Back to Assessments & Documents
Technology Governance and Strategy Active

Technology Governance and Strategy Maturity Assessment

A 52-question diagnostic across 8 domains that evaluates whether technology is governed and directed by the governing body: its mandate and decision rights, policy, strategy, investment direction, oversight of risk, comp...

Start Assessment

Overview

A 52-question diagnostic across 8 domains that evaluates whether technology is governed and directed by the governing body: its mandate and decision rights, policy, strategy, investment direction, oversight of risk, compliance, assurance and AI, reporting, and how governance itself is reviewed. Written for the board, its technology committee and the CIO who need to answer: does the governing body really direct and oversee technology, or does it only receive updates?

Detailed Description

Many organizations have a technology committee that meets, reads status packs and approves what reaches it, yet nobody can say who may decide what, which policies are current, whether the strategy delivered what it promised, or who allowed an AI agent to commit money on the organization's behalf. Decisions are made in corridors, exceptions never expire, failing programs are not stopped, and the board learns of a major supplier dependency only when it fails.

This assessment follows the order in which sound governance is built: one governance framework, a chartered governing body, principles, the operating model and CIO mandate, decision rights and delegation, risk-proportionate approval routes, competence and conflicts; the policy framework, exceptions, conformance, business-led technology rules and group application; context, the IT strategy, its link to enterprise objectives, business participation, roadmap, scenarios, sovereignty and concentration, responsible and sustainable technology, communication and outcome review; investment criteria and mix, decision papers, gate and stop authority, funding model, benefit oversight, sourcing direction and strategic suppliers; use of risk appetite, oversight of top technology and cyber risks, compliance, assurance scope and findings; board oversight of AI, delegated authority for AI agents, AI investment value, emerging technology decisions, AI-assisted governance work and shadow AI; strategic KPIs, the board technology report, the decision log, governance cost and value, post-decision review and external reporting; and governance evaluation, stakeholder perception, tooling, framework change control and improvement.

It is the hub of the Technology Governance family and tests governance direction and oversight only. Depth sits with the owners, reached through named Input documents: Enterprise Risk Management, IT Risk Management, Cyber Risk Management, IT Performance Management, IT Budget and Financial Management, Enterprise Architecture, Business Relationship Management, PRINCE2 Aligned Portfolio Management, Service Integration and Management, AI Governance, AI Spend Management, Shadow AI and AI Sprawl Governance, Data Governance and Management, Continual Service Improvement, Value Realization and Investment ROI and IT Compliance and Control Assurance. Terms used: the governing body is the board; the technology governance body is the body set up by the Technology Governance Charter; sub-forums, such as the architecture, risk and investment review boards, act under its delegation and keep decision logs linked to the Governance Decision Log. Each question is scored on whether the practice is Documented, Implemented and Effective.

Assessment Details

Audience

Board and board technology or risk committee, CEO, CIO, head of IT governance. Secondary: chief risk officer, CFO and portfolio office, chief architect, chief data officer, AI governance lead, internal audit and regulators.

Purpose

Shows where the governing body receives information but does not direct, where decision rights and delegation are unclear (including for AI agents), where policies and exceptions are out of control, where strategy is not tied to outcomes, where investments cannot be stopped, where risk, compliance and assurance do not reach the body, and where governance costs more than it adds. Gives each gap a concrete next step and a measurable target.

Effort

Initial assessment: 5 to 7 hours of facilitated sessions with board or committee members, the CIO and governance office, the portfolio office and IT finance, risk, compliance and internal audit, and architecture, data and AI leads. Evidence gathering: governance framework and charter, decision rights matrix, policy register and exceptions, IT strategy and roadmap, investment planning framework and decision papers, board technology reports and minutes, decision log and governance effectiveness review.

Cadence

Yearly, aligned to the strategy and budget cycle, and after a change in board composition or operating model, a major technology failure or regulatory finding, or the adoption of AI agents that act on the organization's behalf.

