This committee might have more than one name: It might be referred to as an IT steering committee or an IT strategy committee. The steering committee is tasked with ensuring that the IT department is properly aligned with the goals of the business. This is accomplished by using the committee as a conduit to move information and objectives from senior business management to IT management. The committee consists of members of high-level management from within the company:

. Business management—The committee is managed by the CEO or by a personally appointed and instructed representative.
. IT management—This group is represented by the CIO or a CIO representative.
. Legal—This group is represented by an executive from the legal department.

The primary role of an auditor in IT governance is to provide guidance and recommendations to senior management. The objective of providing this information is to improve quality and effectiveness. The first step of this process is to review the following:
. Learn the organization—Know the company’s goals and objectives. Start by reviewing the mission statement.
. Review the IT strategic plan—Strategic plans provide details for the next three to five years.
. Analyze organizational charts—Become familiar with the roles and responsibility of individuals within the company.
. Study job descriptions—Job descriptions detail the level of responsibility and accountability for employees’ actions.
. Evaluate existing policies and procedures—These documents detail the approved activities of employees.

Auditors play a big role in the success of the organization. Auditors must be independent from management and have the authority to cross over departmental boundaries. Auditors usually report governance issues to the highest level of management. Auditors must also have the proper set of skills. If individuals in-house do not have the skills required to lead the audit, an external independent third party should be hired.