SAMA IT Governance Framework (ITGF)

01

What is the SAMA IT Governance Framework?

The Saudi Central Bank (SAMA) Information Technology Governance Framework (ITGF) sets expectations for governing information technology in entities within its scope. It links oversight and strategic direction with risk management, service operations and controlled system change. It is not simply a technical checklist: leadership responsibilities, decision rights, policies, risk oversight and evidence of operating practices all matter.

The official framework is structured around four domains: IT Governance & Leadership; IT Risk Management; IT Operations Management; and System Change Management. Each domain includes objectives and control requirements in the published framework. Assessment should preserve those distinctions and use the current official wording. A mapping to another standard can help organise evidence, but does not substitute for evaluating the SAMA requirements themselves.

A good governance model makes decisions visible: who approves technology strategy, owns risk, accepts exceptions, authorises changes and monitors service performance. It also connects technology decisions to business services and critical dependencies. The framework’s applicability, relevant entity obligations and any supervisory direction must be confirmed for the organisation in question.

02

Who needs to assess ITGF?

Institutions within SAMA’s applicable scope should involve executive sponsors, IT leadership, cybersecurity, risk, compliance, procurement, business service owners and internal audit as appropriate. Each function contributes different evidence. Shared platforms and outsourced providers require a clear division between the regulated institution’s oversight and the supplier’s delivery responsibilities.

A governance assessment can be useful before a technology transformation, following a significant control change, or when responsibilities and evidence are fragmented. It should not assume that all technology risk sits with the IT department. Business owners, senior management and governing bodies have defined roles in an effective operating model.

03

How the review works

We first confirm the entity and framework version, define boundaries, agree stakeholders and identify material services and providers. The evidence plan may include governance charters, strategy, risk methodology, committee records, service inventories, architecture, policies, operational metrics, incident and change records, supplier oversight and audit findings.

Interviews and sample reviews test how the four domains work together. Governance & Leadership examines direction, accountability and oversight. IT Risk Management reviews identification, assessment, treatment and monitoring. IT Operations Management examines service, access, continuity, incident and supplier practices in scope. System Change Management follows planning, testing, approval, release and post-change review. Exact testing follows the published control requirements and agreed scope.

Findings distinguish missing design, inconsistent execution, insufficient evidence and unresolved applicability questions. Owners validate factual details before risk ranking. A practical roadmap sequences foundational governance, risk and operational improvements, then identifies dependencies and measurable closure evidence. If implementation support is requested, design and delivery responsibilities are documented separately.

Retesting checks whether selected changes operate as intended; it does not by itself certify the institution. Management should retain a decision log, approve risk acceptance and maintain ongoing oversight. A sustainable framework integrates with existing risk and service-management processes rather than creating a parallel paperwork system.

04

Typical outputs

A tailored engagement can provide:

• Applicability, scope and evidence plan tied to the current ITGF publication.
• A four-domain assessment matrix with evidence, observations and limitations.
• A prioritised gap register and roadmap with accountable owners and dependencies.
• Executive briefing, detailed findings and optional control-design or retest support.

05

Indicative schedule

A focused entity review may take several weeks. Multiple legal entities, outsourced environments, fragmented records and deep operational sampling can extend the work. The schedule depends on stakeholder access, evidence readiness and approval cycles. It is indicative and agreed after scoping; neither a timeline nor a gap report guarantees supervisory acceptance.

Plan around committee calendars, operational change windows and provider evidence requests. Early agreement on a decision owner and escalation path reduces delays. If a critical issue emerges, communicate it promptly through the agreed governance process instead of waiting for the final presentation.

06

Official source

The SAMA Rulebook publishes the Information Technology Governance Framework: https://rulebook.sama.gov.sa/en/information-technology-governance-framework . Review the current text, structure, scope and any relevant entity-specific direction before setting assessment criteria.