Governance of service management

Guiding principles shape how people make decisions, but an organization also needs a way to make sure that decisions as a whole serve its purpose, respect its obligations and manage its risks. That is the role of governance. This lesson explains what governance is and how it differs from management, introduces the evaluate, direct and monitor model used by ISO/IEC 38500 and COBIT 2019, shows how governance applies to service management, and maps examples from public-sector policy and financial reporting regulation. It closes with practical tools: a RACI matrix and a simple capability assessment.

This course is independent study material. Summaries of standards and regulations here are simplified for learning; always consult the official texts for compliance decisions.

What governance is

ITIL defines governance as the means by which an organization is directed and controlled. Governance is carried out by a governing body: a person or group accountable at the highest level for the performance and compliance of the organization. In a company this is usually the board of directors; in a public body it may be a deputy head, a minister, a board of governors or a council.

Governance answers questions such as: What is the organization trying to achieve? What risks is it willing to accept? Are resources being used responsibly? Is the organization complying with laws and its own policies? Is it getting the value it expects from its investments, including in technology and services?

Governance versus management

Governance and management are related but distinct. Governance sets direction and checks that it is followed; management plans and carries out the work to achieve that direction. A board does not decide which incident management tool to buy, but it does set the risk appetite and investment priorities that guide that decision, and it expects reports showing whether services are meeting objectives.

Evaluate, direct, monitor

The most widely used model of governance activities is evaluate, direct and monitor (EDM). It appears in ISO/IEC 38500, the international standard for governance of information technology for the organization, and in COBIT 2019, ISACA's framework for governance and management of enterprise information and technology. ITIL uses the same three activities.

• Evaluate: the governing body examines the organization's current and future situation, including its strategy, portfolio, risks and the needs of stakeholders.
• Direct: it assigns responsibility for, and directs the preparation and implementation of, strategies and policies. Policies set the expected behaviour across the organization.
• Monitor: it monitors the performance of the organization and its practices, products and services against strategy and policy, to ensure they conform.

The cycle is continuous. Monitoring produces information that feeds the next evaluation. If monitoring shows that a service is failing to meet its objectives, the governing body may evaluate the causes and direct a change of policy or investment.

ISO/IEC 38500

ISO/IEC 38500 provides principles and a model for governing bodies to oversee the use of information technology. The current edition was published in 2024. Earlier editions set out six principles for good governance of IT: responsibility, strategy, acquisition, performance, conformance and human behaviour. The 2024 edition aligns the standard more closely with ISO 37000, the general standard on governance of organizations, but the core idea remains: the governing body is accountable for the use of IT, applies the EDM model and should ensure IT supports the organization's purpose.

The standard is deliberately brief and high level. It does not tell managers how to run services; that is the role of frameworks such as ITIL and COBIT and standards such as ISO/IEC 20000-1 for service management systems.

COBIT 2019

COBIT 2019 is more detailed. It separates governance from management and organizes 40 governance and management objectives into five domains. One domain, Evaluate, Direct and Monitor (EDM), holds the governance objectives, such as ensuring benefits delivery, risk optimization and resource optimization. Four management domains cover Align, Plan and Organize (APO); Build, Acquire and Implement (BAI); Deliver, Service and Support (DSS); and Monitor, Evaluate and Assess (MEA).

COBIT also introduces design factors, such as enterprise strategy, risk profile and threat landscape, which help tailor the governance system to an organization. It rates processes on capability levels from 0 to 5. Many organizations use COBIT for governance and control objectives and ITIL for service management practices, since the two fit together well: ITIL practices supply much of the "how" behind COBIT's management objectives, particularly in the DSS and BAI domains.

Governance in the public sector and in regulated companies

Governance takes concrete forms through policy and regulation. Two examples show how service management connects to them.

In the Government of Canada, the Treasury Board Policy on Service and Digital, in effect since April 2020, sets requirements for how departments govern service delivery, information, data and IT. Deputy heads are accountable for its implementation, supported by a departmental chief information officer. Departments must maintain an inventory of services, set and publish service standards, report on performance and plan IT investments in an integrated way. The accompanying Directive on Service and Digital adds detail such as enterprise architecture review. For service management, this means practices such as service catalogue management, service level management and measurement and reporting directly support compliance.

Publicly listed Canadian companies are subject to National Instrument 52-109, which requires the chief executive officer and chief financial officer to certify annual and interim filings, including the design and, for non-venture issuers, the effectiveness of disclosure controls and procedures and internal control over financial reporting. Unlike the US Sarbanes-Oxley Act, NI 52-109 does not require an external auditor to attest to internal control over financial reporting.

In both cases, financial systems depend on IT, so IT general controls become part of financial governance. These controls typically cover access management (who can use and change systems), change management (how changes to systems are authorized, tested and recorded) and IT operations (backups, job scheduling, incident handling). ITIL practices such as information security management, change enablement and service continuity management supply many of these controls.

Governance of service management

For service management, governance means the governing body ensures that services and the practices that deliver them align with the organization's strategy and obligations. Typical governance activities include approving service strategy and major investments, setting policies (for example on information security, supplier use or AI), defining risk appetite, approving the portfolio of services and monitoring performance against objectives.

Governance is not only for the board. ITIL notes that governance can be cascaded: the governing body delegates authority to management, who establish their own controls. A change authority approving a high-risk change, or a service owner accepting a supplier's performance report, is exercising delegated governance within limits set from above.

Assigning accountability with RACI

Clear accountability is central to governance. A RACI matrix assigns, for each activity, who is Responsible (does the work), Accountable (answers for the result, with only one per activity), Consulted (gives input) and Informed (kept up to date).

Assessing governance capability

Organizations often assess how mature their governance and management practices are. COBIT rates capability from level 0 (incomplete) through 1 (initial), 2 (managed), 3 (defined), 4 (quantitative) to 5 (optimizing). Assessments compare current levels with target levels to set improvement priorities.

Governance and the guiding principles

The guiding principles apply to governance too. Focus on value reminds governing bodies to judge investments by the value they enable. Collaborate and promote visibility means governance depends on accurate, honest reporting. Keep it simple and practical warns against controls so heavy that people work around them. Think and work holistically reflects the governing body's view of the whole organization. ITIL (Version 5) adds specific emphasis on governing AI, covered in ITIL-150.

Governance in exam scenarios

Questions about governance often test the distinction between governance and management. If a scenario describes setting direction, approving strategy or policy, defining risk appetite or overseeing performance at the highest level, it describes governance. If it describes planning work, operating services, choosing tools or producing reports, it describes management. The evaluate, direct and monitor activities belong to the governing body; plan, build, run and monitor belong to management. Watch for distractors that swap these activity sets, or that describe the governing body carrying out day-to-day operations.

A second pattern asks how governance relates to the guiding principles or to continual improvement. The governing body applies focus on value when it judges investments, relies on collaborate and promote visibility for honest reporting, and drives continual improvement by setting objectives and monitoring results. Governance is therefore not separate from the rest of this course; it is the level at which the same ideas are applied across the whole organization.