IT Governance Training Course

Duration 10 days 20 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends IT Managers, Heads of IT and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-IT-039

Before you join: Participants should have practical experience in an IT, digital, security, data, project, service-management, risk or audit role.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

IT leaders are expected to make technology decisions that support business priorities, control risk, meet regulatory obligations and demonstrate value for money. Yet many organisations still struggle with unclear decision rights, duplicated initiatives, weak portfolio controls, inconsistent service performance and limited assurance over cybersecurity, data and third-party providers. Effective IT governance gives executives, boards and technology managers a practical structure for directing, monitoring and improving digital investment and operational performance.

This course equips participants to design and operate an IT governance system using COBIT 2019, ISO/IEC 38500, ITIL 4 and ISO/IEC 27001 concepts. Participants examine governance principles, accountabilities, decision forums, policies, portfolio governance, risk management, performance measurement, architecture oversight, service management, cybersecurity, data governance, supplier control and audit readiness. They learn to translate strategic objectives into governance objectives, define decision rights, establish reporting measures and prepare action plans that address material control gaps.

Teaching combines concise instructor briefings with cases drawn from banking, public services, multinational operations and regulated digital services. Participants analyse governance failures, assess a current-state operating model, build governance artefacts and test decisions through realistic management scenarios. Throughout the course, each participant develops an IT governance improvement pack for a selected organisation or business unit. The final output includes a governance model, RACI matrix, committee structure, risk and control register, performance dashboard and phased implementation roadmap. Participants receive a certificate of completion after attending the ten-day programme.

The course is suited to IT managers and professionals who already manage technology services, projects, risk, security, data or suppliers and now need stronger governance design and oversight capability.

What you will be able to do

  • Assess IT governance maturity using COBIT 2019 design factors and capability concepts
  • Define IT decision rights, accountabilities and escalation paths through a governance operating model
  • Construct a RACI matrix for technology investment, risk, service and architecture decisions
  • Align IT portfolio priorities with enterprise goals, benefits cases and funding controls
  • Develop an IT risk register with treatment actions, control owners and assurance evidence
  • Design governance metrics and executive dashboards using key goal and performance indicators
  • Evaluate supplier, cybersecurity, data and service-management controls against governance requirements
  • Present a phased IT governance improvement roadmap supported by evidence and management reporting

Benefits of attending

For you

  • Ability to lead IT governance reviews with recognised frameworks and evidence
  • Practical language for briefing executives on technology risk, value and accountability
  • A reusable method for defining committees, decision rights and escalation routes
  • Stronger capability to challenge weak business cases, controls and performance reports
  • A completed governance improvement proposal relevant to a current workplace issue

For your organisation

  • Clearer ownership of technology decisions, risks, controls and approval thresholds
  • Better alignment between technology investment, enterprise strategy and measurable benefits
  • Earlier identification of service, cybersecurity, data and supplier control weaknesses
  • More consistent executive reporting on IT performance, risk exposure and improvement actions
  • A practical roadmap for improving governance without unnecessary process overhead

Course modules

20 modules over 10 days

Participants can explain how IT governance directs technology value, risk and accountability.

  • Governance, management and assurance distinguished using ISO/IEC 38500 principles
  • Enterprise value creation through benefits, risk optimisation and resource optimisation
  • Board, executive and management responsibilities across technology decision layers
  • IT governance failure patterns: shadow IT, duplicated spend and unclear ownership
  • Stakeholder expectations from regulators, auditors, customers and business leaders
  • Governance scope defined across services, projects, data, security and suppliers

Participants can use COBIT 2019 to structure a governance system for organisational needs.

  • COBIT 2019 principles and governance system components
  • Governance and management objectives mapped to organisational priorities
  • Design factors assessed for strategy, risk profile and threat landscape
  • Enterprise goals cascade translated into alignment goals and objectives
  • Capability concepts used to identify improvement priorities
  • Tailored governance systems balanced against cost, complexity and control needs

Participants can design governance forums, accountabilities and decision rights for technology management.

