IT governance guide · practical operating model

Governance is who decides, with what evidence, and when.

Ce guide est aussi tenu en français. Gouvernance TI →

Smaller organizations rarely need another committee chart. They need a repeatable way to assign authority, document exceptions, oversee providers, and bring material technology decisions back to leadership.

The decision to enable

Create enough governance to keep decisions accountable without turning routine work into bureaucracy.

Name decision rights before assigning tasks

Execution can be delegated; accountability for risk, spend, access, and business interruption cannot disappear into a provider queue. State which decisions remain with leadership, which belong to an internal owner, and which a supplier may make within agreed boundaries.

Use evidence appropriate to the decision

A renewal may need utilization and contractual facts. An access change needs authorization and verification. A roadmap choice needs dependencies and capacity. Define the minimum evidence for each recurring decision instead of requesting every possible report.

Source and accountable owner
Date or condition under which evidence expires
Open question that prevents approval

Treat exceptions as decisions

When the normal process cannot be followed, record who accepted the exception, why, what compensating action exists, and when it ends. An exception without an owner or expiry quietly becomes the operating model.

Keep leadership review short and consequential

A useful review focuses on decisions due, changed assumptions, unresolved ownership, material exceptions, and roadmap movement. Technical activity belongs only where it changes a leadership choice.

Decision frame

What leadership should be able to verify.

These criteria do not produce a score. They expose the questions that need resolution before a responsible decision.

CriterionUseful signalLeadership question

AuthorityDecision rights and delegation limits are explicit.Who has the authority to approve this outcome?

EvidenceThe source, owner, freshness, and uncertainty are visible.What evidence is sufficient—and what is still inference?

ExceptionDeviation has an owner, reason, control, and expiry.When does this exception return for review?

OversightSupplier performance is connected to owned obligations.Which internal owner accepts or challenges the result?

Practical scenarios

The same discipline applied to different decisions.

Provider requests broad administrative access

Situation: The access may speed delivery but exceeds the current operating boundary.

Useful response: Name the approving authority, purpose, duration, verification, and removal condition before granting.

Boundary: This governance frame does not prescribe a universal technical privilege model.

Project stalls between operations and IT

Situation: Both teams contribute, but neither owns the cross-functional decision.

Useful response: Name one decision owner, identify contributors, define the missing evidence, and set the next review point.

Boundary: Governance clarifies accountability; it does not create unavailable delivery capacity.