ISO/IEC 38500: ISO/IEC 38500 – Tutorial (about 60 minutes)

ISO/IEC 38500 is the international standard that gives boards, councils, trustees and other governing bodies a set of principles for directing and overseeing how their organisation uses information technology. It is read by directors, executives, chief information officers, risk and audit teams and the consultants who support them. After this tutorial you will be able to explain what governance of IT is and how it differs from IT management, describe the principles, model and framework of the current edition, and apply them to a realistic organisation.

Free tutorial · about 60 minutes · 7 lessons · 5 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: the current edition is ISO/IEC 38500:2024, Information technology – Governance of IT for the organization, the third edition, published in February 2024 by ISO and IEC through Joint Technical Committee ISO/IEC JTC 1, Subcommittee SC 40 (IT service management and IT governance). It cancels and replaces the second edition, ISO/IEC 38500:2015, which itself followed the first edition of 2008. According to its foreword, the 2024 edition elaborates the principles and aligns them with the governance principles of ISO 37000:2021 (Governance of organizations – Guidance), adds "engage stakeholders" to the governance model and brings in a framework for the governance of IT that was previously published in ISO/IEC TR 38502. The 2024 edition is the current, published version; no newer edition has been announced. Companion documents in the ISO/IEC 38500 family are revised separately (for example, a revision of the implementation guidance ISO/IEC TS 38501:2015 is in progress in SC 40), so check the ISO catalogue for their latest status. Verified 2026-10-29.

Who it is for: board members and executives who want a clear view of their responsibilities for technology; chief information, digital, data and security officers; enterprise architects; internal auditors and risk managers; and engineers or project leaders who are asked to "align with ISO/IEC 38500" and want to understand what that means.

Prerequisites: none. A general idea of how organisations make decisions (boards, executives, budgets, projects) is helpful, but no legal, accounting or audit background is assumed.

Learning objectives. After this tutorial you will be able to:

Explain why governing bodies need to govern IT and how governance of IT differs from management of IT.
Describe the three intended outcomes of good governance and the eleven principles of the 2024 edition, grouped as in ISO 37000.
Apply the governance model – engage stakeholders, evaluate, direct and monitor – to a real decision about technology.
Use the six framework elements (direction, capability, policy, delegation, performance and accountability) to design governance arrangements.
Explain how governance of IT can be assessed, what ISO/IEC 38503 adds, and why there is no organisational certificate for ISO/IEC 38500.
Place ISO/IEC 38500 alongside ISO 37000, COBIT, ITIL, ISO/IEC 20000-1, ISO/IEC 27001 and other related standards.

Lesson 1 – Origins, purpose and scope

Why governing bodies must care about technology

In most organisations, technology is no longer a back-office utility. A bank's products exist only as software, a hospital depends on clinical systems and connected devices, a city council delivers services through online portals, and a retailer competes through its data and its e-commerce platform. When a large technology programme fails, when customer data leaks or when an automated decision treats people unfairly, the consequences fall on the whole organisation: lost money, regulatory penalties, damaged reputation and, sometimes, harm to people. Those consequences land, in the end, on the people who are accountable for the organisation as a whole – its governing body.

For many years, however, boards treated IT as a technical subject they could hand over entirely to the IT department. Decisions about large investments, outsourcing contracts, cloud migrations or security spending were often made without clear criteria, without the board understanding the risks and without anyone checking afterwards whether the promised benefits arrived. ISO/IEC 38500 exists to close this gap. It tells governing bodies, in plain principles rather than detailed procedures, how to take ownership of the organisation's use of IT without trying to run the IT department themselves.

A short history

The standard grew out of the Australian standard AS 8015, published in 2005, which was put through the fast-track procedure of ISO/IEC JTC 1 and became the basis of the first edition of ISO/IEC 38500 in 2008. That edition introduced the core idea that has survived every revision: the governing body should evaluate, direct and monitor the use of IT, guided by a small set of principles. The second edition, published in 2015, clarified the wording, made it explicit that the standard is about governance of the organisation's use of IT (not of the IT department alone) and kept six principles: responsibility, strategy, acquisition, performance, conformance and human behaviour.

