IT Governance and the Board's Role

I-T governance and the board’s role. This lesson is about the distinction the whole of Domain 2 rests on: the difference between governing I-T and managing it, and what belongs to the board that can never be handed down.

Picture a company that directs its I-T well. There is a steering committee, a strategy document, and a C-I-O who clearly runs a tight operation. Everything looks healthy. Then you notice two things. The steering committee reports to the C-I-O, and the board has not discussed I-T in over a year. Nothing is technically broken, and yet the governance is.

Here is the distinction. Governance sets direction and holds people accountable for following it. Management runs I-T within that direction. Governance asks what I-T should achieve for the enterprise and whether management is delivering it. Management asks how to deliver it with the resources available. Most Domain 2 questions turn on this line.

So keep the two jobs separate in your head. Governance is the board’s work: what should I-T achieve, what risk are we willing to carry, and is management actually delivering. Management is the C-I-O’s work: how do we deliver what governance asked for, and with what resources. When an option has the board designing controls or picking technologies, it is wrong, that is management. When an option has management setting the enterprise’s risk appetite, that is wrong too, that belongs to governance.

Now the line that cannot move. A board can delegate authority to a committee. What it cannot delegate is accountability. It remains answerable to shareholders and regulators for the value I-T delivers and the risk it carries, no matter how much decision-making it hands down.

So what stays with the board, non-delegable. First, setting the strategic direction for I-T, so that I-T supports the enterprise’s objectives rather than its own.

Second, ensuring I-T actually delivers value for what it costs. And third, ensuring I-T risk is managed within an appetite the board itself has defined. Value and risk, both owned at the top.

And fourth, holding management accountable, through reporting the board can actually rely on. Set direction, ensure value, ensure risk is managed, hold management to account. Those four do not move down the organisation.

The fastest way to spot broken governance is to follow the reporting line, exactly as you would for the audit function in Domain 1. Oversight cannot report to the thing it oversees.

Which is the real failure in our scenario. A steering committee exists to align I-T with business needs on behalf of the enterprise. If it is chaired by the C-I-O and reports to the C-I-O, it oversees I-T while answering to the head of I-T. It cannot give independent, business-driven direction. The structure has quietly turned oversight into self-endorsement.

And here is the trap that costs marks. The instinct is to judge governance by how well I-T is run. But a superbly managed I-T function with no board oversight is still a governance failure, because good management is not a substitute for accountability. The exam rewards keeping the two apart.

So carry this question into every Domain 2 scenario. Do not ask, is I-T working well. Ask, who set the direction, and who holds them to it. That is the difference between management and governance, and it is what the exam is testing.