The IT Skeptic adheres to a purist usage of the word "governance" which aligns closely with the new ISO38500 standard. The word is often used to mean management: running a business unit or function. This is just plain wrong. But somewhere in between is a set of activities in a grey area.

Governors don't set up security policy and they don't detect exceptions and they don't administer or oversee project portfolios (let alone individual projects) and they don't run reports: to me this is clear misuse of the word governance.

Governors don't measure. They consider measurements when monitoring the business, but they don't do the measuring. Governors don't audit. They consider audit results when monitoring the business but they don't perform the audit.

Where it gets grey for me is the activity of collecting, collating and analysing information for the governors; and the activity of implementing, communicating and policing the policies and strategies set by the governors. Even though it probably isn't done by the governors, is it governance?

Perhaps. Or maybe we need a better word, like policing. Personally I'd like to see governance restricted to a strict interpretation as ISO38500 is trying to do, but I suspect the bird has flown.