Project Governance and Management is the formal system of policies, structures, roles, decision rights, and control processes that provides oversight, accountability, and strategic alignment across the full IS project lifecycle. Within the ISACA CISA framework, it encompasses two complementary disciplines: (1) Project Governance — the structural layer establishing who holds authority to make decisions, how competing interests are resolved, how risks are escalated, and how projects align with organizational strategy; and (2) Project Management — the operational layer of planning, organizing, directing, and controlling project activities to deliver systems within agreed scope, schedule, budget, and quality parameters. Together they ensure that approved IT investments are executed with discipline, visibility, and accountability. Project governance is NOT simply project management with more meetings — it is the accountability architecture that sits above day-to-day management. It is NOT a one-size-fits-all framework; governance structures must be calibrated to project size, risk, and organizational maturity.
Where it stops · what it isn't
- —IS: The policies, committees, decision rights, escalation paths, reporting structures, and control mechanisms that provide oversight of an IT project from initiation through closure
- —IS: The planning, monitoring, and controlling processes (scope, schedule, budget, quality, risk, communications) used by a project manager to deliver IS projects
- —IS: Integration points between project-level governance and enterprise-level governance (ERM, portfolio management, PMO oversight)
- —IS NOT: Day-to-day software development or technical system design (covered under System Development Methodologies)
- —IS NOT: IT operations governance or steady-state IT service management (covered under COBIT/ITIL frameworks)
- —IS NOT: The business case or feasibility analysis used to initiate a project (covered in the prerequisite competency: Business Case and Feasibility Analysis)
- —IS NOT: A substitute for organizational change management, though governance structures must account for change impact
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
REQUIRESBusiness Case and Feasibility Analysis
ENABLESEnterprise Risk Management (ERM)System Development MethodologiesPortfolio and Program Management
PART OFInformation Systems Acquisition, Development, and Implementation (CISA Domain 3)
RELATED TOIS Acquisition and Vendor ManagementRequirements Engineering and Management
CONSTRAINSAgile and Hybrid Delivery Methodologies