What Is IT Governance?

IT governance is the set of decision rights, accountabilities and oversight processes that determine how an organization decides what technology to invest in, who is responsible for it, and how it checks that the technology is delivering value and staying within acceptable risk. It is not the same as running IT. Management builds, runs and supports systems; governance decides what should be built, sets the limits, and reviews the results.

Frameworks such as COBIT, ITIL and ISO/IEC 38500 give you structures for doing this, and a company of any size can run a lightweight version with a one-page charter, a decision rights table and a monthly meeting. This guide covers all three. This is general information, not legal advice.

IT governance, defined

Strip the frameworks away and governance answers five questions for your technology:

1. Who decides? Which decisions belong to the owner or board, which to a leadership group, which to the IT lead, and which to the teams doing the work.
2. Based on what? The principles (buy before build, cloud first, one system of record for customers) and the strategy the decisions must serve.
3. With what money and risk? How investment is prioritized and approved, and how much risk the organization will accept in exchange.
4. Who is accountable? A named owner for every system, every project and every risk, so that “IT” is never the answer.
5. How do we know it is working? The measures, reviews and audits that tell leadership whether the technology is delivering and whether the rules are being followed.

Governance usually covers five decision areas: IT principles, architecture (the standards systems must fit), infrastructure (the shared platforms), business applications (what gets built or bought) and investment (how money is allocated). Writing down who makes each of those decisions is most of the work.

The distinction from management matters in practice. When a growing company complains that “IT is a black box” or “every department bought its own tool”, the problem is rarely the IT team’s competence. It is that nobody defined the decision rights, so decisions were made by whoever had a credit card, and governance fixes that structure so management has something to execute. The same logic drives data governance and AI governance, which are specialized applications of the same idea to data and to AI systems.

IT governance frameworks: COBIT, ITIL, ISO 38500 and GRC

You do not need to adopt a framework to govern IT, but the frameworks are useful as checklists, and auditors and larger customers recognize their vocabulary.

Framework	Published by	What it covers	Best used for
COBIT (current version COBIT 2019)	ISACA	Governance and management of enterprise IT: 40 objectives split into one governance domain (Evaluate, Direct and Monitor) and four management domains (Align, Plan and Organize; Build, Acquire and Implement; Deliver, Service and Support; Monitor, Evaluate and Assess), plus design factors to tailor the system	Defining the full governance system, audits, aligning IT with business goals in larger or regulated organizations
ITIL (current version ITIL 4)	Axelos / PeopleCert	IT service management: a service value system, a service value chain (plan, improve, engage, design and transition, obtain and build, deliver and support) and 34 practices such as incident, change, problem and service level management	Running IT operations and services consistently; the management layer that governance oversees
ISO/IEC 38500	ISO and IEC	Principles for the governing body: responsibility, strategy, acquisition, performance, conformance and human behavior, applied through an evaluate, direct and monitor cycle	Board-level guidance; short enough for a small company’s leadership to read in full
GRC (governance, risk and compliance)	A discipline, not a single standard	The combined practice of setting direction, managing risk and meeting obligations, often supported by a GRC platform that holds policies, risks, controls and evidence	Organizations with several regulatory obligations that need one register and one evidence trail

How they fit together: ISO 38500 tells the leadership what principles to govern by; COBIT gives the complete set of objectives and processes a governance system can include; ITIL describes how the IT function delivers services day to day; GRC tooling holds the records. Security-specific frameworks such as ISO/IEC 27001 and the NIST Cybersecurity Framework sit inside this picture as the risk and control layer for information security, and frameworks such as TOGAF cover the architecture decisions.

COBIT’s own guidance is to tailor rather than adopt wholesale: its design factors (enterprise strategy, size, risk profile, regulatory requirements, sourcing model, IT role) exist precisely so that a fifty-person company and a bank do not end up with the same governance system. ITIL 4’s guiding principles say the same thing from the operations side: focus on value, start where you are, progress iteratively, keep it simple and practical.

A lightweight IT governance framework for a growing company

Most organizations that search for “it governance framework” do not need COBIT’s forty objectives. They need eight things, maintainable in a few hours a month by the people they already have.

1. A one-page charter. Why governance exists, who is on the steering group, what it decides, how often it meets, and the principles IT decisions must follow.
2. A decision rights table. For each type of decision, who proposes, who approves, who is consulted and who is informed.
3. A system inventory with owners. Every application and platform, its business owner, its technical owner, its cost, its contract renewal date and its criticality. This list is also the start of your policy set and your risk register.
4. An intake and prioritization process. One place to request new systems, changes and projects; a simple scoring (value, cost, risk, urgency); and a visible queue so departments can see why their request is third.
5. A budget and vendor calendar. Approved spend by category, renewals three months ahead, and a rule that no new subscription is bought outside the process.
6. A risk and compliance register. The top technology risks, the obligations you are subject to (HIPAA, SOC 2, PCI DSS, state privacy law, customer contracts) and the status of each.
7. A monthly steering meeting. One hour. Agenda: project status against the queue, incidents and risks, spend against budget, decisions needed. Minutes record the decisions.
8. A handful of measures. Availability of critical systems, incidents and time to resolve, project delivery against plan, spend against budget, open high risks, audit findings closed. Reviewed in the meeting, reported quarterly to the owner or board.

