IT Governance vs. IT Management

Steering and rowing

COBIT draws this line clearly, and the exam uses it often.

	Governance	Management
Who	Board of directors	Executive management, led by the CEO
Activities	Evaluate, Direct, Monitor (EDM)	Plan, Build, Run, Monitor (PBRM)
Concern	Setting objectives and direction; making sure stakeholder needs are met	Achieving those objectives
Outputs	Approved strategy, risk appetite, priorities, oversight of performance	Plans, projects, services, operational reports

A shortcut: governance asks “are we doing the right things?” Management asks “are we doing things right?”

What IT governance is

IT governance is the part of corporate governance that makes sure IT supports the organisation’s strategy and goals. It’s made up of leadership, structures and processes, and the board is accountable for it. It isn’t something IT does on its own.

• Strategic alignment: IT plans support business plans.
• Value delivery: IT investments deliver the benefits promised, on time and on budget.
• Risk management: IT risks are understood and kept within the organisation’s appetite.
• Resource management: the right investment in people, systems, infrastructure and information.
• Performance measurement: progress tracked and reported, often with a balanced scorecard.

Who sits where

Body	Level	Role
Board of directors	Governance	Accountable; sets direction and risk appetite
IT strategy committee	Governance (board level)	Advises the board on IT strategy
Audit committee	Governance	Oversees audit, risk and control
IT steering committee	Management	Prioritises projects and monitors delivery
CIO and IT management	Management	Runs IT

Auditing IT governance

The auditor looks for evidence that:

• the board and senior management are actually involved in IT direction, not just told afterwards
• the IT strategy is written down, approved, and linked to the business strategy
• risk appetite covers IT risk
• committees and roles exist with clear responsibilities
• IT performance is measured and reported to the board

Example. IT runs smoothly and projects finish on time, but the board hasn’t discussed IT since approving a budget three years ago, and the CIO alone decides what to invest in. The governance finding is the lack of board-level direction and oversight of IT, however well IT is managed.

How the exam asks about it

If the question asks…	The answer is usually…
Who is ultimately accountable for IT governance?	The board of directors
Which activity is governance rather than management?	Setting direction, approving strategy and appetite, monitoring performance
Main objective of IT governance	Aligning IT with business goals and delivering value
Best indicator of effective IT governance	Board and senior management involvement in IT direction
Which body advises the board on IT strategy?	The IT strategy committee

In short

• Governance evaluates options, sets direction and monitors results (EDM). It's the board's job.
• Management plans, builds, runs and monitors activities within that direction (PBRM). It's executive management's job.
• IT governance is part of corporate governance, not something IT does on its own.
• IT governance focuses on strategic alignment, value delivery, risk management, resource management and performance measurement.
• Governance asks 'are we doing the right things?'; management asks 'are we doing things right?'.
• IT running smoothly day to day doesn't prove IT governance is good.

Exam traps

• Setting direction and monitoring = governance. Planning and running = management.
• The CIO is a manager. Accountability for IT governance sits with the board.
• The IT steering committee supports governance but is a management-level body.
• Good operations don't prove good governance; ask whether the board is involved in IT direction.

Slides

Click the slide and use the arrow keys. F toggles full screen.