  • Operating model choices: centralised, federated and product-aligned technology functions
  • Decision rights allocated for investment, architecture, risk and service priorities
  • RACI matrices developed for recurring technology governance decisions
  • Delegated authority limits set for approvals, exceptions and expenditure
  • Escalation paths defined for unresolved risks, conflicts and performance failures
  • Governance charters specify mandate, membership, cadence and decisions

Participants can connect technology initiatives to strategic goals, funding decisions and expected benefits.

  • Strategic themes translated into technology objectives and investment criteria
  • Business cases tested for assumptions, benefits, costs and delivery dependencies
  • Benefits realisation plans assign owners, measures and review dates
  • Investment gates apply evidence requirements before funding decisions
  • Demand management separates mandatory work, improvement requests and strategic initiatives
  • Technology roadmaps expose capability gaps, dependencies and sequencing choices

Participants can establish controls for selecting, prioritising and monitoring technology portfolios.

  • Portfolio categories separate run, grow, transform and mandatory investment
  • Prioritisation scoring weights strategic fit, risk reduction and financial value
  • Capacity constraints tested against delivery demand and critical dependencies
  • Portfolio dashboards show spend, milestones, benefits, risks and delivery confidence
  • Stage-gate reviews challenge scope changes, forecasts and benefit erosion
  • Project recovery triggers define intervention, pause and termination decisions

Participants can identify, assess and govern technology risks within enterprise risk management.

  • IT risk taxonomy covers availability, security, change, supplier and data risks
  • Risk appetite statements define acceptable exposure and escalation thresholds
  • Inherent and residual risk assessments use likelihood-impact scoring
  • Risk treatment options compare avoid, mitigate, transfer and accept decisions
  • Key risk indicators provide early warning of deteriorating control conditions
  • Risk owners, control owners and assurance providers assigned distinctly

Participants can assess current IT governance arrangements and identify priority improvement gaps.

  • Assessment scope set around critical decisions, controls and stakeholder concerns
  • Evidence collection uses interviews, documents, reports and meeting records
  • COBIT capability concepts applied to selected governance objectives
  • Maturity findings distinguish design gaps from operating effectiveness gaps
  • Root-cause analysis separates symptoms, process weaknesses and accountability failures
  • Improvement priorities ranked by risk, value, effort and dependency

Participants can structure technology policies and control requirements for accountable operation.

  • Policy hierarchy distinguishes policies, standards, procedures and technical baselines
  • Control objectives linked to risks, obligations and management assertions
  • Policy exceptions documented with compensating controls and expiry dates
  • Control libraries rationalised to remove duplication and conflicting requirements
  • ISO/IEC 27001 control themes connected to governance responsibilities
  • Compliance attestations supported by evidence owners and review schedules

Participants can govern service performance, service risk and continual improvement using ITIL 4 concepts.

  • ITIL 4 service value system linked to governance objectives
  • Service ownership defines accountability for outcomes, costs and performance
  • Service level agreements distinguish customer outcomes from technical measures
  • Incident trends reviewed for material service and control risks
  • Problem management links recurring failures to corrective action ownership
  • Continual improvement registers prioritise service improvements through measurable outcomes

Participants can produce governance reporting that supports informed executive decisions.

  • Goal indicators measure achieved outcomes against approved technology objectives
  • Performance indicators track service, delivery, control and financial drivers
  • Balanced scorecards connect strategic, operational, risk and capability measures
  • Dashboard design uses thresholds, trends, commentary and accountable owners
  • Management packs distinguish decisions required from information for noting
  • Data quality checks test completeness, timeliness, accuracy and consistency

Participants can establish architecture governance for consistent technology and data decisions.

  • Architecture principles guide reusable, secure and interoperable technology choices
  • Architecture review boards assess exceptions, standards and technical debt
  • Target architectures connect business capabilities, applications, data and infrastructure
  • Technology standards catalogues control approved products and lifecycle status
  • Technical debt registers expose remediation cost, risk and ownership
  • Architecture decisions recorded through decision logs and exception registers

Participants can provide governance oversight of cybersecurity risk, controls and incident readiness.

