IT Governance

Guidelines for Directors

Alan Calder

• Éditeur: IT Governance Ltd
• Année: 2005
• ISBN:
  9781849281058
• Sujet: Business
• Sous-sujet: Corporate Governance

Aligning IT with the business is a key board objective. Better shareholder returns, greater competitiveness and fewer compliance issues are typical benefits of an IT governance framework.

This is not a technology book.It has been written specifically for those directors, managers and their professional advisers who want to leverage IT more effectively to compete in our information economy.

It argues that getting real value from IT is about leadership and shows how the board and CEO can take that lead - and avoid security breaches, project failure, compliance exposure, reputation damage, job loss and jail time. It’s a book for business leaders of today - and tomorrow.

CHAPTER 1:
WHY IT GOVERNANCE MATTERS

In the 21^st Century, IT governance is, within the broader corporate governance context, critical for all organizations. Those without an IT governance strategy face significant risks; those with one perform measurably better.

Governance background

The ‘greed is good’ business philosophy of the 1980s and 1990s seemed to give way, at the end of the 20^th Century, to a ‘looting is good’ approach. Catastrophic financial failure is, of course, a characteristic of the business cycle Looting has happened before: BICC and Maxwell Communications are good examples. Corporate collapse, originating in a failure of internal control, has happened before: Baring is an instance. The spate of collapses and financial failures at the end of the Internet bubble, though, suggested a systemic weakness, and one whose increasingly worldwide implications have a significant, negative knock-on effect on already problematic pension funds and pensioner assets. Enron, Worldcon, Marconi, Parmalat and many other corporate disasters are the storm damage of unbridled executive authority; shareholders are no longer enthusiastic about losses on this scale.

Governments, already grappling with the challenge of funding the pensions of an inexorably graying population bulge, cannot afford further wanton asset destruction and have started applying themselves to rooting out corporate misbehavior. They are doing this through a combination of overt regulatory action and slightly more covert pressure on institutional investors to stand up for their rights as shareholders and more determinedly exercise their de facto responsibility to insist on proper governance from those organizations in which they are invested.

The concept of governance is a simple one: ‘corporate governance is the system by which business corporations are directed and controlled.’¹⁵ The ‘holy trinity’ of good corporate governance has long been seen as shareholder rights, transparency and board accountability. While corporate governance is overtly concerned with board structure, executive compensation and shareholder reporting, the underlying assumption is that it is the board that is responsible for managing the business and controlling the risks to its assets and trading future.

In today’s corporate governance environment, where the value and importance of intellectual assets are significant, boards must be seen to extend the core governance principles - setting strategic aims, providing strategic leadership, overseeing and monitoring the performance of executive management and reporting to shareholders on their stewardship of the organization – to the organization’s intellectual capital, information and IT. A culture of opaqueness is out of line with today’s expectation of pro-activity and governance transparency. Boards that treat IT as merely a functional or operational issue simply don’t ‘get it’; directors who are not pro-active in understanding the strategic importance of, and operational risks in, intellectual capital, information and communications technology, are – at best – a drag on the effectiveness of their boards. As younger companies, controlled and managed by people who have grown up with IT and its possibilities, transform the business landscape, so those boards that fail to respond can expect their businesses to be destroyed – and whether the destruction is piece by piece or wholesale is, in the long run, irrelevant.

IT governance is a framework for the leadership, organizational structures and business processes, standards and compliance to these standards, which ensure that the organization’s IT supports and enables the achievement of its strategies and objectives. In the future, IT governance will be even more important than corporate governance is today: information and IT are absolutely fundamental to business survival, and organizations that fail to ‘direct and

¹⁵ OECD Principles of Corporate Governance, 1999

control’ their IT to best competitive advantage will be left as roadkill on the information superhighway.

The five major drivers of IT governance are:

1. The search for competitive advantage – in the dynamically changing information economy - through intellectual assets, information and IT;

2. Rapidly evolving governance requirements across the OECD, underpinned by capital market and regulatory convergence;

3. Increasing information and privacy related legislation (compliance);

4. The proliferation of threats to intellectual assets, information and IT;

5. The need to align technology projects with strategic organizational goals, ensuring they deliver planned value (‘project governance’)

Guideline for Directors: there is no simple technology IT governance solution for this need, whatever vendors say. IT governance, like corporate governance, is about board accountability for the management of the organization.

Information economy, intellectual capital

The new information, or knowledge, economy is (as we all know) fundamentally different from the old manufacturing economy. The globalization of markets, products and resourcing has lead to increasingly similar shopping streets selling increasingly similar products throughout the developed world. In the less developed world, counterfeit versions of western products usually sell just as well. Over 70 percent of workers in developed economies are now knowledge, rather than manual, workers – including those factory and farm workers whose work depends on understanding and using information technology. Information networking and telecommunications connectivity make this ‘global village’ possible – and bring numerous other threats and challenges at the same time.

