ISO/IEC 38500 Lead IT Governance Manager study plan

Define each of the six ISO/IEC 38500 principles (responsibility, strategy, acquisition, performance, conformance, human behaviour) in your own words and give one workplace example per principle.

Distinguish corporate governance of IT from IT management and from IT service management, listing three decision rights that belong to the governing body rather than to IT operations.

Map the ISO/IEC 38500 governance model elements (business pressures, business needs, evaluate, direct, monitor, governing body, managers) onto a single-page diagram you draw yourself.

Explain the terms 'governing body', 'delegation', 'accountability' and 'conformance' with reference to how a board delegates IT decisions without losing accountability.

Explain how the EDM cycle (evaluate, direct, monitor) applies at board, executive and IT-management levels, and identify who performs each task at each level.

Describe the inputs a governing body needs to evaluate an IT proposal (business case, risk appetite, compliance obligations, current portfolio) and the outputs it should produce (decisions, direction, constraints).

Differentiate the three EDM tasks from the Plan-Do-Check-Act cycle and state where the two cycles connect in a governance calendar.

Analyse a public annual-report IT section and classify at least six statements as evaluate, direct or monitor activities.

Draft a governance calendar showing which EDM activities recur monthly, quarterly and annually, and who chairs each.

Write three model board decisions (one investment approval, one risk acceptance, one remediation mandate) that each show the evaluate input, the direction given and the monitoring trigger.

Construct a set of monitoring metrics that measure outcomes rather than activity, and justify why each metric is decision-useful to a governing body.

Identify the failure modes of a broken EDM loop (evaluation without direction, direction without monitoring) and propose a corrective control for each.

Break the ISO/IEC 38500 framework-establishment steps into a sequenced implementation roadmap with dependencies and owners.

Select and justify the artefacts a minimal viable governance framework needs (policy set, decision rights, portfolio register, risk register, performance report, assurance plan).

Design a tailoring approach that adjusts governance rigour to organisational size, sector regulation and IT criticality, and document three tailoring decisions.

Plan a stakeholder engagement and communication approach that secures executive sponsorship and sets expectations for the first 90 days.

Define a continual-improvement loop for the governance framework itself, including how you measure governance effectiveness rather than IT delivery performance.

Design an internal review or self-assessment against ISO/IEC 38500 principles, with evidence sources and a scoring approach.

Distinguish an IT governance audit, an assurance review and a maturity assessment, and state when each is appropriate.

Link governance improvement actions to a risk register so that framework weaknesses are treated as governed risks with owners and dates.

Build an IT risk taxonomy covering strategic, operational, cyber, compliance, supplier and technology-obsolescence risk, and map each category to a governance response.

Define risk appetite and tolerance statements for IT that a board can approve, and show how they constrain project and sourcing decisions.

Explain how IT opportunity exploitation is governed: idea funnel, value case, stage gates, benefits realisation and stop/go criteria.

Describe the three-lines model and assign IT risk ownership, oversight and assurance responsibilities without gaps or duplication.

Trace how business strategy translates into an IT strategy, capability roadmap and investment portfolio, and identify the decision points where governance intervenes.

Critique a weak IT business case and rewrite its benefits, costs, risk and options sections to a standard a governing body could approve.

Design a benefits-realisation review process with post-implementation gates and consequences for missed benefits.

Integrate risk, opportunity and alignment considerations into a single board reporting pack structure.

Consolidate all four domains into a single concept map linking principles, EDM tasks, framework elements, risk and alignment.

Answer at least 120 practice questions across all domains and log every error with the underlying concept gap and a corrective action.

Rehearse scenario-style responses where you must recommend governance actions, justifying each with a principle and an EDM task.

Complete two timed mock exams and review each wrong answer until you can explain why the chosen option fails and the correct one succeeds.