audit efficiency; continuous monitoring may be in place.
Level 5 — Optimized	IT and business co-evolve; real-time alignment through agile governance; innovation is a shared discipline.	Mature ITGC environment; GRC platforms provide continuous assurance; audit can leverage analytics and automated testing.

Alignment maturity levels with CPA audit implications

SECTION 6

Worked Example — Evaluating IT-Business Alignment

Consider the following scenario: You are a CPA performing an ISC engagement for Apex Financial Services, a mid-market commercial lender. The company's strategic plan identifies three business objectives: (1) increase loan origination volume by 20% over two years, (2) reduce regulatory compliance costs by 15%, and (3) improve customer satisfaction scores by 10 points. The CIO has submitted an IT strategic plan requesting $4.5 million for three initiatives: a new loan origination system (LOS), a regulatory compliance automation platform, and a customer relationship management (CRM) upgrade. Your task is to evaluate whether the IT strategic plan is properly aligned with business objectives.

Alignment Assessment of Apex Financial Services IT Strategy

1
Step 1 — Map IT Initiatives to Business Objectives

Create a traceability matrix linking each IT initiative to one or more business objectives. The new LOS maps to Objective 1 (loan origination volume). The compliance automation platform maps to Objective 2 (reduce compliance costs). The CRM upgrade maps to Objective 3 (customer satisfaction). Verify that every business objective has at least one supporting IT initiative and that no IT initiative exists without a clear business justification.

Result: Full traceability confirmed — all three objectives have IT support, and no orphan IT projects exist.
2
Step 2 — Evaluate Governance Structures

Examine whether an IT steering committee exists with representation from both business and IT leadership. At Apex, the committee meets quarterly and includes the CFO, COO, CIO, and Chief Risk Officer. Review meeting minutes for evidence that IT investment decisions reference the strategic plan. Verify that the steering committee has authority to approve, defer, or cancel IT projects based on alignment reviews.

Result: Steering committee exists and has documented authority, but meeting frequency may be insufficient for a $4.5M portfolio — recommend monthly reviews during implementation.
3
Step 3 — Assess Value Measurement Mechanisms

For each IT initiative, verify that quantifiable success metrics have been defined and are linked to the corresponding business objective. The LOS project should define metrics such as application processing time, loan approval turnaround, and origination volume growth. Calculate the projected IT ROI: if the LOS costs $2M with a TCO of $2.8M over 5 years and is expected to generate $1.2M in incremental annual revenue, the 5-year ROI is ((5 × $1.2M) − $2.8M) ÷ $2.8M × 100% = 114.3%.

Result: LOS 5-year ROI = 114.3%, exceeding the company's 25% hurdle rate. Value measurement mechanisms are in place.
4
Step 4 — Evaluate Risk Alignment

Determine whether the IT risk assessment is integrated with the enterprise risk management (ERM) framework. At Apex, the compliance automation platform addresses regulatory risk, which is identified as a top-5 enterprise risk. Verify that IT risk tolerance thresholds are consistent with the board's risk appetite statement. Check whether the CRM project has undergone a data privacy impact assessment given that it will process personally identifiable information (PII) of commercial borrowers.

Result: Compliance platform aligns with ERM; however, CRM project lacks a documented privacy impact assessment — recommend remediation before project launch.
5
Step 5 — Determine Alignment Maturity Level

Using Luftman's six criteria, score Apex across communications (3/5), value measurement (3/5), governance (3/5), partnership (2/5), scope and architecture (3/5), and skills (2/5). The average score is (3 + 3 + 3 + 2 + 3 + 2) ÷ 6 = 2.67, placing Apex at the upper end of Level 2 (Committed) approaching Level 3 (Established). Recommend specific improvements in partnership (joint business-IT teams) and skills (cross-training) to advance maturity.

Result: SAMM score = 2.67 (Level 2, approaching Level 3). Key improvement areas: partnership and skills development.

SECTION 7

Enablers and Inhibitors of Alignment

Research by Luftman, Papp, and others has identified recurring factors that either enable or inhibit IT-business alignment. Understanding these factors is essential for CPA candidates because auditors must not only assess current alignment but also identify conditions that threaten alignment sustainability. An organization may score well on a point-in-time assessment yet be vulnerable to misalignment due to structural inhibitors lurking beneath the surface.

