Policy Disc 1

58 C O M M U N I C AT I O N S O F T H E A C M | F E B R U A R Y 2 0 1 5 | V O L . 5 8 | N O . 2

contributed articles D O I : 1 0 . 1 1 4 5 / 2 6 5 6 3 8 5

Business leaders may bemoan the burdens of governing IT, but the alternative could be much worse.

BY CARLOS JUIZ AND MARK TOOMEY

T O G O V E R N , O R not to govern information technology (IT) is no longer a choice for any organization. IT is a major instrument of business change in both private- and public-sector organizations. Without good governance, organizations face loss of opportunity and potential failure. Effective governance of IT promotes achievement of business objectives, while poor governance of IT obstructs and limits such achievement.

The need to govern IT follows from two strategic factors: business necessity and enterprise maturity. Business necessity follows from many actors in the market using technology to gain advantage. Consequently, being relevant and competitive requires organizations to deeply integrate their own IT agendas and strategic business plans to ensure appropriate positioning of technology opportunity and response to technology-enabled changes in the marketplace. Enterprise maturity follows from a narrow focus on operating infrastructure, architecture, and service management of an owned IT asset no longer being

key to development of the organiza- tion. Achieving value involves more diverse arrangements for sourcing, ownership, and control in which the use of IT assets is not linked to direct administration of IT assets. Divest- ment activities (such as outsourcing and adoption of cloud solutions) in- creasingly create unintended barriers to flexibility, as mature organizations respond to new technology-enabled pressure. Paradoxically, contemporary sourcing options (such as cloud com- puting and software-as-a-service) can increase flexibility and responsiveness. Business necessity and enterprise ma- turity thus overlap and feed each other.

The International Standard for Corporate Governance of Information Technology ISO/IEC 385003 was devel- oped in 2008 by experts from govern- ment and industry (http://www.iso.org) who understand the importance of re- setting the focus for governance of IT on business issues without losing sight of technology issues. While it does not say so explicitly, the standard leads to one inescapable three-part conclusion for which business leaders must as- sume responsibility:

Agenda. Setting the agenda for IT use as an integral aspect of business strategy;

Investment. Delivery of investments in IT-enabled business capability; and

Operations. Ongoing successful op- erational use of IT in routine business activity.

Implementation of effective ar-

To Govern IT, or Not to Govern IT?

key insights ˽ Governance of IT is a board and

top-executive responsibility focusing on business performance and capability, not on technology details.

˽ A principles-based approach to the governance of IT, as described in the ISO/IEC 38500 standard, is consistent with broader models for guidance of the governance of organizations and accessible to business leaders without specific technology skills.

˽ Adopting ISO/IEC 38500 to guide governance of IT helps leaders plan, build, and run IT-enabled organizations.

F E B R U A R Y 2 0 1 5 | V O L . 5 8 | N O . 2 | C O M M U N I C AT I O N S O F T H E A C M 59

I M

A G

E B

Y A

N D

R I

J B

O R

Y S

A S

S O

C I

A T

E S

/S H

U T

T E

R S

T O

C K

rangements for governance of IT must also address the need for organizations to ensure value creation from invest- ment in IT. Lack of good IT governance risks inappropriate investment, failure of services, and noncompliance with regulations.

Following de Haes and Van Grem- bergen,2 proper governance of IT is needed to ensure investments in IT generate required business value and that risks associated with IT are miti- gated. This latest consideration to val- ue and risk is closer to the principles of good governance, but there remains in management-based published guid- ance on IT governance a predominant- ly procedural approach to the require- ment for effective governance of IT.

IT Governance and Governance of IT The notion of IT governance has ex- isted since at least the late 1990s, pro- ducing diverse conflicting definitions. These definitions and the models that underpin them tend to focus on the supply of IT, from alignment of an or- ganization’s IT strategy to its business strategy to selection and delivery of IT projects to the operational aspects of IT systems. These definitions and models should have improved the capability of organizations to ensure their IT activi- ties are on track to achieve their busi- ness strategies and goals. They should also have provided ways to measure IT performance, so IT governance should be able to answer questions regarding how the IT department is functioning

and generating return on investment for the business.

