ISO/IEC 38500 IT Governance Manager flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

IT governance definition

The system by which the current and future use of IT is directed and controlled, involving evaluating, directing, and monitoring IT to achieve organizational goals.

Corporate governance

The system by which organizations are directed and controlled, encompassing strategy, risk, performance, and accountability at the board level.

Governance vs management

Governance sets direction and oversight through evaluation and monitoring; management executes and operates within the governance framework.

ISO/IEC 38500 scope

Provides principles and a model for the corporate governance of IT, applicable to all organizations regardless of size, sector, or technology.

IT governance focus areas

Strategic alignment, value delivery, risk management, resource optimization, and performance measurement are key focus areas of IT governance.

Stakeholders in IT governance

Board, executive management, IT management, internal audit, employees, customers, regulators, and shareholders all have roles in IT governance.

Evaluate activity

Assessing current and future use of IT, including pressures, opportunities, threats, and options, to inform direction and decisions.

Direct activity

Assigning responsibility, setting policies, and establishing investment and risk criteria to ensure IT aligns with business objectives.

Monitor activity

Measuring performance against plans, verifying conformance to policies and regulations, and ensuring IT meets its obligations.

EDM cycle

The continuous cycle of Evaluate, Direct, and Monitor that forms the core of the ISO/IEC 38500 governance model.

Responsibility principle

Individuals understand and accept their responsibilities for IT; those with authority also have accountability for IT outcomes.

Strategy principle

IT strategy aligns with business strategy; IT plans satisfy current and future business needs and are integrated with organizational planning.

Acquisition principle

IT acquisitions are made for valid reasons, based on appropriate analysis, with clear decision-making and transparent processes.

Performance principle

IT is fit for purpose, delivers required services, and is measured for quality and value to the organization.

Conformance principle

IT complies with mandatory legislation, regulations, policies, and standards, and conformance is verified through audit.

Human Behaviour principle

IT policies and practices respect human behaviour, including the needs of all stakeholders, and consider ergonomics and ethics.

Tailoring ISO/IEC 38500

Applying the standard's principles and model in a way that fits the organization's size, sector, culture, and risk appetite.

Responsibility matrix

A tool such as RACI that documents who is responsible, accountable, consulted, and informed for IT governance activities.

IT strategic plan

A document that outlines how IT will support business objectives, reviewed and updated in line with business strategy.

Business case for IT

A justification for IT investment that includes costs, benefits, risks, and alignment with strategic objectives.

IT performance measurement

Using KPIs, service level agreements, and balanced scorecards to assess IT performance and value delivery.

Compliance and conformance

Adherence to laws, regulations, and internal policies, verified through audits and assurance activities.

Ethical IT use

Considering privacy, accessibility, ergonomics, and societal impact when applying IT governance principles.

IT governance committee

A group, often including board members and executives, that oversees the evaluate, direct, and monitor activities for IT.

Gap analysis

Comparing current IT governance practices against ISO/IEC 38500 principles and EDM model to identify improvement areas.

Board accountability

The board is ultimately accountable for IT governance, ensuring IT supports strategy and manages risk.

Internal audit assurance

Independent review of IT governance processes to provide assurance that controls are effective and risks are managed.

IT governance metrics

Quantitative measures such as KPIs, maturity models, and balanced scorecards used to track governance effectiveness.

Sustaining IT governance

Ongoing review, updating of policies, continuous monitoring, and adaptation to changes in business and technology.

Governance culture

Shared values, behaviours, and understanding that embed IT governance across the organization through communication and training.

Documentation of governance

Recording processes, decisions, and accountabilities to support transparency, auditability, and continuous improvement.

Integration with ERM

Aligning IT governance with enterprise risk management to ensure IT risks are managed within the overall risk framework.