Governing service management across the organization
Domain 3 - Governing service management across the organization
Governance is the system of decision rights and accountabilities by which the organisation directs and controls service management. The exam tests the governance-versus-management distinction, the ISO/IEC 38500 principles, and how guardrails let teams move quickly without losing control.
Core rules
- Governance sets direction and boundaries; management executes within them. Governance decides what must be true - risk appetite, investment thresholds, compliance obligations. Management decides how to achieve it.
- ISO/IEC 38500 offers six principles: responsibility (who is accountable), strategy (fit with business aims), acquisition (sound, justified investment), performance (fit for purpose, delivering value), conformance (compliance with obligations) and human behaviour (respect for people).
- A governing body - the board or a delegated committee - owns this, not the IT department alone. Service management governance spans every service, including business and shadow services.
- Guardrails, not gates. Good governance delegates authority with clear thresholds, so a small SaaS purchase needs a risk check rather than a six-week approval chain.
- Accountability is not delegated away, even when work is outsourced or consumed from the cloud.
- Assurance needs evidence: reporting on value, risk, compliance and resource use, with defined escalation paths.
Worked example: a marketing team buys a SaaS tool holding customer data, outside IT. A control-heavy response - ban it, demand it be undone - usually drives the behaviour underground. A governance response instead publishes a decision-rights matrix with spend and data-sensitivity thresholds; requires a light data-protection and security check above the threshold; registers the tool; and reviews quarterly. The outcome is visibility and managed risk rather than prohibition.
Traps that cost marks
- Equating governance with management, or with day-to-day approval queues.
- Treating governance as an IT-only concern.
- Assuming more controls always mean better governance; over-control pushes activity out of sight.
- Focusing only on conformance and ignoring performance and value.
- Believing outsourced or cloud services remove accountability.