Comprehensive and Detailed Step-by-Step Explanation:
Enterprise Architecture (EA) governance requires proper oversight and separation of duties to ensure strategic alignment and risk management.
* Option A (Correct):If IT application owners have sole authority over architecture approval, there is a high risk of inadequate governance, lack of strategic alignment, and potential conflicts of interest.
Architecture decisions should involve multiple stakeholders, including business and security teams, to ensure compliance, security, and business alignment.
* Option B (Incorrect):While having the CIO chair the architecture review board might not be ideal, it is not thegreatestconcern. The CIO is a senior leader who can provide oversight and direction, even if additional governance mechanisms should be in place.
* Option C (Incorrect):Reviewing security requirements within the EA program is abest practice, as it ensures that security is embedded into enterprise architecture rather than treated as an afterthought.
* Option D (Incorrect):Enterprise architecture should ideally encompass both IT and business processes.
Governing non-IT-related projects is not inherently problematic, as EA is designed to align business strategy with IT infrastructure.
Reference:ISACA CISA Review Manual -Domain 1: Information Systems Auditing Process- Covers IT governance and EA program structure.