Governance in ITIL® 5 Explained

What Is Governance?

Governance is about direction and control at the organizational level — setting the strategic direction an organization follows and making sure performance stays aligned with it. A governing body, such as a board or executive team, is accountable for this, even when day-to-day decisions are delegated to managers and teams.

Governance isn't specific to IT. It's a broader organizational concept that IT service management operates within — ITIL®'s guiding principles, practices, and value chain activities all need to align with the direction the governing body sets.

The Evaluate-Direct-Monitor (EDM) Cycle

Governance in ITIL® is exercised through a continuous cycle of three activities:

• Evaluate — the governing body assesses the organization, its strategy, and its context, including changes in the internal and external environment
• Direct — based on that evaluation, the governing body sets direction through policies and decisions
• Monitor — the governing body tracks performance against objectives, feeding back into the next round of evaluation

This cycle runs continuously, not as a one-time event — governance is an ongoing loop, not a single decision made once and left alone.

Where Governance Fits in the Service Value System

Governance is one of the core elements of the ITIL® Service Value System, alongside guiding principles, practices, continual improvement, and the value chain (now the Product and Service Lifecycle in ITIL® 5). Governance sets the direction; guiding principles shape how decisions get made day to day; the lifecycle activities and practices carry out the actual work; and continual improvement keeps everything getting better over time.

Real-World Example

A company's executive board decides that customer data security is a strategic priority (Direct), after reviewing a rise in industry-wide data breaches and regulatory pressure (Evaluate). That decision cascades down: Information Security Management tightens its practices, and Change Enablement adds stricter review steps for anything touching customer data.

Months later, the board reviews security incident metrics and audit results (Monitor) to check whether that direction actually improved the organization's security posture — feeding into the next evaluation cycle.

Why This Matters

Understanding governance matters because:

• It clarifies that governance operates above day-to-day management, setting direction rather than making every operational decision
• It explains why ITIL® practices and lifecycle activities need to stay aligned with something set at a higher level
• It connects strategic accountability (the governing body) to practical service delivery (the practices and lifecycle activities)

Common Exam Mistakes

The most common mistake is confusing governance with management. Governance is about setting direction and monitoring outcomes at the organizational level; management is about the day-to-day activities that carry out that direction. They're related but distinct layers.

A second mistake is treating governance as a one-time activity — something that happens once, at the top, and then trickles down forever. In practice, Evaluate-Direct-Monitor is a continuous cycle, with Monitor results feeding straight back into the next round of Evaluate.

Memory Trick

Think:

Evaluate the situation.

Direct where to go.

Monitor whether it worked.

Then evaluate again — governance never really stops running.

Key Takeaways

• Governance is the means by which an organization is directed and controlled, exercised by a governing body such as a board or executive team.
• It's carried out through a continuous Evaluate-Direct-Monitor (EDM) cycle.
• Governance is distinct from management — it sets direction, while management carries out day-to-day activity within that direction.
• Governance is one of the core elements of the ITIL® Service Value System, alongside guiding principles, practices, and continual improvement.
• This concept carries over from ITIL® 4 into ITIL® 5 largely unchanged, and is a frequently tested area of the Foundation syllabus.

One Practice Question