Top Enablers	Top Inhibitors
Senior executive support for IT — CIO participates in strategic planning at the board level.	IT/business lack close relationships — CIO reports to CFO rather than CEO, signaling IT as a cost center.
IT involved in strategy development — technology capabilities inform competitive strategy formulation.	IT fails to meet commitments — repeated project failures erode business trust.
IT understands the business — IT staff possess domain expertise in the firm's industry.	IT does not understand business — technology decisions are made without domain context.
Business-IT partnership — shared governance structures, joint KPIs, and mutual accountability.	Business does not understand IT potential — leadership views IT only as infrastructure, not as a strategic lever.
Well-prioritized IT projects — portfolio governance ensures resources flow to highest-value initiatives.	IT management lacks leadership — CIO is tactical rather than strategic, unable to articulate value in business terms.

Adapted from Luftman's alignment enablers and inhibitors research

✦

KEY TAKEAWAY

Alignment enablers and inhibitors mirror the concept of control environment in auditing. Just as the COSO framework recognizes that a weak tone at the top undermines even well-designed internal controls, a weak relationship between IT and business leadership undermines even the most sophisticated governance framework. A CPA assessing IT alignment should apply the same professional skepticism used when evaluating management integrity — look beyond documented policies to assess whether alignment is genuinely practiced or merely performative.

SECTION 8

Connection to Enterprise Governance and Emerging Trends

The evolution from IT-business alignment toward IT-business convergence represents the next frontier. In converged organizations, the distinction between 'business strategy' and 'IT strategy' dissolves because technology is inseparable from the business model itself — consider how fintech companies, digital banks, and algorithmic trading firms operate. COBIT 2019 acknowledges this shift by treating governance of enterprise IT (GEIT) as a subset of overall enterprise governance, not a separate discipline. For CPA candidates, this means IT governance questions on the ISC exam increasingly test holistic thinking rather than framework memorization.

Traditional Alignment	IT-Business Convergence
IT strategy follows business strategy	IT and business strategy co-created simultaneously
CIO reports to CEO or CFO	Chief Digital Officer or CTO sits on the board; technology literacy expected of all directors
Periodic alignment reviews (annual, quarterly)	Continuous alignment through agile governance, DevOps pipelines, and real-time dashboards
IT value measured through ROI on discrete projects	IT value measured through enterprise-level digital KPIs (e.g., digital revenue ratio, API throughput)
Governance frameworks: COBIT, ITIL, Val IT	Governance augmented with AI-driven GRC platforms, automated compliance monitoring, and blockchain-based audit trails

Traditional alignment versus emerging convergence paradigm

💡

CPA Exam Connection

The ISC discipline increasingly tests candidates on how emerging technologies — cloud computing, artificial intelligence, robotic process automation, and blockchain — affect IT governance and alignment. Expect scenario-based questions where you must evaluate whether an organization's adoption of a new technology aligns with its risk appetite, regulatory requirements, and strategic goals. The underlying principle remains the same: technology serves the business, not the other way around.

SECTION 9

Practice Problems

Question 1: CONCEPTUAL

Hartwell Manufacturing has strong internal IT governance: its IT infrastructure is well-architected, IT processes are efficient, and IT decisions are guided by a clear IT strategy. However, business leaders frequently complain that IT projects do not support the company's customer-facing initiatives, and the business strategy is developed with little input from IT leadership. Which misalignment in the Henderson-Venkatraman Strategic Alignment Model does this scenario BEST illustrate?A) Weak strategic fit within the business domain, because the business strategy is not reflected in business processes and infrastructure. B) Weak functional integration, because IT and business domains are not horizontally aligned despite each domain having internal coherence. C) Weak strategic fit within the IT domain, because IT infrastructure does not reflect the IT strategy. D) Strong functional integration combined with weak strategic fit, because IT and business strategies are coordinated but internal execution is misaligned.

