Blog

INFORMATION AND TECHNOLOGY GOVERNANCE. IS IT EITHER OR BOTH?

I have the good fortune to be a member of a national IT Governance Taskforce. This advisory board is convened by the Institute of IT Professionals in NZ (IITPNZ), chaired by Murray Wills of Maxsys, Wellington. Murray explains, "The taskforce is committed to raising awareness about information and technology governance (I&TG), adopting good I&TG practices and collaborating with governance, business, and I&TG stakeholders to do this."

They're a talented and diverse group of people with a great deal of information, technology and corporate governance skill and experience. And, like all good professionals we debate things keenly.

At our most recent meeting the debate turned to whether we should emphasize information governance, technology governance or both. What's the difference?

Gartner defines Information Governance as, "the specification of decision rights and an accountability framework to ensure appropriate behavior in the valuation, creation, storage, use, archiving and deletion of information. It includes the processes, roles and policies, standards and metrics that ensure the effective and efficient use of information in enabling an organization to achieve its goals". The problem is, every process, policy and accountability inherent in this definition is now dependent on some aspect of technology and its governance. 

IT governance  (ITG) has been around and definitions changing since the early 2000s. As some directors point out, ITG was the domain of the IT department and not the business of management. However, from about 2006 onwards organizations such as the IT Governance Institute started talking about the role of the board in the enterprise governance of IT. 

Various definitions of ITG exist. The business world tends to focus on oversight of IT performance and creating value from IT investment. Similar to the Gartner definition of Information Governance, others suggest ITG is about: decision rights and accountabilities for the appropriate and ethical use of IT; digital leadership from the board room; and, having structures and processes in place to ensure the organization’s IT sustains and extends the organization’s strategies and objectives.

THIS IS NOT ABOUT SCARE-MONGERING, but...

While some continue to debate whether it's either information or IT governance, there is strong agreement within the Taskforce on one issue. There is an urgent need for capable I&TG directors, executives and advisors. The need occurs across public and private sector organizations, large and small.

Similarly, in my research almost 75% of participants (the largest participant group were experienced chairmen), confirmed the importance of boards building I&TG capability. It's not about scare mongering. The evidence is very very clear. 

1  Individual director competency to govern information and technology, world wide, remains relatively low. But the world has changed dramatically because of technology. Operational and strategic I&T risks have increased in good part because of this gap in board capability. In a number of high profile IT failures and more recent cybersecurity breaches, the question on many lips is, 'Where was the board?'

2  The up-shot is an increasing number of once iconic brands have either gone out of business or lost significant market share because they didn’t keep up with technology.

3  Those organizations that get the right mix of board-led digital vision, combined with prioritized, strategy-aligned I&T investment and rapid change capability develop significant advantage. They earn more, are more profitable and tend to have greater market capitalization.

4  Those boards that fail to build capability risk breaching their duty of care responsibilities. Such court cases started in 2014.

Building director I&TG competency that builds the wider board's awareness and capability is needed. A quantum shift in board I&T leadership and governance capability is required for boards to remain relevant in a digital world.

THERE'S NO QUICK FIX

Those rare, competent digital directors are already having impact and reach beyond their boardrooms into the organizations they govern. And, the problem is not going to be fixed by getting a token or lone "IT guy" onto the board. We're talking capability in technology-enabled strategy, risk and compliance, innovation and value creation (the areas covered in detail in the I&TG competency set). 

The bottom line is that the competitive and financial benefits for those that do build these capabilities, mean there has never been a better time to become a knowledgeable, I&TG capable, digital director.

On the flip side, the longer boards leave I&TG capability building, the bigger the gap between those organizations with digital leadership and I&TG capability (estimated to be as low as 16% of corporate organization world-wide) and all others.

Technology disruption affects every aspect of the business. So this means that even those directors from finance and legal backgrounds may need to up-skill to understand the I&TG impacts for their discipline. So let's be clear...

IT'S DEFINITELY BOTH INFORMATION AND TECHNOLOGY GOVERNANCE

At a very real and practical level, my research concludes that boards have both an ethical duty to be competent and a fiduciary duty of care to capably govern both information and technology.

With the advent of big data, the Internet of Things and the rapid rise of sensing technologies, information must be governed. Information is an asset. Oversight of its competitive and operational effectiveness uses and its security are very much a board's responsibility and accountability.

So too is the need to understand and govern technology enabled organization strategy, risk, compliance, innovation and value creation. The number of technologies and applications available to organisations to create new products and services, create efficiencies and enable deeper and better stakeholder engagement, are expanding every day. 

PRACTICAL SOLUTIONS

These areas of board accountability and capability are captured, detailed and verified across multiple industry sectors in my research, now EGC's board I&T governance competency set. There are multiple practical uses for the set.

Awareness building within boards can start with simple steps such as conducting an honest assessment using EGC's I&TG competency set. This can help determine whether current board capabilities, attitudes and beliefs about ITG are supporting or hindering digital transformation and IT risk reduction. 

The I&T governance competency set can be used for board evaluation, and for director selection, recruitment and professional development. The set compliments the ISO/IEC standard 38500. 

EGC offers a range of services from individual board briefings and workshops to an online learning module.

The e-Learning module "Becoming a capable digital director: an introduction" is self-paced, written by business people but user-tested by business and technology experts. On completion of the module which takes as little as an hour, you get a free book of check lists and helpful hints. 

coming soon

In mid-late March all current print resources including the three board I&T governance competencies will be updated and re-launched. This reflects the final results of the four-year research project that is the basis of this material. Apologies but the white paper resources are off-line while the updates are done.

In late March EGC will launch one-on-one, online executive coaching and mentoring to assist those astute directors who will benefit from personalized, practical and actionable coaching to up-skill. 

And there's more online resources and help for building digital director awareness and capability to come!

+++++++++++++++++++++++++++++++++++++++++++++++ 

About Elizabeth Valentine:

Elizabeth Valentine is an experienced board member, chief executive, change strategist and digital transformation leader. She is also an IT governance expert. Her career has been characterised by both strategic and thought leadership, to which she brings entrepreneurial vision, energy, innovation and flare.

Elizabeth's sector consulting and contracting experience covers regulated and economically essential industries as diverse as government, not-for-profit and corporate organizations. Sector experience includes aviation, tourism, electricity transmission, telecommunications, tertiary education and building and construction. Her work has been internationally bench-marked for operational excellence.

Other Publications by Elizabeth Valentine: at QUT eprints