Chapter 2 summary
IT governance is a framework that outlines policies, processes, and decisions for managing an
organization's information technology (IT).
IT governance is usually a subset of overall corporate governance.
IT governance can help organizations:
1.
2.
3.
4.
5.
6.
7.
8.
Ensure IT investments contribute to business outcomes
Align IT strategy with organizational goals
Manage risk
Oversee the IT manager's performance
Establish IT disaster recovery plans
Ensure IT compliance with regulations
Define IT project management standards
Oversee IT financial management
Some frameworks that can help with IT governance include:
1. COBIT (Control Objectives for Information and Related Technology). An internationally
recognized framework that helps organizations meet business challenges
2. ITIL (Information Technology Infrastructure Library). A set of best practices for IT service
management that includes the concept of "Governance, Risk, and Compliance" (GRC)
3. ISO/IEC 38500. An international standard that provides principles and guidelines for
effective IT governance
Corporate governance is the structure of rules, practices, and processes used to direct and manage
a company.




A company's board of directors is the primary force influencing corporate governance.
Good corporate governance can benefit employees, shareholders, community members,
and the company's operations and reputation.
Bad corporate governance can destroy a company's operations and ultimate profitability.
The basic principles of corporate governance are accountability, transparency, fairness,
responsibility, and risk management.
Corporate governance also provides the structure through which the company's objectives are set,
and the means of attaining those objectives and monitoring performance are determined. The
purpose of corporate governance is to help build an environment of trust, transparency and
accountability necessary for fostering long-term investment, financial stability and business
integrity, thereby supporting stronger growth and more inclusive societies.
Enterprise governance of information and technology (EGIT) implies a system in which all
stakeholders, including the board, senior management, internal customers and departments such
as finance, provide input into the IT decision-making process. EGIT is the responsibility of the
board of directors and executive management. In other words, EGIT is about the stewardship of
IT resources on behalf of all stakeholders (internal and external) who expect their interests to be
met. The board of directors responsible for this stewardship will look to management to implement
the necessary systems and IT controls.
The purpose of EGIT is to direct IT endeavors to ensure that IT aligns with and supports the
enterprise’s objectives and its realization of promised benefits. Additionally, IT should enable the
enterprise by exploiting opportunities and maximizing benefits. IT resources should be used
responsibly, and IT-related risk should be managed appropriately.
EGIT is focused on IT resource management, performance measurement and managing IT risks.