IT Governance
IT Governance
What is IT governance?
- The subject is executive leadership, not the IT department
- Start with one line: who approves
- If the committee never meets, it is just a document
Once IT governance takes hold, 'something the IT department handles on its own' becomes 'something the company decides.' Which systems to buy, who is accountable when a security incident occurs, and whether departments may adopt their own tools are decided by established committees and criteria, not the discretion of technical staff. That is why IT governance belongs to executive leadership, not the IT department. If IT management is about 'how to operate well,' governance is about 'who decides what to do.'
It comes down to five components. First, a decision-making structure that reviews IT investment (an IT committee and approval criteria). Second, a link between business strategy and the IT plan. Third, risk management covering security, privacy, and regulatory compliance. Fourth, performance measurement that tracks return on investment. Fifth, principles for allocating resources. Internationally, ISO/IEC 38500 and ISACA’s COBIT lay out this framework, and in Korea, ISMS-P certification and financial-sector supervisory regulations contain similar requirements. For mid-sized companies, the starting point is not an elaborate system but a single line: 'Which meeting, and who, approves IT spending above a certain amount?'
Where governance touches training and HR is department-level tool adoption. When the training team wants to bring in an LMS or AI tool, governance must already define where it gets a security review, a privacy impact review, and a check for overlap with existing systems. Without this process, each department buys similar tools separately, data gets scattered, and no one knows where former employees’ accounts remain. Conversely, if the process is too heavy, shadow IT grows, with business units skipping the review and paying with personal cards.
The most common failure in practice is building governance only on paper. If there is a policy manual but the IT committee never meets even once a year, real decisions are still made in the hallway, and when an incident occurs, accountability falls on an individual IT staff member. Another common misconception is treating governance as another word for security compliance. Compliance is only one part of governance; without investment decisions and performance measurement, all that remains is 'control,' which invites resistance from business units. If there is no forum where executives personally review IT numbers every quarter, governance does not yet exist.
Ara LimExpert in global leadership, AI, and business communication
Jaryong KooMarketing PhD and leading authority on AI, data analytics, and personal brandingThe concept emerged in the late 1990s, when surging corporate IT investment prompted calls to handle investment decisions and accountability at the management level. ISACA released the COBIT framework in 1996, and the term became established when ISO/IEC 38500 was published in 2008 as the international standard for IT governance.
Consider a hypothetical case. Company A, a logistics company with 620 employees, had three departments each adopt different collaboration and AI tools last year, and a security audit revealed that customer addresses had been uploaded to one of them. Before approving next year’s KRW 400 million (≈ US$299,300) IT investment, the CEO instructed, 'First, build a structure that makes clear who decides.'
- The company formed an IT committee chaired by the CFO, with the IT lead, HR lead, and head of sales as members. It also added one line to the approval policy: any IT spending of KRW 5 million (≈ US$3,740) or more, and any tool that stores data externally, must go through committee review.
- At the first meeting, the head of IT split last year’s KRW 320 million (≈ US$239,400) in IT spending into 'maintenance' and 'new.' When the numbers showed 78% going to maintenance, the CEO asked, 'So next year’s KRW 400 million (≈ US$299,300) will mostly go to maintenance too?'
- The training team’s LMS adoption request was approved by the committee after a privacy impact review and a check for overlap with the existing groupware. The training team lead said, 'The review took two weeks, but after approval nobody raised any objections.'
- Each quarter, the IT team was required to report three numbers to the committee: security incidents, system downtime, and return on investment. From the second quarter, department heads began asking on their own, 'Please put our department’s tools on the list too.'
- One year later, unregistered tools that departments had adopted on their own fell from 11 to 2. The KRW 29 million (≈ US$21,700) saved by canceling duplicates was redirected to new investment, bringing the maintenance share down from 78% to 64%.