An IT Standard Once Required Saying Whether Investments Paid Off

← Back · ACT II · Chapter 7: Value Is Not Promised; It Is Proven

The profession once wrote down the obligation to say whether a technology investment delivered what it promised. That standard no longer stands on its own, and nothing has taken its place.

A purchase is governed when somebody is obliged to say, on the record, whether the value arrived. Most of the machinery an enterprise owns is built to answer a different question, and answers it well.

The profession did write a standard for the first question once. ISACA published Val IT through its IT Governance Institute, and the second edition in 2008 organized twenty-two processes into three domains. The three domains were Value Governance, Portfolio Management and Investment Management. Reading the process list now is a strange experience, because it describes a duty that almost nobody carries today.

The clearest of them is the last process in the investment domain. It required that every investment program be brought to an orderly close, and it defined closure two ways: when there was agreement that the desired business value had been achieved, or when it was clear it would not be. A named decision, either way, that the money had or had not bought what it was spent for. That is the sentence I would put in front of any executive currently approving an AI budget.

What Happened To It

Val IT does not stand on its own now. ISACA’s current catalog lists COBIT 2019 as its framework for the governance and management of enterprise information and technology and files the COBIT 5 material under archived publications. There is no current Val IT publication to adopt or certify against.

The value question was moved inside a broader framework whose stated job was the other one. Val IT’s own documentation drew the line without any ambiguity: Val IT focused on the investment decision, meaning are we doing the right things, and on the realization of benefits, meaning are we getting them, while COBIT focused on execution, meaning are we doing them the right way and getting them done well.

That distinction carries the whole argument. Execution and control are worth governing, and this is not a complaint about either. But an enterprise can run a technically excellent program, on time, inside budget, fully compliant, and still have bought nothing. The instrument written to catch that case was folded into an instrument that is not looking for it.

The People Who Own The Surviving Framework Have Started To Say So

In August 2026, Mark Thomas, a long-standing ISACA governance practitioner and COBIT assessor, published a piece on ISACA’s own blog about what he calls governance debt. He set out seven gaps he sees in nearly every engagement. One of them he named the value blind spot, and he described it in a single line: effort and spend are measured; outcomes are assumed.

He is right, and he is describing exactly what the change produced. His remedy is to use the surviving framework as it was designed to be used, which is a reasonable position for him to hold and a testable one. My reading of the same evidence is narrower. Effort and spend get measured because counting them is already part of someone’s job. Declaring the outcome stopped being anyone’s job once the standard that required it lost its standing, so the outcome is left to assumption.

Why This Is Current Rather Than Historical

The gap sat quietly for years because technology spend was large but slow. It is no longer slow. An enterprise signing agentic AI commitments is being asked to accept outcome claims at a pace no approval cycle was built for, and the one part of the professional record that demanded a verdict on whether those claims held is the part that was absorbed.

I am not arguing for the restoration of a 2008 document. Val IT was written for capital programs with defined start and end dates, and a great deal of current technology spend has neither. The point is narrower and harder to dismiss. The profession has already demonstrated that it knows how to write this obligation down, in detail, with process numbers against it. Then it stopped maintaining it as a standard in its own right, and in the years since, every body that might have picked it up has covered something adjacent instead: the contract, the spend, the vendor’s internal process, the delivery program. Those are real concerns, and none of them asks whether the purchase delivered.

So the buyer is left holding a question that nobody publishes an instrument for. That will not be corrected by another framework, because the parties who publish frameworks are not the party the answer would embarrass. It gets corrected the first time a buyer writes the obligation into their own governance and declines to close a program without a verdict on it. The verdict does not need to be elaborate. It needs a date, a named person, the outcome that was claimed at approval, what was actually observed against it, and a plain statement of whether the two match. Five fields, filed where the next approval decision can read them. That is a standard, whether or not anyone certifies it.

Related: When One Person Tracks Purchase Results, the Record Leaves Too and The New AI Economics Standard Measures Labor Replaced.

Sources: Steven De Haes, Dirk Gemke, John Thorp and Wim Van Grembergen, “Analyzing IT Value Management at KLM Through the Lens of Val IT,” ISACA Journal, 1 September 2011, which sets out the Val IT 2.0 domains and process list and cites IT Governance Institute, Enterprise Value: Governance of IT Investments, The Val IT Framework 2.0, 2008. Mark Thomas, “The Framework to Manage Frameworks: COBIT and the Governance Gap,” ISACA Now Blog, 4 August 2026. ISACA COBIT resource catalog, read 26 August 2026.

Keep reading: ACT II · Chapter 7: Value Is Not Promised; It Is Proven