ISO/IEC TR TECHNICAL REPORT 38502 Second edition 2017-12 Information technology-Governance of IT--Framework and model Technologies de I'information-Gouvernance des TI-Cadre géneral et modele Reference number E ISO/IEC TR 38502:2017(E) ISO/IEC2017 ISO/IEC TR 38502:2017(E) COPYRIGHT PROTECTED DOCUMENT O ISO/IEC2017,Published in Switzerland Allrights reserved.Unless otherwise specified,no part of this publication may be reproduced or utilized otherwise in any form or by any means,electronic or mechanical,including photocopying,or posting on the internet or an intranet,without prior written permission.Permission can be requested from either ISO at the addressbelow or ISO's member body in the country of the requester. ISO copyright office Ch.de Blandonnet 8.CP 401 CH-1214Vernier,Geneva,Switzerland Tel.+41227490111 Fax+41227490947 [email protected] www.iso.org ii @ISO/IEC2017-All rights reserved ISO/IEC TR 38502:2017(E) Contents Page Foreword Introduction 1 Scope 2 Normative references 3 Terms and definitions 4 Model and framework 4.1 Model for governance of IT 4.1.1 Governing body responsibilities and accountabilities 4.1.2 Governance tasks 4.1.3 Managers 'responsibilities and accountabilities 4.1.4 Applicability of the model ... 4.2 Relationship between governance and management of IT 4.3 Key elements of a governance framework for IT 5 Guidance on the application of the model 5.1 Responsibilities of the governing body 5.1.1 General 5.1.2 Governing body and oversight mechanisms 5.2 Strategy formulation and oversight 5.2.1 General .... 5.2.2 The governing body' s role in strategyformulation 5.3 Delegation 5.3.1 General .. 5.3.2 Delegation by the governingbody 5.4 Responsibilities of managers General 5.4.1 5.4.2 The role of managers 5.5 Governance and internal control 5.5.1 General 5.5.2 Establishing internal control Annex A(informative )Principles of good governance of IT Bibliography ISO/IEC2017- Allrightsreserved