Skip to main content
Regulatory Council
Commerce Security logo, "All 12 PCI DSS Requirements in Plain English," "Get it now for free," "Complete Survival Guide" and a button toclick to get it
Category: GRC Governance Frameworks

Val IT

Also known as: Value from IT investments, Val IT Framework
Simply put

Val IT is a governance framework developed by ISACA to help organizations decide how to invest in technology-enabled change and demonstrate the business value gained from those IT investments. It focuses on making sure IT spending delivers worthwhile benefits rather than on the technical delivery of IT itself. In practice, it provides guiding principles and management practices to support investment decisions.

Formal definition

Val IT is an enterprise governance framework developed by ISACA for the governance of IT-enabled business investments, aimed at maximizing the realization of business value from technology investments. It is built on a set of guiding principles supported by a collection of IT-related business processes (described in various sources as approximately 20 to 22 processes) with associated key management practices, management guidelines, and maturity models. As a voluntary governance framework rather than a regulatory obligation, its adoption and application vary by organization; practitioners should consult the primary ISACA publications for the authoritative process set, definitions, and current framework status, as framework content and its relationship to related ISACA guidance may evolve across editions.

Why it matters

Technology investments frequently consume a significant share of an organization's budget, yet the business value they deliver is often assumed rather than demonstrated. Val IT addresses a persistent governance gap: the distinction between delivering an IT project on time and on budget, and actually realizing the intended business benefits from that investment. By focusing on value governance rather than technical delivery, the framework helps boards and executives ask whether IT-enabled change is worth doing, whether it is being done in the right way, and whether the anticipated benefits are being achieved.

For governance professionals, Val IT is relevant because investment decisions about technology are ultimately governance decisions, concerning who holds decision rights, how portfolios of initiatives are prioritized, and how accountability for benefits realization is assigned. Poor investment governance can leave organizations funding initiatives that do not advance strategic objectives or failing to capture value from those that could. Val IT offers guiding principles and management practices intended to make these decisions more disciplined and their outcomes more transparent.

As a voluntary framework developed by ISACA rather than a regulatory obligation, Val IT is adopted at the discretion of the organization, and its application varies considerably by context. Practitioners considering it should note that its content and its relationship to related ISACA guidance may evolve across editions, so authoritative process definitions and current framework status should be verified against the primary ISACA publications.

Who it's relevant to

Governance professionals and boards
Val IT speaks directly to those responsible for directing and controlling the organization, particularly around decision rights and accountability for technology-enabled investments. It supports questions of whether an investment should be made, whether it aligns with strategic objectives, and how benefits realization is governed, matters that sit within the governance pillar rather than technical IT delivery.
IT and technology executives
For CIOs and technology leaders, Val IT provides principles and management practices to demonstrate the business value gained from IT investments, helping shift the conversation from delivery of technical outputs toward realization of business benefits. The maturity models can help these leaders assess and improve their investment governance practices.
Finance and investment decision-makers
Because Val IT concerns how organizations decide to invest in technology-enabled change and how they confirm value is achieved, it is relevant to those involved in capital allocation, portfolio prioritization, and benefits tracking for technology initiatives.
Internal auditors and assurance providers
Val IT's management practices and maturity models offer reference points against which assurance professionals can evaluate the discipline of an organization's IT investment governance. Auditors should note that, as a voluntary framework, its adoption is discretionary, so any evaluation should be framed against the practices the organization has actually chosen to adopt rather than a regulatory requirement.

Inside Val IT

Value Governance
The domain concerned with establishing the governance structures, roles, and decision rights that direct how IT-enabled investments create and sustain value. It typically addresses leadership accountability, integration with enterprise governance, and the definition of value-related processes and reporting. This element aligns primarily with the governance pillar.
Portfolio Management
The domain focused on managing the overall set of IT-enabled investments as a portfolio, including prioritization, resource allocation, and balancing of investments against defined criteria and constraints. It typically emphasizes selecting the right mix of investments to optimize value within the organization's risk appetite and available capacity.
Investment Management
The domain addressing the management of individual IT-enabled investment programs across their life cycle, from business case development through realization and retirement. It often covers evaluation of expected benefits, costs, and associated uncertainty for each investment.
Business Case Orientation
A recurring element emphasizing that investments be justified and monitored through a business case that articulates expected benefits, costs, and risks. Val IT positions the business case as a living instrument rather than a one-time approval document, though the specific content and rigor typically vary by organization and framework edition.
Relationship to Related Frameworks
Val IT is commonly described as complementary to broader IT governance guidance, addressing the value dimension of IT-enabled investment decisions. Practitioners should verify the current status, edition, and integration of Val IT content against the primary source, as governance framework materials evolve over time.

Common questions

Answers to the questions practitioners most commonly ask about Val IT.

