Model and Framework for the Governance of IT
This domain tests whether you can place an activity at the right layer of the ISO/IEC 38500 model and identify which of Evaluate, Direct and Monitor it belongs to. Expect scenarios about escalation, delegation and reporting lines.
Structure of the model
The model has three layers. At the top is the governing body - the person or group accountable for the performance and conformance of the organization. Below it sits executive management, which implements direction; below that, management, which operates. The six principles shape the governing body's behaviour; the EDM cycle is what the governing body does. Its outputs flow down as direction, and information flows back up as performance and conformance reports. The model is technology-neutral and applies wherever IT comes from - insourced, outsourced or cloud.
The three tasks
- Evaluate: examine and judge current and future use of IT - strategies, proposals, supply arrangements - against business needs.
- Direct: assign responsibility, and direct the preparation and implementation of plans and policies; ensure transitions are managed.
- Monitor: measure performance and conformance against plans and targets, using appropriate measurement.
The cycle is continuous, not a one-off annual event.
Worked example
A CIO proposes moving the ERP system to a hosted provider. The board asks for a risk assessment, approves it with conditions, then receives quarterly availability and cost reports.
- Requesting and weighing the assessment against strategy = Evaluate.
- Approving, naming the CIO as accountable owner and requiring a migration plan = Direct.
- Quarterly availability and cost reporting against the plan = Monitor.
The CIO producing the migration plan is executive management acting on the direction given; the governing body's own task remains Direct.
Traps
Do not place operational delivery in the governing body layer, and do not treat Direct as doing the work - it is assignment and authorization. Do not assume ISO/IEC 38500 prescribes an organizational chart, a process library or a maturity model: it sets principles and a model, and works alongside frameworks such as COBIT.