Which of the following is the MOST appropriate action to formalize IT governance in an organization?