ISO/IEC 38500 Lead IT Governance Manager cheat sheet

ISO/IEC 38500 defines IT governance as the system by which the current and future use of IT is directed and controlled; it involves evaluating, directing and monitoring IT use.

Six principles of ISO/IEC 38500: Responsibility, Strategy, Acquisition, Performance, Conformance, Human Behaviour.

Responsibility principle: individuals and groups within the organisation understand and accept their responsibilities for both supply and demand of IT.

Strategy principle: IT strategy aligns with and supports the organisation's business strategy; business plans and IT plans are integrated.

Acquisition principle: IT acquisitions are made for valid reasons, on the basis of appropriate and ongoing analysis, with clear and transparent decision-making.

Performance principle: IT is fit for purpose, delivering required services and levels of quality, and is used effectively and efficiently.

Conformance principle: IT complies with all mandatory legislation and regulations, and with internal policies and practices.

Human Behaviour principle: IT policies, practices and decisions consider and respect human behaviour, including the needs of all people involved.

Governance vs management: governance evaluates, directs and monitors; management plans, builds, runs and monitors IT operations.

The governing body performs three main tasks: Evaluate (assess current and future use of IT), Direct (assign responsibility and set direction), Monitor (check performance against plans).

EDM is a continuous cycle; each task feeds the next and is revisited at defined intervals or on significant change.

Evaluate: the governing body examines current and future use of IT, including strategy, proposals, risks, opportunities, and performance.

Direct: the governing body assigns responsibility, sets policies, and instructs management to prepare and implement plans.

Monitor: the governing body checks that performance conforms to plans and that IT complies with obligations, using agreed metrics and reporting.

The governing body delegates EDM tasks to management but retains accountability; delegation does not remove governance responsibility.

EDM applies at all levels: board to executive, executive to IT management, IT management to service delivery.

Decision-making models: the governing body may use committees (e.g., audit, risk, IT steering) to support EDM, but retains final authority.

Monitoring uses conformance and performance indicators; corrective action is directed back through the Direct task.

Framework establishment follows a cycle: establish, implement, monitor, review, improve (often mapped to PDCA).

Step 1: Establish the framework - define scope, principles, model, policies, and responsibilities for IT governance.

Step 2: Implement the framework - execute EDM, allocate resources, and communicate governance expectations.

Step 3: Monitor and review - collect evidence, assess performance and conformance, and identify gaps.

Step 4: Improve - take corrective and preventive actions, update the framework, and re-enter the cycle.

Key components of a governance framework: principles, model (EDM), policies, processes, roles and responsibilities, performance measurement, and communication.

Governance framework documentation includes a governance charter, RACI matrices, policy set, and reporting calendar.

Continual improvement uses measurable objectives; baseline metrics are set and reviewed at planned intervals.

Stakeholder engagement and clear communication are essential for framework adoption and sustainability.

Risk management process: identify, analyse, evaluate, treat, monitor, and communicate risks (ISO 31000 alignment).

IT risk categories include strategic, operational, compliance, financial, reputational, and technology obsolescence risks.

Risk appetite and risk tolerance are set by the governing body; IT decisions must fall within these thresholds.

Opportunity exploitation: IT investments are evaluated for value, alignment, and risk; business cases include expected benefits and costs.

Alignment is achieved when IT strategy is derived from and supports business strategy, and when business and IT plans are integrated.

Portfolio management: balance IT investments across run, grow, and transform categories to manage risk and opportunity.

Key performance indicators for alignment include IT spend as % of revenue, project success rates, and business satisfaction with IT.

Risk treatment options: avoid, reduce, transfer, accept; each treatment has residual risk that must be monitored.

Governance ensures that risk and opportunity decisions are transparent, documented, and reviewed at appropriate intervals.