What is IT Governance?
IT governance (ITG) is the process of managing and controlling key IT capability decisions to improve IT management, ensure compliance, and increase value from IT technology investments. IT governance centers around making sure the organization knows what impact IT decisions have on business value.
For many organizations, IT is only the means, not the end in itself. Businesses thrive on creating value and that’s no different when it comes to their IT investments. Everyone has a ‘stake’ in the organization and would want to benefit from it. And these aren’t just your usual stakeholders like a board of directors or business executives, either; they’re also your employees, customers, vendors, and partners. IT governance therefore not only ensures value is maximized from IT-related decisions but also works to maintain the trust of these key stakeholders.
A proper IT governance structure would enable organizations to use IT in an efficient, safe, and compliant way that will bring the most benefit to the business. Careful planning and effective execution through the use of policies, established frameworks, and tested best practices can help guarantee IT activities are aligned with business goals.
The history of IT governance
IT governance’s formal history began in 1993 as a subset of corporate governance. It links IT management with an organization’s strategic priorities and goals, emphasizing IT accountability and value creation.
What is corporate governance?
Corporate governance is the process of managing and handling the way businesses are run to promote transparency and accountability in how organizations operate. This was in response to some high-profile corporate fraud and deception that occurred in the 1990s, prompting several countries to establish regulations for corporate governance.
These were just a few of them:
- Committee of Sponsoring Organizations of the Treadway Commission (USA)
- Cadbury Report (UK)
- King Report (South Africa)
As governing bodies worked to improve corporate governance, they realized the importance of IT as a tool that can help propel corporate governance efforts but also as a value creator that will need to be strongly governed itself.
This led to the creation of the AS8015 Corporate Governance of ICT, which was published in Australia in 2005. It was then used to fast-track ISO/IEC 38500, the international standard for IT governance published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). These publications were marked as a milestone in ensuring organizations understand their legal, regulatory, and ethical duties in how they use IT for their business.
Why IT governance is important
Almost every aspect of a business relies on IT in one way or another, so IT activities are impossible to ignore or leave unchecked. And the fact that it falls under overall corporate governance further means organizations shouldn’t take IT governance lightly. Here’s a quick summary of five reasons why.
- Ensures regulatory compliance
As mentioned previously, organizations must follow set standards to promote transparency, fairness, and accountability in their business. Not keeping an eye on your IT activities can easily land a company in hot waters. Having an IT governance process in place means that you can maintain good practices within the organization and are in compliance with key regulations.
- Gains competitive advantage
You can increase the value gained from your IT investments with the right IT governance strategy. An effective structure enables you to draw out the most potential from your IT capabilities, removing bottlenecks and putting you ahead of your competitors.
- Supports business goals
It can be all too easy for the interests of organizations and those managing their IT infrastructure to be at odds with each other. IT governance forces your IT management to be aligned with your business goals, in so doing you can drive the best positive results that matter to your organization.
- Encourages growth and innovation
Failing to implement IT governance processes can also stunt an organization’s growth and ability to innovate. Unmonitored costs or inefficient communication channels not only mean compliance issues but also make it harder to determine the value and thus find opportunities to improve value creation.
- Reduces risks
Cyber threats are a constant and ever-increasing challenge for all businesses, stressing the importance of implementing IT governance processes. Following a strict structure and set procedures can help everyone stay informed of the dangers involved in IT initiatives, mitigate these everyday risks, and provide a safe way of using IT.
Benefits of IT governance
Maintaining compliance is a given benefit of IT governance, not because it’s a nice-to-have but rather a mandatory practice that organizations must fulfill. But regardless of which industry you’re in, you can experience a multitude of other benefits from effective IT governance, too.
- Aligned IT and business goals
Aligning your IT activities to support business goals becomes much easier, enabling you to realize the value brought to the organization.
- Improved culture
By having policies and procedures in place for IT best practices, you can foster an IT culture that is adopted by the whole organization, not just your IT team.
