Technology Governance

Information Technology Management· 3 CUs· D822

Performance assessmentDue Jun 15, 2027

Lessons0 / 15

Governance structures

Frameworks: COBIT, ITIL, CMMI, ISO

Resource management

Risk, compliance and ethics

Governance structures

Governance vs management

15 min

Governance sets direction and checks results. Management plans and runs the work inside that direction.

	Governance	Management
Who	Board, executive committees	CIO, IT managers, teams
Question	Are we doing the right things?	Are we doing things right?
Activities (COBIT)	Evaluate, Direct, Monitor (EDM)	Plan, Build, Run, Monitor (PBRM)
Output	Priorities, policies, risk appetite	Plans, projects, services, reports

Evaluate: weigh current and future needs. Direct: set priorities and policies. Monitor: check performance and compliance against that direction.

Body	Role
Board of directors	Owns governance; approves strategy and risk appetite
IT strategy committee	Board-level; advises on IT strategy and value
IT steering committee	Executives; prioritizes and funds projects
Architecture review board	Approves standards and designs
Change authority (CAB)	Approves changes to services
PMO	Standards and oversight for projects
Data governance council	Data ownership, quality, privacy rules

A CIO running daily operations is management. A board approving the risk appetite is governance.

EDM: Evaluate, Direct, Monitor: the governance cycle in COBIT and ISO/IEC 38500.
Governance: Evaluating options, directing priorities and monitoring results on behalf of stakeholders.
Management: Planning, building, running and monitoring activities within the direction governance sets.

Which activity is governance?

Which body most often prioritizes and funds IT projects across departments?

ITIL Version 5 replaced ITIL 4 in 2026; course may still use ITIL 4 terms.

Content

Task details

Graded by

Rubric

Governance (the board) evaluates, directs and monitors; management plans, builds, runs and monitors. If a question asks who is accountable, it is usually the board.
CISA study guide, governance of IT
COBIT 2019 has 40 objectives: one governance domain, EDM (5), and four management domains: APO (14), BAI (11), DSS (6), MEA (4).
CISA study guide, governance of IT
Know each framework's lane: COBIT for enterprise governance and management of IT, ITIL for service management, ISO 27001 for information security.
CISA study guide, governance of IT
CMMI maturity levels in order: Initial, Managed, Defined, Quantitatively Managed, Optimizing. Defined means standard processes across the organization.
Visure, CMMI maturity levels
Four risk responses: avoid (stop the activity), mitigate (add controls), transfer (insurance, contracts), accept (owner signs off on the residual risk).
CRISC study guide, risk responses
Transferring risk moves financial cost, not accountability: legal, regulatory and fiduciary accountability never transfers to a third party.
CRISC study guide, risk responses
Inherent risk is exposure before controls; residual risk is what remains after them and must fall within the approved risk tolerance.
CRISC study guide, risk responses
For AI risk, NIST's AI Risk Management Framework has four functions: Govern, Map, Measure, Manage.
NIST AI RMF 1.0

Tips

Read the rubric first. Write one heading per rubric aspect, in the same order and wording.
Evaluate, do not describe: name the strategy, its strength, its weakness, and a recommendation with a reason.
Name the framework behind each recommendation: COBIT objective, ITIL practice, CMMI level, ISO standard.
Tie every recommendation to an organizational goal from the scenario.
Cite every outside source in APA, in text and in a reference list.
Cover ethics and social responsibility where the rubric asks; it is easy to skip.
Before submitting, check each rubric aspect against a heading. An aspect with no matching section is the usual reason for a return.

The learner evaluates resource management strategies for technology-driven organizations.
The learner evaluates risk mitigation strategies that meet regulatory and ethical compliance.
The learner evaluates technology governance structures to ensure coordination with organizational goals.

Study hours

40 h

Lessons

4 h 5 min

SourcesUpdated Nov 4, 2026