ISO-38500 has received unanimous support from the International Standards Organisation, with every country that voted approving the standard for fast-track acceptance.
Mark Toomey, founder and managing director of Infonomics, told the IT Service Management Forum Australia last week that while it could be many years before ISO-38500 accreditation is possible, organisations looking for certification should begin planning for compliance now.
ISO-38500 is an IT Governance model. Toomey wrote the book on the standard, in more ways than one.
He was responsible for the wordsmithing on the final version of the standard, and is now writing an actual book about the standard, which he plans to self-publish.
According to Toomey, referring to the standard as an IT Governance model can be misleading because of the tendency within the IT sector to transpose the terms 'management' and 'Governance'.
"Almost everything that is touted today as IT Governance by the industry is actually just plain old IT management," he said. "Governance and management are fundamentally different things."
Essentially, the message of the standard is that IT should be the responsibility of the entire executive management team, not just the CIO.
The model states that an organisation's Governing body should be responsible for evaluating IT proposals, providing directions for improved IT policies, and monitoring ongoing projects.
"That might be read as saying that the directors have to do an awful lot of work that we would normally expect managers to do," Toomey said.
That's not the case at all, he said, explaining that the intent is for directors to provide managers with a set of IT principles - and maintain final approval rights - but the managers will still be doing the work.
When IT projects fail it can lead to disastrous results for an organisation – a lesson British Gas learned the hard way when a failed billing system project resulted in the loss of a million customers and required the temporary hiring of 2,500 new staff. And that's just one of the many recent high-profile examples.
So it's in Directors' interests to comply with ISO-38500.
According to Toomey it will be at least two years before formal ISO-38500 certification is possible – indeed, it could be some time before it's even decided who will be responsible for providing this accreditation.
But directors can begin planning for the process now, starting with asking themselves some tough questions about the state of IT Governance within their organisation.
For example, is there executive-level monitoring of the use, demand for and delivery of IT? Does the IT department deliver rigorous forward-level plans for every proposed IT project? Are clear policies in place to direct how IT is used within an organisation?
Ensuring you can answer yes to all of these questions is a great way to begin the journey towards ISO-38500 compliance, Toomey says.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.