ISO/IEC 38500: IT Governance Principles for Boards and Leaders

ISO/IEC 38500 is the international standard for the governance of information technology. Unlike most IT standards, it is written for the governing body, such as the board of directors, rather than for IT managers. It explains how boards should direct and oversee the organisation's use of technology and data, and hold management accountable, so that IT creates value, supports strategy and is used responsibly.

The third edition, ISO/IEC 38500:2024, aligned the standard with ISO 37000, the international standard on governance of organisations. It adopts ISO 37000's governance outcomes and principles and shows how to apply them to IT, with more attention to data, environmental and social issues. This guide explains what governance of IT means, the principles, the model, board responsibilities, and how ISO/IEC 38500 fits with COBIT, ITIL and management system standards.

What is ISO/IEC 38500?

ISO/IEC 38500 provides principles, definitions and a model for governing bodies to use when evaluating, directing and monitoring the use of IT in their organisations. It is developed by ISO/IEC JTC 1/SC 40, the committee that also maintains ISO/IEC 20000 for service management. The first edition was published in 2008, based on the Australian standard AS 8015, followed by a 2015 edition and the 2024 revision.

The standard applies to all organisations, public and private, of any size, and to all IT, whether developed internally, bought or provided as a service. It is guidance, not a set of auditable requirements, so organisations cannot be certified against it.

Governance versus management

A central idea of ISO/IEC 38500 is the distinction between governance and management. Governance is the system by which the organisation is directed, overseen and held accountable for achieving its purpose; it is the job of the governing body. Management is the planning, building, running and monitoring of activities to achieve objectives within the direction set by governance; it is the job of executives and managers. Boards should not run IT projects, but they should decide what the organisation wants from IT, set policies and risk appetite, ensure resources and accountability, and monitor whether outcomes are achieved. The 2024 edition updates the model that shows this relationship.

What changed in the 2024 edition?

According to the ISO committee responsible:

• IT governance is treated as part of organisational governance, aligned with ISO 37000:2021.
• The standard adopts ISO 37000's three governance outcomes: effective performance, responsible stewardship and ethical behaviour.
• The six principles of the 2015 edition are replaced by eleven principles taken from ISO 37000, with guidance on applying each to IT.
• The focus extends to data use, and to environmental and social issues related to technology.
• The model of how governance and management relate has been updated, and a governance framework, first described in ISO/IEC 38502, is included in expanded form.

Related standards in the series, such as ISO/IEC 38501 on implementation and ISO/IEC 38505-1 on governance of data, were scheduled for revision to match.

Governance outcomes

Outcome	What it means for IT
Effective performance	IT enables the organisation to achieve its purpose and strategy efficiently.
Responsible stewardship	IT, data and related resources are used and protected responsibly for stakeholders and future needs.
Ethical behaviour	Technology and data are used in line with the organisation's values and ethical expectations.

The principles applied to IT

ISO 37000 sets out eleven governance principles, which ISO/IEC 38500:2024 applies to technology and data:

1. Purpose: IT decisions serve the organisation's purpose.
2. Value generation: IT creates value for the organisation and stakeholders.
3. Strategy: IT is integrated into and supports organisational strategy.
4. Oversight: the governing body oversees IT performance and conformance.
5. Accountability: responsibilities for IT decisions and outcomes are clear and enforced.
6. Stakeholder engagement: the views of users, customers and others affected by IT are considered.
7. Leadership: leaders set the tone for responsible use of technology.
8. Data and decisions: data is treated as a strategic asset and used well in decision making.
9. Risk governance: IT-related risks and opportunities are governed within risk appetite.
10. Social responsibility: IT use considers societal and environmental impacts.
11. Viability and performance over time: IT choices sustain the organisation in the long term.

The 2015 edition's six principles, responsibility, strategy, acquisition, performance, conformance and human behaviour, remain useful prompts and map into the new set.

Board responsibilities in practice

Applying the standard, a governing body would typically:

• Approve a technology and data strategy aligned with organisational strategy.
• Set risk appetite for cybersecurity, privacy, availability and technology change.
• Approve major investments and require business cases with clear benefits and risks.
• Ensure accountable executives exist for technology, security and data.
• Require regular reporting on project portfolios, service performance, incidents, risks and compliance.
• Oversee ethical use of data and AI, and environmental impacts such as energy use.
• Commission independent assurance, such as internal audit, on IT governance and controls.

