IT governance: what it is, frameworks and the accountability of top management

IT governance, or governance of information systems, is an area of corporate governance. The term ICT governance also makes its communications component explicit. Applying it requires distinguishing decisions reserved for senior leadership from those that are delegated, establishing who oversees their implementation and which information makes it possible to monitor the outcomes.

IT governance: what it is and what it is for

IT governance links technology investments, services and risks to the priorities of the business. It is used to assess proposals before approval, assign responsibilities and check whether results justify the resources committed and the risks taken.

An outage can cause operational, financial and reputational losses. A lack of defined responsibilities can make the damage worse by delaying decisions and action. That is why it is necessary to establish who approves choices, which conditions require the involvement of top management and who reports on implementation.

IT governance and IT management: differences and responsibilities

While IT governance assesses the needs of the business, sets direction and monitors results, IT management plans and carries out the necessary activities: projects, services, infrastructure, support and supplier management.

The distinction concerns responsibilities, not just job titles. The governing body retains direction and oversight; executive management operates within the mandate it has received. The CIO contributes to technology strategy, proposes investments and coordinates implementation according to the delegations assigned. Operational managers run systems and services.

COBIT 2019 distinguishes governance objectives from management objectives. This separation must also be explicit within the organisation: for each decision, it should be stated who proposes, who approves, who implements and who verifies.

IT governance frameworks and standards

Frameworks and standards help structure decisions, processes and controls. The following references serve different purposes: some concern IT governance, others service or security management. The choice depends on the responsibilities and processes to be overseen.

These references can be coordinated according to the company’s needs. ITIL and ISO/IEC 27001 go deeper into specific areas and do not replace the overall definition of authority, delegation and oversight of IT.

How to set up IT governance in a company

To set up IT governance, we start from the decisions the business needs to take and the controls required to track their effects.

Review the system. Use incidents, variances and project results to update delegation, priorities and controls. Frameworks and standards support this work according to the needs that emerge.

Define the scope. Identify the systems, services and investments relevant to business objectives, including dependencies on suppliers.

Establish delegations and approvals. Document which decisions remain with top management and which are delegated. Criteria may cover amount, service criticality, risks and impact on data.

Assign responsibilities. For each decision, specify who proposes, who approves, who implements and who verifies. A RACI matrix can make this allocation explicit.

Define outcomes and controls. Link every investment to expected benefits and indicators: costs, progress, service availability and open issues. Set the reporting frequency and the conditions that require senior leadership to intervene.

An example: approving a new CRM

In a hypothetical case, the sales department proposes a new CRM to make opportunity management more traceable. The head of sales defines the expected outcome; IT assesses integrations, continuity and supplier dependencies; finance checks total costs and sustainability. The relevant functions review security and data protection.

The proposal is approved by the person authorised under the company’s delegations. If it exceeds the set spending or risk limits, it goes to top management. The decision records the rationale, conditions and responsibilities.

The project manager coordinates implementation. At the agreed intervals, top management receives a report on spending, progress, open risks and benefits achieved. Significant variances require a new decision.

Tools, software and adoption outside the process

An up-to-date inventory makes systems and suppliers visible; a register records risks; approval workflows document decisions; dashboards show results and variances. The choice of software should follow the responsibilities and processes it needs to support.

The rules must also cover shadow IT, meaning tools adopted by departments outside the established approval processes, and artificial intelligence applications. It is necessary to establish which uses are permitted, which data may be entered and who vets suppliers and terms of use. AI governance coordinates these aspects with specific criteria on systems, risks and human oversight.

Top management responsibilities: DORA and NIS 2

Obligations on technology risk governance depend on the sector and on the scope of the applicable rules. DORA and NIS 2 set out specific responsibilities for the entities concerned.

DORA. For financial entities within its scope, Article 5 of Regulation (EU) 2022/2554 assigns the management body the tasks of defining, approving and overseeing the ICT risk management framework, as well as ultimate responsibility for managing those risks.

NIS 2 in Italy. Article 23 of Legislative Decree 138/2024 concerns the administrative and management bodies of essential and important entities. It sets out approval and oversight duties, liability for infringements and training obligations in cybersecurity.

For these entities, operational delegation must go hand in hand with the required supervisory duties. More broadly, integrating technology risk into corporate risk management requires defined responsibilities, regular reporting and criteria for escalating critical issues to the appropriate decision-making level.

The Bliss angle: delegate technology, retain oversight