![]()
CHAPTER 1:
IT GOVERNANCE DEFINED
Governance, as explained in the Introduction, is distinct from management. Any governance frameworkāincluding an IT governance frameworkāmust identify the role of an organisationās governing body, and align that with the governing bodyās role as described in the OECD Principles of Corporate Governance, revised in 2004, and as originally described in the Cadbury Report on Corporate Governance of 1992.
The UKās revised Combined Code (2004) now explicitly states that all directors are required to āprovide entrepreneurial leadership of the company within a framework of prudent and effective controls which enable risk to be assessed and managedā16. This statement recognises the need for a risk management framework and leaves little room for imprudent risk-taking by boards. Directorsā duties in the UK have now been enshrined in statute by their explicit inclusion in the Companies Act 2006.
IT governance is a āframework for the leadership, organisational structures and business processes, standards and compliance to these standards, which ensure that the organisationās IT supports and enables the achievement of its strategies and objectivesā17.
In the future, IT governance will be even more important than corporate governance is today: information and IT are absolutely fundamental to business survival, and organisations that fail to ādirect and controlā their IT to best competitive advantage should expect to be left as road kill on the information superhighway.
The five major drivers of IT governance (which are explored further in subsequent chapters) are:
1 The search for competitive advantage in the dynamically changing information economy, through intellectual assets, information and IT.
2 Rapidly evolving governance requirements across the OECD, underpinned by capital market and regulatory convergence.
3 Increasing information- and privacy-related legislation (IT regulatory compliance).
4 The proliferation of threats to intellectual assets, information and IT (and the consequent need for a structured approach to information security and business continuity).
5 The need to align technology projects with strategic organisational goals, ensuring that they deliver planned value (project governance).
ISO/IEC 38500, published in 2008, is the first international standard explicitly addressed to the governing body of an organisation. It deals specifically with the governance of ICT. It recognises that, in smaller organisations, the members of the governing body may also have roles in management. In this way, the standard makes itself applicable to organisations of all sizes, regardless of purpose, design or ownership structure.
Any effective IT governance framework is likely to encompass and include a number of management systems, standards and methodologies, starting with ISO/IEC 38500. Control Objectives for Information Technology (COBITĀ®), the IT Infrastructure LibraryĀ® (ITILĀ®), ISO/IEC 27001 (2005), the Zachman Framework, the Open Group Architecture Framework (TOGAF), PRINCE2ā¢, and M_o_RĀ® are just some of the frameworks and standards that may help an organisation structure its approach to IT governance. The Calder-Moir Framework18, described in Chapter 12 of this guide onwards, can be described as a meta-model, providing a conceptual approach to organising and deploying this multiplicity of tools; none of these frameworks and standards should overshadow the core responsibility of the board of directors to take forward the governance of IT.
Clearly, for IT governance to be effective within any organisation, board members need to familiarise themselves with their obligations in respect of their organisationās IT; they also need to ensure that they are sufficiently well-informed, as a body, to hold their management to account for evolving and delivering an aligned IT strategy that adds significant competitive value to the organisation.
![]()
CHAPTER 2:
INTELLECTUAL CAPITAL AND THE INFORMATION ECONOMY
The drivers for IT governance have to be understood in the context of the twenty-first centuryās information, or knowledge, economy, because this economy is fundamentally different from the old manufacturing one. The globalisation of markets, products and resourcing has led to increasingly similar shopping streets selling very much the same products throughout the developed worldā #8212;and to much of the world experiencing the same economic downturn.
Over 70% of workers in developed economies are now knowledge, rather than manual, workersāincluding those factory and farm workers whose work depends on understanding and using information technology. Information, networking and telecommunications connectivity make this āglobal villageā possibleābut bring numerous threats and challenges at the same time.
The key characteristics of this global information economy are:
ā¢ Information and knowledge are not depleting resources to be protected; on the contrary, sharing knowledge drives innovation.
ā¢ Effects of location and time are diminishedāvirtual organisations now operate round the clock in virtual marketplaces, so that organisations based in east coast America can manufacture in China, handle customer support from India, and sell globally through a single website.
ā¢ Laws and taxes are difficult to apply effectively on a national basis as knowledge quickly shifts to low-tax, low-regulation environments.
ā¢ Knowledge-enhanced products command price premiums.
ā¢ Captured knowledge has a greater intrinsic value than āknowledge on the hoofā.
ā¢ The speed of economic, technological and business change can be extremely fast, has a global footprint and can undermine successful business models virtually overnight.
ā¢ Interconnected supply changes bring significant commercial advantagesāand significant business risks.
Customer communication and information sharingā #8212;particularly through what is known as Web 2.0 sitesācan have significant impacts, both positive and negative, on the success or otherwise of global, national and regional brands and businesses.
In a very real sense, knowledge grows as it is shared; more knowledge leads to more innovation, which drives more competition, which in turn drives more globalisation. Greater interconnectedness and the āalways onā economy bring much greater risks.
In the pre-digital manufacturing economy, an organisationās key asset was its productive capability: its machinery, logistical support and distribution equipment, and its stocks of raw materials and finished goods. In the information age, an organisationās key asset is its intellectual capital19, the combination of its human, structural and market capitals.
Every organisation with a long-term desire to survive and succeed in its chosen market has to focus on preserving, protecting, developing and applying its intellectual capital for the benefit of its shareholders.
Intellectual capital is made up of human, structural and market capital. Simplistically:
ā¢ Human capital is made up of the individual competences of the employees in a firm, of its team capabilities, and of knowledge, which includes skills, expertise, experience, and contacts. This knowledge can be both implicit (or tacit: peopleās know-how) and explicit (that is, it can be documented, in which case it becomes a datum, a piece of information, for someone else).
ā¢ Structural capital is made up of the organisationās āhardā intangible assets (patents, copyrights and other intellectual property, software, databases, documents, methodologies), its standards, attitudes and values, its objectives (particularly strategic), and its processes.
ā¢ Market capital is made up of corporate and product branding (including reputation and public perception); supply-chain, partner, and (especially) customer relationships; and market momentum.
There is a high level of interdependence between these three components and they all fundamentally depend on information, knowledge and information technology.
The Balanced Scorecard system emerged in the late 1990s to provide an āintegrated set of measurements that link current customer, internal process, employee, and system performance to long-term financial successā20. It ātranslates mission and strategy into objectives and measures, o...
