Governance and IT Governance Concepts
Domain focus
This domain tests whether you can separate governance from management and explain why IT governance is a corporate, not a technical, concern. ISO/IEC 38500 describes governance of IT as the system by which the current and future use of IT is directed and controlled. It applies to the governing body-board or equivalent-and covers IT used across the whole organization, including outsourced and shadow IT.
Core rules
- IT governance is a subset of corporate governance. It sets direction, decision rights, accountability, and oversight; management executes plans, runs services, and delivers projects.
- The governing body remains accountable even when IT is delegated or outsourced. Delegation transfers work, not accountability.
- Governance is enterprise-wide. It is not the IT department's private concern, and it is not the same as IT management or technology architecture.
- The ISO/IEC 38500 model uses Evaluate, Direct, and Monitor: evaluate current and future use, direct preparation and implementation, and monitor performance and conformance.
- Frameworks such as COBIT or ITIL can support governance, but they are not substitutes for the governance model or the governing body's accountability.
Worked example
A retailer's board is asked to approve a cloud ERP programme. Governance does not mean selecting the vendor. The board evaluates strategic fit, total risk, funding, and the adequacy of the business case. It directs management to return with decision gates, a benefits-realization plan, and named accountable executives. It monitors through independent assurance, stage-gate reports, and agreed metrics. Management runs the procurement and implementation.
Traps
The common errors are equating IT governance with IT operations, assuming the CIO owns governance, and treating monitoring as day-to-day service monitoring. Another trap is saying the board "approves the technology" when it should approve direction, risk appetite, and accountability.