ISO/IEC 38506:2020 PDF

Overview

ISO/IEC 38506:2020 - "Information technology - Governance of IT - Application of ISO/IEC 38500 to the governance of IT enabled investments" - provides guidance for governing bodies on overseeing IT enabled investments. It adapts the ISO/IEC 38500 governance model to investment decisions that depend on information technology, covering investments of any scale (from acquisitions and major change programs to operational IT services and innovation funding). The standard is advisory: it clarifies governance responsibilities, decision-making focus and outcomes without prescribing specific management practices.

Key topics

• Governance model: Applies the ISO/IEC 38500 model (Evaluate, Direct, Monitor) to investment lifecycles.
• Six governance principles: Responsibility, Strategy, Acquisition, Performance, Conformance, and Human behaviour - each with application guidance, desired outcomes and governance behaviours.
• Value focus: Emphasizes prioritizing investments that deliver measurable financial or non‑financial value and require complementary business change.
• Accountability and roles: Clarifies obligations of the governing body and guidance for parties interacting with it (project teams, accountants, consultants, portfolio managers).
• Risk and due diligence: Guidance for assessing IT-related risks and value in acquisitions and investment ranking (including contexts such as investment banking).
• Resource allocation for innovation: Advice on balancing short-, medium- and long‑term investment portfolios to sustain innovation and business continuity.
• Scope and limits: Applies across sectors and organization sizes; does not mandate specific management processes or tools.

Applications

Who uses ISO/IEC 38506 and how:

• Governing bodies and boards - for oversight of IT-dependent investments, portfolio prioritization and strategic resource allocation.
• CIOs, program and portfolio managers - to align IT investments with corporate strategy and to frame reporting for boards.
• Project teams and due diligence teams - to evaluate expected benefits, risks and conformance requirements in acquisitions or large change programs.
• Investment professionals and consultants - when assessing IT components of deals or ranking IT-enabled opportunities. Practical uses include investment prioritization, setting governance behaviours, clarifying accountability, guiding due diligence, and improving risk mitigation for IT-enabled change.

Related standards

• ISO/IEC 38500:2015 - foundational IT governance principles and model.
• ISO/IEC TS 38501 - implementation guidance for effective IT governance arrangements.
• ISO/IEC TR 38502 - integration between governing body and management.
• ISO/IEC TR 38504:2016 - principles used in drafting ISO/IEC 38506.

Keywords: ISO/IEC 38506, governance of IT, IT enabled investments, IT governance, ISO/IEC 38500, board oversight, investment governance, IT investment risk.