Understanding that older defini- tions and models of IT governance focus on the internal activities of the IT department leads to the realization that much of what has been called “IT governance” is in fact “IT manage- ment,” and confusion has emerged among senior executives and IT man- agers regarding what exactly is gov- ernance and management (and even operation) of IT. The reason for this confusion is that the frontiers between them may be somewhat blurred and by a propensity of the IT industry to inap- propriately refer to management activi- ties as IT governance.12

There is widespread recognition

60 C O M M U N I C AT I O N S O F T H E A C M | F E B R U A R Y 2 0 1 5 | V O L . 5 8 | N O . 2

contributed articles

Lack of good IT governance risks inappropriate investment, failure of services, and noncompliance with regulations.

Corporate governance includes de- velopment of mechanisms to control actions taken by the organization and safeguard stakeholder interests as ap- propriate.4 Private and public organi- zations are subject to many regulations governing data retention, confidential information, financial accountability, and recovery from disasters.7 While no regulations require a governance-of- IT framework, many executives have found it an effective way to ensure reg- ulatory compliance.6 By implementing effective governance of IT, organiza- tions establish the internal controls they need to meet the core guidelines of many regulations.

Some IT specialists mistakenly think business leaders cannot govern IT, since they lack technology skills. Understanding the capability IT brings or planning new, improved business capability enabled by smarter, more ef- fective use of IT does not require spe- cialized knowledge of how to design, build, or operate IT systems. A useful metaphor in this sense is the automo- bile; a driver need not be a designer or a manufacturing engineer to operate a taxi service but must understand the capabilities and requirements for the vehicles used to operate the service.

Governance of IT Standardization Australian Standard AS 8015, pub- lished in 2005, was the first formal standard to describe governance of IT without resorting to descriptions of management systems and processes. In common with many broader guides for corporate governance and gover- nance in the public sector, AS 8015 took a principles-based approach, focusing its guidance on business use of IT and business outcomes, rather than on the technical supply of IT. ISO/IEC 38500, published in 2008, was derived from AS 8015 and is the first international standard to provide guidelines for gov- ernance of IT. The wording for the defi- nition for governance of IT in AS 8015 and its successor, ISO/IEC 38500, was deliberately aligned with the definition of “corporate governance” in the Cad- bury report.1

Since well before release of either AS 8015 or ISO/IEC 38500, many orga- nizations have confused governance and management of IT. This confusion is exacerbated by efforts to integrate

that IT is not a standalone business resource. IT delivers value only when used effectively to enable business capability and open opportunities for new business models. What were previously viewed as IT activities should instead be viewed as business activities that embrace the use of IT. Governance of IT must thus include important internal IT management functions covered by earlier IT gover- nance models, plus external functions that address broader issues of setting and realizing the agenda for the busi- ness use of IT. Governance of IT must embrace all activities, from defining intended use of IT through delivery and subsequent operation of IT-en- abled business capability.

We subscribe to the definition that governance of IT is the system to direct and control use of IT. As reinforced re- peatedly through major government- and private-sector IT failures, control of IT must be performed from a busi- ness perspective, not an IT perspective. This perspective, and the definition of governance of IT, requires business leaders come to terms with what they can achieve by harnessing IT to enable and enhance business capability and focus on delivering the most valuable outcomes. Governance of IT must pro- vide clear and consistent visibility of how IT is used, supplied, and acquired for everyone in the organization, from board members to business users to IT staff members.5

“Governance of IT” is equivalent to “corporate governance of IT,” “en- terprise governance of IT,” and “orga- nizational governance of IT.” Gover- nance of IT has its origins in corporate governance. Corporate governance objectives include stewardship and management of assets and enterprise resources by the governing bodies of organizations, setting and achiev- ing the organization’s purpose and objectives, and conformance9 by the organization with established and ex- pected norms of behavior. Corporate governance is an important means of dealing with agency problems (such as when ownership and management interests do not match). Conflicts of in- terest between owners (shareholders), managers, and other stakeholders— citizens, clients, or users—can occur whenever these roles are separated.8

F E B R U A R Y 2 0 1 5 | V O L . 5 8 | N O . 2 | C O M M U N I C AT I O N S O F T H E A C M 61

contributed articles

some aspects of governance in com- mon de facto standards for IT man- agement, resulting in these aspects of governance being described in man- agement systems terms. In an effort to eliminate confusion, we no longer refer to the concept of IT governance, focusing instead on the overarching concepts for governance of IT and the detailed activities in IT management (see Figure 1).

