Blog

INFORMATION AND TECHNOLOGY GOVERNANCE. IS IT EITHER OR BOTH?

I have the good fortune to be a member of a national IT Governance Taskforce. This advisory board is convened by the Institute of IT Professionals in NZ (IITPNZ), chaired by Murray Wills of Maxsys, Wellington. Murray explains, "The taskforce is committed to raising awareness about information and technology governance (I&TG), adopting good I&TG practices and collaborating with governance, business, and I&TG stakeholders to do this."

It’s hardly surprising that the call for technology-savvy directors is growing louder. There can be serious consequences if boards ignore or delegate enterprise-level technology governance. This is because boards are operating against a technology-saturated backdrop characterised by speed, complexity and ever-changing risk. They are expected to govern in an environment where the cloud, big data, mobile, social media and the internet of things are changing the way businesses operate and how modern societies work.

Should Technology be part of board oversight?

Technology governance: boards are being sued.

I was recently talking with a board colleague about risk and how agile current board processes are. The conversation turned to two landmark cases.

I was recently challenged by a long standing board member about the 'tough, provocative' language I was using to describe the urgent need for boards to get up to speed with things digital. Why is the need to be competent an uncomfortable truth?

I've been thinking about why Target's US CEO, President and Chairman stepped down and the associated technology governance competency issues.

I've been talking to a wide range of directors about why boards and executives are confused about technology governance roles and responsibilities.

The thing that stands out for me is that most definitions talk about IT governance and could easily be confused with the operational role and tools of management rather than the distinct governance accountabilities of boards.

Recently I was engaged in a brief but very useful discussion on the Boards and Advisors LinkedIn Group about why technology governance should or shouldn't be singled out from other areas of board competency, and if so why. The discussion highlighted two important issues.

Unfathomably there still seems to be a sense among too many board members and governance professionals that boards need only view technology as an enabler that falls into the same bucket as other business enablers like cash/equity, people and plant, and is not a priority.

When it comes to views about the role boards need to play in governing technology, it has been an interesting and telling few months. PWC published their ‘Annual Corporate Director’s Survey’(PWC, 2013). The Information Age announced that the UK government was going to provide FTSE 350 companies with the opportunity to evaluate their cyber-security risk (Swabey, 2013).

A majority of chairmen, directors, senior executives, management and consultants in our July 2013 survey agree. Boards of directors must give serious consideration to whether they are courting increased financial, reputational, compliance and competitive risk if they do not include directors with IT governance knowledge, skills and experience among their ranks. To not have the right competencies so that directors can not only ask the right questions of management and advisors, but also analyze the responses, make judgments or raise further questions if necessary increases risk.

You might be surprised at some of the responses I’m getting in my current research. In the examples I use in this blog,  I can pinpoint the participants almost exclusively to older, more traditional board members. But not always.

 There’s a small but vocal slice of the population convinced that technology governance isn’t any different from other technical domains such as ‘talent management or marketing’. I suggest, having have worked in HR and in close association with marketing, that these domains differ markedly from technology, especially in the area of risk.