Internal and External Requirements for the Governance Framework

Internal and External Requirements for the Governance Framework (CGEIT – Governance of Enterprise IT)

Introduction
In the CGEIT domain Governance of Enterprise IT, one of the most heavily tested ideas is that an IT governance framework is never designed in a vacuum. It must be shaped by the internal requirements of the enterprise and the external requirements imposed by its environment. This guide explains why the topic matters, what it covers, how it works in practice, and how to answer exam questions on it.

1. Why It Is Important
An IT governance framework that ignores its context fails in predictable ways:
• It does not fit the enterprise. A framework copied from another organization or applied straight from a standard (for example COBIT or ISO/IEC 38500) without tailoring will clash with the culture, structure and strategy. Stakeholders will resist or ignore it.
• It exposes the enterprise to legal and regulatory risk. Missing external obligations such as data protection laws, financial reporting rules or industry regulations can bring fines, reputational damage and loss of license to operate.
• It fails to deliver value. Governance exists to make sure IT supports enterprise objectives: value creation, benefits realization, risk optimization and resource optimization. Without knowing internal drivers such as strategy, risk appetite and stakeholder needs, governance cannot direct IT toward what matters.
• It gets no stakeholder buy-in. When the board and senior management see the framework addressing their real concerns, they sponsor it. Without that sponsorship, governance initiatives stall.

CGEIT stresses that governance must be business-driven, tailored and stakeholder-focused. Identifying internal and external requirements is the first step toward all three.

2. What It Is
2.1 Internal Requirements
Internal requirements come from inside the enterprise. Typical examples:
• Enterprise strategy and goals: the mission, vision, strategic objectives and business plans the framework must support.
• Stakeholder needs: expectations of the board, executives, business unit leaders, IT management and employees. Shareholders are often grouped with internal governance stakeholders.
• Organizational structure: centralized, decentralized or federated models, business units, geographic spread, and decision rights.
• Enterprise culture, ethics and behavior: attitudes toward risk, control, innovation and accountability. Culture is often cited as the most important enabler or inhibitor.
• Risk appetite and risk tolerance: how much risk the board will accept in pursuit of objectives.
• Governance and management maturity: current process capability, existing frameworks, and existing control environments.
• Enterprise architecture and IT capabilities: current technology landscape, sourcing model, skills and resources.
• Internal policies, principles and standards: existing codes of conduct, security policies and investment policies.
• Resource constraints: budget, staffing and competing priorities.
• Role of IT for the enterprise: whether IT is strategic, a factory, a turnaround enabler or a support function. This shapes how much governance is needed.

2.2 External Requirements
External requirements come from outside the enterprise. Typical examples:
• Laws and regulations: data privacy (GDPR, HIPAA, CCPA), financial reporting (SOX), anti-money laundering, industry rules (Basel, PCI DSS for card data, FDA rules for life sciences).
• Contractual obligations: service level agreements, outsourcing contracts, customer and partner commitments.
• Industry standards and good practices: COBIT, ISO/IEC 38500, ISO/IEC 27001, ITIL, NIST and similar frameworks. These may be voluntary or required by regulators or customers.
• Market and competitive environment: competitor actions, technological change, customer expectations, digital disruption.
• Geopolitical and economic conditions: cross-border data transfer rules, sanctions and economic volatility.
• External stakeholders: regulators, auditors, customers, suppliers, business partners, rating agencies and the community.
• Threat landscape: cybersecurity threats and emerging risks.

2.3 Design Factors and Context (COBIT 2019 Perspective)
COBIT 2019 formalizes this idea through design factors used to tailor a governance system. They include:
• Enterprise strategy
• Enterprise goals
• Risk profile
• I&T-related issues
• Threat landscape
• Compliance requirements
• Role of IT
• Sourcing model for IT
• IT implementation methods
• Technology adoption strategy
• Enterprise size
Many of these map directly to internal requirements (strategy, goals, role of IT, size) or external requirements (compliance requirements, threat landscape). The goals cascade turns stakeholder drivers and needs into enterprise goals, then alignment goals, then governance and management objectives.

3. How It Works
Identifying and incorporating requirements usually follows a structured cycle:

Step 1: Understand the enterprise context. Review the strategy, business model, structure, culture and current IT role. Interview the board and executives to capture stakeholder drivers and needs.

Step 2: Identify external requirements. Build a compliance and regulatory inventory with legal, compliance, risk and audit functions. Include laws, regulations, contracts and mandated standards for every jurisdiction where the enterprise operates.

Step 3: Assess the current state. Evaluate existing governance practices, maturity and capability levels, policies, decision rights and gaps against the requirements.

Step 4: Prioritize and reconcile. Requirements may conflict. A business unit may want agility while regulation demands strict control. Leadership must reconcile these based on risk appetite and strategic priorities. Mandatory legal requirements are non-negotiable, but the way of meeting them can be optimized.

Step 5: Tailor the framework. Use the requirements to select and adapt governance components:
• principles, policies and frameworks
• processes
• organizational structures
• information flows
• culture, ethics and behavior
• people, skills and competencies
• services, infrastructure and applications
Define decision rights (for example with RACI charts), committees such as an IT steering committee or IT strategy committee, and reporting lines.

Step 6: Obtain approval and sponsorship. The board or its delegated committee approves the framework, confirming it reflects enterprise needs and obligations.

Step 7: Monitor and update continuously. Requirements change through new laws, mergers, new strategies and new technologies. Governance must include mechanisms such as regulatory watch, periodic reviews, audits and performance metrics to keep the framework current. This follows the EDM model (Evaluate, Direct, Monitor) from ISO/IEC 38500 and COBIT.

