IT Governance, Risk and Quality Frameworks

ISO 9001 is the international standard for a quality management system (QMS). It asks you to understand customer and stakeholder requirements, plan processes and risks, control how you design and deliver products and services, measure customer satisfaction and keep improving. For software and IT services firms it formalises requirements management, design and development control, testing, change control and supplier management. The 2026 edition was published in September 2026.

COBIT is ISACA's framework for the governance and management of enterprise IT. It separates governance (evaluate, direct, monitor) from management (plan, build, run, monitor) and defines objectives such as managing risk, security, changes, suppliers and performance, with a capability scale and design factors to tailor the system. ISACA has announced COBIT 7 for launch in late October 2026; COBIT 2019, with its 40 objectives in five domains, is still the version most organisations have implemented.

ITIL is the most widely used framework for IT service management. ITIL 4 describes a service value system and 34 management practices, such as incident management, change enablement, problem management, service desk and service level management, that help IT teams deliver reliable services. PeopleCert began rolling out ITIL Version 5 in 2026, with ITIL 4 running alongside it. ITIL itself is not certifiable for organisations; ISO/IEC 20000-1 is the matching certifiable standard.

FISMA is the US federal law that requires every federal agency to run an agency-wide information security programme, including for systems operated by contractors. Agencies categorise systems, apply NIST SP 800-53 controls under the Risk Management Framework, authorize systems to operate, continuously monitor them and report annually to OMB and Congress. IT companies meet FISMA through contract clauses when they build, host or operate systems for federal agencies.

The Sarbanes-Oxley Act requires US-listed companies to certify their financial reports and maintain effective internal control over financial reporting (ICFR). Section 302 makes the CEO and CFO certify each report, and Section 404 requires an annual management assessment of ICFR, with auditor attestation for larger filers. For IT, this means tested IT general controls (ITGCs) over access, change management and operations for every system that affects the financial statements.

ISO/IEC 20000-1 is the certifiable international standard for an IT service management system. It requires a planned and governed approach to designing, delivering and improving services, including service level management, incident and request handling, problem management, change and release management, capacity, availability and continuity, supplier management and reporting. It is the organisational certificate that matches ITIL practices, and is often required in managed services and outsourcing tenders.

A SOC 1 report is an independent CPA examination of a service organisation's controls that are relevant to its customers' financial reporting. Payroll, billing, payments, ERP hosting and fund administration providers commonly need one so that their public-company clients and their auditors can rely on the service for SOX. Like SOC 2 it comes as Type I (design) or Type II (operating effectiveness over a period), and it lists complementary controls the customer must operate.

ISO 31000 provides principles, a framework and a process for managing any kind of risk. It is guidance, not a certifiable requirements standard. Many IT risk programmes use it as the overall method behind risk registers, risk appetite statements and treatment plans, while ISO 27005 applies it to information security risk.

ISO/IEC 38500 gives boards and governing bodies principles for the effective, efficient and acceptable use of IT in their organisations. The 2024 edition sets out how governing bodies should evaluate, direct and monitor the use of IT and data. It is a short, high-level guidance standard that frameworks such as COBIT build on.

Since December 2023, US-listed companies must disclose material cybersecurity incidents on Form 8-K Item 1.05 within four business days of determining materiality, and describe their cybersecurity risk management, strategy and governance annually under Regulation S-K Item 106. Foreign private issuers make equivalent disclosures on Forms 6-K and 20-F. IT vendors are affected because incidents at third parties can trigger client disclosures.