Domain 4 · Manage the FinOps Practice
Policy in the tool, not in a PDF.
Governance, Policy & Risk is the framework's bridge between business intent and cloud spend. CloudMonitor stores policy as code, logs every evaluation, and enforces RBAC across cost groups — the Run-phase target is policy that evaluates continuously and routes every violation to a named owner, not a quarterly compliance review.
The problem
Policy nobody can find or enforce.
Policy in a PDF.
Tagging standard, naming convention, sizing rules — all in a Sharepoint deck. The engineers it applies to never read it.
No audit trail.
When a policy was applied, who changed it, what slipped through — nothing is logged in one place. Audit becomes a treasure hunt.
Bypassed by engineering.
The fast path to delivery skips the central controls. The team apologises afterwards if anyone notices.
How CloudMonitor answers
Policy that evaluates itself. Owners that close it out.
Policy as code.
Rules expressed as code, version-controlled, evaluated nightly. Change-managed like any other production artefact.
Full audit log.
Every policy evaluation, change, exception, and override logged. Audit becomes a query, not a project.
RBAC across cost groups.
Permissions scoped to the cost-group tree. BU champions own their slice; the centre keeps oversight without micromanaging.
Auto-routed to the owner — Run phase.
Every violation auto-routes to the named owner with a remediation suggestion attached. The Run-phase target — every violation closed by a known owner inside SLA — becomes operational.
Outcomes
Governance that survives audit.
As-code
Version-controlled, change-managed
RBAC
Scoped to cost groups
Run
Continuous evaluation, owner-routed
Related Capabilities
More in the Manage the FinOps Practice Domain.
Invoicing and Chargeback
Per-cost-group invoices and journal-ready exports to your finance system.
All Manage the FinOps Practice Capabilities
See every Capability in this Domain side by side.
Governance, Policy & Risk in CloudMonitor
Policy and its audit trail, on screen.
Policy and audit log
Every evaluation, change, and exception logged.
Policy results and the full change history sit in one view, so an audit is a query instead of a treasure hunt. CloudMonitor evaluates the rules and records the outcome — closing a violation stays with its named owner.
RBAC across cost groups
Access scoped to the cost-group tree.
Permissions follow the cost-group hierarchy — a business-unit champion owns their slice, the centre keeps oversight — so accountability has a structure in the tool, not a policy sitting unread in a slide deck.
Source: this page interprets the Manage the FinOps Practice domain published by the FinOps Foundation, licensed under CC BY 4.0. The wording, examples, and product mapping on this page are CloudMonitor’s own.
See policy-as-code with a live audit trail.
The demo tenant ships a policy set, a live violation, and an auto-routed remediation suggestion sitting with its owner.