Framework Alignment

ISO/IEC 38500:2024 COBIT 2019 ISO 37000:2021 G20/OECD Principles of Corporate Governance 2023 ISO/IEC 38507:2022 ISO/IEC 38505-1:2017 NIST CSF 2.0 NIST AI RMF 1.0 ISO/IEC 42001:2023 IIA Three Lines Model COSO ERM 2017 APQC PCF

KPIs

  • Missed Strategic Outcomes with a Recorded Decision - Share of strategic outcomes that missed their target at the last review with a governing body decision to continue, adjust or stop. Target: 100%.
  • Decisions Made by the Assigned Role - Share of sampled technology decisions made by the role the decision rights matrix assigns at the right threshold. Target: 95% or higher (model target).
  • Stop or Redirect Decisions Taken by the Named Holder - Share of stop or redirect decisions on major initiatives taken by the holder the Gate and Stop Authority names within the time it allows. Target: 100%.
  • Expired Policy Exceptions Still in Use - Number of technology policy exceptions past their expiry date in the quarter neither renewed through approval nor closed. Threshold: 0.
  • Production AI Agents with Delegated Limits - Share of production AI agents with a delegated authority limit and a named accountable person. Target: 100%.

Dependencies

AI Governance (v11.9.6): AI Governance RACI and Decision Rights Matrix, AI Policy and Responsible AI Principles, AI Governance Assurance Program, AI Agent Governance Standard, AI Governance Review and Improvement Register (1.5, 6.1, 6.2, 6.3, 6.5). Data Governance and Management (v1.9.6): Data Governance Charter (1.5). IT Budget and Financial Management (v9.9.6): IT Financial Management Policy, IT Budget Plan, Supplier and Contract Register, IT Financial Performance Report (1.6, 4.4, 4.7, 7.2). Cyber Risk Management (v8.9.6): Cyber Governance Charter, Cyber Risk Reporting Standard (1.7, 5.2, 7.6). IT Risk Management (v7.9.6): IT Issue and Exception Register, IT Control Framework, End-User Computing Inventory, Critical Provider Exit Plans, IT Risk Assessment Procedure, Technology Risk Tolerance Statement, IT Risk Reporting Pack (2.2, 2.3, 2.4, 3.7, 4.2, 4.7, 5.1, 5.2, 5.5, 6.4). Enterprise Architecture (v7.9.6): Architecture Principles and Standards Catalog, Architecture Roadmap, Architecture Performance Report (2.4, 3.2, 3.5, 3.8, 6.4, 7.2). Enterprise Risk Management (v7.9.6): ERM Framework, Emerging Risk Radar, Scenario and Stress Testing Guide, Risk Appetite Framework, Combined Assurance Map, ERM Assurance Plan, Risk Reporting Standard (2.5, 3.1, 3.6, 5.1, 5.4, 7.6). IT Performance Management (v6.9.6): Strategy and Objective Cascade Map, KPI Catalog (3.3, 3.10, 7.1). Business Relationship Management (BRM) (v10.9.6): Business-IT Governance Forum Terms of Reference (3.4). Service Integration and Management (SIAM) (v6.9.6): Sourcing Strategy (3.7, 4.6). PRINCE2 Aligned Portfolio Management (v6.9.6): Portfolio Strategy, Portfolio Funding Model (4.1, 4.4). Value Realization and Investment ROI (v7.9.6): Business Case Template, Investment Decision Log, Benefits Register (4.2, 4.3, 4.5). IT Compliance and Control Assurance (v4.9.6): Compliance Obligations Register (5.3). AI Spend Management (v12.9.6): AI Product Portfolio (6.3). Shadow AI and AI Sprawl Governance (v3.9.6): Shadow AI Tool Inventory and Registry (6.6). Continual Service Improvement (v8.9.6): Continual Improvement Register (8.5).

Assessment Outline

(8 domains · 52 questions)
  1. 1

    1 Governance Mandate and System Design

    The technology governance framework, the governing body charter, governance principles, the technology operating model and CIO mandate, decision rights and delegation, risk-proportionate approval routes, governing body technology competence and conflicts of interest

    • 1.1 Technology Governance Framework 1 questions
    • 1.2 Governance Body and Mandate 1 questions
    • 1.3 Governance Principles 1 questions
    • 1.4 Technology Operating Model and CIO Mandate 1 questions
    • 1.5 Decision Rights Matrix (Bridge) 1 questions
    • 1.6 Adaptive Governance (Bridge) 1 questions
    • 1.7 Governing Body Technology Competence (Bridge) 1 questions
    • 1.8 Decision Integrity and Conflicts of Interest 1 questions
  2. 2

    2 Policy Framework and Conformance

    The technology policy framework and its lifecycle, policy exceptions and waivers, policy conformance review, rules for business-led technology and group and subsidiary application

    • 2.1 Technology Policy Lifecycle 1 questions
    • 2.2 Policy Exceptions and Waivers (Bridge) 1 questions
    • 2.3 Policy Conformance Review (Bridge) 1 questions
    • 2.4 Business-Led Technology Guardrails (Bridge) 1 questions
    • 2.5 Group and Subsidiary Technology Governance (Bridge) 1 questions
  3. 3

