![](https://csdnimg.cn/release/download_crawler_static/10826664/bg4.jpg)
Enterprise Governance of IT
The concept of IT governance has been in existence for less than two decades. In the early
1990s key strands of IT governance could be discerned in the academic literature. The first strand
studied alternative forms of organization of the IT function and the impact of those forms on
business outcomes (ITGI 2005; Ives and Jarvenpaa 1993). A second strand explored the nature and
effect of alignment between enterprise consumers of IT services (‘‘ the business’’ ) and the IT
function (Henderson and Venkatraman 1993; Luftman 1996; Venkatraman et al. 1993). A third
strand, inspired by Porter’s research on strategy and competitive advantage (Porter 1979, 1985),
addressed links between enterprise strategy, investment in IT, and enterprise performance (Andreu
and Ciborra 1996; Chan et al. 1997; Weill 1990, 1992). This strand received considerable impetus
as researchers reacted to research by Brynjolfsson (1993) that pointed to a seeming paradox
between high levels of investment in IT and an absence of evidence on returns on that investment. It
was only in the late 1990s that articles first mentioned IT governance in the title or abstract (e.g.,
Brown 1997; Sambamurthy and Zmud 1999), although these papers mostly focused on debates
about the most effective form of IT organization. In the practitioner arena, ISACA created the IT
Governance Institute (ITGI) (www.itgi.org) in 1998 to promote the IT governance concept. As
explored in more detail shortly, the various publications of ISACA and ITGI explicitly incorporated
IT governance notions in COBIT 3 (ITGI 2000) and the board briefing on IT governance (ITGI
2001).
Current perspectives on enterprise governance of IT see EGIT as an integral part of corporate
governance. The recent ISO/IEC Standard 38500 ‘‘ Corporate Governance of IT’’ defines IT
governance as ‘‘ The system by which the current and future use of IT is directed and controlled.
Corporate governance of IT involves evaluating and directing the use of IT to support the
organization and monitoring this use to achieve plans. It includes the strategy and policies for using
IT within an organization’’ (ISO/IEC 2008). Van Grembergen and De Haes (2009) define EGIT as
the ‘‘ Board overseeing the definition and implementation of processes, structures, and relational
mechanisms in the organization that enable both business and IT to execute their responsibilities in
support of business/IT alignment and the creation of business value from IT enabled investments.’’
Both definitions indicate clearly that IT governance is the responsibility of governing boards and
that execution lies with senior management.
The IT governance concept has received considerable attention in the academic literature over
the last decade. Wilkin and Chenhall (2010), in a recent survey of IT governance, establish a
taxonomy of IT governance. They see concepts of strategic alignment, performance measurement,
risk management, and value delivery as the most significant enablers of IT governance. Wilkin
and Chenhall (2010) note that broader organizational structures, business processes and
technology, and resource capabilities influence the enablers and by extension IT governance.
Wilkin and Chenhall (2010) see corporate governance as being a primary influence on the shape
of IT governance. This focus on corporate governance was in response to two directions in the
academic and professional communities. First, the increasing importance of corporate governance
in general management and the academic literature influenced research in IT governance, as did
professional guidance in the U.S. (COSO 1992) and its counterparts in other parts of the world.
The Sarbanes-Oxley Act in the U.S. in 2002 provided significant impetus to widespread adoption
of corporate governance methods in the field and a dramatic expansion in the academic literature,
along with specialist journals. Second, the increasing importance of IT in meeting enterprise goals
coupled with the inherent tension in aligning business and IT management has led to a recognition
of the importance of setting IT goals and decision rights at the governance level (i.e., governing
boards) (De Haes and Van Grembergen 2008a; Thorp 2003; Weill and Ross 2009). These forces
initiated a shift in the naming of the concept from ‘‘ IT governance’’ toward ‘‘ enterprise
COBIT 5 and Enterprise Governance of Information Technology 309
Journal of Information Systems
Spring 2013