- Optimized operations
IT activities can be better streamlined to provide maximum benefits and value to the organization.
- More successful projects
As IT initiatives are more aligned to your organization’s strategic objectives, it’s easier to execute more successful IT projects that will create a positive impact on the business.
- Managed resource capacity
IT governance can help provide a complete overview of your IT resources, enabling you to plan where to use resources more effectively.
- Better quality output
A good IT governance process helps reduce IT control issues, thus creating better quality IT output and productivity.
- Lower total cost of IT ownership
And with better productivity and higher success rates of IT activities, you can lower the total cost of IT ownership in your organization, increasing the return on your technology investments.
- Increased adaptability
There are always new technologies coming out, affecting the way we work. Organizations have to adapt to these ever-changing scenarios while maintaining compliance and security. IT governance makes this easier to handle.
IT governance process
As you might’ve guessed, IT governance is an ongoing process, constantly assessed and improved on. A successful implementation would mean that IT governance is integrated into the way you operate IT in your organization. As such, there are several different but related processes that make up IT governance, each one focused on a specific part of IT.
- IT architecture governance
This process provides guidelines that new developments being added to the infrastructure need to comply with. This helps ensure that organizations are not using new technologies that they can’t support, avoiding expensive and unnecessary costs.
- IT process governance
IT process governance focuses on the development, management, and support of IT products. Creating standardized processes removes reliance on a single individual or team in overseeing these activities.
- Enterprise IT governance
Enterprise IT refers to the software and hardware designed to support big organizations. It’s crucial that governance for these technologies can cope with the large-scale use and depth of functionalities that typically come in enterprise IT systems.
- Product development governance
Some organizations create their own IT products, which would also require governance. This process falls in line with the software development lifecycle and ensures the different stages are in line with business priorities and objectives.
IT governance frameworks
An IT governance framework is a set of guidelines of best practices created by a neutral third party to help organizations implement effective governance processes. There are various frameworks that are widely recognized across the world. Organizations often incorporate parts of several frameworks to create the model that suits their business.
Here are just some examples of the most well-known IT governance frameworks.
- ITIL
ITIL (IT Infrastructure Library) is one of the most popular frameworks that guide organizations in aligning their IT service management and business needs together. It’s a set of best practices on the ‘hows’ of managing and controlling IT service operations. Created by the UK government’s Central Computer and Telecommunications Agency (CCTA) in the 1980s, it has been through several revisions since, with the latest version being ITIL4.
- COBIT
COBIT (Control Objectives for Information and Related Technologies) is an IT governance framework that focuses on helping enterprises successfully implement governance strategies and navigate risk management. COBIT has Management Guidelines which provide tools that help measure an organization’s IT capabilities against 37 identified COBIT processes.
- ISO/IEC 27002
First published in 2005, ISO/IEC 27002 is the global standard for organizational information security management. Recognized across the world, many companies choose to gain certification under this framework.
IT governance vs ITSM
Seeing the benefits and importance of both IT governance and ITSM, you might notice that there are many overlaps between the two. This can be challenging in determining what sets the two disciplines apart and thus establishing strategies that achieve the goals related to both.
To better understand, we can look at the two as part of a hierarchy, with IT governance sitting at the top and ITSM underneath it. IT governance looks to deliver value to key stakeholders and so sets the directions to create enterprise objectives that would align with business goals. This would include enhancing value creation through realizing benefits and optimizing resources. ITSM takes those directions and uses them to create goals and processes that align IT services with the rest of the business. This would involve making continual improvements and optimization of IT service strategy, assets, incident, risk, security, and more.
Effective IT governance best practice
Like other IT-related disciplines, IT governance is a continuous process. More than getting everything right once, it’s important to keep IT governance top of mind in your organization’s daily way of working. Here are just some best practices you should encourage in your business to ensure you can successfully implement IT governance.
