Fundamental Concepts and Principles of Governance of IT
This domain tests whether you can define governance of IT precisely and apply the six ISO/IEC 38500 principles to realistic boardroom situations. Questions probe the definition's wording, the Evaluate–Direct–Monitor cycle, and the governance/management boundary.
Definitions to quote accurately
ISO/IEC 38500 defines governance of IT as the system by which the current and future use of IT is directed and controlled. Two details matter: it covers both current and future use, and it is about direction and control, not delivery. IT is defined as the resources required to acquire, process, store and disseminate information - so IT includes people, information and facilities, not just hardware.
The six principles
- Responsibility: individuals and groups understand and accept their responsibilities for both supply and demand of IT; responsibility carries matching authority.
- Strategy: IT supports current and future business strategy, and IT plans satisfy both.
- Acquisition: acquisitions are made for valid reasons, on appropriate and ongoing analysis, with a transparent balance of benefits, opportunities, costs and risks over the short and long term.
- Performance: IT is fit for purpose, available when required, and delivers the required quality of service.
- Conformance: IT complies with mandatory legislation and regulations, and policies are defined, implemented and enforced.
- Human behaviour: policies, practices and decisions respect the needs of the people involved.
Worked example
A board approves a CRM replacement because the sales director is persuasive, with no business case and no review of running costs. Which principle fails first? Acquisition: no valid reason, no ongoing analysis, no documented balance of benefits, costs and risks. If the board also never establishes who owns the data migration, Responsibility is engaged.
Traps
Do not treat the principles as processes or maturity levels; they are evaluative criteria. Do not read Monitor as day-to-day operational checking - it is the governing body's oversight against plans. And do not equate governance with management: management plans, builds and runs; the governing body evaluates, directs and monitors.