The key characteristics of the global information economy, in contrast to those of the older manufacturing one, are:

• Information and knowledge are not depleting resources to be protected; on the contrary, sharing knowledge drives innovation;

• Effects of location and time are diminished – virtual organizations now operate round the clock in virtual marketplaces, and organizations based on east coast America manufacture in China, handle customer support from India, and sell globally through a single web site;

• Laws and taxes are difficult to apply effectively on a national basis as knowledge quickly shifts to low tax, low regulation environments;

• Knowledge enhanced products command price premiums;

• Captured knowledge has a greater intrinsic value than ‘knowledge on the hoof’.

In a very real sense, knowledge grows as it is shared; more knowledge leads to more innovation, which drives more competition which in turn drives more globalization, and so on.

In the manufacturing economy, an organization’s key asset was its productive capability: its machinery, logistical support and distribution equipment, and its stocks of raw materials and finished goods. In the information age, an organization’s key asset is its intellectual capital: its human resources, retained knowledge, structural capital and intangible assets. Every organization with a long term desire to survive and succeed in its chosen market has to focus on preserving, protecting, developing, and applying its intellectual capital for the benefit of its shareholders.

Intellectual capital depends, for its productive existence, on information and communication technology: proper IT governance is, therefore, fundamental to both the proper governance and the long term survival of any 21^st century organization.

Competitiveness

In 2005, Singapore displaced the United States as the top economy in information technology competitiveness, according to the World Economic Forum’s Global Information Technology Report¹⁶. Iceland, Finland and Denmark followed Singapore, knocking the US down to fifth place after three years at the top. ICT (Information and Communications Technologies), observed the report, is ‘increasingly playing the catalytic role in pushing the development process forward.’

The same is true for business. IT is neither low-cost nor low-impact. It is investment-intensive. Innovation is common; speed of innovation and deployment can be critical in developing and maintaining competitive advantage. Organizations must respond pro-actively to change within their markets or see their competitive position eroded and ultimately destroyed. Schumpeter called the process ‘Creative Destruction’: the ‘process of Creative Destruction is the essential fact about capitalism…every business strategy acquires its true significance only against the background of that process and with the situation created by it. It must be seen in its role in the perennial gale of creative destruction; it cannot be understood irrespective of it or, in fact, on the hypothesis that there is a perennial lull…’¹⁷

IT on its own and of itself is not, however, necessarily a source of competitive advantage. The way it is used by an organization may be source of competitive advantage but, in many situations, IT is already commoditized and organizations have to ensure that their systems and processes are as good as (or no worse than) those of their competitors, in order to ensure they don’t fall behind in key performance areas.

In the post Internet-bubble era, we no longer believe that the Internet changes everything immediately. IT WILL TAKE A LITTLE

¹⁶ www.weforum.org/gitr has the full report and the comparative 2004 and 2003 rankings.

¹⁷ Capitalism, Socialism and Democracy, Joseph A Schumpeter, 1975

LONGER. Not much longer though: ICT makes revolutionary business models¹⁸ possible and dramatically transforms the business environment. The fact that online security is an issue only slows down the speed with which online banking, financial services and other e-commerce applications develop, but the final outcome is not in doubt. The Internet does enable small businesses everywhere to compete with larger ones, globally; digital communication speeds up outsourcing, customer awareness and reputation destruction. Instant messaging, voice over IP, spyware and sequential auto-responders are technologies as disruptive as CRM (Customer Response Management), HRM (Human Resource Management) and ERP (Enterprise Resource Planning) systems were in their day. OF course, the Internet doesn’t replace the need for a real business strategy, or for generating real economic returns for shareholders;...

Table des matières

• About the author
• CONTENTS
• INTRODUCTION
• CHAPTER 1: WHY IT GOVERNANCE MATTERS
• CHAPTER 2: GOVERNANCE AND RISK MANAGEMENT
• CHAPTER 3: INTELLECTUAL CAPITAL
• CHAPTER 4: COMPLIANCE
• CHAPTER 5: INFORMATION RISK
• CHAPTER 6: SYSTEM DEPLOYMENT AND PROJECT RISK
• CHAPTER 7: DESIGNING AN IT GOVERNANCE FRAMEWORK
• CHAPTER 8: IT GOVERNANCE IN ACTION
• CHAPTER 9: ISSUES FOR THE PUBLIC SECTOR AND NOT-FOR-PROFIT ORGANIZATIONS
• CHAPTER 10: IT’S ALL ABOUT LEADERSHIP
• FURTHER READING
• USEFUL WEBSITES