Questions boards should ask about technology

The principles become practical when turned into questions the board regularly asks management:

• How does our technology and data strategy support our purpose and strategy, and what would change if it failed?
• Which technology investments are under way, what value are they delivering, and are they on track?
• What are our most significant technology and cyber risks, are they within our appetite, and what is being done about those that are not?
• How dependent are we on key suppliers and cloud providers, and what is our exit plan?
• How are we using data and AI, and how do we know this use is lawful, fair and consistent with our values?
• What are the environmental and social impacts of our technology choices?
• Who is accountable for each of these areas, and how do we get independent assurance?

The ISO/IEC 38500 family

ISO/IEC 38500 is supported by a family of related documents from the same committee:

• ISO/IEC 38501: guidance on implementing governance of IT.
• ISO/IEC 38502: framework and model for governance of IT.
• ISO/IEC 38503: assessment of governance of IT.
• ISO/IEC 38505-1: application of ISO/IEC 38500 to the governance of data.
• ISO/IEC 38506: governance of IT-enabled investments.
• ISO/IEC 38507: governance implications of the use of artificial intelligence by organisations.

ISO/IEC 38507 is especially relevant now. It helps governing bodies understand the opportunities and risks of AI, set policies and boundaries for its use, and maintain accountability when decisions are supported or made by AI systems. It works alongside ISO/IEC 42001, which defines a certifiable AI management system for management to operate.

Governance of outsourced and cloud IT

Many organisations now buy most of their technology as services. This does not reduce the board's responsibility; it changes what governance looks like. Boards should make sure there are policies for selecting and overseeing critical suppliers, contracts that provide transparency, audit rights and exit options, reporting on supplier performance and incidents, and plans for concentration risk where many services depend on one provider. Regulations such as the EU's DORA for financial entities and India's RBI technology directions make this oversight explicit for regulated sectors, but the principle applies to every organisation.

Is it mandatory or voluntary?

Voluntary. Some governments and corporate governance codes reference it as good practice, and auditors may use it as a benchmark for IT governance. It is not certifiable.

Designing useful board reporting

Good IT governance depends on the quality of information the board receives. Reports should be short, regular and focused on decisions, not on technical detail. A useful quarterly pack might include progress of major technology initiatives against plan and budget, benefits realised, service availability and significant incidents, cybersecurity posture and key risks against appetite, data protection matters, supplier issues, and decisions the board needs to take. Trends matter more than single numbers. Each item should have an accountable executive. Independent views, such as internal audit findings or external reviews, help the board test what management reports.

Evaluate, direct and monitor

The 2015 edition described governance as three main tasks, which remain a helpful way to organise board activity. Evaluate: examine current and future use of IT, including proposals and plans. Direct: assign responsibility for and direct preparation and implementation of plans and policies, so that IT meets business needs. Monitor: oversee conformance with policies and performance against plans. The 2024 edition updates the model of how governance and management interact, but boards will recognise these activities in any effective approach.

How it relates to COBIT and ITIL

Framework	Focus	Relationship to ISO/IEC 38500
ISO/IEC 38500	Principles for governing bodies	Sets what boards should do
COBIT	Governance and management objectives for enterprise IT	Provides detailed objectives, processes and metrics to implement governance
ITIL	IT service management practices	Management-level practices for delivering services
ISO/IEC 20000-1	Certifiable service management system	Management system that governance oversees
ISO/IEC 27001	Information security management system	Security management that the board directs and monitors

A common combination is ISO/IEC 38500 for board-level principles, COBIT for detailed governance and management objectives, and ITIL or ISO/IEC 20000-1 for service management.

How to apply it, step by step

1. Brief the board on the standard's principles and the governance-management distinction.
2. Assess current IT governance against the principles, identifying gaps in strategy, accountability, oversight and reporting.
3. Define governance arrangements: board or committee responsibilities for technology, delegations to executives, and decision rights.
4. Agree a technology and data strategy and risk appetite.
5. Set up reporting that gives the board meaningful information on value, risk and performance.
6. Integrate with existing frameworks such as COBIT, ISO 31000 and ISO/IEC 27001.
7. Review periodically and commission independent assurance.

