ISACA: The Real Challenge of 2026 Isn't Missing Technology — It's a Governance Gap

On August 4, 2026, ISACA published a column by expert Mark Thomas on what he calls "governance debt" — the gap that builds up when organizations layer new technologies and policies on top of outdated governance structures instead of modernizing them. His argument: the answer isn't inventing a new framework for every emerging risk, but using COBIT as a meta-framework that ties disparate governance models together.

That lands especially well for AI: when a company adopts a third-party model, it transfers the operations but keeps the accountability — Thomas puts it as "borrowed model, owned risk." He traces the same pattern through cloud computing: with each wave — client/server, cloud infrastructure, platform-as-a-service — computing moves further out of direct control, and governance needs to be inherited from the layer before it, not reinvented from scratch.

One line of his stuck with us: "if it isn't documented and operating, it never happened." That's essentially what we check for in a COBIT IT audit — not the technology itself, but whether there's a working decision-making system behind it, not just a policy on paper.