- Get executives on board
IT governance won’t go anywhere if people don’t understand why it matters. It’s important to get your business leaders on board with why an effective IT governance strategy is necessary. Naturally, the CIO plays a pivotal role in acting as a champion in the organization. Fellow C-suite executives should also act as champions to establish good IT governance practices across the different business functions of the organization.
- Clarify regulatory and legislative requirements
Regardless of the industry your organization falls under, you have to adhere to industry-specific rules. This means your organization’s approach to IT governance would need to differ from another organization. It’s important to identify these requirements early on during your planning stages and design your IT governance program with this in mind.
- Leverage existing frameworks
We’ve previously covered existing frameworks that help organizations establish IT governance processes. When it comes to governance, there’s no need to reinvent the wheel. Take advantage of these tried and tested frameworks as a guide in building out the strategies that will work best for your organization.
- Build a strong team
Relevant expertise and knowledge are paramount to good IT governance. Your team must be competent and possess the right qualifications to carry out their responsibilities. Assess whether your team has the skills necessary and consider whether further training or even recruitment would need to be in the cards.
- Prioritize employee education
An IT governance plan can only be truly effective with everyone’s involvement. One of the most common reasons for governance failures is human error, so you should emphasize staff training and education to minimize such risks. Not only can they gain practical knowledge such as preventing phishing attacks or how to handle sensitive data, but also feeling readily equipped to counter such threats can help boost employee morale.
- Pick the technology solution that works
We all know that using the right tool can do a lot to make our jobs easier. But selecting the correct solution can be challenging, especially with the many options distracting you from the important stuff with their latest flashy features. Make sure you have your list of requirements before going out to vendors, so you can have a laser focus on the solutions that can make a significant impact on your IT governance strategy.
- Monitor IT performance
Choosing the best technology solution is just the beginning. Your IT infrastructure must be designed to fully support your IT governance strategy as well. And you do this by monitoring how well your systems are working and fine-tuning them to provide you with better results. How do they fit with your current strategy? How many resources are being allocated in ensuring they work well? These are just some questions worth thinking about when it comes to your organization’s IT performance.
- Update policies for remote/hybrid work
Remote or hybrid working might not be new, but it used to be more of an exception rather than the norm. But as it becomes more commonplace across organizations, it’s crucial that your policies supporting IT governance are adjusted to accommodate this way of working. Remote working meant organizations are constantly generating data across different environments, all of which should be accounted for in your governance plans.
- Review plans continuously
Your organization will continue to grow and evolve, so your IT governance plans should too. Whether you’re implementing a new IT ticketing system or creating a new business unit, your policies should be aligned to these changes, kept up to date, and relevant.
How technology can help with IT governance
Technology solutions help simplify IT governance processes, taking away the manual labor and enhancing the experience for everyone involved. There are four key areas where tech tools can achieve this:
1. Increasing transparency and accountability
Tools for IT governance can provide in-depth reporting functionalities that can give you complete visibility of what’s going on in your IT environments. You can easily outline who’s responsible for what, bolstering transparency and accountability across your workforce.
2. Promoting participation
You can encourage staff participation in ensuring good governance by having technology that makes it easy to do so. Whether that’s through automated alerts reminding them to complete a task or a simple self-service portal that enables them to look for information, by making the experience as smooth as possible, you can incentivize your employees to be fully involved.
3. Streamlining service delivery
Automation and machine learning technologies help remove the repetitive and manual parts of everyone’s work, making it easier for them to focus on delivering great service. With more time and effort put into the most impactful aspects of their work, you can help your people bring better service and value to the business.
4. Providing security
The best IT governance solutions could also provide a high level of security through real-time reporting functionalities that let you know of any IT issues at any time. Automated workflows also help counter any risk quickly and efficiently should they come up.
SOURCE: Craig Whytock (2022 July 19) What is IT Governance (ITG) and why does it matter?. IFS Blog. https://blog.ifs.com/2022/07/it-governance-itg
