A Framework for Assessing Organisational IT Governance, Risk and Compliance

The Securities and Exchange Commission's enhanced disclosure rule on risk oversight, state laws requiring public disclosure of compromised customer information, and high-profile customer information breaches have caused Information Technology (IT) risk management practices to be a major concern for boards of directors and management. The Committee of Sponsoring Organizations of the Treadway Commission's (COSO) Enterprise Risk Management (ERM) framework emphasizes the importance of the board's oversight role while also bringing attention to the firm's reporting structure. Consequently, our study examines whether the maturity of IT risk management practices depends on Chief Information Officer (CIO) reporting structure and Chief Executive Officer (CEO)/Chairman duality. We develop a scale to measure strategic and operational maturity under the larger auspice of IT risk management and distribute a survey to high-level IT professionals. Our survey also captures the reporting structure of their firms. Consistent with our hypothesis, we find that the maturity of strategic IT risk management practices are higher when the CIO reports directly to the CEO. However, contrary to expectations, we do not find that operational risk management is more mature when the CIO reports to the Chief Financial Officer (CFO). Instead, operational risk management is higher when the CIO reports to the CEO. For public firms, the maturity of IT risk management practices are higher when the CEO is also the chairman of the board of directors. As C-level officers may have asymmetric access to the board, understanding reporting structures may inform firms, regulators, and interested stakeholders on how well IT risk is managed and factors that affect IT governance.

PurposeRisk management is an under-explored topic in information systems (IS) research that involves complex and interrelated activities. Consequently, the authors explore the importance of interrelated activities by examining how the maturity of one type of information technology risk management (ITRM) practice is influenced by the maturity of other types of ITRM practices. The purpose of this paper is to explore these relationships, the authors develop a model based on organizational strategy implementation theory and the COBIT framework. The model identifies four types of ITRM practices, namely, IT governance (ITG); communications; operations; and monitoring.Design/methodology/approachThe authors use a survey methodology to collect data on senior information technology (IT) executives' perceptions on ITRM practices. The authors use an exploratory factor analysis (EFA) to identify four dimensions of ITR M practices and conduct a structural equation model to observe the associations.FindingsThe survey of senior IT executives' perceptions suggests that the maturity of ITRM practices related to ITG, communications and monitoring positively influence the maturity of operations-related ITRM practices. Further, the maturity of communications-related ITRM practices mediates the relationship between ITG and operations-related ITRM practices. The aggregate results demonstrate the inter-relatedness of ITRM practices and highlight the importance of taking a holistic view of ITRM.Research limitations/implicationsGiven the content and complexity of the study, it is difficult to obtain senior executives’ responses in large firms. Therefore, this study did not use a separate sample to conduct the EFA to obtain the underlying four constructs. Also, the ITRM practices identified are perceptions. Even though the authors consider this to be a limitation, it also communicates the pressing areas that senior IT professionals are expected to focus given various external and internal pressures. This study focuses on large firms, hence, small to midsize firms are not well represented.Practical implicationsGiven the demanding regulatory and financial reporting requirements and the complexity of IT, there is an increasing possibility that the accounting profession will require IT professionals to focus on operations-related ITRM practices, such as security, availability and confidentially of data and IS are closely related to internal controls. However, as this study demonstrates, the maturity of operations-related ITRM practices cannot be achieved by focusing solely on operations-related IT risks. Therefore, IT practitioners can use this study to raise awareness of the complex interrelationships among ITRM practices among managers to improve the overall ITRM practices in a firm.Social implicationsThe study also shows the importance of establishing proper communication channels among various business functions with regard to ITRM. Extant IT research identifies the importance of the firm’s communication structure on various firm performance measures. For example, Krotov (2015) mentions the importance of communication in improving trust between the Chief Executive Officer and Chief Financial Officer. Firms with established communication channels have the necessary medium to educate and involve other departments with regard to the security of data. Thus, such firms are more likely to have mature risk management practices because of increased awareness of risks and preventive techniques.Originality/valueThe study contributes to ITG and risk management literature by identifying the role of monitoring-related ITRM practices on improving other areas of risk management. The study also extends the existing ITRM literature by providing an organizational strategy perspective to ITRM practices and showing how ITRM practices follow organizational strategy implementation. Further, the authors identify four underlying ITRM categories. Consequently, researchers could choose between two factors (Vincent et al., 2017) or four factors based on the level of detail required for the particular study.

