Guide contents
On this page
Guidance · Governance
Governance
Responsibilities and decision-making structures that keep a process under control, including in exceptional situations.
Ownership and decision-making authority
Name the process owner and describe who may change the process, approve an exception or accept a risk. Responsibilities for individual tasks do not replace ownership of the whole process. Responsibility must be accompanied by sufficient authority.
Decisions in exceptional situations
Agree when an issue moves to a higher decision-making level and who acts when the responsible person is absent. Document important decisions, their rationale and follow-up actions. Strategic feedback helps the owner assess whether the process needs to change.
Governance is reflected in how decisions are made and how their implementation is monitored.
Practical example
Approving a cloud service
In the source example, an architecture committee approves technology choices, the information security lead owns security principles, and a risk management committee assesses significant supplier risks. Production changes are approved under the organisation's change management authority. Adapt these roles to your own organisation.
Include in your process description
- Who is accountable for the process as a whole?
- Who decides on changes and exceptions?
- How are issues escalated, and who acts as a deputy?
- When does the owner review results and improvement needs?
Connections to other components
Based on the Generic Process Model materials. Questions and practical guidance have been structured for reading on the web. Sources and clarifications.