Towards a Theoretical Foundation of IT Governance - The COBIT 5 case

Abstract

COBIT, (Control Objectives for Information and Information related Technologies) as an IT governance framework is well-known in IS practitioners communities. It would impair the virtues of COBIT to present it only as an IT governance framework. COBIT analyses the complete IS function and offers descriptive and normative support to manage, govern and audit IT in organizations. Although the framework is well accepted in a broad range of IS communities, it is created by practitioners and therefore it holds only a minor amount of theoretical supported claims. Thus critic rises from the academic community. This work contains research focusing on the theoretical fundamentals of the ISACA framework, COBIT 5 released in 2012. The authors implemented a reverse engineering work and tried to elucidate as much as possible propositions from COBIT 5 as an empiricism. They followed a qualitative research method to develop inductively derived theoretical statements.

Headnote

Abstract: COBIT, (Control Objectives for Information and Information related Technologies) as an IT governance framework is well-known in IS practitioners communities. It would impair the virtues of COBIT to present it only as an IT governance framework. COBIT analyses the complete IS function and offers descriptive and normative support to manage, govern and audit IT in organizations. Although the framework is well accepted in a broad range of IS communities, it is created by practitioners and therefore it holds only a minor amount of theoretical supported claims. Thus critic rises from the academic community. This work contains research focusing on the theoretical fundamentals of the ISACA framework, COBIT 5 released in 2012. We implemented a reverse engineering work and tried to elucidate as much as possible propositions from COBIT 5 as an empiricism. We followed a qualitative research method to develop inductively derived theoretical statements. However our approach differs from the original work on grounded theory by Glaser and Strauss (1967) since we started from a general idea where to begin and we made conceptual descriptions of the empirical statements. So our data was only restructured to reveal theoretical findings. We looked at three candidate theories: 1) Stakeholder Theory (SHT), 2) Principal Agent Theory (PAT), and 3) Technology Acceptance Model (TAM). These three theories are categorized and from each theory, several testable propositions were deduced. We considered the five COBIT 5 principles, five processes (APO13, BAI06, DSS05, MEA03 and EDM03) mainly situated in the area of IS security and four IT-related goals (IT01, IT07, IT10 and IT16). The choice of the processes and IT-related goals are based on an experienced knowledge of COBIT as well of the theories. We constructed a mapping table to find matching patterns. The mapping was done separately by several individuals to increase the internal validity. Our findings indicate that COBIT 5 holds theoretical supported claims. The lower theory types such as PAT and SHT contribute the most. The presence and contribution of a theory is significantly constituted by IT-related goals as compared to the processes. We also make some suggestions for further research. First of all, the work has to be extended to all COBIT 5 processes and IT-related goals. This effort is currently going on. Next we ponder the question what other theories could be considered as candidates for this theoretical reverse engineering labour? During our work we listed already some theories with good potential. Our used pattern matching process can also be refined by bringing in other assessment models. Finally an alternative and more theoretic framework could be designed by using design science research methods and starting with the most relevant IS theories. That could lead to a new IT artefact that eventually could be reconciled with COBIT 5.

Keywords: IT governance, COBIT 5, stakeholder theory, principal agent theory, TAM

1. Introduction

It has been found that firms with effective IT governance generate 40% higher returns on their IT investments than their competitors (Weill and Ross, 2004). Weill and Ross (2004) define IT governance as specifying the decision rights and accountability framework to encourage desirable behaviour in using IT. IT governance is to distinguished from IT management, in that IT management is the daily decision making and implementation activities around the firm's use of IT. Governance identifies who will make key IT decisions and how will they be held accountable. Good governance is enabling and reduces bureaucracy and dysfunctional politics by formalizing organizational learning and thus avoiding the trap of making the same mistakes over and over again. In that perspective IT governance is also strongly related to the well-researched domain of IT/IS failures.

According to the IT Governance Institute, IT governance is the responsibility of the board of directors and executive management. It is an integral part of enterprise governance and consists of the leadership and organizational structures and processes that ensure that the organization's IT sustains and extends the organization's strategies and objectives. IT governance is a concept that has been evolving rapidly over the last few years, especially in practitioners' communities. The IT Governance Institute is taking a leading role in the debate (ISACA, 2012a) . Practitioners tend to see value of IT governance as the contribution to business performance and try to measure this contribution in terms of firm profitability, since this can be easily expressed in monetary units. Large public enterprises, with their natural propensity to control all business processes and to reduce risks and costs, heavily support this governance approach.

