Governance structures specify the policies, principles and procedures for making decisions about corporate direction. They distribute rights and responsibiliies among stakeholders that typically include executive management, employees, the board etc. Statement I is therefore correct.

"Cybernetics is a transdisciplinary approach for exploring regulatory systems, their structures, constraints, and possibilities. In the 21st century, the term is often used in a rather loose way to imply "control of any system using technology" (Wikipedia). Governance literature has been affected by cybernetics, which is not the same thing as information security or cyber security. Statement II is incorrect.

Corporate governance includes risk governance, and not the other way round. Therefore statement III is incorrect.

The Cadbury Report, titled Financial Aspects of Corporate Governance, was a report issued in the UK in December 1992 by "The Committee on the Financial Aspects of Corporate Governance". The report is eponymous with the chair of the committee, and set out recommendations on the arrangement of company boards and accounting systems to mitigate corporate governance risks and failures. Statement IV is therefore correct.