IT Governance Processes

In order to satisfy specific regulatory requirements, many organizations have focused on IT General Controls (ITGC) with special attention paid to the management of the systems and applications infrastructure (IT Operations).  ITGCs are typically identified as critical to regulatory compliance. ITGCs are focused on infrastructure support processes including Network Management, Change Management, Configuration Management, Problem Management, Provisioning and Access Control.

According to the IT Governance Institute, "The overall objective of IT governance is to understand the issues and the strategic importance of IT, so that the enterprise can sustain its operations and implement the strategies required to extend its activities into the future. IT governance aims at ensuring that expectations for IT are met and IT risks are mitigated".*

In addition to ITGC’s, Governance Controls should be designed and implemented effectively to achieve the goals of IT Governance.  Governance Controls are targeted at the management of information technology as an asset versus the limited operational controls that are typically included in the ITGC category.

As would be expected from the name, Governance Controls are typically much more IT process management or service management specific than ITGCs. Best practices for controls for each governance area should include Program Management, Service Management and Security Management as well as the management of finance and budgeting of the IT function. Examples of best practices include Control Objectives for Information and Related Technology (CobiT) as well as Carnegie-Mellon University, Software Engineering Institute’s Capability Maturity Model Integration (CMMI), however, Governance Controls must be specifically designed to meet each organization’s unique business processes.

*  IT Governance Institute 2003, "Board Briefing on IT Governance, 2nd Edition". Retrieved January 18, 2006