Figure 2 outlines the final draft (issued November 2014) conceptual model for governance of IT from the proposed update of ISO/IEC 38500 and its relation with IT management. As the original ISO/IEC project editor for ISO/IEC 38500, author Mark Toomey12 has presented evolved versions of the original ISO/IEC 38500 model that convey more clearly the distinction be- tween governance and management activities and the business orientation essential for effective use of IT from the governance viewpoint. Figure 2 integrates Toomey’s and the ISO/IEC 38500’s current draft model to maxi- mize understanding of the interdepen- dence of governance and management in the IT context.

In the ISO/IEC 38500 model, the governing body is a generic entity (the individual or group of individuals) responsible and accountable for per- formance and conformance (through control) of the organization. While ISO/IEC 38500 makes clear the role of the governing body, it also allows that such delegation could result in a sub- sidiary entity giving more focused at- tention to the tasks in governance of IT (such as creation of a board commit- tee). It also includes delegation of de- tail to management, as in finance and human resources. There is an implicit expectation that the governing body will require management establish systems to plan, build, and run the IT- enabled organization.

An informal interpretation of Fig- ure 2, focused on business strategy and projects, is that there is a continuous cycle of activity that can simultaneous- ly operate at several levels:

Evaluation. The governing body evaluates the organization’s overall use of IT in the context of the business environment, directs management to perform a range of tasks relating to use of IT, and continues to monitor the use

Figure 1. Main ISO/IEC standards of IT management and governance of IT.

Management of IT

ISO/IEC 38500 Governance of IT

Governance of IT

ISO/IEC 15504 Information Technology

Process Assessment

ISO/IEC 25000 Software Product Quality

Requirements and Evaluation

ISO/IEC 20000 IT Service

Management

ISO/IEC 19770 Software Asset

Management

ISO/IEC 27000 Information Security

Management Systems

Figure 2. Model for governance of IT derived from the current Final Draft International Standard ISO/IEC 38500.3

The Governing Body

Managers and Management Systems for the use of IT

Evaluate

MonitorDirect

Build the IT-enabled

business

Run the IT-enabled

business

S ou

rce of A

u th

ority

Regulatory

Obligations

Business

Pressures

St ak

eh ol

de r

Ex pe

ct at

io ns

Bu si

ne ss

Ne ed

s

B u

sin ess g

oals, d eleg

ation s,

ap p

roved strateg

y, p

rop osals, p

lan s

A ssessm

en ts, proposals, plan

s: • strateg

y • in

vestm en

t • op

eration s

• p olicy

P lan

th e

IT -en

ab led

b u

sin ess

B u

sin ess an

d m

arket evolu

tion , p

eform an

ce, con

form an

ce

62 C O M M U N I C AT I O N S O F T H E A C M | F E B R U A R Y 2 0 1 5 | V O L . 5 8 | N O . 2

contributed articles

Strategy. Plan, supply, and use IT to best support the organization;

Acquisition. Invest in new and ongo- ing use of IT;

Performance. Ensure IT performs well with respect to business needs as required;

Conformance. Ensure all aspects of decision making, use, and supply of IT conforms to formal rules; and

Human behavior. Ensure planning, supply, and use of IT demonstrate re- spect for human behavior.

These principles and activities clarify the behavior expected from implementing governance of IT, as in Stachtchenko:10

Stakeholders. Stakeholders del- egate accountability and stewardship to the governance body, expecting in exchange that body to be accountable for activities necessary to meet expec- tations;

Governance body. The governance body sets direction for management of the organization, holding manage- ment accountable for overall perfor- mance; and

Stewardship role. The governance body takes a stewardship role in the

of IT with regard to business and mar- ketplace evolution;

Assessment. Business and IT units collaboratively develop assessment proposals and plans for business strat- egy, investment, operations, and policy for the IT-enabled business; and

Implementation. The governing body evaluates the proposed assess- ment proposals and plans and, where appropriate, directs that they should be adopted and implemented; the gov- erning body then monitors implemen- tation of the plans and policies as to whether they deliver required perfor- mance and conformance.