Information technology (IT) risk management plays an important role in controlling security and building confidence in using IT system services.Many organizations have focused on risk management for IT security.In this study the committee of sponsoring organizations of the treadway commission (COSO) enterprise risk management (ERM) was used in risk management by identifying risk factors in accordance with the requirements of COBIT 5 areas that need to be controlled.In addition, 2 experiments were conducted with 3 government organizations and 3 business organizations in order to evaluate the performance of IT security control.The first experiment identified the risk levels with risk assessment, which provided the risk levels that need risk response in accordance with COBIT 5 framework implementation life cycle.From the second experiment, it was found that the risk management using all 7 phases of the COBIT 5 implementation life cycle decreased the risk levels for both government and business organizations.However, moderate and low risk levels were still observed which need to be managed in order to keep them at a very low level.In addition, it was found that the risks of government and Business organizations were different, which was a result of differences in obstacles and the context of the problems encountered in risk management.The findings of this study provide the guidelines for developing a framework for IT risk management in the future.

Information and Communication Technology (ICT) Governance is strongly associated with the successful of an organization's management especially about how to control physical assets, data and information were applied. In organizations, universities (Higher Education) Data and information is extremely important given the orientation of utilization is in the form of shared knowledge, through teaching and learning, research and community service (Tri Dharma). With a potential source of threats posed by humans (Human Threats), natural disasters (Natural Threats), and disruption of the environment (Environmental Threats) can interfere with the management of ICT colleges. NIST Framework Model is implemented by integrating the concept of Information Technology (IT) Risk Management through assessment risk mitigation strategies and recommendations to measure the probability of the threat and the level of impact on the institution. Then, through indepth interviews with ICT department/unit using IT General Control Questionnaire (ITGCQ) and also review operational documents to found risk analysis issues. Risk analysis results are summarized in the form of safeguard implementation plan to reduce the level of IT risk governance PTS. XYZ. More and more ICT management activities that do not have control, the higher the level of risk management of ICT.

The use of Information Technology (IT) is an important part of all business activities, especially in the service sector. It is important to ensure the security, availability and integrity of their systems. The impact of failure in IT Risk Management greatly influences success. The implementation of IT Risk Management is needed to be able to help companies in the event of losses. In its use, a framework is needed that functions to identify, evaluate and manage existing risks. Therefore, this research will show the COBIT framework that is suitable for managing existing risk management. This research was carried out using the Systematic Literature Review method which started from the stages of formulating research questions, literature search, literature selection, data extraction and discussion aimed at answering Research Questions. In this research, 25 articles were found which were used as literature sources. The research results show that COBIT 2019 is the version of COBIT most often used in IT Risk Management in the industrial service sectors. In implementing COBIT, companies face various challenges such as lack of in-depth understanding of COBIT, lack of work process documentation and lack of operational standards for risk control and incompatibility of IT strategy with company strategy. This research also found that there are 8 points of COBIT implementation strategy to help service industry companies achieve organizational goals more effectively and efficiently through IT risk management.

It has been recognised that effective risk management is one of the requirements for the success of information technology (IT) projects. This paper proposes a slack analysis framework taken from data envelopment analysis for improving IT-related scenarios through the IT risk management processes mentioned in the most-recent framework for managing IT risks. The proposed framework enables managers to decide on which sub-indicators of an inefficient or weakly efficient scenario should be augmented to improve its CI and how much they should be increased. The proposed improvement framework is a two-stage process in which the suggested scenarios are first evaluated by a linear optimisation model, and then the improvement stage is performed on those scenarios that can increase their CI. The proposed model is applied on Iran Telecommunication Research Center (ITRC) to assess and improve several suggested scenarios that have positively impacts on the maturity level on IT governance.

