Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500
What the exam tests
This domain checks whether you can distinguish governance from management, explain ISO/IEC 38500's principles-based approach, and apply the six principles to realistic board-level decisions.
Core concepts
ISO/IEC 38500 treats governance of IT as the system by which the current and future use of IT is directed and controlled. Two ideas carry most marks:
- Governance is not management. The governing body (board or equivalent) evaluates, directs and monitors; executive management plans, builds, runs and reports. A board that approves every server purchase has slipped into management.
- Scope is broad. "IT" covers information, data, technology, and the people and processes that use it - not just infrastructure.
- Principles, not prescriptions. The standard is sector-neutral and scale-neutral. It does not mandate COBIT, ITIL or any particular org chart.
The six principles, each a lens for board decisions: Responsibility (clear ownership and authority), Strategy (IT direction supports business objectives), Acquisition (justified, transparent analysis balancing benefits, opportunities, costs and risks), Performance (IT is fit for purpose and measured), Conformance (compliance with law, regulation, contracts, policy), Human behaviour (policies and decisions account for how people actually behave).
Worked example
A retailer's board weighs a cloud migration. Responsibility: name an accountable executive and clarify who approves spend. Strategy: test the migration against the omnichannel plan. Acquisition: compare options, including do-nothing, on benefits, opportunities, costs and risks. Performance: agree service levels and benefit metrics before approval. Conformance: check data protection and cross-border transfer obligations. Human behaviour: budget retraining and expect workarounds. The board directs, then monitors against those measures - it does not design the architecture.
Traps
- Scoring governance as "the IT department's governance."
- Treating the principles as a checklist completed once.
- Assuming ISO/IEC 38500 requires a specific framework or maturity level.
- Forgetting that "IT" includes data and information.