Are roles and responsibilities of the IT organization defined, documented and understood? Are the documents updated as needed? And are roles and responsibilities of the IT organisation segregated from roles and responsibilities of the user departments?