The absence of appropriate governance policies over end-user computing applications is the greatest concern because it increases the risk of inconsistent controls, data integrity issues, unauthorized changes, and regulatory noncompliance across the organization.

The necessary condition for effective risk management in IT governance is that risk evaluation is embedded in management processes. Risk evaluation is the process of comparing the results of risk analysis with risk criteria to determine whether the risk and/or its magnitude is acceptable or tolerable. Risk evaluation should be integrated into the management processes of planning, implementing, monitoring, and reviewing the IT activities and resources. This will ensure that risk management is aligned with the business objectives, strategies, and values, and that risk responses are timely, appropriate, and effective. References:
CISA Review Manual (Digital Version)
CISA Questions, Answers and ExplanationsDatabase

Clearly defining requirements is critical to ensure the selected software aligns with business needs, functional expectations, and control requirements, which directly determines whether the implementation will be successful.

Privacy laws prohibiting the cross-border flow of personally identifiable information would make it impossible to locate a data warehouse containing customer information in another country. Time zone differences and higher telecommunications costs are more manageable. Software development typically requires more detailed specifications when dealing with offshore operations.