Want FREE Templates on Digital Transformation? Download our FREE compilation of 50+ slides. This is an exclusive promotion being run on LinkedIn.







Flevy Management Insights Case Study
ISO 38500 Corporate Governance Framework for D2C Health Supplements Brand


There are countless scenarios that require ISO 38500. Fortune 500 companies typically bring on global consulting firms, like McKinsey, BCG, Bain, Deloitte, and Accenture, or boutique consulting firms specializing in ISO 38500 to thoroughly analyze their unique business challenges and competitive situations. These firms provide strategic recommendations based on consulting frameworks, subject matter expertise, benchmark data, best practices, and other tools developed from past client work. Let us analyze the following scenario.

Reading time: 9 minutes

Consider this scenario: The organization in question operates within the direct-to-consumer (D2C) health supplements space and has been grappling with aligning its IT governance to the principles of ISO 38500.

Despite robust market growth and a loyal customer base, the company's strategic use of IT has not been fully optimized, leading to inefficiencies, increased operational risks, and stunted innovation. The objective is to recalibrate the organization's IT governance to better support business strategy and compliance with ISO 38500, ensuring sustainable growth and competitive advantage.



The company's recent expansion has surfaced underlying IT governance issues that may be impeding growth and compliance. The hypothesis is that the organization's current IT governance framework is not fully aligned with ISO 38500, which may be causing strategic misalignment and operational inefficiencies. Another hypothesis is that there is a lack of clarity in roles and responsibilities within IT governance, leading to ineffective decision-making and resource management.

Strategic Analysis and Execution Methodology

Addressing the organization's IT governance challenges requires a structured, phased approach, drawing from industry-standard methodologies to ensure thorough analysis and effective implementation. This methodology will benefit the organization by providing a clear roadmap to align IT governance with business objectives and ISO 38500 compliance.

  1. Assessment and Benchmarking: The initial phase involves an assessment of the current IT governance framework against ISO 38500 standards. Key questions include: How does the current governance structure compare to ISO 38500? What are the gaps in compliance? This phase will involve stakeholder interviews, documentation review, and benchmarking against industry best practices.
  2. Strategic Alignment: This phase focuses on aligning IT governance with business strategy. Key activities include defining the strategic role of IT, establishing clear governance objectives, and ensuring that IT investments are in line with business priorities. The potential insight is identifying misalignments and opportunities to leverage IT for strategic advantage.
  3. Framework Development: Here, the development of a tailored IT governance framework based on ISO 38500 principles takes place. Activities include drafting governance policies, defining roles and responsibilities, and setting up governance structures. This phase aims to create a robust framework that facilitates effective decision-making and oversight.
  4. Implementation Planning: The focus shifts to planning the implementation of the new governance framework. This involves creating a detailed implementation roadmap, defining success metrics, and establishing a communication plan to ensure organization-wide buy-in.
  5. Execution and Change Management: The final phase involves the execution of the implementation plan, along with ongoing change management to address resistance and ensure adoption. Training programs, regular communication, and feedback mechanisms are critical activities in this phase.

Learn more about Change Management Best Practices ISO 38500

For effective implementation, take a look at these ISO 38500 best practices:

ISO/IEC 38500 Training Toolkit (193-slide PowerPoint deck)
Kanban Board: ISO 38500 (Excel workbook)
View additional ISO 38500 best practices

Are you familiar with Flevy? We are you shortcut to immediate value.
Flevy provides business best practices—the same as those produced by top-tier consulting firms and used by Fortune 100 companies. Our best practice business frameworks, financial models, and templates are of the same caliber as those produced by top-tier management consulting firms, like McKinsey, BCG, Bain, Deloitte, and Accenture. Most were developed by seasoned executives and consultants with 20+ years of experience.

Trusted by over 10,000+ Client Organizations
Since 2012, we have provided best practices to over 10,000 businesses and organizations of all sizes, from startups and small businesses to the Fortune 100, in over 130 countries.
AT&T GE Cisco Intel IBM Coke Dell Toyota HP Nike Samsung Microsoft Astrazeneca JP Morgan KPMG Walgreens Walmart 3M Kaiser Oracle SAP Google E&Y Volvo Bosch Merck Fedex Shell Amgen Eli Lilly Roche AIG Abbott Amazon PwC T-Mobile Broadcom Bayer Pearson Titleist ConEd Pfizer NTT Data Schwab

Executive Audience Considerations

An executive might question the adaptability of the IT governance framework in the face of rapidly evolving technology trends. To address this, the framework includes a continuous improvement process to regularly review and update governance policies in line with technological advancements and market changes. Another consideration is the integration of the governance framework with existing business processes to ensure seamless operations, for which the methodology incorporates a thorough analysis of process interdependencies and integration strategies. Lastly, executives may be concerned about measuring the impact of the framework, which is why we emphasize defining clear KPIs and success metrics upfront.

