From Boardroom to Server Room: Connecting the Two Governance Conversations

Somewhere along the way, governance became two different conversations - one in the boardroom and one in the server room.

If you’ve ever sat in a meeting where half the room talked about strategy while the other half talked about controls, you’ve experienced this split firsthand. Over time, the term GOVERNANCE has been stretched to cover both the strategic coordination between technology and business (Big G Governance) and the operational oversight of technology processes (little g governance). Both matter, but they serve very different purposes.

This distinction between Big G Governance and Little g governance is critical, because without clarity on which altitude you’re operating at, governance efforts can easily talk past each other or lose focus on value creation.

The Two Altitudes of Governance

Big G Governance: The Strategic Altitude

Big G Governance operates at the enterprise level — aligning technology with the business strategy. It’s not about managing systems; it’s about steering direction.

The IT Governance Institute (ITGI, now part of ISACA) once defined five core components of Technology Governance that remain as relevant as ever:

1. Strategic Alignment: ensuring technology initiatives advance business goals.
2. Risk Alignment: understanding how technology risks affect enterprise risks and vice versa.
3. Resource Alignment: aligning people, skills, and assets to support business and technology priorities.
4. Performance Alignment: Establishing technology performance objectives and expectations for delivering outcomes.
5. Value Delivery: confirming that technology investments reduce friction and deliver measurable business value. Don’t confuse Performance Alignment with Value Delivery. Technology can exceed performance expectations without delivering the expected value to the organization.

(Note: ITGI actually referred to items 2, 3, and 4 as Management rather than Alignment. I’ve changed this distinguish between the tactical management activities in little g governance and the strategic Big G Governance activities.)

These pillars found their way into COBIT’s Evaluate, Direct, Monitor (EDM) domain. This is the “Governance” domain that helps organizations govern risk and ensure accountability at the highest level.

Little g Governance: The Operational Altitude

Little g governance lives closer to the ground in the processes, policies, and controls that keep technology reliable, compliant, and safe. You see it in data governance, AI governance, cybersecurity governance, and similar disciplines.

It’s about:

• Defining expectations and requirements.
• Monitoring processes to ensure compliance.
• Managing exceptions when things drift off course.

Little g governance should be built into the practices outlined in COBIT’s key domains:

• Align, Plan, Organize — defining organizational structures and alignment mechanisms.
• Build, Acquire, Implement — translating strategic plans into tangible systems and solutions.
• Deliver, Service, Support — ensuring operations and service management deliver as expected.
• Monitor, Evaluate, Assess — reviewing and improving performance and compliance.

These domains are operational by nature and tactical in focus. It’s not less important, but it’s a different altitude entirely.

Trail Leadership: A Governance Analogy

Both Big G Governance and Little g governance require continuous communication and leadership — just as hikers must regularly check in, adjust their course, and confirm they’re still moving toward the same destination.

Think of Big G and little g governance like two levels of leadership on a long hike.

• Big G Governance chooses the destination and plans the route - ensuring everyone agrees on where we’re headed and why.
• Little g governance maintains the trail - marking the path, monitoring conditions, and keeping hikers from straying too far from safety.

Without Big G Governance, you’re hiking without a map. Without little g governance, you’re wandering off the trail. The best expeditions have both - a clear destination and disciplined trail management along the way.

Why Many Organizations Struggle

In my experience, most technology organizations place greater emphasis on in little g governance. They focus on the mechanics - controls, dashboards, audits - but neglect the altitude where governance connects to business direction.

For example, I’ve seen large enterprises implement dozens of dashboards and controls in pursuit of maturity, yet still miss critical business shifts because no one paused to ask if those controls served the organization’s evolving goals. In one case, a firm spent millions refining incident response metrics but failed to align them with business resilience priorities—leaving leadership blindsided when a major outage halted customer operations.

When Big G is missing, governance becomes an inward-looking exercise. It polices the trail but forgets to ask whether it’s still leading to the right summit.

The result? Technology runs efficiently, but not necessarily strategically. It becomes a well-tuned engine driving toward the wrong mountain.

Bridging the Two Altitudes

The most effective technology leaders don’t pick one altitude - they bridge them.  Here’s how:

• Translate oversight into alignment. Frame process metrics in business terms (e.g., how data governance improves decision confidence, not just compliance rates).
• Bring governance to the table. Make technology risk, performance, and value part of enterprise-level discussions.
• Connect the roles. Create feedback loops between governance boards (Big G) and process owners (little g).
• Use shared language. Replace technical jargon with the business language of outcomes, efficiency, and resilience.
• Measure the success between altitudes. Use integrated KPIs that connect Big G Governance objectives to Little g governance execution. These metrics reveal how strategic intentions translate into operational results and where adjustments are needed to maintain alignment.

What I See in Practice

Across assessments and advisory engagements, I often find that “governance”means something different to every team. The security group defines it one way, risk another, and IT operations yet another - often with no bridge between them.

Mature organizations treat governance as a collaboration and a conversation, not a checklist. They understand that Big G and little g aren’t competing for attention - they’re two altitudes of the same climb.

---

Big G Governance and little g governance don’t compete; they complete each other. The art of Governance is knowing when to climb higher - and when to walk the trail.

If your technology governance only looks inward, ask yourself: who’s steering the hike?