Show answer

Correct Answer: B Step-by-step verification: Step 1 — Identify what is working well. The scenario explicitly states that IT infrastructure is well-architected, IT processes are efficient, and IT decisions follow a clear IT strategy. This confirms that strategic fit within the IT domain is strong — the IT strategy is properly translated into IT infrastructure and processes. There is no indication that business operations fail to reflect business strategy, so strategic fit within the business domain also appears intact. Step 2 — Identify what is broken. Business leaders report that IT projects do not support customer-facing (business) initiatives, and business strategy is developed without IT leadership input. This is a cross-domain disconnect: the business domain and IT domain are not communicating or aligning with each other, even though each appears internally coherent. Step 3 — Apply Henderson-Venkatraman definitions. The model has two key alignment dimensions: • Strategic fit = vertical alignment within a single domain (strategy ↔ infrastructure/processes within business, or within IT). • Functional integration = horizontal alignment across domains (business strategy ↔ IT strategy at the strategic level; business infrastructure ↔ IT infrastructure at the operational level). The failure here is cross-domain and horizontal, which maps directly to weak functional integration. Step 4 — Eliminate distractors. • A is incorrect — the scenario gives no evidence that Hartwell's business strategy fails to translate into business operations; strategic fit in the business domain is not described as broken. • C is incorrect — the scenario explicitly describes IT strategic fit as strong; IT infrastructure and processes align well with IT strategy. • D is incorrect — the scenario describes disconnection between business and IT strategy, not coordination; functional integration is weak, not strong, and internal execution within each domain is not described as misaligned. Step 5 — Confirm answer. B is correct. Each domain (business and IT) may be internally coherent (strong strategic fit within each), but the two domains are not horizontally linked. IT capabilities do not enable business goals, and business strategy does not leverage IT potential. This is the defining characteristic of weak functional integration in the Henderson-Venkatraman model.

Question 2: BASIC CALCULATION

A company invests $1.5 million in an ERP system with a total cost of ownership (TCO) of $3.2 million over five years. The system is expected to generate annual cost savings of $950,000. Calculate the 5-year IT ROI and determine whether the investment meets a 40% hurdle rate.

Show answer

Using the IT ROI formula: IT ROI = (Net Benefits − TCO) ÷ TCO × 100%. Net benefits over 5 years = 5 × $950,000 = $4,750,000. IT ROI = ($4,750,000 − $3,200,000) ÷ $3,200,000 × 100% = $1,550,000 ÷ $3,200,000 × 100% = 48.4%. Since 48.4% exceeds the 40% hurdle rate, the investment meets the threshold. However, a CPA should note that this simplified calculation does not account for the time value of money; a net present value analysis using the firm's weighted average cost of capital would provide a more rigorous assessment.

Question 3: INTERMEDIATE

An IT steering committee at a healthcare organization is evaluating three proposed IT projects: (A) an electronic health records (EHR) upgrade costing $2M, (B) a patient portal enhancement costing $800K, and (C) an internal data analytics platform costing $1.2M. The organization's strategic plan prioritizes regulatory compliance, patient engagement, and operational efficiency in that order. Using the COBIT goals cascade approach, explain how the committee should prioritize these projects and what governance mechanisms should be in place.

Show answer

The committee should map each project to stakeholder needs and enterprise goals through the COBIT cascade. Project A (EHR upgrade) directly supports the top-priority regulatory compliance objective, as healthcare regulations such as HIPAA and Meaningful Use require specific EHR capabilities. Project B (patient portal) supports the second-priority patient engagement objective. Project C (analytics platform) supports operational efficiency, the third priority. Based on strategic prioritization, the committee should rank A > B > C. Governance mechanisms should include: (1) a formal project charter for each initiative linking it to specific enterprise and alignment goals, (2) defined KPIs for each project mapped to the corresponding business objective, (3) stage-gate reviews where the committee evaluates progress against alignment criteria before releasing subsequent funding tranches, and (4) an escalation process for when projects deviate from their alignment targets. The committee should also assess interdependencies — for instance, the analytics platform may depend on data from the EHR system, suggesting Project A should be completed first.

Question 4: APPLIED

You are a CPA conducting an ISC engagement at a regional bank. During your assessment, you discover the following: the CIO does not attend board meetings, IT budget requests are reviewed only by the CFO without input from business unit leaders, the bank recently suffered a failed core banking system migration that cost $3M over budget, and business unit managers report that IT 'doesn't understand our needs.' Using Luftman's six alignment criteria, score the bank's maturity on each criterion (1–5 scale) and calculate the overall alignment maturity level. Provide recommendations for improvement.