The expected business outcomes post-implementation include improved strategic alignment of IT investments, enhanced compliance with ISO 38500, reduced operational risks, and fostered innovation. The organization can anticipate a more agile IT governance structure that can quickly adapt to changing market demands.

Implementation challenges may include resistance to change from staff accustomed to existing processes, the complexity of integrating new governance structures with legacy systems, and the need for ongoing education and leadership support to ensure adoption.

Learn more about Continuous Improvement Agile Operational Risk

ISO 38500 KPIs

KPIS are crucial throughout the implementation process. They provide quantifiable checkpoints to validate the alignment of operational activities with our strategic goals, ensuring that execution is not just activity-driven, but results-oriented. Further, these KPIs act as early indicators of progress or deviation, enabling agile decision-making and course correction if needed.


Without data, you're just another person with an opinion.
     – W. Edwards Deming

  • Compliance Rate with ISO 38500 Standards: Measures the extent to which IT governance practices align with the standard, highlighting areas of non-compliance for remediation.
  • IT Strategic Alignment Score: Assesses how well IT initiatives support the overall business strategy, ensuring that technology investments are driving value.
  • IT Project Delivery Success Rate: Tracks the success rate of IT projects in terms of meeting scope, budget, and time objectives, indicative of effective governance.

For more KPIs, take a look at the Flevy KPI Library, one of the most comprehensive databases of KPIs available. Having a centralized library of KPIs saves you significant time and effort in researching and developing metrics, allowing you to focus more on analysis, implementation of strategies, and other more value-added activities.

Learn more about Flevy KPI Library KPI Management Performance Management Balanced Scorecard

Implementation Insights

Throughout the implementation, it became evident that leadership commitment is paramount for successful IT governance transformation. McKinsey research indicates that 70% of complex, large-scale change programs don't reach their stated goals, commonly due to lack of employee engagement and inadequate support from management. This emphasizes the need for C-level executives to actively champion the governance changes.

Another insight pertains to the importance of culture in IT governance. It's not merely about processes and policies; fostering a culture that values compliance, risk management, and strategic alignment is crucial. As per Gartner, organizations that integrate IT governance into their corporate culture achieve 20% higher performance in strategic initiatives.

Learn more about Corporate Culture Risk Management Employee Engagement

ISO 38500 Deliverables

  • IT Governance Framework (PDF)
  • ISO 38500 Compliance Assessment Report (PDF)
  • IT Governance Implementation Roadmap (PowerPoint)
  • Change Management Plan (Word)
  • IT Governance Training Materials (PowerPoint)

Explore more ISO 38500 deliverables

ISO 38500 Case Studies

A Fortune 500 company successfully implemented a new IT governance framework, resulting in a 30% reduction in IT-related incidents and a 25% increase in time-to-market for new digital products. The framework was based on ISO 38500 and led to significant improvements in IT's contribution to business objectives.

A global hospitality brand adopted an IT governance model aligned with ISO 38500, which helped them streamline operations and reduce IT costs by 15% while improving overall customer satisfaction through enhanced digital services.

Explore additional related case studies

ISO 38500 Best Practices

To improve the effectiveness of implementation, we can leverage best practice documents in ISO 38500. These resources below were developed by management consulting firms and ISO 38500 subject matter experts.

Aligning IT Governance to Business Strategy

Ensuring IT governance is fully aligned with business strategy is paramount for the C-suite. The process of alignment involves establishing a clear communication channel between IT and business unit leaders to ensure that IT capabilities are not only meeting current needs but are also adaptable for future demands. This requires a dynamic governance framework that can respond to strategic shifts in the business environment.

According to BCG, companies that tightly align their IT and business strategies can achieve 12% higher revenue growth than their less-aligned competitors. The key is to maintain an iterative dialogue between IT and business stakeholders, facilitated by governance structures that promote collaboration and shared objectives. This ensures that IT investments are driving innovation and competitive advantage in alignment with the strategic direction of the company.

Learn more about Competitive Advantage IT Governance Revenue Growth

Measuring the Impact of IT Governance

Measuring the impact of IT governance on the organization's performance is essential for validating the effectiveness of the implemented framework. This can be achieved by establishing robust KPIs that are tied to business outcomes. For instance, metrics such as IT cost reduction, improvement in service delivery, and increased rate of successful project completions are directly indicative of efficient IT governance.