In 2021 ISO published ISO 37000, a general guidance standard on the governance of organisations. Because governance of IT is one part of governing an organisation, it made sense to align the two. The third edition of ISO/IEC 38500, published in 2024, does exactly that: it adopts the eleven governance principles of ISO 37000 and explains what each one means for the use of IT. It also adds stakeholder engagement to the model and includes a governance framework that used to sit in a separate technical report.

Scope: who and what it applies to

The standard is written primarily for members of governing bodies and the people who support them. Its subject is the effective, efficient and acceptable use of IT – both current and future use – within the organisation. It applies to every kind of organisation: public and private companies, government bodies and not-for-profit organisations, from a ten-person charity to a multinational group, whether they use a little IT or a great deal.

Three points about the scope are often misunderstood. First, "IT" is meant broadly. It covers technology the organisation owns, rents or consumes as a service, including cloud platforms, software bought by business units, data, digital channels, operational technology and emerging technologies such as artificial intelligence. Second, the standard recognises that governance happens throughout the organisation, not only in the boardroom: the governing body sets direction and keeps oversight, but it relies on managers and staff at every level to carry that direction into daily decisions. Third, ISO/IEC 38500 is a guidance standard. It uses "should" rather than "shall", contains no auditable requirements and deliberately avoids implementation detail. It tells you what good governance of IT looks like and leaves the "how" to the organisation and to companion documents.

The three tools of the standard

The 2024 edition offers the governing body three tools that work together. The principles describe what good governance of IT is trying to achieve and how a governing body should behave. The model sets out the core tasks of governing IT and how they connect with management. The framework describes the elements through which governance arrangements actually operate in an organisation. You will meet each tool in detail in Lesson 3.

Figure 1 – Governance of IT is one domain of organisational governance; its principles, model and framework guide how management uses IT.

Lesson 2 – Key concepts and vocabulary

ISO/IEC 38500 takes most of its terminology from ISO 37000 and adds a few terms of its own. The explanations below are written in plain language; consult the standards for the authoritative definitions.

Governance – the system by which an organisation is directed, overseen and held accountable for achieving its purpose. It is about who decides, on what basis, and how those decisions are checked.
Governance of IT – the part of organisational governance that concerns the current and future use of IT. It covers the decisions, oversight and accountability that make sure technology serves the organisation's purpose.
Governing body – the person or group with ultimate accountability for the whole organisation: a board of directors, a supervisory board, a council, trustees, or a sole owner-manager in a small business.
Management – the people to whom the governing body delegates authority to plan, build, run and improve the organisation's activities, including its use of IT. Management works within the direction and limits that governance sets.
Organisational purpose – the reason the organisation exists and the value it intends to create for its stakeholders. In the 2024 edition, purpose is the reference point against which every use of IT is judged.
Stakeholder – any person or group that can affect, or is affected by, the organisation's decisions: customers, employees, shareholders, regulators, suppliers, communities and society at large.
Engage stakeholders – the governance task of identifying stakeholders, understanding their needs and expectations about the use of IT, and communicating with them. It was added to the model in 2024.
Evaluate – the governance task of examining the current and future use of IT, including proposals, options, risks and the external environment, to form a judgement.
Direct – the governance task of communicating the purposes and outcomes the organisation wants, typically by setting or approving objectives, strategies and policies for the use of IT. The governing body may delegate the detailed setting of objectives to management.
Monitor – the governance task of watching performance and conformance, comparing results with the direction given, and acting when they diverge.
Accountability – being answerable for decisions and their results. The governing body stays accountable for the organisation's use of IT even when it delegates work and authority to others.
Delegation – the formal transfer of authority to act or decide, with defined limits, from the governing body to management or a committee. Delegation passes authority; it does not remove the governing body's accountability.
Oversight – the governing body's activity of making sure that what management does stays within the direction, policies and risk limits that were set, supported by internal control and assurance.
Governance outcomes – the three results that good governance aims for in ISO 37000 and ISO/IEC 38500: effective performance, responsible stewardship and ethical behaviour.
Risk governance – the governing body's role in setting the organisation's attitude to risk and making sure risk is considered in decisions, as distinct from the day-to-day work of risk management.
Governance framework – the set of arrangements (structures, policies, delegations, measures and reporting lines) through which governance of IT is carried out in a specific organisation.

