ISACA Certified in the Governance of Enterprise IT

No framework fits as published. You compare the main approaches to governing IT, tailor one to an enterprise’s size and context, and measure the capability of the governance system it creates.

• Governance frameworks compared
• Components of a governance system
• Design factors that shape tailoring
• Capability and maturity assessment
• Mapping frameworks to each other
• Rolling out a framework

You build A tailored governance framework for a named organization, with the reasons for each choice.

Governance operates through people with authority. You design the committees, roles and reporting lines that decide IT matters, and make decision rights clear between the board, the business and IT.

• Boards, committees and IT steering
• The role of the CIO and the business executive
• Decision rights and RACI charts
• Organizational structures for IT
• Culture and behavior in governance
• Avoiding duplication with other governance bodies

You build A decision rights matrix for IT investment, risk and architecture.

IT should follow the strategy of the enterprise. You connect business strategy to IT strategy, use enterprise architecture to turn intent into designs and track progress with balanced measures.

• Cascading enterprise goals to IT goals
• IT strategy and roadmaps
• Enterprise architecture as a governance tool
• Balanced scorecards for IT
• Communicating strategy
• Reviewing alignment regularly

You build A goals cascade from enterprise strategy to IT goals and measures.

IT resources are assets with life cycles and costs. You govern the portfolio of information, applications and infrastructure, including cloud, technical debt and retirement.

• Information as an enterprise asset
• Application portfolio management
• Infrastructure and cloud strategy
• Technical debt and renewal
• Asset life cycles and retirement
• Governing data and AI resources

You build An application portfolio review with keep, change and retire recommendations.

Value depends on who does the work. You govern sourcing choices, oversee suppliers, plan skills and talent, and manage the financial resources of IT with transparent costs.

• Sourcing strategies and models
• Supplier governance and oversight
• Skills and capability planning
• Budgeting and cost transparency
• Funding models for IT
• Measuring supplier and team performance

You build A sourcing strategy and supplier governance model for one IT service.

Investment should follow value and risk. You review business cases, prioritize programs across a portfolio, set stage gates and decide when to stop an initiative that is not delivering.

• Business cases and their review
• Portfolio prioritization and balance
• Stage gates and funding releases
• Program and project governance
• Stopping failing initiatives
• Reporting portfolio status to the board

You build A portfolio review of six investments, with a recommended funding decision for each.

A benefit unmeasured is a benefit assumed. You manage benefits from business case to result, name benefit owners, measure value and review investments after delivery.

• The benefits management life cycle
• Benefit owners and accountability
• Measures, baselines and targets
• Value tracking during and after delivery
• Post-investment reviews
• Performance scorecards for IT

You build A benefits realization plan for one investment, with measures, owners and review dates.

The aim is not zero risk but the intended risk. You set appetite for IT risk with the board, embed risk practice in IT governance, and balance risk against opportunity in each investment.

• Risk appetite for technology
• Governance of IT risk
• Integrating with enterprise risk management
• Risk and opportunity trade-offs
• Risk culture in IT
• Reporting IT risk to the board

You build An IT risk appetite statement with a review of two investments against it.

Governance must show that obligations are met. You oversee regulatory compliance, internal control and assurance activities, and the resilience and security practices that protect the enterprise.

• Regulatory and contractual compliance oversight
• Internal control and assurance providers
• Security and privacy governance
• Resilience and continuity oversight
• Using audit results in governance
• Evidence for the board

You build An assurance map showing who gives assurance over each area of IT, and what is uncovered.

Governance works through conversation. You report IT performance and risk to the board in plain terms, engage stakeholders, and manage the change that new governance brings.

• Reporting IT to the board
• Stakeholder analysis and engagement
• Dashboards and decision papers
• Managing change in governance practice
• Handling disagreement between business and IT
• Building momentum for governance improvement

You build A board paper and dashboard presenting IT value, risk and investment status.

One design covers the domain. You assess an enterprise, tailor a framework, set structures and decision rights, define how value and risk are measured and present the system to its board.

• Assessing the enterprise’s governance position
• Tailoring a framework and structures
• Setting value, resource and risk practices
• Planning rollout and measures
• Presenting to the board

You build A governance system design with framework, structures, measures and rollout plan.