Today, IT is advancing at a faster pace, and its influence is growing rapidly as a result. Consequently, IT has evolved from a simple tool that supports field operations into a powerful strategic weapon that redefines business models and shifts market dynamics. Therefore, companies must exercise leadership to control and guide IT in the right direction to mitigate business risks.

Just as ISO/IEC 20000 exists as an internationally recognized standard for IT service management, ISO/IEC 38500 serves as the international standard for IT governance. Today, we will explore how corporate decision-makers should view and govern IT based on ISO/IEC 38500.

[Image Source: STEG Luke Kim]

Moving Beyond the Limits of Practical 'Management' Toward Strategic 'Governance'

IT governance is a fundamentally different concept from IT Service Management (ITSM) and security control. Management revolves around 'execution,' focusing on how flawlessly and efficiently a given system is operated. In contrast, the governance defined by ISO/IEC 38500 is about 'direction,' questioning whether our IT resources are properly aligned with the company's ultimate business goals. In other words, ISO/IEC 38500 is not a technical manual for developers or system engineers; rather, it provides the management principles and philosophies that organizational decision-makers need to operate IT responsibly.

6 Core Principles for Maximizing Business Value

ISO/IEC 38500 presents six core principles to help executives make the right decisions.

First, all stakeholders within the organization must clearly recognize their authority and 'Responsibility' regarding the supply and demand of IT. This means that an issue with an IT system is not solely the fault of the development department; the leaders who plan and use the system also share a joint responsibility.

Built upon this sense of responsibility, IT planning must achieve a 'Strategy' alignment that seamlessly integrates with the organization's business direction.

In addition, companies must introduce new systems or invest in technology through a transparent 'Acquisition' process based on thorough feasibility analysis.

The implemented technology can only prove its worth if it leads to 'Performance,' precisely meeting the service levels required by the business and generating tangible business benefits.

However, no matter how outstanding a system's performance may be, it must satisfy 'Conformance' by strictly adhering to legal regulations and ethical standards.

Ultimately, perfect digital trust is built only when the system complies with the 'Human Behavior' principle by respecting the psychology and work habits of the people who interact with it every day.

The Leader's Compass: Evaluation, Direction, and Monitoring

For the six principles above to take deep root within an organization, three core activities—evaluation, direction, and monitoring—must be continuously repeated.

In the 'Evaluation' activity, companies periodically compare technological trends with their organizational business requirements. Through this, they closely examine whether the current level of IT utilization is appropriate and whether the technologies to be adopted in the future will pose any risks. The evaluation process allows a company to determine its future direction.

Following the evaluation activity, the company establishes policies aligned with the chosen direction. To execute these policies, it delegates authority to practitioners, giving them the 'Direct' mandate to move in the right direction.

Subsequently, through continuous 'Monitor' activities, they verify whether the directives are being properly carried out according to regulations and if the expected performance indicators are being achieved. Monitoring is a crucial activity that narrows the gap between strategy and execution.

Applying the governance philosophy presented by ISO/IEC 38500 to a business environment is no easy task. This is because executives must secure visibility that allows them to look transparently into data across the entire organization to evaluate and monitor the status of IT assets. Only when decision-makers fully understand and control IT can a company truly take the helm of its digital innovation.

@STEG Luke Kim