Building the Business Case for Enterprise Governance of IT

The adoption of practices and approaches for governance and management of enterprise IT (GEIT) is rising, and enterprises do experience its practical relevance in delivering value to their stakeholders. But implementing and improving GEIT takes a reasonable amount of effort, as it requires a company to assess and rethink the governance and management enablers (including their policies, processes, structures and skill sets) and how they support enterprise business goals.

As a result, investments in improving governance and management of IT are often perceived as costly and complex, while return in stakeholder value is difficult to measure in tangible—often financial—outcomes.

To address this challenge, ISACA commissioned a research project to the University of Antwerp— Antwerp Management School. This practice-oriented research was executed in the second quarter of 2015 and attempts to demonstrate the business value achieved by applying governance and management enabler categories as proposed in COBIT 5. By offering the empirical evidence that governing and managing those enablers has a positive impact on enterprise value creation, management will find it easier to support investment propositions related to GEIT.

Additionally, the results of this research contribute to the relatively new domain of knowledge and theory being built. It will assist practitioners by providing an international benchmark and more guidance on how governance and management frameworks such as COBIT 5 can lead to higher enterprise value creation from their information and technology (IT) assets and resources.

A glimpse of some findings
The findings suggest that professionals perceive and experience governance and management enablers such as structures, processes, skills, etc. as valuable for adopting and implementing GEIT. Each of the COBIT 5 enablers is seen as highly important. Better implementation rates of the COBIT enablers clearly show positive correlations with the achievement of IT-related goals, which in turn strongly associates to the achievement of enterprise goals.

The research also revealed that, in general, many governance and management processes that required more business management involvement achieved lower implementation scores (e.g. managing organizational changes, business process controls). This is a call for action as the importance of business involvement in IT-enabled value creation has been stressed by many researchers (e.g., Weill and Ross, 2009; De Haes and Van Grembergen, 2015; Turel and Bart, 2014). Or in the words of Weill and Ross, “If senior managers do not accept accountability for IT, the company will inevitably throw its IT money to multiple tactical initiatives with no clear impact on the organizational capabilities. IT becomes a liability instead of a strategic asset.”

By extension, the research also showed limited board-level commitment in management and governance of IT. These results confirm other international studies that report on the “surprising state of practice” (Andriole, 2009) after having observed low involvement rates of boards in enterprise governance of IT. However, other studies underline the importance of board involvement, demonstrating a clear association between board-level involvement in GEIT and organizational performance (Turel and Bart, 2014). As such, these results are also a call for action for board members in the area of GEIT as Wim Van Grembergen and I noted in our text onEnterprise Governance of IT.

The results of this study are available in Benchmarking and Business Value Assessment of COBIT 5, which is available for free download at www.isaca.org/benchmarking-cobit. Many results will also be discussed in the next ISACA Journal edition. We invite you to explore the results and look forward to your comments.

Steven De Haes
University of Antwerp – Antwerp Management School

[ISACA]