Information technology governance is a subset discipline of corporate governance. Although it is sometimes mistaken for a field of study in its own right, IT governance is part of an organisation’s overall corporate governance strategy. In simple terms, IT governance puts structure around how an organisation aligns IT strategy with business strategy, ensures it stays on track to achieve its strategies and goals, and measures IT’s performance. It makes sure that all stakeholders’ interests are taken into account and that processes deliver measurable results.
An IT governance framework answers some key questions, such as how the IT department is functioning overall, what key metrics management needs and what return IT is giving the business on its investment.
The primary goals of IT governance are to ensure that investments in IT generate business value and to mitigate the risks associated with IT. This can be achieved by implementing an organisational structure with well-defined roles and responsibilities for information, business processes, applications and infrastructure.
Organisations need a structure or framework to ensure that the IT function can sustain the organisation’s strategies and objectives. The framework and level of detail needed depend on the organisation’s size, industry and applicable laws or regulations. In general, the larger and more regulated the organisation, the more detailed the IT governance structure should be.
IT Governance Framework
It doesn’t make sense to reinvent the wheel by starting from scratch. Start with an established IT governance framework; there are many to choose from, and using at least one means the groundwork has already been organised by industry experts.
An IT governance framework includes three elements:
- Governance principles: the principles by which all IT initiatives will be governed
- Governance structure: the roles and responsibilities of the major stakeholders in the IT governance decision-making process, including committees and organisational elements at the branch level
- Governance process: the stages required to review, assess and approve or reject new IT initiatives
Implementing good IT governance requires a framework.
COBIT
Control Objectives for Information and Related Technologies (COBIT), first released in 1996 and maintained by ISACA (originally the Information Systems Audit and Control Association), is probably the most widely used IT governance framework. It is a set of guidelines and supporting tools for the governance and management of enterprise information and technology that is used worldwide by auditors and organisations to align technology with business objectives and implement controls. COBIT 2019, which replaced COBIT 5, is built around a governance system of 40 governance and management objectives, design factors that tailor the framework to each enterprise, and a capability-based performance management model. It draws on and aligns with other major frameworks and standards, including ITIL, the NIST Cybersecurity Framework and ISO/IEC standards. ISACA has announced that COBIT 7, the successor to COBIT 2019, will be published in October 2026, so organisations planning a governance programme now should check which version their auditors and certification bodies expect.
The Information Technology Infrastructure Library (ITIL), originally developed by the UK government and now owned by PeopleCert, is the other widely used framework alongside COBIT. ITIL is a set of practices for IT service management (ITSM) that focuses on aligning IT services with the needs of the business. The ITIL 2011 edition, with its five lifecycle publications, has been superseded: ITIL 4 (2019) reorganised the guidance around a service value system and 34 management practices, and PeopleCert launched ITIL (Version 5) in 2026, with ITIL 4 certifications still available alongside it.
ITIL supports ISO/IEC 20000-1:2018 (which grew out of BS 15000), the international standard for IT service management, although differences between the two do exist. ITIL describes practices, processes and checklists that are not specific to any one organisation, which an organisation can use to integrate with its strategy, deliver value and maintain a minimum level of competency. It allows the organisation to establish a baseline from which it can plan, implement and measure, and it is used to demonstrate compliance and measure improvement.
Need help designing an IT governance framework that fits your organisation? Please contact us.
Sources: ISACA, COBIT resources (isaca.org) and webinar listing announcing COBIT 7 for October 2026 (isaca.org); PeopleCert, ITIL certifications (peoplecert.org).