Establishing, implementing and continually improving an IT governance framework
What the exam tests
Whether you can design a governance framework tailored to an organization, implement it so it changes decisions, and keep improving it - rather than simply naming a product such as COBIT.
Core rules
A framework is the structures, processes, decision rights, policies, metrics, assurance and culture through which the governing body evaluates, directs and monitors IT. ISO/IEC 38500 sets principles; ISO/IEC TS 38501 supplies implementation guidance; ISO/IEC 38502 describes the framework and model. A workable build sequence:
- Establish a sponsor with authority, define scope (subsidiaries, outsourcing, shadow IT), and assess the current state.
- Design decision rights and accountabilities, policies aligned to the six principles, investment and risk gates, and a measurement set.
- Implement with communication, training, and a pilot that proves the framework changes real decisions.
- Operate and review through metrics, internal audit and independent assurance.
- Improve using plan–do–check–act, maturity assessment, audit findings, incidents and lessons learned, revisiting the framework as strategy, regulation or technology changes.
Continual improvement is not a one-time reorganisation: the governing body should review framework effectiveness on a scheduled basis, with evidence.
Worked example
A public agency receives an audit finding that IT investment decisions are undocumented. The board establishes an audit-committee sponsor and scopes the framework to include a shared-services contract. It designs a two-gate investment process, a risk register reviewed quarterly, and six KPIs linked to the principles. A pilot in one directorate reveals the gates are too slow; thresholds are adjusted before roll-out. Twelve months later, internal audit confirms decisions are documented and the board adds an annual external assurance review. The pilot finding and the adjustment are the improvement loop in action.
Traps
- Equating framework with tooling or an organisation chart.
- Documentation without embedding in decision-making.
- No metrics, so improvement cannot be evidenced.
- Leaving outsourced, cloud and subsidiary IT outside scope.
- No scheduled review or independent assurance.