IT Governance is crucial for governing risks and complexities of modern IT environments, ensuring compliance, fostering innovation, and aligning IT with business goals. Poor governance of IT can have various and significant negative impacts in the organizations such as security risks, compliance issues, operational inefficiencies, financial losses, poor decision-making, reputation damages, and innovation stagnation.
Before elaborating further on IT Governance, it is important to explain governance. Governance refers to the system comprising, directing, overseeing, and accountability by which an organization operates and makes decisions. It involves the establishment of principles and policies, the monitoring of their implementation, and the accountability of the governing body. Governance aims to create a framework for transparent, accountable, and effective decision-making, and it ensures that the interests of stakeholders (shareholders, employees, customers, etc.) are balanced and respected.
And while governance and management are closely related concepts, they are not the same. Governance refers to the framework of rules, practices, and processes by which an organization is directed and controlled. Management refers to the process of planning, organizing, directing, and controlling resources to achieve specific goals. It involves the execution of policies and plans set by the governing body.
IT Governance, a component of the governance of organizations, is a system by which the current and future use of IT is governed. IT Governance focuses on ensuring that the organization’s IT resources and systems are governed and managed in a way that supports its overall goals and objectives. And being communication technology relevant and intertwined with IT, IT Governance should also be read as ICT – Information and Communication Technology – Governance.
IT Governance aims to ensure that IT resources are used effectively to achieve the organization’s strategic objectives. Effective IT Governance ensures that IT investments align with business objectives, risks are managed appropriately, and value is delivered from IT assets. It also promotes transparency, accountability, and continuous improvement, ultimately leading to better overall organizational performance. Digital transformation, cybersecurity threats, regulatory compliance, data governance, risk governance, innovation and competitiveness, stakeholder trust, strategic alignment, resource optimization, and organizational agility are some of the key drivers for effective IT Governance.
Effective IT Governance involves ensuring the establishment and implementation of IT policies, processes, and structures that enable an organization to achieve its objectives in a transparent, accountable, and efficient manner. It supports and is essential for the success and stability of any organization. It fosters trust, ensures accountability, and enables the achievement of the organizational goals.
And standards play a pivotal role in establishing and deploying effective IT Governance by providing a framework for consistent and reliable governance of IT resources. They help organizations ensure that their IT practices align with industry best practices, regulatory requirements, and business objectives.
Governance vs Management
Governance and management are many times misunderstood and used as synonyms, however, they are different and serve different roles and functions within an organization. Governance sets the direction and framework for the organization, ensuring accountability and transparency, while management executes the strategies and policies to achieve specific goals. Governance is concerned with “doing the right things,” whereas management is concerned with “doing things right.”
On one hand, governance focuses on establishing overall goals and objectives, defining policies, procedures, and standards, ensuring accountability, transparency, and ethical behaviour, and monitoring and evaluating the organization’s performance and conformance.
Governance typically involves a governing body such as a board of directors, trustees, or executive committee. And governance decisions are made by individuals who may not be involved in the day-to-day operations of the organization.
On the other hand, management focuses on implementing strategies and policies set by governance, managing day-to-day operations and activities, allocating resources effectively, ensuring that tasks are completed efficiently and effectively.
Management involves managers and other operational leaders who are responsible for specific functions or departments. Management decisions are made by individuals who are directly involved in the operational aspects of the organization.
Effective IT Governance
According to the ‘IT Governance: How Top Performers Manage IT Decision Rights for Superior Results’ publishing, IT Governance specifies the decision rights and accountability framework to encourage desirable behaviour in the use of IT. Implementing effective IT Governance facilitates better alignment between IT and business goals, increases accountability and transparency in IT decision-making, improves risk management and security, enhances performance and value delivery from IT investments, and eases compliance with legal, contractual, and regulatory requirements.
Weill and Ross laid out in the publishing, the following three questions that must be addressed for effective IT Governance. See more in Figure 1.
- What decisions must be made to ensure effective management and use of IT?
- Who should make these decisions?
- How will these decisions be made and monitored?
Standards can help in addressing these three questions and support implementing effective IT Governance. ISO/IEC 38500 series of standards are focused on Governance of IT and can be used for implementing effective IT Governance.
The ISO/IEC 38500 Series in a Nutshell
The documents of the ISO/IEC 38500 series are developed by the committee ISO/IEC JTC 1/SC 40 IT service management and IT Governance which is responsible for standardization in:
- Governance of IT
- Governance of data
- IT service management
- IT enabled services – business process outsourcing
Figure 2 shows an overview of the documents of the ISO/IEC 38500 series.