Governance versus management

The single most important idea in ISO/IEC 38500 is the distinction between governance and management. Governance answers questions such as "Is this the right thing for our organisation to do with technology?", "Who may decide this, and within what limits?" and "How will we know whether it is working?". Management answers questions such as "How do we deliver this project on time?", "Which vendor offers the best contract?" and "How do we patch these servers?". The governing body should not design network architectures or approve every purchase order. Equally, management should not decide on its own that the organisation will accept a level of cyber risk or an ethical stance on artificial intelligence that the governing body has never considered.

The two meet at clear interfaces. Management brings proposals, plans and performance information upward; governance sends direction, policies, approvals and delegated authority downward. When these interfaces are well designed, decisions are made at the right level, quickly and with the right information. When they are missing, organisations swing between two failure modes: boards that micromanage technology they do not understand, and boards that rubber-stamp technology decisions they never really examined.

Effective, efficient and acceptable use

The scope talks about the effective, efficient and acceptable use of IT. Effective means technology actually helps achieve the organisation's purpose and objectives. Efficient means it does so without wasting money, people or energy. Acceptable means it is used in a way that stakeholders and society would consider legitimate: lawful, secure, fair, respectful of privacy and environmentally responsible. A system can be effective and efficient yet unacceptable – for instance an algorithm that cuts costs by quietly discriminating against some customers. Governance of IT has to keep all three in view at once.

Lesson 3 – Structure of the standard

The 2024 edition is a short document of about twenty pages. Its clauses are organised as follows (titles paraphrased where helpful):

Clause 1 – Scope: purpose of the document, audience and applicability.
Clause 2 – Normative references: ISO 37000, whose terms and principles the standard builds on.
Clause 3 – Terms and definitions: it reuses the terms of ISO 37000 and adds a few terms specific to governance of IT, beginning with direct.
Clause 4 – Good governance of IT: the outcomes of good governance (effective performance, responsible stewardship, ethical behaviour) and how principles, model and framework fit together.
Clause 5 – Principles for the governance of IT: eleven principles, each presented as the principle itself, its governance implications for the use of IT, and the outcomes expected when it is applied.
Clause 6 – Model for the governance of IT: the governance practice (engage stakeholders, evaluate, direct, monitor), the management practice it interacts with, and the link to the framework.
Clause 7 – Framework for the governance of IT: six elements – direction, capability, policy, delegation, performance and accountability.
Bibliography: related standards.

The three outcomes

Clause 4 starts with results rather than rules. Effective performance means the organisation achieves its purpose and objectives, with IT contributing to that success. Responsible stewardship means the organisation looks after the resources entrusted to it – money, data, people, infrastructure, the environment – so they are used wisely and preserved for the future. Ethical behaviour means decisions about technology reflect the organisation's values and the expectations of society, not only what is legal or profitable. Each of the eleven principles contributes to one or more of these outcomes.

The eleven principles

ISO 37000 groups its eleven principles into one primary principle, four foundational principles and six enabling principles. ISO/IEC 38500:2024 follows the same principles and order and interprets each for the use of IT. In your own work you can think of them as follows.

Primary principle

Purpose: the governing body should make sure the organisation's purpose is clear and that the use of IT is tied to it. Technology is never a goal in its own right; a digital platform, a data lake or an AI model is justified only by what it does for the organisation's purpose and stakeholders.

Foundational principles

Value generation: IT should create value for the organisation and its stakeholders – financial value, but also service quality, safety, social benefit and resilience. In practice this means clear business cases, benefits tracking and an honest view of total cost of ownership.
Strategy: the organisation's strategy should be informed by what technology makes possible, and the IT strategy should support the organisational strategy. Governing bodies should ask both "How does IT serve our strategy?" and "How could IT change our strategy?".
Oversight: the governing body should oversee the use of IT so that it stays within direction, policy, law and risk appetite, supported by internal control and independent assurance.
Accountability: the governing body remains answerable for the organisation's use of IT. It should define who is accountable for what, require reporting and accept that delegating work does not delegate ultimate responsibility.

