Governance, risk, compliance and continual improvement of ITAM
Domain 5: Governance, risk, compliance and continual improvement of ITAM
This domain tests how ITAM is directed, controlled and improved, and how compliance and risk are evidenced rather than assumed.
Core rules
- Governance sets direction through policy: scope, ownership, data standards, sourcing rules, disposal rules and performance reporting.
- Internal controls include approvals, segregation of duties, physical controls, access controls, reconciliation and audit trails.
- Risk management identifies threats such as unlicensed software, data leakage, obsolete assets, supplier failure and inaccurate records; assess likelihood and impact, then treat.
- Compliance covers contractual, licensing, data protection, environmental (for example WEEE), health and safety and financial reporting requirements.
- Metrics should link to value: cost per asset, license compliance, data accuracy, asset utilization, disposal compliance and audit findings.
- Continual improvement uses the ITIL 4 continual improvement model: vision, current state, target state, plan, action, measurement and sustaining momentum.
Worked example
An audit finds 8% of installed software is unlicensed. The risk is financial penalty and security exposure. The team treats it by true-up, removing unused installations, adding discovery-based license reconciliation and reporting monthly to the asset owner. A follow-up audit shows variance below 2%. The improvement is documented and the control is embedded.
Traps
- Treating compliance as a one-off audit.
- Measuring activity (number of records) rather than outcomes.
- Ignoring cloud and subscription terms that differ from perpetual licenses.
- Failing to link ITAM objectives to organizational objectives.
Key points
- Governance sets policy, ownership, data standards and reporting.
- Controls include approvals, segregation of duties, reconciliation and audit trails.
- Risk treatment addresses unlicensed software, data leakage, obsolescence and inaccurate records.
- Metrics should measure outcomes such as compliance, cost and data accuracy.
- Continual improvement follows the ITIL 4 model from vision to sustained momentum.