Implementing and Sustaining IT Governance (Roles, Responsibilities, Assurance)
Domain focus
This domain tests implementation and sustainment: who does what, how assurance works, and how governance survives after the initial project. ISO/IEC 38500 expects the governing body to set the framework and receive assurance, while management operates the system.
Roles and responsibilities
- Governing body: approves the governance framework, risk appetite, and strategic IT direction; monitors performance and conformance.
- Executive management: translates direction into portfolios, policies, budgets, and operating controls; owns delivery.
- Business and IT owners: accept accountability for specified services, data, projects, and risks.
- Risk, compliance, and finance: provide second-line oversight and challenge.
- Internal audit: provides independent assurance; it should not design the controls it later audits.
Implementation and sustainment
Establish a mandate and scope; assess current governance and pain points; define decision rights and policies; assign accountable owners; integrate with enterprise risk, finance, and audit; then operate a review cycle. Sustain through metrics, issue management, periodic policy review, assurance plans, and culture work.
Worked example
A bank receives a regulatory finding on IT change risk. The board establishes an IT risk committee, approves a change-risk appetite, and directs a RACI that names business owners for critical systems. Management implements change gates and reporting. Internal audit independently tests a sample of changes. The committee monitors overdue changes, failed changes, and repeat findings quarterly; the board receives a summary and challenges slow remediation.
Traps
Common failures are making the CIO the sole governance owner, treating internal audit as management's control tester, and launching governance as a one-off documentation exercise. Another trap is monitoring activity counts without outcome or conformance measures. Unclear decision rights cause escalation paralysis.