IT Strategy and Governance
The IT Strategy and Governance domain tests whether you can connect business direction to technology choices and distinguish governing IT from managing it. Questions target strategy formulation, operating models, decision rights, portfolio value, and benefits realization.
Strategy is a set of choices
An IT strategy is not a project list. It states where technology creates advantage, which capabilities matter, what is standardized versus differentiated, and how investment is sequenced. The Henderson–Venkatraman operating model frames the core choice as standardization versus integration of business processes and IT. High integration supports shared customer data and end-to-end processes; high standardization supports cost, speed, and reuse. Strategy must also state what the organization will not do.
Governance sets decision rights
COBIT 2019 separates governance from management. Governance is the EDM cycle - Evaluate, Direct, Monitor - owned by the board or governing body. Management plans, builds, runs, and monitors through APO, BAI, DSS, and MEA. COBIT defines 40 objectives: five governance and 35 management. Weill and Ross archetypes - business monarchy, IT monarchy, feudal, federal, IT duopoly, anarchy - should be matched to decision type. Architecture principles often suit a federal model; infrastructure standards may suit an IT monarchy; major business cases need business input. The Three Lines Model places management in line one, risk and compliance in line two, and internal audit in line three.
Worked example
A retailer wants weekly e-commerce releases. The board should not approve each release. It sets risk appetite, delegates release authority to a product and platform board (federal archetype), and monitors outcome metrics such as lead time and change failure rate. The CIO manages the pipeline. If the board begins approving individual changes, it has slipped into management and created a bottleneck. The evidence of good governance is not meeting frequency but clear decision rights, measured outcomes, and escalation when risk appetite is breached.
Traps that cost marks
- Treating governance as a committee rather than decision rights and accountability.
- Writing a strategy that is only a project list or a technology wish list.
- Measuring IT only by spend, not by benefits, risk, and service outcomes.
- Using one decision archetype for every decision.
- Confusing IT alignment with IT taking over business strategy.
- Forgetting benefits realization after project closure.