Decision rights table (starter)

Decision	Proposes	Approves	Consulted	Informed
IT principles and strategy	IT lead	Owner or executive team	Department heads	All staff
New business application	Department head	Steering group	IT lead, finance, security	Affected teams
Architecture and platform standards	IT lead	Steering group	Development team, vendors	Department heads
Spend above an agreed threshold	Requesting owner	Owner or executive team	IT lead, finance	Steering group
Spend below the threshold	Requesting owner	IT lead	Finance	Steering group
Risk acceptance	Risk owner	Owner or executive team	IT lead, security, legal	Steering group
Production changes	Engineer or vendor	IT lead (change process)	System owner	Affected users

Charter template

[COMPANY NAME] IT Governance Charter
Purpose: to ensure technology decisions support company strategy, stay within
approved risk and budget, and have a named accountable owner.
Steering group: [Owner or executive sponsor], [IT lead], [Finance lead],
[Operations lead], [rotating department representative].
Decides: IT principles and standards; approval of new systems and projects;
prioritization of the request queue; spend above [threshold]; risk acceptance.
Principles: one system of record per data domain; buy before build unless the
capability is a differentiator; cloud services preferred; security and
compliance requirements defined before purchase; every system has an owner.
Cadence: monthly one-hour meeting; quarterly report to [owner or board];
annual review of this charter, the inventory and the risk register.

Size-agnostic by design: a founder-led company fills the steering group with three people and sets the spend threshold low; a department inside a larger organization uses the same table but inherits principles and thresholds from the corporate framework; a company preparing for an audit adds the compliance register and the evidence trail. The structure does not change, only the names and numbers.

Where PS3G fits

PS3G helps organizations of every size set up and run this lightweight model, or map an existing one to COBIT, ITIL or ISO 38500 when an audit, a customer or a parent company requires it. Through technology consulting we facilitate the charter and decision rights work, build the system inventory and intake process, and can act as a fractional CTO on the steering group. Where governance has to satisfy specific obligations, our IT compliance consulting adds the risk and compliance register, the policies and the evidence trail for HIPAA, SOC 2, ISO 27001 or CMMC, and coordinates with your auditors.

Related reading

• What Is Data Governance? A Plain-English Guide for Growing Companies
• What Is AI Governance? A Practical Guide for Any Size of Organization
• IT Policies and Procedures: The 10 Every Company Needs
• Technology consulting services

Frequently asked questions

What is the difference between IT governance and IT management?

Governance decides and oversees; management executes. Governance sets the principles, approves investments, assigns accountability, defines acceptable risk and reviews results, while management plans, builds, runs and supports the systems within those limits. COBIT draws the line explicitly with its Evaluate, Direct and Monitor domain for governance and four separate domains for management. In a small company the same people may do both, but the two activities should be kept distinct.

Is COBIT or ITIL better for a small company?

They answer different questions, so it is rarely a choice between them. COBIT is about governing IT as a whole; ITIL is about running IT services well. A small company usually needs a lightweight governance structure (the charter and decision rights in this guide) and a few ITIL practices such as incident, change and service request management. Adopt the parts that solve a problem you have.

Does a company with ten employees need IT governance?

Yes, in proportion. At ten people governance is a short charter, a list of systems with owners, a rule about who approves new subscriptions, and a monthly review that takes thirty minutes. That small structure prevents the duplicate tools, orphaned systems and surprise renewals that become expensive to untangle at fifty people, and it gives customers and insurers the answers they ask for.

What is governance, risk and compliance (GRC)?

GRC is the combined discipline of setting direction (governance), identifying and treating threats to objectives (risk) and meeting legal, regulatory and contractual obligations (compliance), managed together so that one set of policies, controls and evidence serves all three. GRC platforms hold these records and their workflows. Smaller organizations usually run GRC in spreadsheets and a document system until the number of obligations justifies a tool.

How is IT governance related to data governance and AI governance?

They share the same mechanics: decision rights, named owners, policies, risk assessment and review. IT governance covers the technology estate as a whole; data governance applies the mechanics to data quality, ownership, access and retention; AI governance applies them to AI systems, their risks and their oversight. In practice the three share a steering group and a register, with specialists owning the data and AI parts.