COBIT, as an IT governance, management and audit framework is well-known in IS practitioners communities (ISACA 2012a). It would impair the virtues of COBIT to present it as a framework as such. COBIT analyses and describes the complete IS function and offers normative support to manage, govern and audit IT in organizations (Kerr and Murthy 2013). COBIT is even used in academic programs for learning graduate students the principles of governing IT in organisations (Alves et al. 2012, Cabukovski and Tusevski 2011).

This may sound a bit awkward, but IT academics often lag behind IT practitioners with the description, explanation and predicting of IT phenomenon's. The latter cannot always wait for good normative theories to build IT artefact's. Both communities have of course their own objectives and ways of working. Working with IT to build and implement information systems (IS) however is certainly not straightforward and a lot failures often darkens the blue skies predicted by IT suppliers and vendors (Avison et al. 2006, Conboy 2010, Dwivedi et al. 2013). On the other hand information systems are enablers for conducting a business today. In many industries, survival and even existence is challenging without extensive use of information and communication technology. No longer can we imagine going to work and conducting businesses without IT/IS (Laudon et al. 2012). In a world of cutting-edge product development, the struggle between speed and quality is over. Speed has won decisively. In today's highly competitive global markets, getting innovations out quickly can mean the difference between success and failure (Cross 2011).

Although the COBIT framework is well accepted in a broad range of IS communities, it is created by and for practitioners and therefore it holds only a minor amount of firm theoretical supported claims. Thus critic rises from the academic community (Ridley et al. 2008, Goldschmidt et al. 2009, Choi and Yoo 2009, Chen and Shen 2010). The quest for theoretical underpinnings is not only a pure academic matter or an art pour l'art exercise, but can contribute to problems also raised by IT practitioners about COBIT. The main critic coming from this front is the huge amount of very complex descriptive guidelines and the strong accent on conceptual objectives. The 'what' is clearly specified but not so much the 'how'. This is good for IT auditors and risk managers, but clearly not so for IT managers and consultants. The authors of COBIT are well aware of these issues and have already anticipated within COBIT with the implementation of the Single Integrated Framework concept.

We agree with King and Lyytinen (2004) that theory is an input to a process of getting strong results, not an outcome. However the importance of IT/IS for organisations and society and the ever larger growing group of IS practitioners has much to gain in researched based educational programs strongly grounded in theoretical foundations. We asked ourselves if COBIT does have clearly theoretical foundations that can support some of the claims made in the framework. We focused on the process model of COBIT as well as on the principles and IT-related goals. This work is of value to strengthen a well spread practitioners framework with the rigor of a scholarly work albeit that the course of the trajectory, first the theory and then the practice is here just the opposite. However, there is no evidence that the large group of COBIT authors, reviewers and contributors should not have done an excellent job and certainly made a practical and pragmatic contribution to the IT/IS field.

So to say, we implemented a reverse engineering work and try to elucidate as much as possible propositions from COBIT as an empiricism. We followed a qualitative research method to develop an inductively derived theoretical framework. However our approach differs from the originally work on grounded theory by Glaser and Strauss (1967) since we have a general idea of where to begin and we made conceptual descriptions of the empirical statements in COBIT. So our data was only restructured to reveal theoretical findings.

The paper proceeds as follows: in section two we elaborate on the COBIT framework. In section three we make a suggestion of candidate theories and give a classification of the chosen theories according to the method of Gregor (2006). Section four describes our research method and in section five we bring a discussion of our findings. In section six we make our conclusion and give some recommendations for further research and some suggestions for refining our method of investigation.

2. The COBIT 5 framework

COBIT dates back to 1996 and was originated as an IT audit framework. In 2012 a new version of COBIT 5 was released (ISACA 2012a). In the rest of the paper we will use COBIT, however we did our investigation entirely with COBIT 5. As stated before COBIT is a business framework for the governance and management of enterprise IT and is almost entirely made by IT practitioners with an appetite for IT in larger organisations, mostly in banking, insurance and consultancy. COBIT is not a scholarly work. There were academics involved in the work of establishing the framework, but there is to the best of my knowledge no theoretical work done on the many claims in COBIT.

COBIT provides a framework that supports enterprises in achieving their objectives for the governance and management of enterprise IT. COBIT is based on five key principles that embodies these objectives and enables the enterprise to build an effective governance and management framework that optimises IT investments and use for the benefit of stakeholders (ISACA 2012a). Table 1 gives an overview of the five key principles of COBIT.

