ISO/IEC 38500 IT Governance Manager common mistakes
ISO/IEC 38500 IT Governance Manager · Understand the traps and how to avoid them.
Treating ISO/IEC 38500 as a framework that tells you how to run IT operations (procurement steps, service management processes, control catalogues) rather than as a governance standard for the direction and oversight of IT by the governing body.
Candidates bring habits from ITIL, COBIT or project-management study, where the material is operational and prescriptive. 38500 deliberately stays at the level of principles and a governing-body model, so those habits produce answers that are too operational.
What to do instead
Before answering, ask who is acting: if the actor is the board or equivalent governing body setting direction and holding management to account, it is in scope; if the actor is a delivery team executing a process, it is management practice. Practise sorting a list of activities into 'governing body' versus 'management' until the split is automatic.
Confusing corporate governance of IT with IT governance as practiced by the CIO, and answering that the CIO or IT steering committee is accountable for IT governance.
In most organisations the CIO is the visible owner of IT, so the intuitive answer names the CIO. The standard places accountability with the governing body, with IT governance being a subset of corporate governance.
What to do instead
Memorise the accountability chain: governing body is accountable, executive management implements, and the CIO is normally a member of executive management who is responsible for execution. When a question asks 'who is accountable', default to the governing body unless the scenario explicitly delegates a defined responsibility.
Mixing up the three tasks of the model, for example describing 'Direct' as assigning tasks to staff or 'Monitor' as day-to-day supervision of projects.
The everyday meanings of 'direct' and 'monitor' pull candidates toward operational management, whereas in the model they mean, respectively, assigning responsibility and giving direction through strategy and policy, and measuring performance against plans.
What to do instead
Anchor each task with a one-line test: Evaluate = assess current and future use of IT, including pressures and options; Direct = prepare and implement plans and policies, assign responsibility and allocate resources; Monitor = measure performance against plans and conformance to policy, using both internal and external assurance. Apply the test to each option before choosing.
Answering that Evaluate, Direct and Monitor are strictly sequential phases completed once and then finished.
The words read like a lifecycle, so candidates map them onto a linear process. In the standard they are a continuous, iterative cycle applied by the governing body at every governing-body meeting and at every decision point.
What to do instead
Picture the model as a loop that runs continuously over the same IT estate, with each task feeding the next and the monitoring results re-entering the evaluation. Choose answers that describe ongoing oversight rather than a one-off project gate.
Reciting the six principles by name but being unable to apply them to a scenario, for example failing to recognise that an unclear accountability question is testing the 'Clear responsibilities' principle.
Candidates memorise the list (responsibility, strategy, acquisition, performance, conformance, human behaviour) but never practise mapping a symptom in a scenario to the principle it violates.
What to do instead
For each principle, write one realistic symptom and one realistic governing-body response, then practise reading a short scenario and naming the principle before reading the options. If the scenario mentions unclear ownership, overlapping accountabilities or nobody able to approve a decision, it is almost certainly 'Clear responsibilities'.
Treating the 'Acquire' principle as being only about buying hardware and software, and missing that it covers valid, informed investment decisions across the whole IT lifecycle, including business cases, options analysis and benefits realisation.
The word 'acquire' suggests procurement. The principle is about making acquisition decisions on appropriate and ongoing analysis with clear and transparent business cases, and it applies to any investment in IT capability.
What to do instead
Remember the principle's intent: informed, transparent investment decisions with a defensible business case and expected benefits stated up front. When a scenario involves a decision to invest, extend, replace or retire IT capability, test the options against business-case quality, transparency and lifecycle thinking rather than procurement mechanics.
Answering that the governing body should personally perform assurance activities, or that internal audit reports to the CIO, rather than requiring independent assurance and a clear reporting line.
Candidates conflate 'the governing body monitors' with 'the governing body does the checking', and they default to the organisational chart they know, where audit sits under finance or IT management.
What to do instead
Separate the three lines: management owns and operates controls, a risk or compliance function oversees, and internal audit provides independent assurance. The governing body commissions and receives assurance and must be satisfied it is independent; it does not execute the checks. Learn to spot options that compromise independence.
Leaving roles and responsibilities implicit, or assigning a responsibility without the matching authority, when answering questions about implementing governance.
Candidates describe what needs to happen but not who decides, who is accountable and who must be informed, because the standard's own language about assigning responsibility feels obvious and is therefore skipped.
What to do instead
For any implementation question, force yourself to state three things explicitly: the accountable role, the authority that role holds, and the mechanism by which the governing body receives evidence. If an option assigns accountability without authority, or names a committee without a decision right, reject it.
Proposing a one-off governance implementation (publish a policy, appoint a committee, run a review) with no mechanism for sustaining it through performance measurement, review cycles and continuous improvement.
Exam scenarios often ask 'what should be done first' or 'what should be established', and candidates answer with a single artefact. The standard expects governance to be embedded and repeatedly evaluated, so single-artefact answers are incomplete.
What to do instead
Build a habit of pairing every implementation answer with its sustainment mechanism: policy plus review cycle, committee plus defined decision rights and reporting, assurance activity plus escalation and follow-up. Prefer options that close the loop from monitoring back into direction.
Selecting the most detailed or most prescriptive-sounding option, or the one that matches a familiar framework's terminology, instead of the option that reflects 38500's principle-based, outcome-focused stance.
Exam technique habits reward the most specific answer, and distractors are often written using terminology from other frameworks. The correct answer here is usually the one that states a governing-body behaviour and an outcome, not a process step.
What to do instead
Rank options by two filters: does it describe a governing-body action, and does it express an outcome or principle rather than a procedure? Eliminate options that import process detail, then choose among the remaining principle-level statements. Review any question you got wrong to confirm which filter you skipped.