Documentation you will need

• IT governance policy or charter.
• Board or committee terms of reference covering technology.
• Technology and data strategy.
• Risk appetite statements for technology risks.
• Investment decision criteria and business cases.
• Board reporting packs on IT performance and risk.
• Assurance and review reports.

Timeline and cost considerations

Applying ISO/IEC 38500 is mainly a matter of leadership time rather than tools. A governance review and new arrangements can be completed in a few months. Some organisations engage an independent adviser to facilitate the first review and board workshop, then run later reviews internally. Costs are low compared with management system implementations, but benefits depend on the board's commitment to act on what it learns.

Benefits and limitations

• Benefits: a recognised, concise basis for board oversight of technology; consistency with wider governance through ISO 37000; better alignment of IT investment with strategy; clearer accountability.
• Limitations: high-level and principle-based, so it needs frameworks such as COBIT for detail; not certifiable; effectiveness depends on board engagement.

Common mistakes

• Delegating all IT matters to the CIO without board oversight.
• Board reports full of technical metrics but little on value and risk.
• No clear decision rights for major technology investments.
• Treating cybersecurity as only an IT issue rather than an organisational risk.
• Ignoring data and AI ethics in governance discussions.

Best practices for technology companies

• Create a board technology or risk committee with technology expertise.
• Report a small set of indicators: delivery against roadmap, availability, security incidents, technical debt and key risks.
• Document major architecture decisions with options, risks and rationale.
• Review AI and data use against ethical principles and regulation.
• Commission periodic independent reviews of security and delivery.

We run software projects with documented architecture decisions, measurable delivery and transparent reporting that support board-level oversight, through our custom software development and modernisation services.

Real-world example

A mid-sized Indian SaaS company preparing for institutional investment uses ISO/IEC 38500 to formalise IT governance. The board sets up a technology and risk committee with an independent director who has technology experience, approves a three-year technology strategy and cyber risk appetite, and requires quarterly reports on product delivery, uptime, security incidents, data protection and major architecture decisions. Management uses COBIT objectives to organise detailed controls, and internal audit reviews the arrangements annually.

Next steps

1. Brief the board on governance of IT.
2. Assess current arrangements against the principles.
3. Clarify decision rights and accountability.
4. Improve board reporting.
5. Link to COBIT and risk management.

Frequently asked questions

What is ISO/IEC 38500?

The international standard providing principles and guidance for governing bodies on the governance of IT.

What is the current version?

ISO/IEC 38500:2024, the third edition, which replaced the 2015 edition.

Is ISO 38500 certifiable?

No. It provides principles and guidance, not certifiable requirements.

Who is ISO 38500 for?

Primarily boards and governing bodies, as well as executives and advisers who support them.

What changed in the 2024 edition?

It aligned with ISO 37000, adopted its three outcomes and eleven principles, and extended focus to data, environmental and social issues.

What is the difference between ISO 38500 and COBIT?

ISO 38500 sets high-level principles for boards; COBIT provides detailed governance and management objectives to implement them.

What is the difference between governance and management of IT?

Governance directs, oversees and holds accountable; management plans, builds, runs and monitors within that direction.

Does ISO 38500 cover data governance?

The 2024 edition gives more attention to data, and ISO/IEC 38505-1 covers governance of data specifically.

Can small organisations use it?

Yes. The principles apply to any organisation, and small boards can adopt them proportionately, for example with a short technology section in each board meeting rather than a separate committee.

What was in the 2015 edition?

Six principles, responsibility, strategy, acquisition, performance, conformance and human behaviour, with an evaluate, direct and monitor model.

Is there an ISO standard for governing AI?

Yes. ISO/IEC 38507 covers the governance implications of AI for governing bodies, alongside ISO/IEC 42001 for AI management systems.

Does ISO 38500 apply when IT is outsourced?

Yes. Governing bodies remain accountable for outsourced and cloud IT and should oversee suppliers, contracts, risks and exit plans.