Which framework is described as primarily associated with IT governance rather than financial controls?

• A. COSO
• B. COBIT
• C. ISO 27001
• D. NIST 800-53

Answer: (B)

IT governance is about how an organization directs and controls its IT resources to meet business objectives. COBIT is the framework designed specifically for that purpose: it governs and manages enterprise IT, translating business goals into IT objectives and providing structured processes, metrics, and accountability to ensure IT delivers value, manages risk, and uses resources effectively. In contrast, COSO centers on internal controls for financial reporting, ISO 27001 focuses on establishing an information security management system, and NIST 800-53 provides detailed security and privacy controls. These other frameworks address security or financial controls rather than IT governance as a whole, so COBIT is the best fit when the emphasis is IT governance rather than financial controls.