GOVERNANCE
The concept of governance is central to the sound operation and management of all healthy organisations. It covers the various policies, processes and structures established by senior management to ensure the smooth running and effective control of the organisation. The guidance provided through the ITIL disciplines offers a sound foundation for the development of effective governance, which is as important to the IT provider as to any other organisation.
The international standard for IT governance, ISO/IEC 38500:2008, ‘provides a framework for effective governance of IT to assist those at the highest level of
organisations to understand and fulfil their legal, regulatory and ethical
obligations in respect of their organisations’ use of IT’. This framework sets out six principles for good corporate governance of IT, covering responsibility,
strategy, acquisition, performance, conformance and human behaviour, making it clear that IT governance is about much more than IT processes and controls. It is a management system used by directors of an organisation to ensure the proper and effective stewardship of the IT resource.
Nevertheless, effective IT procedures and controls are a vital component of good governance. The ITIL framework can be a key part of the foundations for excellent IT governance.
IT is a service business, and the adoption of ITIL service management practices is an effective way to address IT governance. Every part of the service lifecycle has a role to play. For example, service strategy ensures that IT investments
not only address issues that are important to the business, but also that they are sound investments that take proper account of costs, benefits and risks.
Continual service improvement helps the business achieve greater value and higher levels of efficiency while conforming to standards such as ISO/IEC 20000 and external constraints such as Sarbanes–Oxley (SOX). Further specific references to IT governance can be found in Chapter 8 Financial Management for IT Services
(a service strategy process) and Chapter 18 Information Security Management and Access Management (service design and service operation processes).