Enabling principles

Stakeholder engagement: understand and respond to what stakeholders need and expect from the organisation's use of technology, for example customers' expectations about privacy or employees' concerns about automation.
Leadership: the governing body should set the tone for the ethical and effective use of IT and lead by example, including building its own understanding of technology.
Data and decisions: treat data as a strategic resource, make sure decisions are informed by reliable information and govern how data is collected, used and protected.
Risk governance: set the organisation's attitude to IT-related risk, including cyber security, dependence on suppliers and the risks of emerging technology, and make sure risk is weighed in decisions alongside opportunity.
Social responsibility: consider the effect of the organisation's use of IT on society and the environment – energy use, electronic waste, accessibility, fairness and human rights.
Viability and performance over time: make sure the use of IT supports the organisation's long-term survival and performance, not only this year's results; for example avoid accumulating technical debt or lock-in that will cripple the organisation later.

Figure 2 – The eleven principles adopted from ISO 37000: purpose comes first, four foundational principles build on it and six enabling principles make them work.

For each principle, clause 5 explains what it implies for governing the use of IT and what outcomes should follow. This three-part pattern is useful when you apply the standard: for any principle you can ask "What does it mean for our technology?" and "How would we see that it is working?".

What happened to the 2015 principles?

Many organisations built their governance arrangements on the six principles of the 2015 edition, so it helps to see how the ideas carry over. The mapping below is an interpretation to help you migrate, not an official table from the standard.

2015 principle	Main idea	Where the idea lives in 2024
Responsibility	People understand and accept their IT responsibilities	Accountability; leadership
Strategy	IT strategy supports business strategy	Strategy; purpose
Acquisition	IT investments are made for valid reasons with clear analysis	Value generation; oversight; risk governance
Performance	IT is fit for purpose and supports the organisation	Value generation; viability and performance over time
Conformance	IT complies with laws, regulations and internal policies	Oversight; risk governance; social responsibility
Human behaviour	IT decisions respect the needs of people affected	Stakeholder engagement; social responsibility; leadership

The model

The model in clause 6 describes the governance practice as four tasks. The governing body engages stakeholders to understand their needs and expectations; it evaluates the current and future use of IT, including proposals from management; it directs by setting or approving objectives, strategies and policies and by assigning responsibility; and it monitors performance and conformance against that direction. The management practice – planning, building, running and improving IT – sits beneath governance and interacts with it continuously. The model is a cycle, not a sequence you complete once: monitoring feeds the next round of evaluation, and stakeholder engagement informs every step.

Figure 3 – The governance model: the governing body engages stakeholders, evaluates, directs and monitors, while management turns direction into projects and operations and reports back.

The framework

Clause 7 describes six elements that an organisation's governance of IT arrangements should contain. They answer the practical question "What do we need to put in place so that the principles and the model actually happen?".

Direction – the statements of intent for the use of IT: purpose, objectives, strategy and the governing body's expectations.
Capability – making sure the organisation has, or can obtain, the people, skills, technology, data and suppliers needed to follow that direction. In practice, many organisations treat the governing body's own understanding of technology as part of this element.
Policy – the rules and boundaries that guide decisions and behaviour, such as an acceptable-use policy, a cloud policy, an information security policy or a policy on the use of AI.
Delegation – who has authority to decide what, with which limits and under which conditions, documented for example in a delegation-of-authority schedule or committee charters.
Performance – how the organisation measures whether its use of IT delivers what was intended, with targets, indicators and regular reports.
Accountability – how people answer for their decisions and results, through reporting, assurance and consequences, closing the loop to the governing body.

Figure 4 – The six elements of the governance of IT framework form a loop from direction to accountability and back.

Lesson 4 – How it works in practice

Roles

Because ISO/IEC 38500 is principle-based, it does not prescribe an organisation chart. In practice the following roles usually appear:

The governing body owns the governance of IT, approves the IT-related strategy, risk appetite and major investments, and receives regular reports. Many boards create a technology or digital committee, or extend the remit of the audit and risk committee, to look at technology in more depth.
The chief executive and executive team are the main recipients of delegated authority. They translate direction into plans and are answerable for results.
The chief information officer (or chief technology, digital, data or information security officer) leads the management of IT and is often the main bridge between the governing body and technical teams.
Business owners are accountable for the benefits of the systems and investments they sponsor. Governance of IT is not only a matter for the IT function.
Internal audit and other assurance providers give the governing body independent confidence that controls work and that reports are reliable.
All staff participate, because governance happens throughout the organisation: a developer choosing a cloud service or a manager subscribing to a software tool is applying, or ignoring, governance direction.