The healthcare sector has faced increasing pressures to reduce costs and increase healthcare quality in recent years. Thus, managing knowledge in healthcare organizations is critical to achieving low-cost optimization of higher quality services. Also, information technology (IT) plays an essential and crucial role in providing a central database for managing patient data in the healthcare sector. The current study investigates the effects of three aspects of knowledge capabilities (i.e., individual knowledge capabilities, managerial knowledge capabilities, and collaborative organizational capabilities) on information technology governance in healthcare institutions in the Sultanate of Oman. Data were collected using a non-simple random sampling technique by distributing a questionnaire completed by (325) employees working in (13) public hospitals and medical centers in (8) governorates. The collected data were analyzed using AMOS software and structural equation modeling (SEM). This study indicates that individual knowledge capabilities significantly affect only one dimension of IT governance: IT risk management. Moreover, collaborative knowledge capabilities significantly influence all dimensions of IT governance pillars in healthcare institutions, while managerial knowledge capabilities have no significant effect. The study findings can be used to deeply understand the role of knowledge capabilities in sustaining the IT governance application in the health sector context.

Digitization is fundamentally changing how organizations create and deliver business value, with information technology (IT) leveraged to improve business processes and controls. Its pervasive effects upon organizations’ risk exposures and performance requires boards’ prudent and integrated consideration of the resultant IT opportunities and risk management. However, IT governance research suggests that boards’ governance of IT is more commonly delegated and relegated to management and committees than integrated as part of their corporate governance practices. In response, our study contributes timely and structured understanding of boards’ roles and the mechanisms required for IT governance to become an integrated component of corporate governance.

Effective information asset management is the basis of information security as well as many other issues. IT risk assessments work well with the proper handling of asset values, and also it is for effectively securing information assets. There is also a wide variety of risk assessment methodologies. This chapter presents information about the overall IT risk management process and methodologies. Best practices are mentioned and occasionally compared based on the requirements of the information technology (IT) sector in practice. This chapter will provide deep knowledge about the IT risk management approach and construction to implementers, risk owners, IT auditors, executive managers, and other IT staff.

The purpose of this paper is to explore the importance of Information Technology (IT) Governance models for public organizations and presenting an IT Governance model that can be adopted by both practitioners and researchers. A review of the literature in IT Governance has been initiated to shape the intended theoretical background of this study. The systematic literature review formalizes a richer context for the IT Governance concept. An empirical survey, using a questionnaire based on COBIT 4.1 maturity model used to investigate IT Governance practice in multiple case studies from Kingdom of Bahrain. This method enabled the researcher to gain insights to evaluate IT Governance practices. The results of this research will enable public sector organizations to adopt an IT Governance model in a simple and dynamic manner. The model provides a basic structure of a concept; for instance, this allows organizations to gain a better perspective on IT Governance processes and provides a clear focus for decision-making attention. IT Governance model also forms as a basis for further research in IT Governance adoption models and bridges the gap between conceptual frameworks, real life and functioning governance.

The increasing reliance on information technology (IT) across various sectors has led to the growing importance of managing IT risks effectively. Information technology systems are prone to a variety of risks, including cybersecurity threats, system failures, and human errors. These risks can have severe consequences, such as financial loss, data breaches, and operational disruptions. To address these challenges, organizations must adopt comprehensive risk management strategies. This literature-based study explores various approaches and frameworks for managing IT risks, such as ISO 27001, NIST, and OCTAVE, by reviewing existing research and methodologies. The study aims to identify best practices, challenges, and trends in the field of IT risk management, offering insights into how organizations can improve their risk management strategies to enhance the resilience of their IT systems. Through this literature review, the paper highlights the importance of a systematic approach to IT risk management and provides recommendations for organizations seeking to mitigate risks and safeguard their technological.

Past research in information technology (IT) governance has shown that strong IT governance results in improved business performance. Despite widespread acceptance that IT governance is important, there are limited studies focusing on IT practitioners in IT governance initiatives. This study aims to examine the extent of commitment, awareness, perceived importance and competency in influencing IT practitioners’ participation in IT governance initiatives. Data analysis using Partial Least Squares reveals that awareness, perceived importance and competency have positive influence on participation in IT governance. However, commitment is not a significant predictor of participation in IT governance. The practitioner-centric approach taken by this study adds knowledge to the existing IT governance literature from organisational perspective. The findings from this study help IT management identify focus areas in increasing to maximise participation of IT practitioners in IT governance initiatives.