ISO/IEC 38500, a principle-based standard, provides guiding principles for members of governing bodies of organizations and those that support them on the effective, efficient, and acceptable use of information technology (IT) within their organizations.
As the governance of IT is a domain of the governance of organizations, ISO/IEC 38500 aligns to ISO 37000 and its principles of governance. It can also be used in conjunction with other governance codes and principles for effective governance.
Key Components of IT Governance presented in ISO/IEC 38500 are: Principles, Model, and Framework. Figure 3 presents a table with principles based on ISO/IEC 38500.
Figure 4 depicts a model based on ISO/IEC 38500 which encompasses IT Governance practice and IT Management practice.
Figure 5 shows the elements of an IT Governance framework based on ISO/IEC 38500.
Figure 6 lists the documents from ISO/IEC 38500 series that are currently published.
Figure 7 exhibits mappings between IT Governance, Data Governance, and AI Governance domains and related topics, along with the ISO/IEC 38500 series.
Figure 8 presents a mapping of the questions for effective governance and the ISO/IEC 38500 series.
The following clauses elaborate on the relationships between IT Governance and other domains that are as well relevant for effective organizational governance.
Data Governance
The relationship between IT Governance and Data Governance is intertwined, as both frameworks are essential for ensuring that an organization’s IT resources and data are used responsibly and managed effectively, securely, and in alignment with the organization’s overall goals.
Data Governance is focused in assessing the value, risks, and constraints on the use of data, and ensuring that mechanisms are in place for data quality and accuracy, protecting data privacy and security, defining data ownership and accountability, and promoting data accessibility and usability for decision-making.
Data Governance involves the policies, processes, and standards that ensure the effective management, quality, security, and usability of an organization’s data. Developing unified policies that address both IT and data management can streamline governance processes and ensure consistency across the organization. This ensures that IT systems and data management practices are aligned and mutually supportive.
Security, Cybersecurity, and Privacy
IT Governance, security, cybersecurity, and privacy are all interconnected components that contribute to the effective management and protection of an organization’s information systems.
IT Governance supports security and cybersecurity by defining policies and standards that align with the organization’s risk appetite and regulatory requirements, ensuring the implementation of controls to safeguard the IT infrastructure, including the networks, applications, and data from threats, and the establishment of monitoring and auditing of security practices to ensure compliance and effectiveness.
IT Governance plays an important role in ensuring privacy by establishing policies and procedures for data protection and privacy compliance, ensuring that personal data is collected, processed, and stored in accordance with relevant laws and regulations, such as the General Data Protection Regulation (GDPR).
Artificial Intelligence (AI)
AI Governance recently became a major domain of organizational governance. AI Governance involves policies, processes, and standards that ensure the ethical, responsible, and transparent development and use of artificial intelligence (AI) technologies.
Organizations should develop collaborative frameworks that integrate IT Governance and AI Governance to create a comprehensive framework that ensures the effective, secure, and ethical management of IT resources and AI technologies. This synergy enables organizations to achieve their strategic objectives, mitigate risks, and build trust with stakeholders.
Third Parties
The relationship between IT Governance and third parties is critical for ensuring that IT services and products provided by third-party vendors align with the organization’s goals, strategies, and compliance requirements. As the interconnections and dependency of the organizations from the third parties increase, IT Governance became, more than ever, a critical aspect to be taken into consideration.
By maintaining strong governance over third-party relationships, organizations can ensure that third-party vendors contribute positively to their IT operations, support business objectives, and minimize potential risks.
Environmental, Social, and Governance (ESG)
The relationship between IT Governance and Environmental, Social, and Governance (ESG) is increasingly important in today’s business landscape. ESG refers to a framework for evaluating a company’s performance in three key areas: environmental impact, social responsibility, and governance practices. IT Governance supports ESG by supporting sustainability, enhancing social responsibility, improving governance practices, and enforcing risk governance. By integrating sustainable practices into IT Governance, organizations can significantly contribute to achieving the United Nations Sustainable Development Goals (SDGs), driving positive social, environmental, and economic impacts.
Conclusion
Global trust is vital in today’s interconnected world, where businesses, governments, and individuals rely on technology to communicate, collaborate, and conduct transactions. IT Governance is crucial to the governance of the current and future use of IT but also contributes to building and maintaining trust on a global scale. And standards play a pivotal role in achieving effective IT Governance to foster global trust by ensuring trustworthiness through efficient, secure, reliable, robust, transparent, responsible, and ethical use of IT across organizations.
Organizations that prioritize IT Governance are better positioned to establish and sustain the confidence of their stakeholders, ultimately supporting their long-term success and reputation.