Typical artefacts

Organisations that apply the standard usually produce a small set of documents and mechanisms. Their names vary, but their functions map neatly to the framework elements:

Artefact	Framework element it supports	What good looks like
Governance of IT charter or terms of reference	Direction, delegation	States the governing body's role, committee remits and how IT matters reach the board
Digital or IT strategy linked to organisational strategy	Direction	Shows how technology serves the purpose; reviewed at least annually
Delegation-of-authority schedule	Delegation	Thresholds for investment, contracts and risk acceptance, with escalation rules
Policy set (security, data, cloud, AI, acceptable use)	Policy	Short, owned, approved at the right level, reviewed on a cycle
Investment and benefits criteria	Performance, accountability	Common business-case format, benefits owners and post-implementation reviews
Risk appetite statements for IT and cyber risk	Direction, policy	Clear limits that management can apply without asking the board each time
Board technology dashboard	Performance, accountability	A few meaningful indicators with trends, exceptions and actions
Skills and capacity plan, including board education	Capability	Identifies gaps in technical, data and governance skills and how to close them

Implementation steps

The standard itself does not contain an implementation method; the ISO/IEC 38500 family includes separate implementation guidance for that purpose. A practical approach that is consistent with the principles looks like this:

Secure governing body sponsorship. Governance of IT is the governing body's responsibility. Begin with a session in which the board discusses why technology matters to its purpose and what it currently does and does not see.
Understand the current state. Map how technology decisions are actually made today: who approves investments, how risks are escalated, what the board receives, where shadow IT exists. Use interviews, documents and recent decisions as evidence.
Engage stakeholders. Ask customers, regulators, staff and partners what they expect from the organisation's use of technology, and record those expectations.
Agree direction. Confirm or refresh the purpose and strategy, and state the governing body's expectations for IT: value, risk appetite, ethical boundaries and priorities.
Design the framework. Define delegations, committee remits, key policies, capability needs, performance measures and reporting lines, using the six framework elements as a checklist.
Put it into operation. Communicate the arrangements, train decision-makers, and start the regular cycle of evaluation, direction and monitoring.
Monitor and improve. Review how well governance itself works, through self-assessment or independent assessment, and adjust.

Applying the model to one decision

Imagine management proposes moving the organisation's core systems to a public cloud provider. Under the model, the governing body first considers which stakeholders are affected – customers, regulators, staff whose jobs change – and what they expect. It then evaluates the proposal against purpose and strategy, the business case, the risks (supplier dependence, data location, resilience, skills) and the alternatives. It directs by approving, rejecting or approving with conditions: for example requiring an exit plan, a data residency policy and staged delivery with checkpoints. It delegates execution to management within stated limits. Finally it monitors progress, costs, risk indicators and benefits, and returns to evaluation if things change. Notice that the governing body never chooses instance types or migration tools – that is management's job – yet it shapes the decision decisively.

Making the model routine

Governance of IT works best when it becomes part of the normal rhythm of the organisation rather than a special exercise. Common practices include a standing technology item on the board agenda, an annual strategy session that explicitly covers technology, a forward plan of deep dives (for example cyber resilience in one quarter, data and AI in the next), clear criteria for which investments come to the board, and an annual review of the governance arrangements themselves.

Lesson 5 – Assessment, certification and compliance

A guidance standard, not a certification standard

ISO/IEC 38500 is a guidance document. Its recommendations are written with "should", and it intentionally leaves implementation to each organisation. That has an important consequence: there is no accredited certification of organisations against ISO/IEC 38500 comparable to ISO/IEC 27001 or ISO 9001 certification, where an accredited certification body audits a management system against "shall" requirements and issues a certificate. If a supplier claims to be "ISO/IEC 38500 certified" as an organisation, ask exactly what was assessed, by whom and against which criteria; at best it will be a voluntary assessment or attestation, not an accredited certificate.

Being a guidance standard does not make the standard weak. Many organisations use it as the reference point for their governance of IT arrangements, and auditors and consultants often use it as a reference point when they review how technology is governed. Its strength is that it describes outcomes and behaviour, which can be assessed in other ways.

Assessing governance of IT with ISO/IEC 38503

The ISO/IEC 38500 family includes ISO/IEC 38503:2022, which gives guidance on assessing the governance of IT. It builds on the principles, definitions and model of ISO/IEC 38500 and covers approaches to carrying out an assessment, the criteria to use, guidance on suitable evidence, and a method for determining the maturity of an organisation's governance of IT. Note that ISO/IEC 38503 was written against the earlier edition of the principles; when you use it with the 2024 edition, map its criteria to the eleven principles and the framework elements.

