ICAB PL IT Governance cheat sheet

IT governance is the set of responsibilities and practices exercised by the board and executive management to provide strategic direction, ensure objectives are achieved, verify risks are managed and confirm resources are used responsibly.

Governance differs from management: governance sets direction, evaluates and monitors; management plans, builds, runs and monitors within that direction.

Five focus areas of IT governance (ISO/IEC 38500): evaluate, direct, monitor, plus the principles of responsibility, strategy, acquisition, performance, conformance and human behaviour.

Three governance questions: Are we doing the right things (strategic alignment and value)? Are we doing them the right way (risk and compliance)? Are we getting them done well (performance and resources)?

Accountability cannot be delegated: the board remains accountable for IT outcomes even when IT activities are outsourced or delegated to committees.

Typical governance structures: board, audit committee, IT steering committee, CIO, enterprise risk committee, and process owners such as information owners.

Governance mechanisms include decision rights, policies, standards, performance scorecards, escalation paths and assurance from internal audit.

Separation of duties: the body that approves a change should not be the same body that implements it, and assurance should be independent of delivery.

Strategic alignment means IT strategy and business strategy are mutually derived: business strategy drives IT capability, and IT capability options inform business strategy.

Alignment maturity levels (Luftman): initial/ad hoc, committed, established/focused, improved/managed, optimised - rising maturity increases shared goals and governance.

Value delivery requires a business case per investment: costs, benefits, risks, assumptions and a defined owner accountable for realising benefits.

IT investment categories: run the business, grow the business, transform the business; portfolios should be balanced and reviewed against strategic themes.

Enterprise architecture aligns IT with business via layers: business, data, application and technology, with current-state and target-state views and a gap roadmap.

Portfolio management decision rules: fund initiatives that trace to a strategic objective; retire or consolidate those with no traceable contribution.

Service level agreements translate business requirements into measurable targets (availability, response time, resolution time) with agreed penalties or credits.

Demand management: consolidate duplicate requests, prioritise by business value and risk, and sequence delivery against capacity constraints.

Risk = likelihood × impact; risk exposure is assessed before controls (inherent) and after controls (residual), with residual compared against risk appetite and tolerance.

Risk treatment options: mitigate (apply controls), transfer (insurance or contracts), avoid (stop the activity), accept (documented with owner approval).

Control types: preventive, detective and corrective; and administrative, technical and physical - layered controls reduce single points of failure.

Key frameworks: COBIT for governance, ISO/IEC 27001 for information security management systems, NIST CSF for cybersecurity functions, ITIL for service management.

Compliance obligations include laws, regulations, contractual terms, industry standards and internal policy; each obligation needs an owner, evidence and review cycle.

Segregation of duties conflicts occur when one person can both initiate and approve a transaction, or both develop and deploy to production.

Third-party risk: due diligence before contracting, contractual security and audit rights, ongoing monitoring, and exit plans for critical suppliers.

Incident response phases: prepare, detect and analyse, contain, eradicate, recover, and post-incident lessons learned feeding risk reassessment.

Resource management covers people, applications, information, infrastructure and facilities; each needs capacity plans, ownership and lifecycle rules.

IT cost categories: fixed versus variable, capital versus operating; chargeback or showback allocates cost to business units by usage driver.

Key performance indicators must be specific, measurable, achievable, relevant and time-bound, with baselines and targets defined before measurement.

Performance measurement hierarchy: goals, then key goal indicators (outcomes), then key performance indicators (process drivers), then metrics.

Balanced scorecard perspectives for IT: financial, customer, internal process, and learning and growth - avoid measuring only availability and cost.

Value delivery is confirmed by realised benefits against the business case, not by on-time on-budget delivery alone; both are reported.

Capacity management: model current utilisation, forecast demand growth, set thresholds, and plan acquisition or optimisation before thresholds breach.

Knowledge and skills management: maintain a competency inventory, identify gaps against the target architecture, and plan training or recruitment.

COBIT distinguishes governance objectives from management objectives and organises them into domains with processes, each having purpose, inputs, outputs and metrics.

Board-level assurance relies on three lines: management controls (first line), risk and compliance functions (second line), internal audit (third line).

Decision rights must be explicit: who decides, who is consulted, who is informed, and who is accountable for the outcome.

Policies state mandatory direction; standards specify measurable requirements; procedures describe step-by-step execution; guidelines are recommended practice.

Governance effectiveness is evidenced by documented decisions, minutes, action tracking, exception registers and periodic independent review.

Committee terms of reference define membership, quorum, decision authority, reporting lines and meeting frequency; without them accountability is ambiguous.

Delegation limits and escalation thresholds must be documented so that decisions above a defined value or risk level reach the board or its delegate.