ISO/IEC 38500 IT Governance Manager cheat sheet

Corporate governance is the system by which organizations are directed and controlled; IT governance is a subset focused on IT's contribution to organizational performance and risk management.

ISO/IEC 38500 defines IT governance as the system by which the current and future use of IT is directed and controlled.

IT governance involves evaluating, directing, and monitoring IT use to achieve strategic alignment, value delivery, risk management, resource optimization, and performance measurement.

Governance differs from management: governance sets direction and oversight; management executes and operates within that framework.

Key IT governance frameworks: ISO/IEC 38500 (principles), COBIT (control objectives), ITIL (service management), TOGAF (architecture). ISO/IEC 38500 is principle-based and technology-neutral.

Governance applies to all forms of IT, including outsourced services, cloud, and shadow IT, not just internally managed systems.

Stakeholders in IT governance include the board, executive management, IT management, internal audit, and external regulators.

IT governance is not a one-time project; it is an ongoing cycle of evaluate, direct, and monitor integrated with corporate governance.

The scope of ISO/IEC 38500 covers the governance of IT within an organization, from strategic direction to conformance, and is applicable to all sizes and types of organizations.

The model comprises three core activities: Evaluate, Direct, and Monitor (EDM).

Evaluate: assess current and future use of IT, including pressures, opportunities, threats, and options; consider business strategy, external environment, and stakeholder needs.

Direct: assign responsibility, set policies, establish investment and risk criteria, and ensure alignment with business objectives.

Monitor: measure performance against plans, verify conformance to policies and regulations, and ensure IT meets its obligations.

The EDM cycle is continuous and applies at all levels of the organization, from board to operational management.

ISO/IEC 38500 defines six principles: Responsibility, Strategy, Acquisition, Performance, Conformance, and Human Behaviour.

Responsibility: individuals understand and accept their responsibilities for IT; those with authority also have accountability.

Strategy: IT strategy aligns with business strategy; IT plans satisfy current and future business needs.

Acquisition: IT acquisitions are made for valid reasons, based on appropriate analysis, with clear decision-making and transparent processes.

Performance: IT is fit for purpose, delivers required services, and is measured for quality and value.

Conformance: IT complies with mandatory legislation, regulations, policies, and standards.

Human Behaviour: IT policies and practices respect human behaviour, including the needs of all stakeholders.

The six principles are the foundation for evaluating, directing, and monitoring IT; each principle must be applied in context.

Applying the principles requires tailoring to the organization's size, sector, and risk appetite; the standard is not prescriptive.

Responsibility principle requires clear assignment of IT-related roles and accountability, often documented in a responsibility matrix (e.g., RACI).

Strategy principle requires an IT strategic plan that is reviewed and updated in line with business strategy.

Acquisition principle requires business cases for IT investments, including total cost of ownership and risk assessment.

Performance principle requires KPIs and service level agreements to measure IT performance and value delivery.

Conformance principle requires compliance with laws, regulations, and internal policies, supported by audit and assurance activities.

Human Behaviour principle requires consideration of ergonomics, accessibility, privacy, and ethical use of IT.

Application of the standard often involves establishing an IT governance committee or board to oversee EDM activities.

Implementation begins with a gap analysis against the ISO/IEC 38500 principles and EDM model.

Roles: the board is accountable for IT governance; executive management directs; IT management executes; internal audit provides independent assurance.

Responsibility for IT governance should be explicitly assigned, often to a board committee or a dedicated IT governance function.

Assurance activities include internal audits, external audits, management reviews, and compliance assessments.

Performance measurement uses metrics such as balanced scorecards, KPIs, and maturity models to track governance effectiveness.

Sustaining governance requires regular review and updating of policies, continuous monitoring, and adaptation to changes in business and technology.

Communication and training are essential to embed IT governance culture across the organization.

Documentation of governance processes, decisions, and accountabilities supports transparency and auditability.

Integration with enterprise risk management ensures IT risks are managed within the overall risk framework.