Assessments are typically carried out in three ways:

Self-assessment by the governing body and executives, often with a questionnaire built on the principles and framework elements. It is quick and builds ownership, but it tends to be optimistic.
Internal audit reviews, which test whether governance arrangements exist and work in practice, using documents, minutes, decisions and interviews as evidence.
Independent external review by consultants or auditors, useful before a major transformation or after a serious incident, and valued by regulators and investors.

What counts as evidence

Because the standard is about behaviour, good evidence shows decisions being made and checked, not only documents existing. Useful evidence includes board and committee minutes showing that technology proposals were evaluated against criteria; approved strategies and policies with owners and review dates; delegation schedules and examples of escalations; dashboards that the board actually received and acted on; post-implementation reviews comparing promised and achieved benefits; and records of stakeholder consultation. Weak evidence includes policies nobody has read, charters that were approved but never used, and reports that list activity without saying whether outcomes were achieved.

Typical assessment questions

An assessor working with the 2024 edition might ask, for example: Can the governing body explain how the main technology investments serve the organisation's purpose? Is there an agreed appetite for cyber and supplier risk, and does management use it? Are delegations for technology decisions documented and followed? Does the board receive information about benefits and risks, not only project status? Has the organisation considered the social and environmental effects of its technology? Who is accountable for the results of the last major programme, and what happened when it overran?

Certification of individuals

While organisations cannot be certified against ISO/IEC 38500, individuals can earn training credentials. For example, PECB offers three ISO/IEC 38500 training courses – Foundation, IT Corporate Governance Manager and Lead IT Corporate Governance Manager – each with an exam and a personal credential, delivered through its training partners. These credentials show that a person has studied the standard and passed an exam; they say nothing about whether any particular organisation governs IT well.

Compliance context

ISO/IEC 38500 is not a law, but it often helps organisations meet legal and regulatory expectations. Corporate governance codes, financial-sector regulators and public-sector rules increasingly expect boards to oversee technology and cyber risk. The standard gives a structured, internationally recognised way to show that oversight. It complements rather than replaces specific obligations such as data protection law or sector-specific operational resilience rules.

Lesson 6 – Worked example

To see how the pieces fit together, follow a fictional but realistic organisation through its first year of applying ISO/IEC 38500:2024.

The organisation

Northbridge Mutual is a regional health insurer with about 1,800 employees and 600,000 members. It is governed by a board of nine non-executive directors and the chief executive. Over three years it has suffered a claims-platform replacement that ran 18 months late and 40 % over budget, a ransomware attack on a supplier that stopped claims processing for four days, and a growing number of software subscriptions bought directly by departments. Now the claims team wants to use a machine-learning model to triage claims. The new chair asks: "Are we actually governing our technology, or is it governing us?"

Step 1 – Purpose and stakeholders

The board holds a strategy day dedicated to technology. It restates the purpose: affordable, fair and reliable health cover for members in the region. Directors then engage stakeholders: a member panel says speed and fairness of claims decisions matter most and that members worry about automated decisions; the regulator expects operational resilience and clear accountability for outsourced services; staff fear the AI model will replace them. These expectations are recorded and become inputs to every later decision.

Step 2 – Evaluate the current state

Internal audit maps how technology decisions are really made. It finds that the board saw the claims-platform programme only twice, both times as a status report with no benefits information; that there is no stated appetite for cyber or supplier risk; that 140 software subscriptions are paid by departments without IT or security review; and that no director has a technology background. The board recognises weaknesses against several principles: oversight, accountability, risk governance, data and decisions, and leadership.

Step 3 – Direct

The board approves a short governance of IT charter. It sets direction: technology must serve the purpose, with member fairness and resilience as non-negotiable. It approves an IT and cyber risk appetite statement (for example, no single supplier failure may stop claims for more than one working day). It asks management to produce a digital strategy linked to the corporate strategy within six months, and it approves three policies: cloud and software acquisition, data and AI use, and information security.

