ISO/IEC 38500 Lead IT Governance Manager common mistakes
ISO/IEC 38500 Lead IT Governance Manager · Understand the traps and how to avoid them.
Treating ISO/IEC 38500 as a technical or operational standard and answering scenario questions by choosing the most technically sophisticated IT control (e.g., a specific firewall configuration or patch cadence) instead of the governing-body action.
Candidates arrive from IT operations, audit, or security backgrounds where 'best answer' means the most granular technical control, and they carry that reflex into a standard that deliberately addresses the directing body rather than IT staff.
What to do instead
Before answering, ask 'who performs this action in ISO/IEC 38500 terms?' If the answer is an administrator or engineer, the option is probably wrong. The standard's subject is the governing body's evaluation, direction, and monitoring of IT, so prefer answers framed as setting expectations, assigning accountability, approving policy, or requiring assurance.
Confusing the six principles (responsibility, strategy, acquisition, performance, conformance, human behaviour) with the three governance tasks (evaluate, direct, monitor), and selecting a principle name when the question asks which EDM activity is being performed, or vice versa.
Both lists are short, memorised together, and often recalled as a single undifferentiated set of 'six or nine things.' Under time pressure the candidate grabs whichever term is most familiar.
What to do instead
Build a two-axis mental table: principles describe what good governance looks like; EDM describes what the governing body does. Practise classifying short scenario sentences into one axis or the other until the distinction is automatic, and check the question stem for cues such as 'which principle' versus 'which activity'.
Describing the EDM cycle as strictly linear and one-pass (evaluate, then direct, then monitor, then stop), and rejecting options that place monitoring before or alongside direction.
The three words appear in sequence in the standard and are easy to memorise as a waterfall. Candidates then treat any iterative or feedback description as contradicting the model.
What to do instead
Learn EDM as a continuous loop: monitoring feeds the next evaluation, and direction is adjusted as evidence arrives. Expect questions where the correct answer shows the governing body re-evaluating after a monitoring report, or monitoring an existing investment while directing a new one.
Assigning the governing body direct operational responsibility, for example answering that the board 'implements the IT risk treatment plan' or 'manages the IT service continuity arrangements' rather than requiring and overseeing them.
The principle of responsibility is misread as 'the board is responsible for everything,' which collapses the distinction between accountability and delegation that the standard is careful to preserve.
What to do instead
Use the delegation test: the governing body remains accountable but assigns execution. Correct answers typically show the board approving risk appetite, assigning ownership, and requiring evidence, while management designs and operates controls. Reject options that put the board in the execution seat.
Treating framework establishment as a one-time documentation exercise and choosing 'write the policy and publish it' as the complete answer, omitting implementation, monitoring, and continual improvement.
Many candidates have seen governance maturity models and policy templates, so they equate 'framework' with a document set. The improvement clause of ISO/IEC 38500 is the least practised part of the cycle.
What to do instead
For any framework question, check whether the chosen option closes the loop: establish (define, assign, approve), implement (resource, communicate, embed), monitor (measure, assure, report), and improve (review, adapt). An option that stops at publication is almost always incomplete.
Ignoring the conformance principle when a scenario is really about compliance, and instead answering with a performance or acquisition principle because the scenario mentions budgets, projects, or vendors.
Business scenarios are written realistically, so a compliance question often contains financial and procurement detail that pulls attention toward the wrong principle. Candidates match on surface keywords rather than the governance concern at issue.
What to do instead
Identify the governance question being tested before reading the options: is it 'are we doing the right thing, legally and to our own rules' (conformance) or 'are we doing it well and at acceptable cost' (performance)? Write the concern in three words, then select the option that addresses that concern.
Answering IT risk questions by listing controls rather than by articulating risk appetite, tolerance, ownership, and escalation to the governing body.
Risk management training in technical and audit contexts emphasises control catalogues and mitigation tactics. Candidates reproduce that training instead of the governance view, which is about deciding how much risk is acceptable and who is accountable for it.
What to do instead
Frame every risk answer around three governance artefacts: an approved risk appetite, named risk owners with authority, and a reporting route that escalates breaches to the directing body. Controls belong to management; the exam usually tests the decision and oversight layer.
Treating IT strategy alignment as an IT-department deliverable, so the chosen answer has IT producing a strategy and presenting it to the business for endorsement, rather than business strategy driving IT direction.
In many organisations IT planning genuinely happens this way, and candidates generalise from their own workplace. The standard's strategy principle requires IT plans to be derived from and integrated with the organisation's objectives.
What to do instead
Look for the direction of derivation in each option. Correct answers show business objectives defined first, IT direction derived from them, and the governing body ensuring both stay aligned through periodic evaluation. Reject options where IT sets the agenda and seeks retrospective approval.
Selecting the most comprehensive-sounding option in 'exploiting IT opportunities' questions, even when it commits the organisation to investment without evaluation, business case, or defined benefit measures.
Opportunity questions feel positive, and candidates associate thoroughness with long, ambitious answers. They overlook that the standard requires disciplined evaluation before commitment, not enthusiasm.
What to do instead
Prefer options that require a business case, defined expected benefits, staged approval, and post-implementation benefit realisation review. An option that approves a large transformation without those elements is a governance failure dressed as initiative.
Answering 'human behaviour' scenarios with change-management or training tactics only, missing the governance expectation that the directing body sets expectations about how people use and are affected by IT.
Human behaviour is the principle candidates remember least and the one most easily reduced to 'run a training programme.' Training is a management action, not the governance requirement the question is testing.
What to do instead
For human behaviour questions, look for options where the governing body establishes and communicates expectations about acceptable IT use, considers the impact of IT change on people, and holds management accountable for culture and capability. Training may appear as a supporting action, not the whole answer.