    3 Technology Strategy and Direction

    Context analysis, the IT strategy, alignment to enterprise objectives, business participation, the strategic roadmap, scenarios and options, sovereignty and concentration direction, responsible and sustainable technology direction, strategy communication, and strategy refresh with outcome review

    • 3.1 Technology Context Analysis 1 questions
    • 3.2 IT Strategy 1 questions
    • 3.3 Goals Alignment (Bridge) 1 questions
    • 3.4 Business-IT Collaboration (Bridge) 1 questions
    • 3.5 Technology Roadmap (Bridge) 1 questions
    • 3.6 Scenario Planning and Strategic Options (Bridge) 1 questions
    • 3.7 Technology Sovereignty, Concentration and Exit Direction (Bridge) 1 questions
    • 3.8 Responsible and Sustainable Technology Direction (Bridge) 1 questions
    • 3.9 Strategy Communication 1 questions
    • 3.10 Strategy Refresh Cycle 1 questions
  4. 4

    4 Investment and Resource Direction

    Investment ranking criteria and mix, the investment decision paper standard, gate and stop authority, the funding model and envelopes, benefit oversight, technology sourcing direction and strategic supplier oversight

    • 4.1 Investment Criteria and Mix Direction 1 questions
    • 4.2 Business Case Standard (Bridge) 1 questions
    • 4.3 Stage-Gate Reviews (Bridge) 1 questions
    • 4.4 Incremental Funding (Bridge) 1 questions
    • 4.5 Benefits Realization (Bridge) 1 questions
    • 4.6 Sourcing Strategy (Bridge) 1 questions
    • 4.7 Vendor Tiering and Concentration Oversight (Bridge) 1 questions
  5. 5

    5 Risk, Compliance and Assurance Oversight

    Use of risk appetite and tolerances in technology decisions, oversight of top technology and cyber risks, compliance oversight, independent assurance scope and tracking of significant findings

    • 5.1 Technology Risk Appetite (Bridge) 1 questions
    • 5.2 Top Technology Risk Oversight (Bridge) 1 questions
    • 5.3 Compliance Obligations Oversight (Bridge) 1 questions
    • 5.4 Independent Assurance (Bridge) 1 questions
    • 5.5 Corrective and Preventive Action (Bridge) 1 questions
  6. 6

    6 AI and Emerging Technology Oversight

    Governing body oversight of AI, delegated authority for AI agents, AI investment and value oversight, emerging technology adoption decisions, controls on AI-assisted governance work and shadow AI oversight

    • 6.1 AI Governance Oversight (Bridge) 1 questions
    • 6.2 Delegated Authority for AI Agents (Bridge) 1 questions
    • 6.3 AI Investment and Value Oversight (Bridge) 1 questions
    • 6.4 Emerging Technology Evaluation (Bridge) 1 questions
    • 6.5 Controls on AI-Assisted Governance Work (Bridge) 1 questions
    • 6.6 Shadow AI Oversight (Bridge) 1 questions
  7. 7

    7 Performance Oversight and Stakeholder Reporting

    Strategic technology KPIs, the board technology report, the governance decision log and follow-through, governance cost and value, post-decision review and regulator and external reporting

    • 7.1 Technology KPIs and OKRs (Bridge) 1 questions
    • 7.2 Board and Executive Reporting (Bridge) 1 questions
    • 7.3 Governance Decision Log and Follow-Through 1 questions
    • 7.4 Governance Cost-Benefit 1 questions
    • 7.5 Post-Decision Review 1 questions
    • 7.6 Regulator and External Reporting (Bridge) 1 questions
  8. 8

    8 Governance Review and Improvement

    Governance effectiveness evaluation and benchmarking, stakeholder perception of governance, governance workflow tooling, governance framework change control and governance improvement

    • 8.1 Governance Self-Assessment and Benchmarking 1 questions
    • 8.2 Stakeholder Perception of Governance 1 questions
    • 8.3 GRC Tooling and Automation 1 questions
    • 8.4 Governance Framework Change Control 1 questions
    • 8.5 Governance Improvement (Bridge) 1 questions

At a Glance

Category Technology Governance and Strategy
Type Free
Roles 6
Domains 8
Questions 52
Start Assessment

Still have questions? Get in touch

ITSGovernance
  • Twitter

Contact us

ITSGovernance