ISO/IEC 38500 IT Governance Manager study plan

Define corporate governance, IT governance, and management in your own words, and articulate where governance ends and management begins.

Map the relationship between ISO/IEC 38500 and adjacent frameworks (COBIT, ITIL, ISO/IEC 27001, TOGAF) without conflating their purposes.

Explain the difference between governance of IT and governance by IT, with one workplace example of each.

Identify the key stakeholder groups (board, executive management, business units, IT, assurance) and the interest each holds in IT governance.

Describe the Evaluate, Direct, Monitor (EDM) cycle and the inputs and outputs of each stage.

Explain the three tasks the governing body performs under each EDM stage as defined in the standard.

Distinguish the governing body's role from the executive's role within a single EDM cycle, using a worked scenario.

Relate the six principles to EDM and note which principles most strongly shape Evaluate, which shape Direct, and which shape Monitor.

Analyse how the six principles (responsibility, strategy, acquisition, performance, conformance, human behaviour) interact and where they can conflict.

Apply the model to a realistic scenario in which a business unit procures a cloud service outside IT's knowledge.

Explain the concept of the governing body's accountability for IT even when IT is outsourced or decentralised.

Identify the business pressures that drive governing bodies to intervene in IT decisions and the signals that trigger each EDM stage.

Interpret each of the six principles into assessable statements an organisation could actually test against.

Design a set of evaluation criteria and a proportionate assessment approach for at least three principles.

Explain how the principles scale differently for a small enterprise versus a regulated multinational.

Distinguish conformance (internal and external compliance) from performance (service levels and business value) and explain why both are needed.

Draft a policy statement and terms of reference that assign IT governance accountability to a named body.

Define roles for the board, an IT steering or governance committee, the CIO, business owners, and risk and audit functions, with clear decision rights.

Explain how the human behaviour principle shapes policy design, including escalation, whistleblowing, and acceptable-use provisions.

Identify the documentation an organisation needs to demonstrate conformance to the standard.

Design an implementation roadmap that sequences governance changes over 12 months with quick wins in the first quarter.

Select metrics and reporting formats that let the governing body monitor performance and conformance without drowning in operational detail.

Explain how to integrate IT governance with enterprise risk management and internal audit planning.

Anticipate the main resistance points (perceived bureaucracy, loss of autonomy, unclear ownership) and plan a response to each.

Assess how assurance is obtained: internal audit, external audit, self-assessment, and independent review, and when each is appropriate.

Explain how to evaluate whether governance arrangements remain fit for purpose as the organisation changes.

Plan a governance review cycle, including scope, evidence gathering, findings reporting, and follow-up tracking.

Distinguish assurance over the design of governance from assurance over its operating effectiveness.

Consolidate all four domains into a single mental model linking concepts, EDM, principles, and implementation.

Complete timed practice questions across all domains and review every incorrect answer to its underlying concept.

Rehearse explaining EDM and the six principles aloud in under five minutes each, as if briefing a board member.

Identify remaining weak areas and schedule targeted review before the exam date.