  • Cybersecurity governance assigns accountability from board to operational teams
  • Security strategy aligns threat priorities with business services and assets
  • NIST Cybersecurity Framework functions structure security oversight reporting
  • Control assurance tracks vulnerabilities, privileged access and remediation commitments
  • Incident governance defines notification, decision authority and crisis communications
  • Security metrics distinguish activity volumes from risk reduction evidence

Participants can define governance structures for data ownership, quality, protection and use.

  • Data ownership assigns accountability for quality, access and retention
  • Data stewards coordinate definitions, quality rules and issue resolution
  • Critical data elements identified through regulatory, financial and operational impact
  • Data quality dimensions measure accuracy, completeness, timeliness and validity
  • Information classification guides handling, access controls and retention periods
  • Data governance councils resolve cross-functional ownership and prioritisation disputes

Participants can govern supplier, cloud and outsourced-service risks throughout the contract lifecycle.

  • Supplier segmentation assesses criticality, substitutability and data access exposure
  • Due diligence reviews financial stability, security controls and delivery capability
  • Contract clauses specify service levels, audit rights and incident notification
  • Cloud shared-responsibility models assign control ownership between customer and provider
  • Vendor performance reviews track commitments, risks, issues and improvement actions
  • Exit plans address data return, transition support and service continuity

Participants can set governance controls for technology change, release risk and configuration integrity.

  • Change categories distinguish standard, normal, emergency and major changes
  • Change authority matches approval depth to risk and business impact
  • Release readiness criteria cover testing, rollback, communications and support
  • Configuration management databases link assets, dependencies and service impacts
  • Segregation of duties controls development, deployment and production access
  • Post-implementation reviews capture benefits, incidents and corrective actions

Participants can govern IT costs, funding decisions and realised value with transparent controls.

  • Technology cost models separate fixed, variable, project and service costs
  • Total cost of ownership includes acquisition, operation, support and retirement
  • Chargeback and showback models clarify consumption and cost accountability
  • Capital and operating expenditure governed through approved funding rules
  • Benefits tracking compares realised outcomes with approved business-case assumptions
  • FinOps practices monitor cloud consumption, unit costs and budget variances

Participants can prepare governance evidence and respond effectively to assurance findings.

  • Three lines model clarifies management, risk and internal audit roles
  • Control design testing assesses whether controls address stated risks
  • Operating effectiveness testing examines evidence, frequency and exception handling
  • Audit findings classified by risk, root cause and remediation priority
  • Management action plans assign accountable owners, dates and validation evidence
  • Assurance maps identify duplicated reviews and unaddressed technology risks

Participants can convert assessment findings into a credible, phased governance improvement plan.

  • Target-state governance models define future accountabilities, forums and artefacts
  • Improvement roadmaps sequence quick wins, foundational controls and strategic changes
  • Dependencies mapped across people, process, technology, policy and funding
  • Change impact assessments identify affected roles, behaviours and communications
  • Implementation risks assessed with mitigations, owners and review points
  • Success measures establish adoption, control, performance and value targets

Participants can prepare concise governance recommendations for senior decision-makers.

  • Executive narratives state decision context, evidence, recommendation and consequences
  • Decision papers distinguish strategic choices from operational management matters
  • Risk reporting explains exposure, control confidence and required decisions
  • Dissenting stakeholder views documented without obscuring accountability
  • Committee minutes record decisions, conditions, owners and due dates
  • Escalation briefings present options, trade-offs and recommended action clearly

Participants can build, review and present a complete IT governance improvement proposal with governance model, controls, metrics and implementation roadmap.

