Understanding IT governance and management
The Global Internal Audit Standards, also published by the IIA, define governance as the combination of processes and structures the board uses to inform, direct, manage and monitor activities toward achieving objectives. Within this framework, IT governance refers specifically to the oversight of technology, ensuring that IT aligns with strategy, mitigates risks and delivers value.
As a subset of organisational governance, IT governance encompasses structures, policies and processes that ensure IT aligns with and supports strategic goals. It is the board’s responsibility to establish IT objectives, define strategies and oversee risk management, performance, and resource allocation. Key governance areas include strategic alignment, risk oversight, value delivery, performance monitoring and resource oversight.
By contrast, ISACA defines management as the “planning, building, running and monitoring of activities” aligned with governance direction. IT management is more tactical, focusing on service delivery, project execution and daily risk management.
IT management is led by senior executives and involves the tactical execution of IT strategies through daily operations, resource coordination, risk mitigation and performance tracking. It ensures that IT services are delivered effectively and efficiently to meet operational needs.
Together, IT governance and management address challenges such as increasing IT complexity, data dependency, cyber threats, regulatory compliance and the adoption of emerging technologies like artificial intelligence. Their effective implementation enhances organisational resilience, competitiveness and decision-making.
The internal audit function: A strategic enabler
Internal audit serves as the third line in the IIA’s Three Lines Model, providing independent assurance that governance, risk management and control processes are effective. In the context of IT governance and management, internal audit plays a pivotal role in evaluating whether IT supports organisational strategies and objectives.
Internal audit can be a powerful ally in navigating the complexities of IT environments. It helps ensure that IT investments deliver value, risks are proactively managed, and performance metrics are meaningful and actionable. Internal auditors assess whether roles, responsibilities, and accountabilities are clearly defined, and whether the “tone at the top” is effectively communicated throughout the organisation.
From our experience, recurring challenges in IT governance often arise from resource and capability gaps. Insufficient budget allocations can limit the effectiveness of IT initiatives, while Boards without members possessing sufficient IT expertise may struggle to provide meaningful challenge to IT management. In addition, the absence of clear policies and procedures, or the presence of blurred reporting lines, can undermine accountability and oversight. These issues emphasise the need for internal audit to bring independent insight and support organisations in building stronger IT governance practices.
Internal audit engagements, whether assurance or advisory can be tailored to your organisation’s maturity level. Assurance engagements assess the implementation of governance and management practices, while advisory services provide guidance on design and effectiveness, particularly in organisations with immature IT structures.
Internal audit adds value by identifying root causes of issues and collaborating with management to develop constructive solutions. By providing independent assurance and advisory services, internal auditors help ensure IT is not only secure and compliant but also strategically aligned. Internal audit adds value by:
Highlighting governance gaps before they become crises.
Ensuring risk and performance information flows reliably to the Board.
Linking technical issues to business impact.
Facilitating conversations between IT and business leadership.
Supporting innovation by ensuring risk management and governance keep pace with change.
Conclusion
The GTAG on Auditing IT Governance and IT Management underscores the strategic importance of internal audit in today’s digital landscape. By applying its principles, internal auditors can ensure that IT functions not only support but also enhance organisational objectives. Their role extends beyond compliance, contributing to innovation, resilience and sustained success.
