A regulatory audit assessed an enterprise's main transactional application as noncompliant. In addition to fines and required corrections, an agreement was reached to implement a set of governance con

While the CIO is responsible for implementing and managing IT, ultimate accountability for overall IT governance and regulatory compliance rests with the board, not solely with IT management.

The internal audit director assesses controls but is not accountable for establishing or managing the controls themselves; their role is independent assurance.

Application users are responsible for following procedures and controls, but they do not hold accountability for the design or strategic oversight of IT governance controls.

The board of directors holds the ultimate oversight and fiduciary responsibility for the entire enterprise, including ensuring compliance with regulations and establishing effective IT governance. After a regulatory non-compliance finding, assigning accountability to the board reinforces the critical importance of these controls at the highest level.