  • Current-state assessment findings synthesised into material governance improvement priorities
  • Target governance model defines decision rights, committees and accountabilities
  • RACI matrix assigns ownership for investment, risk, services and architecture
  • Risk and control register links exposures, controls, evidence and owners
  • Executive dashboard presents goals, thresholds, trends and required decisions
  • Phased roadmap sets actions, dependencies, milestones, resources and success measures

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. COBIT-based IT governance maturity assessment template
  2. IT governance operating model and committee charter
  3. Technology decision-rights RACI matrix
  4. IT risk and control register
  5. Executive IT governance dashboard template
  6. Phased IT governance improvement roadmap

Who should attend

  • IT Managers — establish clearer controls, accountabilities and management reporting
  • Heads of IT — direct technology investment and operational performance against business priorities
  • IT Service Managers — connect service performance, incidents and continual improvement to governance
  • Cybersecurity Managers — integrate security risk, control assurance and executive oversight
  • Project and Portfolio Managers — strengthen investment decisions, benefits tracking and delivery escalation
  • Internal Audit and Risk Professionals — assess IT governance design and evidence control effectiveness

Skills and tools covered

IT governance designDecision rights definitionTechnology risk managementPortfolio oversightPerformance reportingGovernance assurance

Tools and standards

COBIT 2019, ISO/IEC 38500, ITIL 4, ISO/IEC 27001

How the course runs

Training methodology

The course uses short briefings to establish methods and standards, followed by case analysis, group discussion, governance simulations and structured application planning. Participants work with realistic scenarios involving investment approvals, failed services, cyber incidents, audit findings and outsourced technology operations. They progressively apply course tools to a selected organisation, business unit or case organisation. Facilitated peer review tests whether proposed accountabilities, controls, metrics and reporting would withstand executive, audit and regulatory scrutiny.

Requirements and prerequisites

Participants should have practical experience in an IT, digital, security, data, project, service-management, risk or audit role. They should understand basic organisational structures, technology services, project delivery and common business reporting. Familiarity with ITIL, COBIT, ISO standards or enterprise risk management is helpful but not required. The course does not require programming, systems administration, advanced cybersecurity expertise, formal audit qualifications or prior governance certification. Participants benefit most when they can bring examples of current technology decisions, reporting challenges, risk issues or governance structures from their workplace.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should have practical exposure to an IT, digital, security, data, project, service-management, risk or audit role. Prior COBIT, ITIL or ISO certification is not required, and no programming knowledge is needed.

Bring a laptop if possible and examples of governance issues you face, such as reporting packs, committee terms of reference, risk registers or policy gaps. You should not bring confidential information; anonymised examples are sufficient.

The course is designed primarily for IT managers, service managers, security leaders, portfolio managers, data managers and technology risk professionals. It also suits internal auditors and business managers with responsibility for technology oversight.

ITIL focuses on service management practices, cybersecurity courses focus on security controls, and project management courses focus on delivery. This course addresses how leaders direct, approve, monitor and assure all of these technology activities through accountabilities, forums, controls and reporting.

Participants develop an IT governance improvement pack that can be adapted for their own team, business unit or organisation. The templates support immediate work on decision rights, risk reporting, committee structures, maturity assessment and improvement planning.

Each day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first week establishes governance foundations and builds initial artefacts; the second week covers specialised governance areas, assurance, implementation planning and the capstone proposal.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

More courses in Information Technology

GIS & Remote Sensing 3D Remote Sensing Reconstruction and Visualisation Training Course 10 days · from USD 2,200 · next 16 Nov Data Analytics Accounting Data Analytics with Python Training Course 10 days · from USD 2,200 · next 16 Nov GIS & Remote Sensing Advanced ArcGIS Pro Applications Training Course 10 days · from USD 2,200 · next 16 Nov Information Technology Enterprise Architecture Foundation Training Course 10 days · from USD 2,200 · next 16 Nov Information Technology Healthcare Information Systems Management Training Course 10 days · from USD 2,200 · next 16 Nov Information Technology IT Service Management Administration Training Course 5 days · from USD 1,100 · next 16 Nov Information Technology IT Strategy and Governance Training Course 10 days · from USD 2,200 · next 16 Nov Information Technology Microsoft Office Productivity Training Course 5 days · from USD 1,100 · next 16 Nov