IT Governance is the framework of processes and decision making structure within an organization applied through clearly defined policies and procedures relative to oversight of technology assets across the enterprise.  The primary focus of IT governance is the stewardship of IT resources on behalf of various stakeholders. IT Governance is critical to a business to assure that the investments in IT generate business value on an on-going basis. As business processes and technology are integrated, businesses are compelled to provide IT governance in order to manage their financial, operational and compliance risks.

There is no universally accepted or mandated model for IT governance. However, there are a number of frameworks established by governing or standards bodies or industry associations across the globe. Well known frameworks and standards include ISACA Control Objectives for Information and Related Technology (COBIT) and ISO/IEC 38500, an international standard published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

IT governance focuses on delivering business value of technology through four focus areas – Strategic Alignment with stakeholder values, Performance Measurement, Risk Management and IT Value Delivery. Enterprise Architecture frameworks that provide blueprints of the enterprise business processes, systems, information, infrastructure and technology are one of the foundational elements to implementing IT governance. Architects at all levels play an important role in this process. Enterprise Architects facilitate creation of the enterprise architecture. The Enterprise Architecture framework serves to provide context and content of technology assets and services that run and/or support the business. Enterprise Architecture, Portfolio Management and, Information Risk and Security are recognized as strategic pillars for planning and implementing enterprise wide governance of technology.
Architects of all roles – Business, Information, Infrastructure and Software have to keep governance requirements foremost in designing and managing architectures. Different architect role holders are responsible for governing architecture viewpoints, standards and assets for their respective areas of concern.  Architects also enforce compliance and keep the architecture aligned with business changes. But the role of architects goes beyond providing a governance structure. Architects have to play a critical and leading role in design of the enterprise architecture that can enable effective governance in a globally distributed business and technology portfolio. Therefore, architects should not view governance as an overhead. Instead, the focus should be on a disciplined approach to meeting architecture requirements to deliver business value and mitigate risks, thus ensuring governance in a proactive, rather than reactive manner.

The major challenges architects have in the area of IT governance are related to knowledge and disciplined adoption of practices for governance. The better embedded an architecture function is within the IT organization and the better alignment between business and IT, the easier it is to govern over the lifecycle. Architects should also create enablers for governance such as reference architecture, architecture principles, standards and policies. Creation of an architecture governance framework will lead to increasing maturity and re-use of assets and IP. Architects should promote self-governance by ensuring business value is delivered from IT solutions and that architectural requirements for technology are well designed and implemented.

• Setting up and building and Enterprise Architecture using an EA framework.
• Establishing clear EA governance structure for strategic alignment, risk mitigation and escalation.
• Formation of an Architecture Review Board.
• Creating a culture of self-governance as opposed to regimentation, through living standards, guidelines and practices.
• Architect solutions (consider all architectural requirements).
• Adoption of an industry standard/model for governance such as COBIT.
• Usage of enterprise reference architecture and industry standards.

Corporate Governance of IT

Corporate Governance of IT is the planning and implementation of initiatives and procedures to ensure that the IT services used by an organization, and the technology which supports them, deliver value, are efficient in use of resources, and are compliant with all relevant legislation and regulations. COBIT and ITIL are among the two well-known frameworks that are generally accepted as models for implementing governance. Governance models generally take a pyramid structure representing accountability and decision making hierarchy across operational, managerial and executive levels in an enterprise. Operational responsibilities and activities are delegated downwards while escalation and ownership flows upwards.

Continuous Guidance and Oversight

These are activities that focus on overseeing and guiding the performance or operation of a group with the intent of continuous improvement of quality, performance and results.

Information Security and Risk Management

Information Security and Risk Management is the overall framework for control of Information security in an organization. It is the explicit identification of digital information assets, policies and procedures to ensure confidentiality, integrity, and availability of information, aided by information risk management framework for corporate governance of risks related to information security.

Related Capabilities

• BTS – Risk Management
• BTS – Compliance

Articles:

• Information Technology Governance – isaca.org
• IT Governance Frameworks – www.itgovernance.co.uk
• Fundamentals of IT Governance – http://www.isaca.org/JOURNAL/PAST-ISSUES/2010/VOLUME-5/Pages/Fundamentals-of-IT-Governance-Based-on-ISOIEC-38500.aspx
• http://companies.mybroadband.co.za/blog/2013/04/29/cobit-5-makes-enterprise-architecture-a-mandatory-discipline/

Blogs/Webcasts/News/Reference sources:

• Enterprise Governance of Information Technology: Achieving Strategic Alignment and Value by Wim Van Grembergen (Author),    Steven De Haes (Author) ISBN-13: 978-0387848815 ISBN-10: 0387848819
• Governance of Enterprise IT based on COBIT 5: A management guide by Geoff Harmer ISBN-13: 978-1849285186 ISBN-10: 1849285187
• Information Governance: Concepts, Strategies, and Best Practices (Wiley CIO) by Robert F. Smallwood ISBN-13: 978-1118218303 ISBN-10: 1118218302
• Data Governance: How to Design, Deploy and Sustain an Effective Data Governance Program by John Ladley ISBN-13: 978-0124158290 ISBN-10: 0124158293
• Managing Risk and Information Security: Protect to Enable by Malcolm Harkins ISBN-13: 978-1430251132 ISBN-10: 1430251131

Maya More
AVP – Enterprise Architecture Center of Excellence

Maya More is an IASA member and CITA-Foundation certified architect having over 19 years experience in business technology consulting, enterprise architecture and technology implementation. She has worked with global businesses in multiple countries and industries such as insurance, healthcare and oil & gas. She currently works as Architecture and Technology SME for a leading oil & gas corporation in India.