PECB ISO/IEC 38500 Foundation Exam Practice & IT Governance Study Guide key terms

The system by which an organization directs and controls its use of information and communication technology, evaluating options, setting direction and monitoring results so that stakeholder expectations are met.

The system of rules, practices and processes by which an organization is directed and controlled, covering strategy, risk, accountability and relationships with shareholders and other stakeholders.

The person or group with ultimate authority and accountability for the organization's strategy and performance, such as a board of directors, a council or an owner.

The senior managers who run the organization day to day and implement the direction set by the governing body within agreed authority, resources and constraints.

The governance task of examining current and future use of IT, including options, risks and value, so that the governing body can make informed decisions about direction.

The governance task of assigning responsibility, setting policy and strategy, and instructing executive management on how IT should be used to meet organizational objectives.

The governance task of measuring and reviewing IT performance, conformance with policy and use of resources, and confirming that the agreed direction has actually been followed.

The recurring sequence of evaluate, direct and monitor tasks through which a governing body governs IT, feeding the results of monitoring back into fresh evaluations.

Everyone involved in IT understands and accepts their duties for both supplying and demanding IT, with authority clearly assigned and matched to accountability.

IT strategy and plans are aligned with and support the organization's business strategy and objectives, and are reviewed as business needs and circumstances change.

Decisions to acquire IT are justified by clear business needs, based on sound and continuing analysis, and made through open, well-documented decision processes.

IT is fit for purpose and delivers the required service levels, quality and capacity to support business needs, both now and in the future.

IT use complies with laws, regulations, contractual obligations and internal policies, and that compliance is demonstrated through evidence, review and reporting.

IT policies, practices and decisions consider and respect the behaviour of people, including culture, skills, workloads and impacts on staff and customers.

Any person or group with an interest in the organization's use of IT, including shareholders, employees, customers, suppliers, regulators and the wider community.

The obligation of a named person or body to answer for decisions, actions and outcomes, and to accept the consequences, even where authority has been delegated.

The formal transfer of decision rights and duties from a higher level to a lower level, with clear limits, retained accountability and defined reporting back.

An internal or external force, such as regulation, competition, cost pressure or new technology, that drives change in how an organization governs and uses IT.

A structured set of principles, roles, processes and measures an organization uses to direct and control IT, often combining ISO/IEC 38500 with supporting frameworks.

The condition in which IT priorities, investments and capabilities match and actively support the organization's business goals, plans and operating model.

The realization of intended business benefits from IT investments, including efficiency, revenue, service quality and risk reduction, measured against agreed objectives.

The effect of uncertainty on IT-related objectives, covering threats and opportunities such as outages, security incidents, cost overruns and rapid technology change.

Making the best use of IT resources, including people, infrastructure, data, finances and suppliers, so they deliver the greatest benefit at acceptable cost.

The use of defined indicators, targets and reports to assess whether IT is delivering the expected levels of service, value and control.

The state of meeting applicable laws, regulations, standards, contracts and internal rules, supported by evidence that the obligations are actually being fulfilled.

The policies, procedures and checks designed to give reasonable assurance that IT objectives are met, assets are protected, and significant errors or fraud are prevented or detected.

An independent or objective assessment that gives the governing body confidence that IT controls, reporting and risk management are designed and operating effectively.

Openness about how IT decisions are made, who is accountable and what results are achieved, so stakeholders can see and challenge the basis of decisions.

Governance evaluates, directs and monitors IT, while management plans, builds, runs and reports on it within the direction and limits set by the governing body.

Any asset or capability used to deliver IT services, including people, applications, infrastructure, data, facilities, budgets and third-party service providers.

Applying governance effort and formality in proportion to the size, complexity, risk and importance of IT to the organization, avoiding unnecessary bureaucracy.

The ongoing practice of reviewing governance and IT performance, identifying weaknesses and making changes so that outcomes improve over successive cycles.

A documented statement of intent and boundaries issued with authority, defining what must or must not be done in a given area of IT.

An international standard that provides principles and a model for governing IT, applicable to organizations of every size and sector, and usable by boards and senior executives.

A widely used framework from ISACA that translates governance objectives into management practices and controls, often used to implement ISO/IEC 38500 direction.