Governance FAQ

IT governance and IT management are distinct but complementary functions. Governance focuses on oversight, direction, and accountability — ensuring that technology investments serve organizational objectives and that technology-related risks are managed appropriately. Governing bodies (boards and senior executives) are responsible for governance.

IT management focuses on planning and running IT operations, implementing technology solutions, delivering services, and executing the direction set by governance. Management provides information to governance through reporting and obtains direction from governance through approved strategies, policies, and risk parameters.

The distinction matters for accountability: governance failures are typically failures of oversight and direction; management failures are failures of execution. Effective technology governance requires both layers to function properly.

Board engagement with technology governance typically operates through several mechanisms:

• Oversight of technology strategy alignment with organizational objectives
• Approval of IT risk appetite and major technology investment decisions
• Receipt of technology performance reporting, including cybersecurity posture
• Oversight of significant technology programs and major change initiatives
• Review of technology audit and assurance results

Many boards establish a Technology Committee or Risk Committee that provides dedicated oversight of technology and cyber risk matters, with reporting to the full board. In regulated financial institutions, OSFI's Corporate Governance Guideline requires boards to ensure adequate technology and cyber risk oversight.

Effective board engagement requires that boards receive independent assurance — from internal audit, external auditors, and independent advisors — not only management-prepared reporting.

Framework selection depends on organizational context, regulatory environment, and the specific governance problems the organization needs to address. Several factors guide selection for mid-sized Canadian organizations:

• Regulated sectors (financial services, healthcare) often require framework alignment with specific regulatory guidance from OSFI, provincial health regulators, or equivalent bodies
• Organizations with IT audit and financial reporting obligations frequently adopt COBIT for its alignment with internal control frameworks
• Organizations prioritizing cybersecurity governance may adopt NIST CSF 2.0, which aligns with Canadian Centre for Cyber Security guidance
• ISO/IEC 27001 certification may be required for organizations serving enterprise customers or government contracts

Many mid-sized organizations adopt a simplified COBIT implementation covering the highest-priority governance objectives, combined with NIST CSF for cybersecurity governance and ISO/IEC 27001 for information security management.

Technology governance performance metrics measure whether governance structures and processes are achieving their intended outcomes. Metrics operate at two levels: governance process metrics and governance outcome metrics.

Governance process metrics assess whether governance activities are occurring as designed — committee meeting frequency and attendance, audit completion rates, risk review cadence, policy review cycles, and management response completion rates for audit findings.

Governance outcome metrics assess whether technology is delivering value and risks are being managed effectively — IT project delivery performance, cybersecurity incident rates and severity, system availability against targets, technology spend against budget, and compliance audit findings counts and remediation timelines.

COBIT 2019 provides example governance and management objectives metrics for each of its 40 objective areas, which organizations can adapt to their governance measurement needs.

A technology governance committee charter documents the committee's mandate, authority, composition, and operating procedures. Typical charter elements include:

• Purpose and mandate — The committee's governance objectives and scope of responsibility
• Authority — Decision rights delegated to the committee versus matters requiring escalation
• Composition — Membership requirements, chair designation, and quorum rules
• Meeting requirements — Frequency, quorum, and agenda preparation requirements
• Reporting obligations — What the committee reports to, on what matters, and at what frequency
• Review cycle — How often the charter is reviewed and approved

Committee charters should be reviewed annually and approved by the governing body. Charters that are outdated or misaligned with actual committee practice create governance accountability gaps.

Cloud environments require governance adaptations because the traditional organizational boundary between infrastructure under direct control and third-party infrastructure does not apply. Key governance considerations for cloud include:

• Shared responsibility model understanding — clearly defining which security and governance controls the organization retains versus which the cloud provider manages
• Third-party risk management — applying governance frameworks like OSFI B-10 to cloud service provider relationships including due diligence, contract requirements, and ongoing monitoring
• Data residency and sovereignty — ensuring cloud architecture aligns with Canadian data residency requirements, particularly for public sector and regulated-sector organizations
• Cloud governance policy — explicit policies for cloud service classification, approved service lists, data classification guidance for cloud placement, and exit provisions
• Audit and assurance — evaluating cloud provider SOC 2, ISO 27001, and other third-party assurance reports as part of ongoing governance monitoring

Internal audit provides independent assurance to the governing body that technology governance structures, risk management processes, and controls are functioning effectively. In technology governance, internal audit contributes through:

• Risk-based IT audit planning that identifies and prioritizes technology audit coverage
• Assurance audits of general IT controls, application controls, and cybersecurity controls
• Governance audits assessing the design and effectiveness of governance committees and processes
• Third-party audit coverage for significant technology vendor relationships
• Advisory services on governance framework implementation and risk management program design

Internal audit independence from management is essential for effective governance assurance. The internal audit function should have a direct reporting line to the audit committee of the board, separate from its administrative reporting relationship to management.

Technology governance frameworks require periodic review to ensure they remain aligned with organizational strategy, technology environment, and regulatory requirements. Typical review cadences include:

• Annual review of governance policies and risk appetite statements
• Annual review of governance committee charters and terms of reference
• Triennial or biennial review of the overall governance framework structure and design, or earlier when significant changes occur in organizational strategy, regulatory environment, or technology landscape
• Event-triggered reviews following significant technology incidents, major regulatory changes, or material organizational changes such as mergers, acquisitions, or significant technology transformations

Framework review should be documented with assessment of gaps identified, changes made, and rationale for unchanged elements. Board approval of governance framework updates provides accountability for governance structure decisions.