PECB ISO/IEC 38500 Foundation Exam Practice & IT Governance Study Guide flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Governance of IT

The system by which the current and future use of IT is directed and controlled, as defined in ISO/IEC 38500; it involves evaluating, directing and monitoring the use of IT.

Governing body

Person or group of people accountable for the performance and conformance of the organization; in ISO/IEC 38500 the governing body evaluates, directs and monitors the use of IT.

Six governance principles

ISO/IEC 38500 principles: Responsibility, Strategy, Acquisition, Performance, Conformance and Human Behaviour; they express preferred behaviour for governing IT in any organization.

Responsibility principle

Principle stating that individuals and groups within the organization understand and accept their responsibilities for both supply of and demand for IT, with authority matching responsibility.

Strategy principle

Principle stating that the organization's business strategy takes account of current and future IT capability, and that IT sustains and extends the organization's strategy and objectives.

Acquisition principle

Principle requiring IT acquisitions to be made for valid reasons, based on appropriate ongoing analysis, with transparent decisions balancing benefits, opportunities, costs and risks over the short and long term.

Performance principle

Principle stating that IT is fit for purpose in supporting the organization, providing the services, service levels and service quality required to meet current and future business requirements.

Conformance principle

Principle stating that IT complies with mandatory legislation and regulations, and that policies and practices are clearly defined, established and implemented, with IT consistent with them.

Human Behaviour principle

Principle stating that IT policies, practices and decisions recognize and take into consideration human behaviour and the evolving needs of all the people in the business processes.

Corporate governance relationship

ISO/IEC 38500 positions governance of IT as a subset of corporate governance; IT direction and control must be consistent with the organization's overall governance arrangements.

Stakeholder

Person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity, including decisions and activities that concern the use of IT.

IT (38500 definition)

Defined in ISO/IEC 38500 as the resources required to acquire, process, store and disseminate information, covering the people, processes and technology the organization relies on.

Guidance, not requirements

ISO/IEC 38500 provides guidance rather than requirements; it is not intended for third-party certification of conformity, although organizations may use it for self-assessment and improvement.

Accountability

Obligation to answer for decisions, actions and results; under ISO/IEC 38500 the governing body remains accountable for the governance of IT even when it delegates tasks.

Authority with responsibility

Rule within the responsibility principle: those who hold responsibility for IT actions must also have the authority needed to perform those actions and to complete them.

Supply and demand for IT

The two sides the responsibility principle covers: business functions that demand IT services, and the internal or external parties who supply and operate those services.

Evaluate

Governing body task of examining and making judgements on the organization's current and future use of IT, including plans, policies, strategies, proposals and supply arrangements.

Direct

Governing body task of assigning responsibility and directing the preparation and implementation of IT plans and policies, requiring appropriate organizational structures and arrangements.

Monitor

Governing body task of monitoring IT performance against plans and policies, internal objectives and external obligations such as legislation, regulation, contracts and professional standards.

Evaluate-Direct-Monitor model

The three-task cycle described in ISO/IEC 38500 through which a governing body governs IT; the outputs of monitoring feed back into the next evaluation.

ISO/IEC 38502

Complementary standard to ISO/IEC 38500 that provides a framework and model for the governance of IT and guidance on applying the evaluate, direct and monitor tasks.

ISO/IEC 38501

Implementation guide for ISO/IEC 38500; it offers practical guidance on applying the governance of IT standard in organizations of any size or sector.

ISO/IEC 38505-1

Standard that applies the ISO/IEC 38500 principles and evaluate, direct, monitor model to the governance of data, giving guidance to governing bodies responsible for data.

ISO/IEC 38507

Standard addressing the governance implications of the use of artificial intelligence by organizations, built on the ISO/IEC 38500 principles and the evaluate, direct, monitor model.

External obligations

Obligations the governing body monitors IT conformance against alongside internal plans and policies; examples are legislation, regulation, common law, contracts and professional codes.

Governance versus management

Governance sets IT direction and control at governing-body level, while management executes the plans, builds and runs IT services within that direction and reports upwards.

Delegation under EDM

A governing body may assign evaluate, direct or monitor tasks to committees or managers, but accountability for the governance of IT is not transferred and monitoring must continue.

EDM feedback loop

Characteristic of the model: monitoring results inform the next round of evaluation, making governance of IT a continuous cycle rather than a single one-off exercise.

Typical evaluation inputs

Subjects the governing body evaluates: current and future IT use, business plans and IT strategies, policy proposals, and internal, external or mixed supply arrangements.

Framework components

In ISO/IEC 38500 the framework combines the six principles with the evaluate, direct, monitor model; ISO/IEC 38502 expands on how this framework is applied.

Outputs of directing

What directing IT produces: assigned responsibilities, approved plans and policies, and appropriate organizational structures and decision-making arrangements for the use of IT.

Supply arrangements

IT may be supplied internally, externally or through a mix; the governing body evaluates these arrangements and directs and monitors them whatever sourcing model is used.