an IT resource allocation policy that ensures adequate and optimal investment in and allocation of IT resources.  5.4.2  The board should ensure that the company’s risk management includes IT risk