Governance of Enterprise IT
Governance of Enterprise IT carries the largest weight on CGEIT. It tests whether you can design, direct and monitor an enterprise IT governance system-not run IT projects. Expect questions on governance versus management, stakeholder needs cascading into IT objectives, and COBIT 2019 tailoring.
Governance versus management
Governance sets direction and accountability; management executes. COBIT 2019 expresses governance through five EDM objectives: EDM01 Ensured Governance Framework Setting and Maintenance, EDM02 Ensured Benefits Delivery, EDM03 Ensured Risk Optimization, EDM04 Ensured Resource Optimization and EDM05 Ensured Stakeholder Engagement. Management objectives sit in APO, BAI, DSS and MEA. A board that approves IT strategy but personally selects the ERP vendor has crossed from direction into management.
Governance system design
COBIT 2019 is a tailored governance system, not a fixed process catalogue. It uses six component types-processes; organizational structures; culture, ethics and behavior; information; services, infrastructure and applications; people, skills and competencies. Eleven design factors shape tailoring: enterprise strategy, goals, risk profile, IT-related issues, threat landscape, compliance requirements, role of IT, sourcing model, IT adoption strategy, enterprise size and future factors. ISO/IEC 38500 adds six principles: responsibility, strategy, acquisition, performance, conformance and human behavior.
Accountability
Apply the three lines model. The first line owns operational risk; the second provides oversight, frameworks and challenge (risk, compliance, architecture); the third gives independent assurance. An IT steering committee normally sits in the second line and should not approve its own spend beyond board-set limits.
Worked example
An insurer wants faster cloud adoption. Should IT or the business approve cloud projects? Reasoning: the board applies EDM-it sets risk appetite and strategic direction, not individual approvals. Design factors show a growth strategy, conservative risk profile from regulated data, and multi-vendor sourcing. Decision rights: business units own business cases and outcomes; IT owns architecture and security standards; a cloud review board applies guardrails; internal audit assures. The board monitors through KRIs and a quarterly dashboard. This is governance design, not a project decision.
Traps
- Treating COBIT as a prescriptive process list rather than a tailored system.
- Calling a steering committee 'governance' when it only reviews project status.
- Assigning accountability for business benefits to IT.
- Ignoring culture, ethics and behavior as a governance component.
- Treating ISO/IEC 38500 and COBIT as alternatives rather than complements.