IT governance: linking technology accountability to institutional objectives

IT governance is the accountability structure that links an institution's technology decisions to its objectives and keeps them under board control.

For South African public institutions and complex private entities, clear technology accountability is what aligns digital investment with the legal mandate and the statutory duties.

Why IT governance is accountability, not tooling

In many complex organisations, technology governance is mistaken for an internal technical process run by the IT department. That is a costly misconception, because software merely executes workflows while executive leadership stays legally accountable for the institution's outcomes, its financial control and its regulatory compliance. Under the PFMA as administered by National Treasury, public-sector governance is built around an outputs- and accountability-driven approach rather than narrow administrative compliance.

IT governance therefore has to work as an executive oversight discipline that binds technology spending to the organisation's strategy and its legal obligations. Recognised IT-governance frameworks, such as COBIT, exist to help structure these oversight mechanisms, but the underlying legal accountability is set by statute.

Boards, accounting officers and accounting authorities have to establish the structures that decide how a technology decision is evaluated and how digital risk is managed. By framing technology governance around statutory accountability rather than technical tooling, leadership keeps digital investment subordinate to institutional purpose, financial discipline and public oversight.

Linking technology decisions to institutional objectives

Institutional objectives define why a technology investment exists and what it must deliver. Under the PFMA as administered by National Treasury, public financial management promotes good financial management that maximises service delivery through the efficient use of limited resources. A public entity does not exist to acquire digital platforms for their own sake; it exists to fulfil its mandate and meet the performance targets it reports against predetermined objectives. Every major technology decision should therefore serve a clear statutory purpose and contribute to institutional performance.

When leadership evaluates a digital investment through that outputs lens, selection stops being an arbitrary procurement and becomes a controlled strategic investment. Defining the performance target before procuring the system prevents scope creep, eliminates wasteful expenditure, and keeps the digital capability strengthening the core workflows.

Accountability for data protection and compliance

Where a platform collects or processes personal information, the IT-governance structure has to carry explicit data-protection accountability. POPIA sets conditions that establish minimum requirements for the lawful processing of personal information by public and private bodies. It expressly addresses data-subject rights on automated decision-making and unsolicited electronic communications, and it sets strict rules for the cross-border transfer of personal information.

Independent oversight and enforcement sit with the Information Regulator of South Africa, an independent body established in terms of section 39 of POPIA, subject only to the Constitution and the law and accountable to the National Assembly. Empowered to enforce compliance with POPIA and the Promotion of Access to Information Act, the Regulator monitors how institutions handle data. In terms of section 55 of POPIA, a responsible party must register its information officer on the Regulator's Information Officer Portal before that officer assumes their duties.

Under the PFMA as administered by National Treasury, public-sector governance is built around an outputs- and accountability-driven approach rather than narrow administrative compliance.

— Synthesis of South African regulatory guidance

Embedding internal controls and independent assurance

A resilient IT-governance structure depends on effective internal controls and independent testing to verify that the systems hold. Under the PFMA as administered by National Treasury, accounting officers and accounting authorities carry a statutory duty to operate basic financial management systems and maintain robust internal controls. Those controls include the automated validation routines, the user-access permissions and the audit logs that protect the financial records and the operational reporting against error or fraud.

To confirm that the controls actually work, Chapter 9 of the PFMA obligates the appointment and composition of audit committees across public-sector institutions. The audit committee reviews the control mechanisms, evaluates the risk-management arrangements, and examines the independent assurance over the technology infrastructure. IT governance has to embed the internal controls in the daily workflow and give the audit committee uncorrupted data to verify that the systems are reliable.

Who is accountable

Ultimate accountability for IT governance rests with executive leadership and cannot be transferred to technical staff or an external consultant. The PFMA sets a clear division of responsibility between the political head, who owns policy and outcomes, and the accounting officer or accounting authority, who owns outputs, implementation, the basic systems and the budget. Accounting officers and accounting authorities carry non-delegable fiduciary duties to operate the basic systems, enforce internal controls, and submit accurate performance reports against predetermined objectives.

Under the PFMA as administered by National Treasury, an accounting officer or accounting authority who acts negligently faces strict disciplinary sanctions, up to dismissal, and potential prosecution for financial misconduct. Boards, accounting officers and accounting authorities must direct the IT-governance strategy actively and enforce strict personal accountability across the digital operation — they cannot delegate that ownership to the IT function or to a framework.

What good looks like

Exemplary IT governance in a complex South African institution is marked by clear leadership accountability, robust internal controls, and alignment between the technology decisions and the statutory mandate. Well-governed organisations weigh every digital investment against the predetermined objectives under the PFMA, keeping public resources used efficiently and effectively. They embed the POPIA conditions into the technical systems, respect the rules on automated decision-making and cross-border transfers, and keep their information officer registered on the Information Officer Portal of the Information Regulator under section 55.

Accounting officers, accounting authorities, information officers and the audit committees appointed under Chapter 9 of the PFMA keep active oversight of the digital assets. Grounding technology oversight in the legal duties is what makes IT governance a genuine enabler of institutional integrity, public accountability and sustainable value.

Related insights

• POPIA in Practice: a 2026 Data-Protection Baseline
• Cyber security as a board and institutional risk-management question
• IT audit and technology assurance: questions for the audit committee