Although the authors of COBIT posit that COBT is not prescriptive, it suggest a process approach for the implementation of the framework, the COBIT Process Model (ISACA 2012b). Processes are seen as enablers or factors that, individually and collectively, influence whether something will work for IT governance or management. COBIT suggests that enablers (and thus processes) are driven by a goal cascade, i.e. higher-level IT-related goals define what the different enablers should achieve (ISACA 2012b). There are seven categories of enablers in COBIT: 1) principles, policies and frameworks, 2) processes, 3) organizational structures, 4) culture, ethics and behaviour, 5) information, 6) services, infrastructure and applications, and 7) people, skills and competencies. In this work we limited our investigation to the processes. COBIT defines a process as 'a collection of practices influenced by the enterprise's policies and procedures that takes inputs from a number of sources (including other processes), manipulates the inputs and produces outputs (e.g. products, services)' (ISACA 2012a).

There are generic processes for IT governance as well as for IT management. The structural overview and consistency of the processes aims at an alignment between the business and IT (De Haes and Van Grembergen 2010). COBIT is a structure of 37 processes divided in five domains. One domain is IT governance, the other four domains are IT management domains. Each process of COBIT has input, output, goals, key process activities, metrics, sub processes and related references. Table 2 gives the five domains of the COBIT processes.

3. The chosen IS theories

The choice for candidate theories was based on the work of Truex et al. (2006) that gives four recommendations: 1) considering the fit between selected theory and phenomenon of interest, 2) considering the historical context of the theory, 3) considering how the theory impacts the choice of research method, and 4) considering the contribution of theorizing to cumulative theory (Truex et al. 2006).

First we selected three theories from a long list of theories used in IS research (Larsen et al. 2014) and checked for the Truex criteria. The chosen theories are: Stakeholder Theory (SHT), Principal Agent Theory (PAT) and Technology Acceptance Model (TAM). In Table 3 shows an overview of the selected theories and the fulfilled recommendations of Truex. We added the seminal papers or the theories in the bottom row of table 3.

In this work we only choose three theories, but it is should be clear this can certainly not be a complete situation. There are so many explaining, describing and predicting IS theories. During discussion with academics active in the field of IT governance we were attended on the Contingency Theory (CT) and the theory of the Resource-based view (RBV) of the firm (Fiedler, 1964; Penrose, 1959). Historically, CT has sought to formulate broad generalizations about the formal organizational structures that are typically associated with or best fit the use of different technologies. According to CT, business value is contingent to (i.e. dependent on) organizational factors, such as structure and environment (e.g. size). CT is an organizational theory and encompassed the idea that there is no best way of organizing. RBV is grounded in the economic work on firm heterogeneity (as against market structure) in conferring above normal profits and in driving imperfect competition. According to RBV heterogeneous firm resources are a basic for competitive advantage (i.e. differing resources, such as financial, people, know-how, etc.). RBV argues that firms possess resources, which enable them to achieve competitive advantage, and lead to superior long-term performance. RBV contributes to an organizational theory.

SHT is a management theory that identifies groups and individuals th at have a stake in an organisation (Frooman 1999). The theory helps to identify, understand and use in a strategic way stakeholders in an organisation. Traditionally stakeholders where stockholders or owners of an enterprise. PAT is one of the cornerstone theories of the firm. The theory is well developed as a variance as well as a process theory. The theory is very well related to the theory of Transaction Cost Economics (TCE). TAM is one of most developed IS theories and brings the human interactions and perceptions in the middle. It is a theory which has his roots in psychology but it is actually a genuine IS theory.

For each of the three theories we made an analysis and a classification according to Gregor (2006) and we developed a summary of components. In table 4 we show the fiche of the SHT component as an example. Similar fiches were made for PAT and TAM.

In summery we can consider SHT and PAT as theories for explaining, and TAM as a theory for explaining and predicting (Gregor, 2006).

4. The research method

To assess the degree of presence of any of the three selected theories in COBIT we designed a mapping tool. This tool is based on the ideas in ISO/IEC 15504-2 (ISO/IEC 2003). We do not use the tool as an capability determination instrument but as an assessment instrument. We developed a four layered scale to score the matching of a COBIT statement, keyword or proposition with theoretical components related to the three theories. The scale was constructed as follows

§ Score N: (Not Present) There are no propositions, keywords or statements in COBIT that can be matched with components of one of the selected theories.