Regarding management scope, as outlined in Figure 2, managers must im- plement and run the following activities:

Plan. Business managers, sup- ported by technology, organization development, and business-change professionals plan the IT-enabled business, as directed by the governing body, proposing strategy for the use of IT and investment in IT-enabled busi- ness capability;

Build. Investment in projects to build the IT-enabled business are un- dertaken as directed by and in con-

formance with delegation, plans, and policies approved by the board; project personnel with business-change and technology skills then work with line managers to build IT-enabled business capability;

Run. To close the virtuous cycle, once the projects become a reality, managers deliver the capability to run the IT-enabled business, supported by appropriate management systems for the operational use of IT; and

Monitor. All activities and systems involved in planning, building, and running the IT-enabled business are subject to ongoing monitoring of mar- ket conditions, performance against expectations, and conformance with internal rules and external norms.

ISO/IEC 38500 set out six principles for good corporate governance of IT that express preferred organizational behavior to guide decision making. By merging and clarifying the terms for the principles from AS 8015 and ISO/ IEC 38500, we derive the following summary of the principles:

Responsibility. Establish appropri- ate responsibilities for decisions relat- ing to the use and supply of IT;

Figure 3. Coverage area for behavior-oriented governance and management of IT, linking corporate and key assets (own elaboration from Weill and Ross14).

Corporate Governance

Governance of IT

Stakeholders

Direction

Accountability

Shareholders

Monitoring

Leadership

Board

Senior Executive Team

Key Assets

Strategy Desirable Behavior

Human Assets

Financial Assets

Physical Assets

Relationship Assets

IT and Information Assets

IP Assets

HR Management

Processes

Financial Management

Processes

Physical Management

Processes

Relationship Management

Processes

IP Management

Processes

IT Management Processes

F E B R U A R Y 2 0 1 5 | V O L . 5 8 | N O . 2 | C O M M U N I C AT I O N S O F T H E A C M 63

contributed articles

The best process model is often readily defeated by poor human behavior.

traditional sense of assuming respon- sibility for management of something entrusted to one’s care.

Governance of IT: Process-Oriented vs. Behavior-Oriented Van Grembergen13 defined governance of IT as the organizational capac- ity exercised by the board, executive management, and IT management to control formulation and implementa- tion of IT strategy, ensuring fusion of business and IT. Governance consists of leadership, organizational struc- tures, and processes that ensure the organization’s IT sustains and extends the organization’s strategy and objec- tives. This definition is loosely consis- tent with the IT Governance Institute’s definition4 that governance of IT is part of enterprise governance con- sisting of leadership, organizational structures, communication mecha- nisms, and processes that ensure the organization’s IT sustains and extends the organization’s strategy and objec- tives. However, both definitions are more oriented to processes, structures, and strategy than the behavioral side of good governance, and, while em- bracing the notion that effective gov- ernance depends on effective manage- ment systems, tend to focus on system aspects rather than on true governance of IT aspects.

Weill and Ross14 said governance of IT involves specifying the decision rights and accountability framework to produce desired behavior in the use of IT in the organization. Van Grem- bergen13 said governance of IT is the responsibility of executives and senior management, including leadership, organizational structures, and process- es that ensure IT assets support and ex- tend the organization’s objectives and strategies. Focusing on how decisions are made underscores the first ISO/IEC 38500 principle, emphasizing behavior in assigning and discharging responsi- bility is critical for deriving value from investment in IT and to the organiza- tion’s overall performance.

Governance of IT must thus include a framework for organizationwide de- cision rights and accountability to en- courage desirable behavior in the use of IT. Within the broader system for gov- ernance of IT, IT management focuses

on a small but critical set of IT-related decisions, including IT principles, enterprise architecture, IT infrastruc- ture capabilities, business application needs, and IT investment and prioriti- zation.14 Even though governing IT and its core is deeply behavioral, this set of IT-related decisions defines the imple- mentation framework. These decision rights define mainly who makes deci- sions delegated by the governing body and what decisions they make, along with how they do it. Focusing on deci- sion rights intrinsically defines behav- ioral rather than process aspects of the governance of IT.