Key relationships to remember
• Governance vs. management: The board evaluates requirements, sets direction and monitors. Management plans, builds, runs and monitors in line with that direction.
• Compliance is a floor, not the goal: Meeting external requirements is necessary but not sufficient. The framework must also create value.
• Alignment: Requirements feed the business–IT alignment process. Governance makes sure IT investments and services reflect both.

4. Practical Example
A multinational bank wants to expand digital banking services.
• Internal: The strategy calls for rapid digital growth. The risk appetite is moderate. The culture is conservative. IT is seen as strategic. The structure is federated across regions.
• External: Banking regulators require operational resilience and outsourcing oversight. GDPR and local privacy laws apply. PCI DSS applies to card data. Fintech competitors are moving fast.
The governance framework therefore includes:
• a board-level technology committee
• clear decision rights between global and regional IT
• a risk management process aligned with the risk appetite
• vendor governance for cloud providers
• privacy-by-design policies
• metrics reporting both value delivery and compliance status

5. Common Pitfalls
• Adopting a framework off the shelf without tailoring.
• Focusing only on compliance and ignoring value and strategy.
• Letting IT define requirements without business stakeholders.
• Treating requirements as a one-time exercise.
• Ignoring culture and organizational readiness.
• Missing requirements in foreign jurisdictions or in third-party contracts.

Exam Tips: Answering Questions on Internal and External Requirements for the Governance Framework

Tip 1: Think like a board member, not a technician. CGEIT is a governance exam. The best answer usually reflects enterprise-level, business-driven thinking. Choose options about alignment with strategy, stakeholder needs and value over purely technical or operational fixes.

Tip 2: Identify requirements FIRST. When a question asks what to do first when establishing or revising a governance framework, look for answers like:
• understand enterprise strategy and stakeholder needs
• identify the business drivers
• determine applicable regulatory requirements
• assess the current state
Avoid answers that jump straight to selecting tools, implementing processes or writing detailed procedures.

Tip 3: Tailoring beats copying. If an option suggests adopting a framework or standard as-is, or copying a peer organization, it is usually wrong. The correct answer usually involves adapting the framework to the enterprise's context, size, culture and requirements.

Tip 4: Strategy and stakeholder needs are the primary drivers. When asked what most influences governance framework design, enterprise strategy, objectives and stakeholder needs usually outrank individual regulations or technologies. The exception is a question that explicitly focuses on a mandatory legal requirement.

Tip 5: Laws and regulations are mandatory, but the response is risk-based. Non-compliance with laws is not an acceptable option. Still, the best answer often involves integrating compliance into the governance framework efficiently, rather than creating isolated, duplicative compliance silos.

Tip 6: Watch for the culture clue. If a scenario describes resistance, failed adoption or poor buy-in, the root cause is often failure to consider internal requirements such as culture, organizational structure or stakeholder engagement. The best answer usually involves executive sponsorship, communication and alignment with culture.

Tip 7: Board approval and accountability. The board, or a board-level committee, is accountable for the governance framework. Answers that leave final approval to the IT department or CIO alone are usually incorrect at the governance level.

Tip 8: Continuous monitoring. Questions about changes such as a new regulation, merger, new market entry or new strategy test whether you know the framework must be reassessed and updated. Choose answers involving review of requirements and adjustment of the framework.

Tip 9: Distinguish internal from external quickly. Use a simple test: if it originates from the enterprise's own decisions, it is internal. Examples are strategy, risk appetite, policies and culture. If it is imposed by outside parties, it is external. Examples are laws, regulators, contracts, market forces and industry standards required by customers. Some questions simply test this classification.

Tip 10: Look for the most comprehensive answer. When several options seem right, pick the one that addresses both value and risk, both internal and external requirements, and involves the right stakeholders. Narrow answers that address only one regulation or one department are usually distractors.

Tip 11: Know the vocabulary. Be comfortable with these terms:
• stakeholder drivers and needs
• goals cascade
• design factors
• risk appetite and risk tolerance
• compliance requirements
• EDM (Evaluate, Direct, Monitor)
• enablers or components
• decision rights
• business–IT alignment
• value delivery

Tip 12: Eliminate distractors systematically. Remove options that are:
• too operational
• IT-centric without business involvement
• reactive rather than proactive
• one-time rather than continuous
• focused on cost alone rather than value and risk

Sample Question Walkthrough
Question: An enterprise is designing a new IT governance framework. Which of the following should be done FIRST?
A. Select a leading industry framework and implement all of its processes
B. Identify enterprise objectives, stakeholder needs and applicable regulatory requirements
C. Establish an IT steering committee
D. Purchase a governance, risk and compliance (GRC) tool

Answer: B.
• B is correct because understanding internal requirements (objectives and stakeholder needs) and external requirements (regulations) is the foundation for tailoring the framework.
• A skips tailoring.
• C is a structural decision that comes after the requirements are understood.
• D is a tool decision and premature.

Summary
Internal and external requirements are the inputs that make an IT governance framework relevant, compliant and valuable.
• Internal requirements: strategy, stakeholder needs, culture, structure, risk appetite and maturity.
• External requirements: laws, regulations, contracts, standards, market forces and the threat landscape.
• Process: identify and reconcile the requirements, tailor the framework, obtain board approval, then monitor and update continuously.
In the exam, favor answers that are business-driven, tailored, comprehensive, board-accountable and continuously reviewed.