Show answer

Based on the evidence, the scoring would be approximately: Communications (1) — the CIO's exclusion from board meetings and business managers' complaints indicate poor IT-business dialogue. Value Measurement (2) — some budget review exists but it's limited to the CFO and lacks business-outcome tracking. Governance (2) — a formal budget process exists but lacks cross-functional input and post-implementation reviews, as evidenced by the $3M overrun. Partnership (1) — business managers explicitly state IT doesn't understand their needs, indicating minimal collaboration. Scope & Architecture (2) — the failed migration suggests architectural planning weaknesses. Skills (1) — the lack of business understanding points to insufficient cross-training. Overall score: (1 + 2 + 2 + 1 + 2 + 1) ÷ 6 = 1.5, placing the bank firmly at Level 1 (Initial/Ad Hoc) with some pockets of Level 2 capability. Key recommendations: elevate CIO reporting to the CEO, establish an IT steering committee with business representation, implement post-implementation reviews for all projects exceeding $500K, create business liaison roles within IT, and invest in cross-functional training.

Question 5: CRITICAL THINKING

Some scholars argue that the concept of 'IT-business alignment' is becoming obsolete as digital transformation blurs the line between technology and business. Under this view, alignment implies two separate entities that must be brought together, whereas modern organizations should treat technology as inherent to the business model — a concept called 'IT-business convergence.' As a CPA advising a board of directors, evaluate the merits and risks of abandoning the alignment paradigm in favor of convergence. How would this shift affect IT governance, the role of the CIO, and the CPA's approach to evaluating IT controls?

Show answer

The convergence argument has significant merit, particularly for digitally native businesses where technology is the product (e.g., fintech, e-commerce, SaaS platforms). In these contexts, maintaining a separate 'IT strategy' can create artificial boundaries that slow decision-making and innovation. The merits of convergence include: faster technology adoption since business and IT decisions are unified, elimination of the 'lost in translation' problem between business requirements and technical specifications, and recognition that digital capabilities are a core competency rather than a support function. However, the risks are substantial. Without explicit alignment mechanisms, organizations may lose governance discipline — the very structure that ensures IT investments are evaluated against risk appetite, regulatory requirements, and fiduciary responsibilities. The CIO role would evolve into a Chief Digital Officer embedded in business strategy, but this consolidation could reduce the independence needed for effective IT risk management. For CPAs, convergence doesn't eliminate the need to evaluate IT controls; instead, it means IT controls become indistinguishable from business process controls. The auditor must then apply integrated thinking — evaluating automated and manual controls holistically rather than testing ITGCs separately. A prudent board would adopt convergence gradually, ensuring that governance safeguards are redesigned rather than abandoned. The CPA's role becomes even more critical as a check on whether the organization's enthusiasm for convergence has compromised the discipline of governance.

SUMMARY

Lesson Summary

Summary

Aligning IT strategy with business objectives is a governance discipline that ensures every technology investment, process, and capability directly contributes to the enterprise's strategic goals. The Strategic Alignment Model (SAM) provides the theoretical foundation through its four domains of strategic fit and functional integration. The COBIT goals cascade translates this theory into operational practice by tracing stakeholder needs through enterprise goals, alignment goals, and governance objectives to specific processes and controls. Luftman's maturity model provides a scoring framework across six criteria — communications, value measurement, governance, partnership, scope, and skills — enabling CPAs to assess where an organization stands and what improvements are needed.

For CPA candidates preparing for the ISC discipline, the key takeaways are: (1) alignment requires traceability from boardroom strategy to IT operations, (2) governance structures such as IT steering committees are the primary mechanism for maintaining alignment, (3) value measurement through IT BSC perspectives and ROI calculations ensures accountability, and (4) alignment is not static — it requires continuous monitoring through maturity assessments and adaptation to emerging technologies. As organizations move toward IT-business convergence, the CPA's role in evaluating IT governance becomes even more critical — ensuring that the enthusiasm for digital transformation does not compromise the discipline of governance and internal controls.