The ISO/IEC 38500 Model for the Corporate Governance of IT (Evaluate, Direct, Monitor)
Domain focus
This domain tests the ISO/IEC 38500 model itself: the Evaluate–Direct–Monitor cycle and the six principles. You need to recognize what each principle requires and how the model is used iteratively, not as a one-off project stage.
The model
- Evaluate: assess current and future use of IT, including business value, risk, opportunities, costs, and compliance obligations. Use evidence, not vendor claims.
- Direct: set strategy, policies, decision rights, and plans; assign accountable owners; require appropriate business cases and controls.
- Monitor: check performance against plans and conformance with policies and obligations; use both management reporting and independent assurance.
The six principles
- Responsibility: people understand and accept their IT responsibilities; authority and accountability are aligned.
- Strategy: business and IT strategies align; IT enables the organization's objectives.
- Acquisition: IT is acquired for valid reasons, after transparent analysis of benefits, costs, risks, and alternatives.
- Performance: IT is fit for purpose, delivers required service levels, and is reviewed.
- Conformance: IT complies with laws, regulations, policies, and internal standards.
- Human behaviour: policies and practices account for how people actually behave and are likely to respond.
Worked example
An insurer considers generative AI for claims triage. Evaluate: the board reviews accuracy, bias, regulatory exposure, and strategic value. Direct: it sets a risk appetite, requires human review for adverse decisions, and names the chief claims officer as accountable. Monitor: it receives model-performance, complaint, and audit data. The cycle repeats as the model changes.
Traps
Do not treat the principles as a checklist with no decision rights. Do not turn Direct into micromanagement. Do not omit Monitor after approval. Do not confuse the model with a delivery lifecycle; it is a governing-body activity.