IT governance model and the evaluate, direct and monitor (EDM) cycle
What the exam tests
You must describe Evaluate–Direct–Monitor as a continuous, delegated-but-accountable cycle at governing-body level, and place each task correctly in a scenario.
Core rules
Evaluate gathers evidence before commitment: current and future use of IT, strategy fit, proposals, internal and external supply arrangements, risk appetite, capability and performance. Output: informed judgement, options and a recommendation.
Direct converts judgement into direction: approve strategy, policies, plans and budgets; assign responsibility and accountability; set constraints such as risk appetite and delegation limits; communicate expectations.
Monitor checks delivery: performance against agreed metrics, conformance with obligations, and risk within appetite. It draws on management reporting plus independent assurance, and feeds corrective action and re-evaluation.
Three rules govern the cycle: it repeats (not a one-off gate); authority can be delegated but accountability cannot; and the same EDM logic applies at every layer, from board to executive to business unit - with the board accountable for the whole. ISO/IEC 38502 elaborates the model and framework; ISO/IEC TS 38501 covers implementation.
Worked example
A bank's board considers an AI chatbot for customer service. Evaluate: business case, model and privacy risk, third-party dependency, expected benefit, conformity with conduct rules. Direct: approve a use-of-AI policy, appoint an accountable executive, set an approval threshold for high-risk models, instruct the CIO and risk committee. Monitor: monthly benefit and complaint metrics, incident reporting, internal audit assurance. When assurance shows rising misclassification, the board re-evaluates and narrows scope - the loop restarts.
Traps
- Approving a proposal without an evaluate stage.
- Monitoring cost and schedule only, ignoring benefits, risk and conformance.
- Treating "direct" as instructing the IT department rather than setting board-level direction.
- Supposing delegation removes accountability.
- Assuming self-reported management data alone constitutes monitoring.