Is Val IT the same thing as COBIT, or does it replace it?
No. Val IT is not a replacement for COBIT; the two are complementary. Val IT was developed by the same body (the IT Governance Institute, associated with ISACA) and is generally positioned to work alongside COBIT. Where COBIT has historically focused on the governance and management of IT processes and controls broadly, Val IT concentrates specifically on the governance of IT-enabled investments and the realization of business value from them. In later developments, much of the Val IT thinking was absorbed into and aligned with the broader COBIT framework, so treating them as rival alternatives misrepresents their intended relationship. Organizations should verify the current status and integration of these materials against ISACA's primary sources, as framework structures evolve across editions.
Does Val IT only concern the IT function or the technology department?
Not primarily. Although the name references IT, Val IT is concerned with the governance of IT-enabled business investments, which typically extend well beyond the technology function. The value from such investments generally depends on business change, process redesign, and organizational adoption, not on technology alone. Accountability for realizing value under this approach is therefore usually framed as a business responsibility rather than something owned solely by an IT department. Positioning Val IT as a purely technical or IT-departmental concern understates its intended scope, which spans decision rights and accountability across business and IT stakeholders.
How does Val IT relate to an organization's investment portfolio decisions?
Val IT is often applied to help organizations select, prioritize, and manage IT-enabled investments as a portfolio rather than as isolated projects. In practice this typically involves establishing decision rights over which investments are funded, defining the business case elements required for approval, and monitoring investments through their lifecycle against expected benefits. It sits within the governance pillar because it concerns the structures and decision-making by which investment direction is set and controlled. Specific portfolio criteria and thresholds vary by organization and should be tailored to context; the framework provides principles rather than prescriptive rules.
What role does the business case play in a Val IT approach?
The business case is often central to Val IT, serving as a living document rather than a one-time approval artifact. The approach typically emphasizes that a business case should capture expected benefits, costs, risks, and the assumptions on which value depends, and that it should be revisited across the investment lifecycle as circumstances change. This supports ongoing decisions about whether to continue, adjust, or terminate an investment. The rigor and format of business cases will differ by organization size and sector, and organizations should adapt the depth of analysis to the materiality of the investment.
How can an organization measure whether value is actually being realized?
Under this approach, value realization is typically monitored by defining expected benefits at the outset, assigning accountability for delivering them, and tracking actual outcomes against those expectations over time. This often requires linking investment objectives to measurable business results and reviewing them at defined points rather than assuming benefits materialize automatically once a project is delivered. Because benefits frequently depend on business change and adoption, measurement usually needs to extend beyond project completion. Suitable metrics are context-dependent and should be agreed with the accountable business stakeholders; no single measurement set applies universally.
What governance structures typically support a Val IT implementation?
Implementation generally depends on clear governance structures that establish who holds decision rights over IT-enabled investments and who is accountable for benefit realization. This often includes defined roles for executive sponsors, investment or portfolio oversight bodies, and business owners responsible for outcomes, together with processes for approving, monitoring, and reviewing investments. The aim is to ensure that direction is set and controlled at an appropriate level rather than left implicit. The specific bodies and reporting lines vary considerably by organization, and effective structures should be integrated with existing governance arrangements rather than created in parallel. Where structures intersect with legal or regulatory obligations, those requirements should be confirmed with appropriate professional advice.

Common misconceptions

Val IT is a risk management framework that identifies and treats IT risks.
Val IT is primarily oriented toward the governance of value from IT-enabled investments, spanning the governance pillar more than risk management. While investment decisions inherently involve uncertainty, Val IT's focus is on directing and controlling value creation rather than serving as a dedicated risk identification and treatment methodology. Risk considerations are typically one input among several to investment decisions.
Applying Val IT guarantees that IT investments will deliver their expected value.
No governance framework can guarantee investment outcomes. Val IT is intended to improve the structures, accountability, and decision processes that support value realization, which can modify the likelihood and management of value shortfalls but does not eliminate the underlying uncertainty. Outcomes remain dependent on execution, external conditions, and factors outside the framework's scope.
Val IT is a binding regulatory requirement that organizations must adopt.
Val IT is guidance and leading practice rather than a binding legal or regulatory obligation. Its adoption is voluntary, and applicability and relevance vary by organization size, sector, and jurisdiction. Where regulatory obligations touch on IT governance, they arise from applicable laws and regulations rather than from Val IT itself.

Best practices

Treat the business case as a living document, revisiting expected benefits, costs, and risks across the investment life cycle rather than only at the point of initial approval.
Establish clear governance roles and decision rights for IT-enabled investments, and integrate value governance with broader enterprise governance structures to avoid siloed decision-making.
Manage IT-enabled investments as a portfolio, applying consistent prioritization criteria and balancing the mix against the organization's risk appetite and available capacity.
Distinguish value governance activities from risk and compliance activities, coordinating with those functions where investment decisions depend on risk assessments or regulatory considerations.
Verify the current edition, status, and integration of Val IT content against the primary source before relying on specific structures or terminology, since governance framework materials evolve over time.
Define and monitor value-related reporting so that leadership has visibility into whether investments are progressing toward their expected benefits, while recognizing that outcomes cannot be guaranteed.
Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide