ICAB PL IT Governance key terms

The system of structures, processes, and relationships used by senior leaders to direct, monitor, and hold IT accountable for delivering value while managing risk and using resources responsibly.

A structured set of principles, roles, and process models that organisations adapt to direct and control IT consistently, such as COBIT or ISO/IEC 38500.

The governing body's duty to set expectations for IT, approve strategy and risk appetite, monitor performance, and ensure accountability without managing day-to-day technology operations.

A control principle that divides critical tasks among different people so no single individual can initiate, approve, execute, and conceal a transaction or change unauthorised.

An accountability structure where operational management owns risk, a risk and compliance function provides independent oversight, and internal audit gives independent assurance to the governing body.

A cross-functional decision forum of senior business and IT leaders that prioritises IT investments, resolves competing demands, and monitors delivery against agreed objectives.

A documented plan describing how technology capabilities, investments, and sourcing will support the organisation's business goals over a defined planning horizon.

The ongoing state in which IT priorities, spending, and capabilities match business objectives, so technology is treated as an enabler of strategy rather than a standalone service.

A structured description of business processes, applications, data, and technology infrastructure, plus the roadmap for moving from the current to a target state.

A time-phased plan sequencing technology changes, investments, and retirements so capabilities arrive when the business needs them and dependencies are managed.

The practice of capturing, evaluating, and prioritising requests for IT work so limited capacity is directed to initiatives with the greatest agreed business value.

A coordinated programme of technology-enabled change to business models, processes, and customer experience, requiring governance of benefits, risks, and organisational capability.

The possibility that technology failures, misuse, or external events will harm business objectives, expressed through likelihood and impact on operations, finances, or reputation.

The amount and type of risk an organisation is willing to accept in pursuit of its objectives, set by leadership and used to guide IT decisions and tolerances.

A maintained record of identified risks with owners, likelihood and impact ratings, existing controls, and planned responses, reviewed regularly by management.

The chosen response to a risk: accept, mitigate through controls, transfer through insurance or contracts, or avoid the activity altogether.

A measurable metric tracked over time that signals rising exposure to a specific risk, enabling management to act before losses or incidents occur.

An assessment identifying critical business processes, their dependencies on IT, and the tolerable downtime and data loss for each, used to set recovery objectives.

Documented procedures enabling an organisation to keep critical services running or restore them within agreed timeframes during and after a disruptive event.

The maximum acceptable elapsed time to restore a service or process after disruption, derived from business impact analysis and used to design resilience measures.

The maximum acceptable amount of data loss measured in time before a disruption, which determines backup frequency and replication design.

A statement of the outcome a control is meant to achieve, such as preventing unauthorised access, against which control design and effectiveness are assessed.

A policy, procedure, or technical measure designed to provide reasonable assurance that objectives are met and errors, fraud, or misuse are prevented or detected.

Evidence-gathering activity that evaluates whether a control is designed appropriately and operates effectively over a period, often by inspection, observation, or re-performance.

Conformity with applicable laws, regulations, contractual obligations, and internal policies, demonstrated through documented controls, monitoring, and evidence of adherence.

The set of laws, rules, and supervisory expectations that govern an organisation's technology activities, including reporting duties and prescribed control standards.

The set of legal and organisational measures safeguarding personal information through lawful processing, consent or other legal bases, retention limits, and individual rights.

Assigning information to sensitivity tiers such as public, internal, confidential, and restricted, so handling, access, and retention controls match the harm of disclosure.

Measures that grant or deny use of systems and data based on identity, role, and need, including authentication, authorisation, and periodic entitlement review.

A chronological, protected record of system activity and user actions that supports investigation, dispute resolution, and evidence of compliance with controls.

An independent function that assesses the design and effectiveness of controls and governance, reporting findings and opinions to the governing body or audit committee.

The process of assessing, contracting with, monitoring, and exiting suppliers so their technology, security, and continuity failures do not harm the organisation.

A contract defining measurable service expectations such as availability, response times, and remedies, used to hold internal or external providers accountable.

Planning and controlling people, infrastructure, applications, information, and money so capacity and skills match current and forecast business demand.

Balancing current and future demand for processing power, storage, networks, and staff against supply so performance targets are met economically.

Managing IT investments as a group, evaluating, selecting, balancing, and reviewing them so spending supports strategy and underperforming initiatives are stopped.

Demonstrating that IT investments produce agreed business benefits relative to their cost and risk, evidenced through defined measures and post-implementation review.

A quantifiable measure selected to track progress toward an important objective, with a target, owner, and regular reporting cadence.

A staged scale describing how formal, measured, and optimised a process is, used to benchmark current capability and plan governance improvements.

A structured evaluation of whether processes, skills, and tools meet required performance levels, producing gaps and prioritised improvement actions.