Governance and the VeriSM operating model
Domain 3: Governance and the VeriSM operating model
This domain tests how governance and the operating model work together. You need to distinguish governance from management, identify what the operating model describes, and explain how accountability, risk and value flow through service delivery.
Core rules and concepts
- Governance is the system by which the organization is directed and controlled. It sets direction, decision rights, risk appetite and compliance expectations.
- Governance is accountable for value delivery and risk, but it does not run services day to day. Management executes within the governance framework.
- The VeriSM operating model describes how the organization delivers services: governance, service management and the management mesh working together.
- Decision rights matter: governance defines who can approve investment, accept risk and change service scope.
- The operating model is not an org chart; it shows how capabilities, practices, technologies and people combine to create value.
- Feedback from service performance and consumer outcomes informs governance, so the model is responsive rather than a one-way command chain.
Worked example
A bank introduces a mobile payment feature. The board's governance forum sets the risk appetite for fraud and data privacy, approves the investment and defines who can accept residual risk. The service management team designs the support model and service levels. The management mesh combines fraud analytics, incident response, secure development practices and supplier assurance. Reasoning: governance does not write the incident procedure; it sets the limits and accountability within which service management and the mesh operate. If fraud risk exceeds appetite, the issue escalates to governance, not to the tool team.
Traps that cost marks
- Equating governance with operational management or with a single compliance checklist.
- Treating the operating model as a reporting structure rather than a value-delivery system.
- Assuming governance can delegate accountability for risk entirely to suppliers.
- Forgetting that governance needs feedback from outcomes and service performance.
- Confusing "who decides" with "who does the work".