From the management side, it includes the IT staff members. A measure of competency of the IT staff is a key factor. Obviously, the more competent the IT staff, the lower the risks associated with all the elements of IT they affect, and vice versa. It also includes the management of the IT function, such as policies and procedures for the IT function, IT governance and project management. The more the IT function uses best practices of project management, the lower the level of risk. The best practices of IT governance, such as those found in the ISACA/IT Governance Institute literature,1 constitute mitigating factors in the management of IT risks.