Step 4 – Build the framework

Using the six framework elements as a checklist, the board and executives design the arrangements:

Framework element	What Northbridge put in place
Direction	Charter, purpose statement for technology, risk appetite, digital strategy
Capability	A new director with technology experience; board training on cyber and AI; a skills plan for data science and supplier management
Policy	Cloud and software acquisition policy, data and AI use policy, information security policy
Delegation	Executive may approve technology investments up to a set threshold; anything above it, or any new use of AI in member decisions, goes to the board's new technology and risk committee
Performance	A one-page quarterly dashboard: benefits delivered, top technology risks against appetite, supplier resilience, member complaints about digital services
Accountability	Named business owners for each major investment; post-implementation reviews reported to the committee; internal audit review of governance each year

Step 5 – A real decision: the AI claims triage model

The claims director brings the AI proposal to the technology and risk committee, as the delegation rules require. The committee evaluates it against purpose (faster decisions for members), value (lower handling cost, faster payments), risk governance (bias, errors, regulatory exposure), data and decisions (quality and provenance of training data), stakeholder engagement (member and staff concerns) and social responsibility (fairness to vulnerable members). It directs a conditional approval: the model may recommend but not refuse claims; every recommendation to decline goes to a human assessor; the model is tested for unequal outcomes across member groups before launch and quarterly afterwards; members are told when automation is used; and staff are retrained rather than made redundant during the pilot. The committee sets indicators and a review date.

Step 6 – Monitor and learn

Six months later the dashboard shows that claims are paid faster, but one indicator is red: the model sends a higher share of claims from one rural area to manual review. The committee asks management to investigate; the cause is poorer data quality from a local clinic network. Management fixes the data feed and adjusts the model. The committee also notices that department-bought subscriptions have fallen from 140 to 60 under the new acquisition policy, and that a supplier continuity test met the one-day limit. These results are reported to the full board, which updates its assessment of governance.

What the example shows

Northbridge did not buy a tool or hire a large team. It changed who decides what, on what basis, and how results come back. The board never selected an algorithm or a cloud region; it set purpose, limits and expectations, and it insisted on evidence. That is governance of IT as ISO/IEC 38500 intends: principles turned into everyday decision-making.

Figure 5 – Northbridge's AI decision path: delegation rules route the proposal to the committee, which directs conditions and monitors results.

Lesson 7 – Relationship to other standards and frameworks

ISO/IEC 38500 is deliberately short and high-level, so it is almost always used together with other standards. Understanding the relationships helps you avoid duplication and gaps.

The ISO/IEC 38500 family

SC 40 maintains a family of documents that apply or support ISO/IEC 38500. They include implementation guidance (ISO/IEC TS 38501), the framework and model report (ISO/IEC TR 38502, whose framework has now been incorporated into the 2024 edition), guidance on assessing governance of IT (ISO/IEC 38503), guidance on principles-based standards (ISO/IEC TR 38504), documents on the governance of data (ISO/IEC 38505 parts), the governance of IT-enabled investments (ISO/IEC 38506) and the governance implications of using artificial intelligence (ISO/IEC 38507). Several were written against the 2015 edition and some are being revised (for example ISO/IEC TS 38501), so always check the latest edition in the ISO catalogue.

Comparison with related standards and frameworks

Standard or framework	Main focus	Relationship to ISO/IEC 38500
ISO 37000 – Governance of organizations	Principles for governing any organisation as a whole	Parent document: ISO/IEC 38500:2024 adopts its eleven principles and applies them to IT
COBIT (ISACA)	Detailed framework for governance and management of enterprise information and technology, with objectives and capability assessment	Operationalises the same evaluate-direct-monitor idea in far more detail; often used to implement ISO/IEC 38500 principles
ITIL 4 and ISO/IEC 20000-1	IT service management practices and a certifiable service management system	Management-level standards that deliver services under the direction governance sets
ISO/IEC 27001 and ISO/IEC 27014	Certifiable information security management system; governance of information security	Security-specific management and governance; supports the risk governance and oversight principles
ISO 31000	Risk management guidelines	Provides the risk management process that risk governance oversees
ISO/IEC 42001	Certifiable management system for artificial intelligence	Management system for AI; ISO/IEC 38507 covers the governing body's view of AI
ISO/IEC 38505-1	Governance of data	Applies ISO/IEC 38500 to data, supporting the data and decisions principle

Governance standards versus management system standards

A helpful way to place these documents is to ask who they speak to. ISO 37000 and ISO/IEC 38500 speak to the governing body: they describe principles and oversight. Management system standards such as ISO/IEC 27001, ISO/IEC 20000-1 and ISO/IEC 42001 speak to management: they contain requirements for planning, operating, checking and improving a specific area, and they can be certified. Frameworks such as COBIT and ITIL sit between: they provide detailed practices that organisations tailor. A mature organisation uses ISO/IEC 38500 to decide what it wants from technology and how it will oversee it, and uses the management standards and frameworks to deliver and evidence it.