Likewise, process-oriented IT man- agement as described in Control Ob- jectives for Information and Related Technology, or COBIT (http://www. isaca.org/cobit), and similar frame- works is also part of the governance of IT, ensuring IT activities support and enable enterprise strategy and achievement of enterprise objectives. However, focusing primarily on IT management processes does not en- sure good governance of IT. IT man- agement processes define mainly what assets are controlled and how they are controlled. They do not gener- ally extend to broader issues of setting business strategy influenced by or set- ting the agenda for the use of IT. Nor do they extend fully into business ca- pability development and operational management intrinsic to the use of IT in most organizations. The latest ver- sion of COBIT—COBIT 5—includes the ISO/IEC 38500 model for the first time. However, there is a quite fun- damental and significant difference between ISO/IEC 38500 and COBIT 5 and is a key focus of our research. Whereas ISO/IEC 38500 takes a behav- ioral stance, offering guidance about governance behavior, COBIT 5 takes a process stance, offering guidance about process, mainly suggesting au- ditable performance metrics rather than process descriptions.

Process-oriented IT management frameworks, including processes for extended aspects of management dealing with the business use of IT, are frequently important, especially in larger organizations, but are insuf- ficient to guarantee good governance and management because they are at risk of poor behavior by individu-

64 C O M M U N I C AT I O N S O F T H E A C M | F E B R U A R Y 2 0 1 5 | V O L . 5 8 | N O . 2

contributed articles

mance, and value should be normal be- havior in any organization, generating business value from investment in and the ongoing operation of IT-enabled business capability, with appropriate accountability for all stakeholders.

Acknowledgment This work was partially supported by the Spanish Ministry of Economy and Competitiveness under grant TIN2011-23889.

References 1. Cadbury, A. (chair). Report of the Committee on the

Financial Aspects of Corporate Governance. Burgess Science Press, London, U.K., 1992.

2. de Haes, S. and Van Grembergen, W. IT governance and its mechanisms. Information Systems Control Journal 1 (2004), 1–7.

3. ISO/IEC. ISO/IEC 38500: 2008 Corporate Governance of Information Technology. ISO/IEC, Geneva, Switzerland, June 2008; http://www.iso.org/ iso/catalogue_detail?csnumber=51639

4. IT Governance Institute. Board Briefing on IT Governance, Second Edition. IT Governance Institute, Rolling Meadows, IL, 2003; http://www.isaca.org/ restricted/Documents/26904_Board_Briefing_final.pdf

5. Juiz, C. New engagement model of IT governance and IT management for the communication of the IT value at enterprises. Chapter in Digital Enterprise and Information Systems, E. Ariwa and E. El-Qawasmeh, Eds. Communications in Computer and Information Science Series, Vol. 194. Springer, 2011, 129–143.

6. Juiz, C., Guerrero, C., and Lera, I. Implementing good governance principles for the public sector in information technology governance frameworks. Open Journal of Accounting 3, 1 (Jan. 2014), 9–27.

7. Juiz, C. and de Pous, V. Cloud computing: IT governance, legal, and public-policy aspects. Chapter in Organizational, Legal, and Technological Dimensions of Information System Administration, I. Portela and F. Almeida, Eds. IGI Global, Hershey, PA, 2013, 139–166.

8. Langland, A. (chair). Good Governance Standard for Public Services. Office for Public Management Ltd. and Chartered Institute of Public Finance and Accountancy, London, U.K., 2004; http://www.cipfa. org/-/media/Files/Publications/Reports/governance_ standard.pdf

9. Professional Accountants in Business Committee of the International Federation of Accountants. International Framework, Good Governance in the Public Sector: Comparison of Principles. IFAC, New York, 2014; http://www.ifac.org/sites/default/files/ publications/files/Comparison-of-Principles.pdf

10. Stachtchenko. P. Taking governance forward. Information Systems Control Journal 6 (2008), 1–2.

11. Toomey, M. Another governance catastrophe. The Infonomics Letter (June 2010), 1–5.

12. Toomey, M. Waltzing With the Elephant: A Comprehensive Guide to Directing and Controlling Information Technology. Infonomics Pty Ltd., Victoria, Australia, 2009.

