IT Governance Frameworks Explained: COBIT, ITIL and ISO/IEC 38500

If you move into IT leadership, you will hear three names again and again: COBIT, ITIL and ISO/IEC 38500. They are often mentioned in the same breath, but they answer different questions and are written for different audiences.

In short, ISO/IEC 38500 is a brief international standard addressed to boards and other governing bodies. COBIT is a detailed framework for governing and managing enterprise information and technology. ITIL is a body of guidance for managing digital products and services day to day. None of them replaces the others, and none needs to be adopted whole.

This guide explains what each one is, based on what their owners publish, and how a technology leader can use them together. A note on access: the full text of all three is sold rather than freely published, so this guide relies on the owners' public descriptions. Details are noted where we could not verify them.

Governance versus management

The most useful idea to take from these frameworks is the difference between governance and management.

Governance is about direction and oversight: deciding what the organization wants from technology, setting policy and risk appetite, and checking that results match intentions. It is usually the job of a board or similar governing body.

Management is about planning, building, running and monitoring technology to deliver what governance has asked for. It is the job of executives and their teams.

COBIT makes this split explicit. ISACA's 2025 white paper on COBIT for AI governance describes the Evaluate, Direct and Monitor domain as "primarily focused on governance activities at the highest level," with the other four domains covering management.

ISO/IEC 38500: principles for governing bodies

ISO/IEC 38500:2024, Information technology — Governance of IT for the organization, is the third edition of the standard. ISO lists it as published in February 2024, replacing the 2015 edition, at 21 pages. It is maintained by the joint ISO and IEC committee JTC 1/SC 40.

According to ISO's abstract, it provides "guiding principles for members of governing bodies of organizations and those that support them on the effective, efficient and acceptable use of information technology (IT) within their organizations." It applies to all kinds of organizations, public and private, government and not-for-profit, and to organizations of all sizes.

What we could not verify: the standard's full text is sold by ISO, and we did not have access to it, so this guide does not list the 2024 edition's specific principles or model. If you are preparing board materials based on 38500, buy the current edition rather than relying on summaries of earlier versions.

How leaders use it: 38500 is the shortest and highest-level of the three. It is a good reference when you are explaining to a board what its responsibilities for technology are, as distinct from management's.

COBIT: a framework for governing and managing I&T

COBIT is published by ISACA, which describes it as a framework for enterprise governance of information and technology (EGIT). The current core publications are branded COBIT 2019. ISACA's COBIT page lists a core model of 40 governance and management objectives.

ISACA's white paper organizes those objectives into five domains:

• Evaluate, Direct and Monitor (EDM), focused on governance.
• Align, Plan and Organize (APO), which deals with strategic planning.
• Build, Acquire and Implement (BAI), covering developing and deploying systems.
• Deliver, Service and Support (DSS), covering ongoing operations.
• Monitor, Evaluate and Assess (MEA), emphasizing continuous improvement.

The same paper describes seven types of components that make up a governance system (processes; organizational structures; information; people, skills and competencies; principles, policies and procedures; culture, ethics and behavior; and services, infrastructure and applications) and 11 design factors used to tailor which objectives matter most for a given enterprise.

How leaders use it: COBIT is useful as a map. It helps you check whether every important area of technology governance and management has an owner and a practice, and it gives auditors and risk teams a shared vocabulary. ISACA also publishes companion guides, including focus areas on information security, I&T risk and DevOps, and a guide for small and medium enterprises.

ITIL: guidance for digital product and service management

ITIL is owned by PeopleCert. As of October 2026, PeopleCert's site presents a new release, ITIL Version 5, alongside the ITIL 4 certifications that many practitioners hold. PeopleCert describes ITIL as "the global best practice framework for digital product and service management" and says the new version is "AI-native by design."

According to PeopleCert's description of the ITIL Foundation (Version 5) course, core concepts include:

• Value co-creation between providers, consumers and other stakeholders.
• Four dimensions: organizations and people, value streams and processes, information and technology, and partners and suppliers.
• The ITIL Value System, which brings together guiding principles, governance, value chain activities, management practices and continual improvement.
• A product and service lifecycle from discovery and design through operation, delivery and support.
• Management practices, supported by official practice guides, and value stream mapping.

PeopleCert also lists an ITIL AI Governance extension module. What we could not verify: the exact release date of Version 5 and the full list of practices it contains, because the official publications are sold.

How leaders use it: ITIL is the most operational of the three. It shapes how teams handle incidents, changes, requests, service levels and continual improvement.

How the three fit together

Think of them as layers:

1. ISO/IEC 38500 frames what the governing body is responsible for.
2. COBIT turns that into a full set of governance and management objectives with owners and practices.
3. ITIL provides detailed guidance for the service management work inside several of those objectives.

They also sit alongside specialist frameworks. You might use the NIST Cybersecurity Framework for security outcomes and the NIST AI Risk Management Framework for AI. Our guide to cybersecurity governance for technology leaders covers the first of these.

Choosing where to start

You do not need to "implement COBIT" or "become ITIL compliant" to get value. A practical approach:

• Start with the problem. Board unclear on its role? Read 38500. Gaps in ownership across IT? Use COBIT's objectives as a checklist. Service quality issues? Look at ITIL practices.
• Adopt selectively. COBIT's design factors exist precisely so enterprises can tailor it.
• Keep the language consistent. Pick one framework's vocabulary for board and audit reporting so terms do not drift.
• Budget for the real documents. Training summaries are helpful, but decisions should rest on the official publications.

Key takeaways

• Governance sets direction and oversees; management plans, builds, runs and monitors.
• ISO/IEC 38500:2024 gives principles for governing bodies and applies to organizations of any size or sector.
• COBIT 2019 offers 40 governance and management objectives in five domains, tailored with design factors.
• ITIL, now in Version 5 according to PeopleCert, guides day-to-day digital product and service management.
• Use them as complementary layers and adopt selectively, starting from a real problem.

Sources

• International Organization for Standardization, ISO/IEC 38500:2024 Information technology — Governance of IT for the organization (February 2024)
• ISACA, COBIT: Control Objectives for Information Technologies
• ISACA, Leveraging COBIT for Effective AI System Governance (January 31, 2025)
• PeopleCert, ITIL Framework
• PeopleCert, ITIL Foundation (Version 5)