Using them together without duplication

Organisations sometimes create separate committees, policies and reports for each standard. A better approach is to let the governance of IT framework be the umbrella: one direction, one set of delegations, one board dashboard, with security, service management, data and AI management systems reporting into it. This keeps the governing body's view coherent and avoids conflicting instructions to management.

Common pitfalls and best practices

Common pitfalls

Treating governance of IT as an IT department project. If the CIO "implements ISO/IEC 38500" without the governing body's active participation, the result is management documentation, not governance.
Boards micromanaging technology. Directors who debate product choices or project tasks crowd out management and neglect their real job of setting direction and checking outcomes.
Rubber-stamping. Approving large technology investments on the strength of a presentation, with no criteria, alternatives or benefits plan, is the opposite of evaluation.
Delegating accountability along with the work. Outsourcing a service or delegating a decision does not move accountability away from the governing body.
Reports about activity rather than outcomes. Dashboards full of project percentages and ticket counts hide whether value is created and whether risks are within appetite.
Ignoring technology bought outside IT. Software and cloud services acquired by business units often carry the biggest unmanaged risks.
Claiming organisational "certification". Presenting a training certificate or a consultant's review as ISO/IEC 38500 certification misleads stakeholders.
Forgetting acceptability. Focusing only on cost and performance while ignoring privacy, fairness and environmental effects.

Best practices

Start with purpose. Link every major technology decision explicitly to the organisation's purpose and strategy.
Write down delegations. A clear delegation-of-authority schedule with thresholds and escalation rules makes decisions faster and safer.
Set a risk appetite for technology. Concrete limits for cyber, supplier and data risk let management act without constant escalation.
Build board capability. Regular education, external advisers or a director with technology experience give the governing body the knowledge to evaluate proposals.
Measure benefits, not just delivery. Assign business owners and review whether promised benefits arrive after go-live.
Engage stakeholders early. Ask affected groups before decisions are made, especially for automation and data use.
Use one integrated framework. Bring security, service, data and AI governance under one direction and one board view.
Assess governance itself. Review the arrangements periodically, using ISO/IEC 38503 guidance or internal audit, and improve them.

Summary and key takeaways

ISO/IEC 38500:2024 is the current, third edition of the international guidance standard for governing bodies on the governance of IT; it replaced the 2015 edition.
Governance sets direction, limits and oversight; management plans, builds and runs IT within them. Keeping that distinction is the heart of the standard.
The 2024 edition aligns with ISO 37000 and adopts its eleven principles: purpose; value generation, strategy, oversight and accountability; and six enabling principles.
Good governance of IT aims at three outcomes: effective performance, responsible stewardship and ethical behaviour.
The model is a continuing cycle of engaging stakeholders, evaluating, directing and monitoring, interacting with the management of IT.
The framework's six elements – direction, capability, policy, delegation, performance and accountability – turn principles into working arrangements.
There is no accredited organisational certification; governance of IT is assessed through self-assessment, internal audit or independent review, with ISO/IEC 38503 as guidance.
ISO/IEC 38500 works as an umbrella over detailed frameworks and management system standards such as COBIT, ITIL, ISO/IEC 20000-1, ISO/IEC 27001 and ISO/IEC 42001.

Reflection questions

Think of the last large technology decision in your organisation. Which parts were governance and which were management, and were they made at the right level?
Which of the eleven principles do you think your organisation applies least well to its use of IT, and what evidence supports your view?
If your governing body had to state an appetite for supplier and cyber risk in two sentences, what would they say, and how would management use them?
Which stakeholders are most affected by your organisation's use of data or automation, and how are their expectations currently heard?
Design a one-page board technology dashboard for your organisation: which five indicators would show value, risk and accountability rather than activity?