13. Van Grembergen, W. Strategies for Information Technology Governance. Idea Group Publishing, Hershey, PA, 2004.

14. Weill, P. and Ross, J.W. IT Governance: How Top Performers Manage IT Decision Rights for Superior Results. Harvard Business School Press, Cambridge, MA, 2004.

Carlos Juiz ([email protected]) is an associate professor at the University of the Balearic Islands, Palma de Mallorca, Spain, and leads the Governance of IT Working Group at AENOR, the Spanish body in ISO/IEC.

Mark Toomey ([email protected]) is managing director at Infonomics Pty Ltd., Melbourne, Australia, and was the original ISO project editor of ISO/IEC 38500.

© 2015 ACM 0001-0782/15/02 $15.00

als and groups within and sometimes even external to the organization. The best process model is often readily de- feated by poor human behavior. We see evidence of poor behavior in many in- vestigations of failed IT projects (such as the Queensland Audit Office 2009 review of Queensland Health Payroll11). On the other hand, good behavior en- sures conformance with an effective process model and compensates for deficiencies in weaker process models.

In any effective approach to the governance of IT, the main activities described in ISO/IEC 38500—direct, evaluate, monitor—must be per- formed following the six principles of this standard and must guide behavior with respect to IT management.

Good corporate governance is not the only reason for organizations to improve governance of IT. From the outset, most discussions iden- tify “stakeholder value drivers” as the main reason for organizations to up- grade governance of IT. Stakeholder pressure drives the need for effective governance of IT in commercial or- ganizations. Lack of such pressure may explain why some public services have less effective governance of IT.12 The framework depicted in Weill and Ross14 has been expanded for gover- nance of IT (see Figure 3), showing the connection between corporate gover- nance and key-assets governance.

Figure 3 emphasizes the system for governance of IT extends beyond the narrow domain of IT-management processes. The board’s relationships are outlined at the top of the frame- work. The senior executive team is commissioned by the board to help it formulate strategies and desirable behaviors for the organization, then implement the strategies and behav- iors. Six key asset classes are identified below the strategy and desirable be- haviors. In this framework, governance of IT includes specifying the decision rights and accountability framework responsibilities (as described in ISO/ IEC 38500) to encourage desirable be- havior in the use of IT. These respon- sibilities apply broadly throughout the organization, not only to the CIO and the IT department. Governance of IT is not conceptually different from gov- erning other assets (such as financial, personnel, and intellectual property).

Strategy, policies, and accountability thus represent the pillars of the organi- zation’s approach to governance of IT.

This behavioral approach is less influenced by and less dependent on processes. It is conducted through de- cisions of governance structures and proper communication and is much more focused on human communities and behaviors than has been proposed by any process-oriented IT manage- ment model.

Conclusion Focusing on technology rather than on its use has yielded a culture in which business leaders resist involvement in leadership of the IT agenda. This cul- ture is starkly evident in many analy- ses of IT failure. Business leaders have frequently excused themselves from a core responsibility to drive the agenda for business performance and capabil- ity through the use of all available re- sources, including IT.

Governance of IT involves evaluat- ing and directing the use of IT to sup- port the organization and monitoring this use to achieve business value. As defined in ISO/IEC 38500, governance of IT drives the IT management frame- work, requiring top-down focus on producing value through effective use of IT and an approach to governance of IT that engages business leaders in appropriate behavior. Governance of IT includes business strategy as the principle agenda for the use of IT, plus the policies that drive appropri- ate behavior, clear accountability and responsibility for all stakeholders, and recognition of the interests and behaviors of stakeholders beyond the control of the organization.

Using ISO/IEC 38500 to guide gover- nance of IT, regardless of which mod- els are used for management systems, ensures governance of IT has appropri- ate engagement of the governing body, with clear delegation of responsibility and associated accountability. It also provides essential decoupling of gover- nance oversight from management de- tail while preserving the ability of the governing body to give direction and monitor performance.

Asking whether to govern IT, or not to govern IT should no longer be a question. Governing IT from the top, focusing on business capability, perfor-

Copyright of Communications of the ACM is the property of Association for Computing Machinery and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.