Accenture reports that companies that excel in IT governance can realize up to a 40% reduction in IT costs while simultaneously improving service quality and agility. By tracking these metrics over time, executives can gauge the health of their IT governance and make informed decisions about where to invest in improvements or course corrections.

Learn more about Cost Reduction

Ensuring Compliance with ISO 38500

Compliance with ISO 38500 is not just a tick-box exercise; it is about embedding the principles of the standard into the organization's IT governance practices. To ensure compliance, it is critical to conduct regular audits and reviews of IT governance processes, comparing them against the ISO 38500 framework. This helps in identifying any gaps and areas for improvement.

Deloitte's insights affirm that organizations with robust compliance processes are better positioned to manage risks and capitalize on opportunities. They are 33% more likely to respond effectively to regulatory changes, and this proactive stance on compliance can serve as a competitive differentiator in the marketplace.

Adapting to Technological Changes

With the rapid pace of technological change, IT governance frameworks must be flexible and adaptable. This means that the framework should not only address current technologies but also have the capacity to evolve with emerging technologies. To achieve this, organizations should incorporate a process of continuous learning and innovation into their IT governance practices.

A study by PwC highlights that technology agility is a key driver of business success, with agile organizations achieving up to three times higher growth than their less agile counterparts. By embedding agility into IT governance, organizations can ensure that they are not only keeping pace with technological advancements but are also positioned to lead in innovation.

Change Management and Staff Engagement

Effective change management is critical to the success of new IT governance initiatives. This involves not only communicating the changes to all stakeholders but also actively engaging them in the process. By involving staff in the development and implementation of the governance framework, organizations can foster a sense of ownership and increase the likelihood of successful adoption.

According to McKinsey, successful change programs are those that fully engage their employees, with those programs being 30% more likely to stick than those that do not. This underscores the importance of change management as a critical component of IT governance transformation.

Legacy Systems and Integration Challenges

Integrating new IT governance frameworks with existing legacy systems presents a significant challenge for many organizations. Legacy systems can be deeply entrenched in an organization's operations, making changes complex and potentially disruptive. However, the integration process can be managed effectively through careful planning, phased rollouts, and continuous feedback mechanisms.

KPMG's research indicates that organizations that adopt a strategic approach to legacy system integration, prioritizing scalability and flexibility, can reduce integration costs by up to 25% while also improving system performance. By viewing legacy systems as an integral part of the IT governance framework rather than a hindrance, organizations can leverage their existing investments while modernizing their governance practices.

Additional Resources Relevant to ISO 38500

Here are additional best practices relevant to ISO 38500 from the Flevy Marketplace.

Did you know?
The average daily rate of a McKinsey consultant is $6,625 (not including expenses). The average price of a Flevy document is $65.

Key Findings and Results

Here is a summary of the key results of this case study:

  • Improved strategic alignment of IT investments, enhancing compliance with ISO 38500 standards.
  • Reduced operational risks through the implementation of a robust IT governance framework.
  • Enhanced IT project delivery success rate, indicative of effective governance.
  • Facilitated a more agile IT governance structure, adaptable to changing market demands.

The initiative has successfully improved strategic alignment of IT investments and compliance with ISO 38500, reducing operational risks and fostering a more agile IT governance structure. The implementation has positively impacted IT project delivery success rates, indicating effective governance. However, challenges were encountered in staff resistance to change, integration with legacy systems, and the need for ongoing education and leadership support. To enhance outcomes, a more comprehensive change management strategy and phased legacy system integration could have been considered.

Next steps should focus on refining the change management strategy to address staff resistance, and implementing a phased approach to legacy system integration. Additionally, ongoing education and leadership support should be prioritized to ensure continued adoption and success of the IT governance framework.

Source: ISO 38500 Corporate Governance Framework for D2C Health Supplements Brand, Flevy Management Insights, 2024

Flevy is the world's largest knowledge base of best practices.


Leverage the Experience of Experts.

Find documents of the same caliber as those used by top-tier consulting firms, like McKinsey, BCG, Bain, Deloitte, Accenture.

Download Immediately and Use.

Our PowerPoint presentations, Excel workbooks, and Word documents are completely customizable, including rebrandable.

Save Time, Effort, and Money.

Save yourself and your employees countless hours. Use that time to work on more value-added and fulfilling activities.




Read Customer Testimonials




Additional Flevy Management Insights

Download our FREE Strategy & Transformation Framework Templates

Download our free compilation of 50+ Strategy & Transformation slides and templates. Frameworks include McKinsey 7-S Strategy Model, Balanced Scorecard, Disruptive Innovation, BCG Experience Curve, and many more.