ISO/IEC 38500 Lead IT Governance Manager flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

IT governance definition

The system by which the current and future use of IT is directed and controlled, involving evaluating, directing and monitoring IT use to achieve business objectives.

Responsibility principle

Individuals and groups within the organisation understand and accept their responsibilities for both supply and demand of IT, with clear accountability.

Strategy principle

IT strategy aligns with and supports the organisation's business strategy, ensuring business and IT plans are integrated and mutually reinforcing.

Acquisition principle

IT acquisitions are made for valid reasons, based on appropriate and ongoing analysis, with clear and transparent decision-making processes.

Performance principle

IT is fit for purpose, delivering required services and levels of quality, and is used effectively and efficiently to meet business needs.

Conformance principle

IT complies with all mandatory legislation and regulations, and with internal policies, practices, and ethical standards.

Human Behaviour principle

IT policies, practices and decisions consider and respect human behaviour, including the needs of all people involved in or affected by IT.

Governance vs management

Governance evaluates, directs and monitors IT use; management plans, builds, runs and monitors IT operations to execute the direction set.

Evaluate task

The governing body examines current and future use of IT, including strategy, proposals, risks, opportunities, and performance, to inform decisions.

Direct task

The governing body assigns responsibility, sets policies, and instructs management to prepare and implement plans consistent with governance direction.

Monitor task

The governing body checks that performance conforms to plans and that IT complies with obligations, using agreed metrics and reporting.

EDM cycle

A continuous cycle of Evaluate, Direct and Monitor tasks performed by the governing body, revisited at defined intervals or on significant change.

Delegation in EDM

The governing body may delegate EDM tasks to management but retains accountability; delegation does not remove governance responsibility.

EDM at all levels

EDM applies from board to executive, executive to IT management, and IT management to service delivery, ensuring governance throughout the organisation.

Governance committees

Committees such as audit, risk, and IT steering support the governing body in EDM tasks, but final authority remains with the governing body.

Framework establishment cycle

A cycle of establish, implement, monitor, review, and improve, often mapped to PDCA, for continually improving the IT governance framework.

Step 1: Establish

Define the scope, principles, model, policies, and responsibilities for IT governance, creating the foundation of the framework.

Step 2: Implement

Execute EDM, allocate resources, and communicate governance expectations throughout the organisation to embed the framework.

Step 3: Monitor and review

Collect evidence, assess performance and conformance, and identify gaps to determine the effectiveness of the governance framework.

Step 4: Improve

Take corrective and preventive actions, update the framework, and re-enter the cycle to achieve continual improvement.

Governance framework components

Principles, EDM model, policies, processes, roles and responsibilities, performance measurement, and communication are key components.

Framework documentation

A governance charter, RACI matrices, policy set, and reporting calendar document the governance framework and support consistent application.

Continual improvement metrics

Measurable objectives with baseline metrics are set and reviewed at planned intervals to drive continual improvement of the framework.

Stakeholder engagement

Clear communication and engagement with stakeholders are essential for framework adoption, sustainability, and alignment with business needs.

Risk management process

Identify, analyse, evaluate, treat, monitor, and communicate risks, aligned with ISO 31000, to manage IT-related uncertainties.

IT risk categories

Strategic, operational, compliance, financial, reputational, and technology obsolescence risks are common categories of IT risk.

Risk appetite and tolerance

The governing body sets risk appetite and tolerance thresholds; IT decisions must fall within these limits to ensure acceptable risk exposure.

Opportunity exploitation

IT investments are evaluated for value, alignment, and risk; business cases include expected benefits and costs to justify exploitation.

Strategic alignment

IT strategy is derived from and supports business strategy, with business and IT plans integrated to achieve organisational objectives.

Portfolio management

Balancing IT investments across run, grow, and transform categories to manage risk and opportunity effectively.

Alignment KPIs

IT spend as percentage of revenue, project success rates, and business satisfaction with IT are key performance indicators for alignment.

Risk treatment options

Avoid, reduce, transfer, or accept risks; each treatment leaves residual risk that must be monitored and reviewed.