IT governance, risk and compliance, ready for your next IT audit
IT governance is how a governing body directs and controls an organisation's use of technology; an IT audit tests whether the resulting IT controls work. Arke Technologies, in Johannesburg, helps South African organisations, public bodies and schools set up IT governance, risk and compliance, prepare for IT audits and close the findings.
What is IT governance?
IT governance, also called the governance of IT or enterprise governance of IT, is the system by which an organisation's governing body directs and controls its current and future use of technology. ISO/IEC 38500, the international standard for the governance of IT, reduces the board's work to three tasks: evaluate, direct and monitor. The board or council evaluates what technology the organisation needs, directs it through strategy, policy and budget, and monitors performance, risk and conformance.
IT governance and IT management are different jobs. Management plans, builds, runs and monitors technology day to day; governance decides priorities, sets the risk appetite, holds management to account and reports to stakeholders. IT governance vs corporate governance is a question of scope: IT governance is part of corporate governance, which is why King IV (Principle 12) and its successor, King V (Principle 10, published by the Institute of Directors in South Africa in October 2025), put technology and information, and in King V data too, on the governing body's agenda.
Why is IT governance important? Technology now carries much of an organisation's risk and spending, and boards answer for both. The benefits of IT governance are practical: spending tied to strategy, risks known and owned, compliance shown rather than assumed, fewer audit findings, and decisions that survive a change of staff because they are recorded.
IT governance structure and planning
A workable IT governance structure has four layers: the governing body (a board, council or school governing body), which approves direction and risk appetite; a committee, usually audit and risk or an ICT steering committee, which oversees delivery; an executive owner, such as a CIO, head of ICT or IT governance manager, accountable for performance; and the policies, registers and reports that make oversight possible.
IT governance planning turns the structure into a plan. Government departments keep a three-year ICT plan aligned to the medium-term expenditure framework and a one-year ICT operational plan (DPSA, March 2022), and companies, municipalities and schools benefit from the same rhythm. Our IT consulting and virtual CIO service writes and maintains these plans with you.
IT risk management and IT GRC
Information technology risk management identifies, rates, treats and monitors the risks that come with technology: cyber attacks, outages, supplier failure, failed projects, data breaches, unlicensed software, critical spreadsheets and AI tools used without oversight. IT GRC, short for IT governance, risk and compliance, joins that work to the governance structure and to compliance, so one register and one reporting cycle serve the board, the auditors and the regulators.
IT risk governance means the governing body sets the appetite and sees the top risks, while management owns the treatments; IT governance and risk management meet in the risk register, which we build and keep current with you. IT compliance and governance cover the rules you must meet: POPIA, sector regulation, procurement law and your own policies. Cyber security compliance sits inside that, and GRC for ISO 27001 is often the most demanding part; see ISO 27001 readiness and POPIA compliance. Where you need an IT risk consultant to own the programme, a virtual CISO can.
What an IT audit tests
An IT audit examines whether an organisation's IT controls protect its assets, keep its data reliable and support its objectives. Most IT audits centre on IT general controls (ITGCs), the controls every system depends on:
Logical access control. Who can sign in to what, how access is approved, reviewed and removed, and how privileged accounts are protected.- Change management. How changes to systems are requested, tested, approved and recorded.
- Program development and acquisition. How new systems are specified, tested and accepted.
- IT operations. Backups and restore tests, job monitoring and incident management.
- IT service continuity. Disaster recovery plans, and proof that they work.
Auditors also test application controls in finance and revenue systems, and IT governance itself. How to audit IT governance: test whether the structures, decisions and reports work as the chosen framework says they should. An IT audit may come from your IT internal audit function, your external auditors or, for public bodies, the Auditor-General of South Africa; an ISO IT audit is a certification audit against a standard such as ISO/IEC 27001.
IT audit and assurance, and where we fit
IT audit and assurance, in the formal sense, belongs to independent assurance providers: internal audit, external audit firms and the Auditor-General. A lead IT auditor runs the engagement, a certified IT auditor usually holds ISACA's CISA, an IT compliance auditor tests conformance with a standard or law, and an IT audit trainee gathers much of the evidence. When comparing IT audit companies, first decide whether you need assurance, which is an independent opinion, or readiness, which is gaps found and fixed.
We provide readiness and remediation, not audit opinions. If we also run your environment, we say so in the scope and recommend an independent reviewer where you need a formal opinion.
Enterprise architecture: TOGAF, Zachman and FEAF
What is enterprise architecture? Enterprise architecture (EA) is the blueprint of how an organisation's business processes, data, applications and technology fit together, and the roadmap for changing them. IT governance and enterprise architecture depend on each other: governance decides where to go, the architecture shows what must change to get there, and an architecture review board is often part of enterprise IT governance.
TOGAF, The Open Group Architecture Framework, is one of the most widely used enterprise architecture frameworks; its current version is the TOGAF Standard, 10th Edition (TOGAF 10, released in 2022). Its Architecture Development Method works through four domains: business, data, application and technology architecture. TOGAF business architecture comes first, so every system decision traces back to what the organisation needs to do. Other enterprise architecture frameworks include the Zachman Framework, a grid for classifying architecture descriptions; the US Federal Enterprise Architecture Framework (FEAF); SABSA, a security architecture method often used with TOGAF; and, in South African government, the Government-Wide Enterprise Architecture (GWEA) framework, derived from TOGAF. ArchiMate, also from The Open Group, is the modelling language widely used with TOGAF, giving enterprise architecture diagrams a standard notation.
IT governance in the public sector
Public bodies govern IT under law as well as codes. The PFMA (section 38) and the MFMA (section 62) require accounting officers to maintain effective, efficient and transparent systems of financial and risk management and internal control, and IT controls are part of those systems. Cabinet approved the Public Service Corporate Governance of ICT Policy Framework in 2012, and the DPSA revised it in March 2022, partly because the Auditor-General's repeat findings showed continuing IT governance weaknesses: the 2020/21 audit outcomes still found weak IT governance practices at 63% of auditees (DPSA, March 2022). The revised framework asks each department's head of ICT to report to the ICT steering committee and executive committee on five general IT controls: information security, user access, ICT service continuity, the management of external service providers, and IT asset lifecycle management.
We help departments, municipalities and state-owned entities put these frameworks to work and answer audit findings. See IT for the public sector, IT for municipalities and PFMA, MFMA and ICT procurement.
Deliverables, reporting, procurement and continuity
- Deliverables you keep. An IT governance charter and policies, a risk register, an IT strategic plan, architecture models, an audit-readiness pack and a remediation tracker, in formats you can edit.
- Reporting. A summary for the board or audit committee at the cadence your committee sets and, for managed clients, a monthly service review and report.
- Briefings and skills. We brief executives and committee members on their governance roles. IT governance training and certification, such as ISACA's CGEIT or COBIT courses, suit people who want to specialise.
- Procurement. Level 1 B-BBEE contributor (sworn affidavit available on request), which gives buyers 135% procurement recognition; company documents, CSD supplier number and SARS tax compliance status available on request; and standard bidding documents completed when a tender requires them. See company facts.
- Continuity. Everything we produce is yours, in open, editable formats, so your team or any future provider can maintain it.
IT governance is one of our technology services; it works alongside managed IT, cybersecurity, systems integration, data and analytics and AI governance.