Domain 4 · Manage the FinOps Practice
Policy in the tool, not in a PDF.
Governance, Policy & Risk is the framework's bridge between business intent and cloud spend. CloudMonitor stores policy as code, logs every evaluation, and enforces RBAC across cost groups — the Run-phase target is policy that evaluates continuously and routes every violation to a named owner, not a quarterly compliance review.
The problem
Policy nobody enforces.
Policy in a PDF.
Tagging standard, naming convention, sizing rules — all in a Sharepoint deck. The engineers it applies to never read it.
No audit trail.
When a policy was applied, who changed it, what slipped through — there's no single log. Audit becomes a treasure hunt.
Bypassed by engineering.
The fast path to delivery skips the central controls. The team apologises afterwards if anyone notices.
How CloudMonitor answers
Policy that evaluates itself, and owners who close it out.
Policy as code.
Rules expressed as code, version-controlled, evaluated nightly. Change-managed like any other production artefact.
Audit log.
Every policy evaluation, change, exception, and override is logged. Audit becomes a query, not a project.
RBAC across cost groups.
Permissions scoped to the cost-group tree. BU champions own their slice; the center keeps oversight without micromanaging.
Auto-routed to the owner — Run phase.
Every violation auto-routes to the named owner with a remediation suggestion attached. That makes the Run-phase target operational — every violation closed by a known owner, inside SLA.
Outcomes
Governance that survives audit.
As-code
Version-controlled, change-managed
RBAC
Scoped to cost groups
Run
Continuous evaluation, owner-routed
Related Capabilities
More in the Manage the FinOps Practice Domain.
Invoicing and Chargeback
Per-cost-group invoices and journal-ready exports to your finance system.
All Manage the FinOps Practice Capabilities
See every Capability in this Domain side by side.
Governance, Policy & Risk in CloudMonitor
Policy and its audit trail, on screen.
Policy and audit log
Every evaluation, change, and exception logged.
Policy results and change history are queryable together, so an audit is a query instead of a treasure hunt. CloudMonitor evaluates the rules and records the outcome, and closing a violation stays with its named owner.
RBAC across cost groups
Access scoped to the cost-group tree.
Permissions follow the cost-group hierarchy — a business-unit champion owns their slice, the center keeps oversight — so accountability has a structure in the tool, not a policy sitting unread in a slide deck.
Source: this page interprets the Manage the FinOps Practice domain published by the FinOps Foundation, licensed under CC BY 4.0. The wording, examples, and product mapping on this page are CloudMonitor’s own.
See policy-as-code with a live audit trail.
The beta applies a policy set, surfaces violations, and auto-routes each remediation suggestion to its owner.
