I85PREP
⌘ K
ICAB PL IT Governance study materials
ICAB PL IT Governance study resources

ICAB PL IT Governance: IT Governance Fundamentals

ICAB PL IT Governance · Work through your exam, one topic at a time.

All guide sections

IT Governance Fundamentals

What governance actually is

IT governance is the set of structures, processes and relational mechanisms that direct and control IT so that it supports the organisation's objectives. The key word is direct and control, not operate. Governance sits above management: the board and executive set direction, define decision rights and accountabilities, and monitor outcomes; management executes. Questions frequently blur these two layers. A trap answer will describe a task such as patching servers or running a service desk as governance activity. It is not.

Core concepts to know

  • Decision rights and accountability: who decides on IT investment, architecture standards, priorities and risk appetite.
  • Structures: board IT committee, IT steering committee, CIO reporting line, audit committee oversight.
  • Processes: strategic planning, portfolio management, performance measurement, risk management, compliance.
  • Relational mechanisms: business-IT dialogue, shared goals, cross-functional roles.
  • Frameworks: COBIT (governance objectives and maturity), ISO/IEC 38500 (six principles: responsibility, strategy, acquisition, performance, conformance, human behaviour), ITIL (service management, not governance per se), TOGAF (architecture).

Traps to watch

  1. Confusing frameworks: ISO/IEC 38500 is principle-based and board-facing; COBIT is more prescriptive and control-oriented; ITIL is operational.
  2. Assuming governance equals compliance. Compliance is one outcome; value delivery and risk optimisation are equally central.
  3. Ignoring the distinction between governance of IT (board directing IT) and IT governance used loosely to mean IT management.
  4. Forgetting that accountability cannot be delegated away, even when responsibility is.

Worked example / rule of thumb

A question asks who is accountable for ensuring IT risk is within appetite. The CIO may be responsible for executing controls, but the board (or its risk committee) remains accountable. Rule of thumb: if the answer describes doing work rather than setting direction, granting authority or monitoring, it is management, not governance.