ISO/IEC 38500 IT Governance Manager key terms

The system by which organizations are directed and controlled, covering accountability, decision rights, stewardship, and the relationships among owners, boards, executives, and other stakeholders.

The part of corporate governance concerned with the direction, control, and accountability of information and communication technology, ensuring IT supports and extends organizational objectives while risks are understood and managed.

The person or group with ultimate authority and accountability for the organization's direction, such as a board of directors or equivalent, which sets expectations for IT and oversees their fulfilment.

The obligation of a named individual or group to answer for decisions, actions, and outcomes within their area of responsibility, and to accept consequences without shifting blame elsewhere.

The assigned duty to carry out a task or activity. It can be delegated to others, but the accountability for the outcome cannot be delegated away from the accountable party.

The formally granted right to make decisions, commit resources, and direct work within defined limits, enabling a role to act rather than merely advise.

Any individual or group with an interest in the organization's IT-enabled outcomes, such as customers, employees, regulators, shareholders, suppliers, or the community, whose needs inform governance decisions.

The benefits an organization realizes through investment in and use of information technology, measured in financial, operational, or strategic terms and weighed against the resources consumed.

The effect of uncertainty on IT-related objectives, covering likelihood and impact of events such as security breaches, service outages, compliance failures, or failed projects.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in terms that guide decisions about IT investments, controls, and tolerance thresholds.

The three core governance activities in the ISO/IEC 38500 model: assessing current and future IT use, assigning plans and policies with clear accountability, and overseeing performance against those plans.

The governance activity of examining current and future use of IT, including proposals and options, to form judgments about alignment with business needs, value, and risk before decisions are made.

The governance activity of assigning responsibility, approving plans and policies, and instructing management so that IT use proceeds in line with evaluated objectives and agreed constraints.

The governance activity of overseeing performance and conformance of IT against plans, policies, and standards, using reports and assurance to confirm that direction is being followed and outcomes achieved.

The six foundational statements in ISO/IEC 38500 that describe desired behaviour for IT use: responsibility, strategy, acquisition, performance, conformance, and human behaviour.

The principle stating that individuals and groups within the organization understand and accept their responsibilities for both supply of and demand for IT, with authority matched to those duties.

The principle requiring that IT plans and business plans are aligned, so that current and future capability of IT supports the organization's strategic objectives and evolving needs.

The principle stating that IT acquisitions are made for valid reasons, on the basis of appropriate and ongoing analysis, with clear and transparent decision-making and a balanced consideration of costs, benefits, and risks.

The principle that IT is fit for purpose, delivering required service levels and quality to support the business, with performance measured and demonstrated against agreed criteria.

The principle that IT use complies with relevant laws, regulations, contractual obligations, and internal policies, with compliance demonstrated through rules, practices, and assurance.

The principle that IT policies, practices, and decisions consider and respect human behaviour, including the needs and expectations of people affected by IT and the way they actually work.

The condition in which IT strategy, architecture, and investment are consistent with and actively support business strategy, priorities, and operating model rather than pursuing separate goals.

A structured justification for an IT investment that sets out expected benefits, costs, risks, options considered, and assumptions, and that is reviewed as the initiative progresses.

Adherence to mandatory requirements arising from legislation, regulation, contracts, and internal policies, evidenced through controls, records, and independent verification where appropriate.

A structured set of principles, roles, processes, and practices used to direct and control IT, which may combine ISO/IEC 38500 with detailed standards such as COBIT or ISO/IEC 27001.

A widely used framework of governance and management objectives for enterprise IT that provides detailed practices and process models supporting the high-level principles of ISO/IEC 38500.

Independent or objective evidence that controls, processes, and reporting are reliable and meet requirements, giving the governing body confidence that IT is directed and controlled as intended.

A systematic, independent examination of IT-related records, controls, and practices against defined criteria, producing findings that inform governance oversight and corrective action.

The use of defined metrics, targets, and reporting to track whether IT delivers agreed outcomes, enabling comparison over time and supporting evidence-based governance decisions.

A documented commitment about the quality and availability of an IT service, expressed through measurable targets such as uptime, response time, or resolution time, against which delivery is reviewed.

The formal transfer of authority to perform activities or make defined decisions to another role, while accountability for the outcome remains with the party that delegated it.

A document that maps governance and management activities to accountable and responsible parties, often using a matrix such as RACI, to remove ambiguity about who decides and who performs.

The coordinated activities of identifying, assessing, treating, and monitoring risks to objectives, embedded in IT decision-making so that exposure stays within the organization's stated appetite.

The governance focus on ensuring IT investments produce the intended benefits at an acceptable cost and risk, with benefits tracked and realized rather than assumed at approval.

The discipline of selecting, prioritizing, and balancing a set of IT investments and services so that collectively they best support strategy within resource and risk constraints.

A structured scale describing progressive levels of capability in a process area, used to assess current IT governance practice and plan realistic improvement steps.

The ongoing cycle of measuring governance and IT performance, identifying gaps, and implementing changes so that direction, control, and assurance strengthen over time.