ISO/IEC 38500 is the international standard for the corporate governance of information technology. Written for boards and executive leaders rather than IT teams, it sets out six principles and an evaluate-direct-monitor model that help directors govern the use of IT so technology creates value, controls risk, and meets legal and regulatory obligations.
Most technology standards tell technical teams how to build and run systems. ISO/IEC 38500 does the opposite. It speaks to the people who own accountability for the organisation, giving them a concise framework for asking the right questions about IT without becoming specialists themselves. That focus on the boardroom is what makes it distinct, and it is why the standard sits alongside financial, legal, and operational oversight rather than inside the IT department.
What is ISO/IEC 38500?
ISO/IEC 38500 provides principles, definitions, and a model of governance to guide the governing body of any organisation, regardless of size or sector. It deals with the governance of IT, not its day-to-day management. The distinction matters: governance is about setting direction, assigning accountability, and overseeing outcomes, while management is about planning, building, and running systems to deliver on that direction. By drawing a clear line between the two, the standard ensures decision rights are unambiguous and that boards remain answerable for whether IT actually serves the business.
The standard applies whether IT is delivered by internal teams, cloud platforms, or outsourced providers. Because it is deliberately technology-neutral and non-prescriptive, it has aged well and remains relevant as sourcing models shift. It tells directors what good governance looks like, not which tools to buy or which processes to run.
The Standish Group's 2020 CHAOS research on roughly 50,000 projects found that only about 31% of IT projects were fully successful, while some 19% were cancelled outright and 50% were challenged by cost, time, or scope problems. Weak board-level governance is a recurring theme behind those numbers, which is precisely the gap ISO/IEC 38500 is designed to close.
The six principles of ISO 38500
At the heart of the standard are six principles that express what good governance of IT should achieve. Each principle is a statement of desired behaviour that the governing body should evaluate, direct, and monitor across every significant IT decision.
- Responsibility: individuals and groups understand and accept their duties for both supply of and demand for IT.
- Strategy: business plans account for current and future IT capability, and IT plans satisfy those business needs.
- Acquisition: IT investments are made for valid reasons, with clear analysis, balancing benefits, risks, and cost.
- Performance: IT is fit for purpose, delivering reliable, timely service that supports the organisation's needs.
- Conformance: IT complies with all mandatory legislation, regulations, and internal policies and standards.
- Human behaviour: IT policies and decisions respect the needs of all people involved, including current and future users.
These principles are intentionally broad. A board does not implement them directly; instead it uses them as a lens to interrogate strategy papers, investment cases, service reports, and compliance updates. When every major IT decision can be traced back to one or more of these principles, governance becomes systematic rather than ad hoc.
The Evaluate-Direct-Monitor (EDM) model
ISO/IEC 38500 pairs its principles with a simple governance model built on three continuous activities. Together they form a cycle that keeps directors engaged with IT over time rather than only at budget season.
- Evaluate: assess the current and future use of IT, including strategies, proposals, and supply arrangements against business needs.
- Direct: assign responsibility, prepare and implement plans and policies, and set the direction for investments and projects.
- Monitor: measure performance against plans and policies, and check conformance with external obligations and internal rules.
The EDM cycle clarifies who is accountable for major IT decisions. It helps boards ask the right questions, set clear direction, and then track whether IT is delivering the expected benefits while keeping risk under control. This same evaluate-direct-monitor pattern later became the backbone of the governance domain in COBIT, which is one reason the two frameworks fit together so naturally.
ISO 38500 vs COBIT: how they relate
ISO/IEC 38500 and COBIT are complementary rather than competing. ISO 38500 offers principles and posture: it is short, non-prescriptive, and covers only the governance layer that the board owns. COBIT 2019 offers structure and depth, covering both governance and the management of enterprise IT in considerable detail, with objectives, practices, and metrics that implementation teams can act on.
In practice, a board familiar with ISO 38500 can use COBIT as the implementation detail for the management activities it directs. Conversely, an IT executive fluent in COBIT can use ISO 38500 to frame and organise governance conversations with the board. COBIT even adopted the evaluate-direct-monitor language for its governance objectives, so moving between the two is straightforward. Many organisations use ISO 38500 to define the boardroom conversation and COBIT to operationalise it.
How to apply ISO 38500 in practice
Getting started does not require a certification programme, because ISO/IEC 38500 is a guidance standard rather than a certifiable management system. A pragmatic path is to map current board activity against the six principles, identify where accountability is unclear or where IT decisions bypass proper evaluation, and then embed the EDM cycle into existing governance forums such as board meetings, investment committees, and audit committees.
- Assign clear responsibility for IT governance at board level, not just to the CIO.
- Require every major IT investment to present a benefits, risk, and cost case before approval.
- Add IT performance and conformance reporting to the standing board agenda.
- Use COBIT objectives to translate board direction into measurable management activity.
Applied consistently, ISO/IEC 38500 raises IT out of a purely technical conversation and into strategic oversight. It gives directors a defensible, repeatable basis for the decisions they are already accountable for, and it provides a shared vocabulary that connects the boardroom to the frameworks and teams that deliver technology every day.