PECB ISO/IEC 38500 Foundation Exam Practice & IT Governance Study Guide cheat sheet

Governance of IT - ISO/IEC 38500 definition: the system by which the current and future use of IT is directed and controlled; it is a subset of corporate governance and does not replace management.

Nature of the standard: ISO/IEC 38500 gives guidance, not requirements; it is not intended for certification of conformity, and it applies to organizations of any size, sector or type.

Six principles, mnemonic R-S-A-P-C-H: Responsibility, Strategy, Acquisition, Performance, Conformance, Human Behaviour.

Responsibility: individuals and groups within the organization understand and accept their responsibilities for both supply of and demand for IT; responsibility is matched by authority to act.

Strategy: the business strategy takes current and future IT capability into account, and IT sustains and extends the organization's strategy and objectives.

Acquisition: IT acquisitions rest on valid reasons and ongoing analysis, use transparent decision-making, and balance benefits, opportunities, costs and risks in the short and the long term.

Performance: IT is fit for purpose in supporting the organization, providing the services, service levels and service quality required to meet current and future business requirements.

Conformance: IT complies with all mandatory legislation and regulations, policies and practices are clearly defined, established and implemented, and IT is consistent with them.

Human Behaviour: IT policies, practices and decisions recognize and take into consideration human behaviour and the evolving needs of all the people in the business processes.

The ISO/IEC 38500 model defines three tasks of the governing body: Evaluate, Direct, Monitor (EDM).

Evaluate: the governing body examines and makes judgements on current and future use of IT, including plans, policies, strategies, proposals and supply arrangements - internal, external or both.

Direct: the governing body assigns responsibility, directs the preparation and implementation of plans and policies, and requires appropriate organizational structures and arrangements.

Monitor: the governing body checks IT performance against plans and policies, the organization's internal objectives, and external obligations such as legislation, regulation, common law, contracts and professional codes.

EDM is a closed loop: outputs of monitoring feed the next evaluation, so governance of IT is continuous rather than a one-off project.

Framework components: the six principles plus the EDM model; ISO/IEC 38502 elaborates the framework and model for the governance of IT.

ISO/IEC 38501 is the implementation guide that shows how to apply ISO/IEC 38500 in an organization.

Extension standards: ISO/IEC 38505-1 applies the 38500 principles and model to governance of data; ISO/IEC 38507 addresses governance implications of the use of artificial intelligence.

Delegation rule: the governing body may assign EDM tasks to committees or managers, but accountability for the governance of IT stays with the governing body, so monitoring must continue.