This study provides additional evidence on information technology (IT) governance and its relationship to firm performance in emerging markets. It aims primarily to determine the level of IT governance in Saudi Arabian companies; it also aims at examining the impact of IT governance on the firm performance. The study target sample is 131 companies taken from 20 sectors of the Saudi financial market; during the year 2017. The researchers have used the IT-related backgrounds of the members of the board of directors as an indicator of IT governance. The researchers have also used another group of corporate governance indicators in addition to a set of control variables. The performance of the companies has been referred to as the operational performance which is represented as Return on Assets (ROA) and the financial performance as the Return on Equity (ROE). The descriptive results have been shocking. The study has shown a sharp decline in IT governance in Saudi companies; only 15% of companies have members of the board of directors with IT-related backgrounds, and the IT governance is not adopted or used in many important sectors. However, the regression analysis shows that there is a positive impact on IT governance only on the operational performance of Saudi companies. The results of this study provide a significant indicator of IT governance in Saudi companies. These results can be also used to develop the corporate governance code to focus more on IT governance.

IT Governance is a branch of the corporate governance system focused on information technology (IT) as well as performance and risk management. IT Governance is defined as the processes that ensure the effective and efficient use of IT in enabling an organization to achieve its goal. There are many different frameworks that can be used for managing the delivery of cost-effective IT services. IT managing the delivery of cost-effective IT services does not always give the advantage to the company. There are times when the IT managing the delivery of cost-effective IT services does not provide any benefit, it can cause IT Productivity Paradox. IT Productivity Paradox can be prevented, one is to analyze the processes undertaken with IT. From this analysis we will get the significance of the relationship processes with the IT Goal. The significance will be seen which one significant process and which one are not significant to the IT Goal. If the IT process there are not significant to the IT Goal, the process does not need to be repaired because it has no effect on IT Goal. Existing IT governance frameworks are COBIT, ITIL, ISO 20000, 17799/27001, Six Sigma, etc. The IT Infrastructure Library (ITIL), initially developed in the UK by the Office of Government Commerce (OGC), is gaining traction in the global IT community as a framework for IT governance. ISO 20000-focusing upon IT service management. ISO 17799 / ISO 27001 - focusing upon information. Six Sigma-focusing upon operational performance and defect identification. COBIT - framework for information IT management risks. Control Objectives for Information and related Technology (COBIT) provides good practices across a domain and process framework and presents activities in a manageable and logical structure. COBIT’s good practices represent the consensus of experts. They are strongly focused more on control, less on execution. These practices will help optimise IT-enabled investments, ensure service delivery and provide a measure against which to judge when things do go wrong. This research is intend to find out whether Cobit mapping Business Goal to IT Goal appropriate with case study. The result The results using SEM approach shows that the mapping of COBIT is not significant in the case studies of academic administration.

Purpose This paper aims to reveal the potential challenges and opportunities for information technology (IT) governance in higher education institutions (HEIs). Furthermore, the authors extend what the identified determinants mean for Saudi universities. Design/methodology/approach This study pursued a systematic literature review applying the Preferred Reporting Items for Systematic Reviews and Meta-Analyses strategy protocol. Findings IT governance is both beneficial and challenging to integrate into the higher education setting. This is because most IT Governance frameworks are created and implemented in a traditional organizational setting, which differs from the overall culture of HEIs. As for the context of Saudi Arabia, findings depict a hopeful picture for the future of IT Governance, as HEI stakeholders are primarily aware of IT Governance policies, but Saudi HEIs are yet to work toward this goal systematically. Research limitations/implications Apart from extending the current literature on IT governance, this paper adds the educational perspective and the Saudi context, which is found to be limited in the existing literature. The findings could be used to benchmark the IT Governance scenario in other countries, wherein this study could support the roadmap of effective IT governance adoption in HEIs in various nations. Originality/value This study could support improving the institutional operational performance of HEIs in Saudi Arabia, particularly in terms of electronic monitoring systems, effective monitoring of processing systems, prevention of fraud and reducing the manipulation and wasting of funds. The insights from this study could be beneficial to government policymakers, higher education managers, researchers and academics.