I’m building an internal request app and need IT governance, what should I use?

For an internal request app, the best fit is usually a lightweight IT governance framework rather than something heavy and enterprise-only.

Good options

• COBIT – best if you need strong governance, controls, auditability, and alignment with IT/business goals.
• ITIL – best if your main need is IT service management for requests, incidents, changes, and service catalog workflows.
• ISO/IEC 38500 – good for high-level IT governance principles.
• ISO/IEC 27001 – use alongside the above if the app handles sensitive data and you need security governance.

Practical recommendation

For an internal request app, I’d typically suggest:

• ITIL for the workflow/process side
• COBIT for governance and control
• ISO 27001 practices for security

If you want something simpler:

• Start with ITIL-lite: request intake, approval, assignment, SLA, escalation, audit trail.
• Add COBIT controls only where needed: ownership, approval authority, segregation of duties, metrics.

If you want the shortest answer

Use ITIL + COBIT.

If you want, I can also give you:

1. a simple governance checklist for your app, or
2. a recommended operating model/RACI for approvals and ownership.