§ Score P: (Present) There is a least one proposition, keyword or statement in COBIT that can be matched with one components of one or more of the selected theories.

§ Score L: (Largely present) There is more than one proposition, keyword or statement in COBIT that can be matched with one theory.

§ Score F: (Fully present) There is a strong match of several (more than two) COBIT propositions, keywords or statements with one theory.

We derived the propositions and keywords as suggested by Gregor (2006) from COBIT from three sources: 1) the five COBIT principles, 2) five selected COBIT processes (APO13, BAI06, DSS05, and MEA03) and 3) four selected IT-related goals (goal 02 'IT compliance and support for business compliance with external laws and regulations', goal 07 'Delivery of IT services in line with business requirements, goal 10 'Security of information, processing infrastructure and applications', goal 16 'Competent and motivated business and IT personnel'). We selected one IT-related goal from each dimension of the BSC (ISACA 2012b). In table 5 we give the pattern mapping for the five selected COBIT processes, principles and IT-related goals.

(1) Meeting Stakeholder Needs, (2) Covering the Enterprise End-to-End, (3) Applying a Single Integrated Framework, (4) Enabling a Holistic Approach, (5) Separating Governance From Management.

5. Findings and discussion

Based on the pattern mapping as shown in table 5 we brought all the mappings together in overall overview which is presented in table 6. The scores are now cumulated from the previous detailed scores as shown in table 5. The scores can now be read as follows:

§ Score N: The theory is not present.

§ Score LP: The theory is only partly present. Only three base components of the theory are present.

§ Score P: The theory is present and the empirical findings are within the scope of the theory and there are causal explanations found.

§ Score F: The theory is strongly present. There are testable propositions that can be derived or prescriptive statements present.

The strongest theoretical foundations in COBIT are coming for PAT. This will come as no surprise since PAT is theory that is often used to explains the elements of control in a governance versus management setting. There is also coupling in appearance between PAT and SHT. The dual appearance of PAT and SHT is remarkable in the COBIT principles. TAM is less present in COBIT. This can be due to the fact that TAM is a higher type of theory, with strong causal relations.

What we have noticed during our enquiry is that the IT-related goals can strongly determine the presence of a theory. This is the way around, a framework should be designed with a theoretical stance in the first place. As an example: IT-related goal 07 suggest to be based on TAM and brings the theory into the process BAI06. The same goes for the IT-related goals 02 and 10 that bring in PAT in APO13 and DSS05. A possible explanation can be given that when a goal is present in a process, the process is likely to be shaped to meet the goal. In that way a possible 'hidden' theory is unveiled in the process. In table 7 we combined the IT-related goals with the five selected processes. We did no go further in that direction, but this suggest a deeper investigation.

6. Conclusions

The classification of IS theories and the matching with the COBIT principles, processes and IT-related goals have shown that COBIT did not took off from a clear theoretical starting position. However the derived theoretical propositions from the selected theories were surprisingly present in the framework, albeit not always completely. The primary constructs, scope and statements of relationship of the theories are often found, but causal explanations are often absent. Some theories do not have very clear causal explanations, so type I and type II theories have a higher likelihood to be supportive for COBIT. This is the case for PAT.

As for the SHT we see that prescriptive statements are only limited present in COBIT. To fully implement SHT one could use the findings of Mitchell et al. (1997) to assess the influence of each stakeholder. Together with the findings of Frooman (1999) the framework could be enriched with the way how stakeholders try to execute their influence. This could lead to better or more fine-tuned metrics.

The strong appearance of PAT and SHT in COBIT is probably due to the fact that both theories are lower types of theories according to the classification of Gregor (2006). Also COBIT was originally build as an IT audit guideline, so control and stakeholders are key elements there.

TAM is the less present theory of the selected theories in COBIT. To act according to TAM large changes will be necessary. We suggest a more intensified application of TAM into the COBIT processes. The ease of use and the usefulness are such important constructs for the acceptation of technology, and this should be noticeable in COBIT. We consider it as a drawback that COBIT does not take TAM more into account. This high level theory has yet proofed to be very valuable.

IT-related goals always suggest the presence of an IS theory. But this touches the fundamental problem of COBIT: what is the initiator of a descriptive of normative statement? For us, academics it should be a theory and not a set of well agreed practical statements. However the goals cascade mechanism in COBIT forces the authors to make causal statements, derived from the principles down to the IT-related goals. Although this a common research practice, it is in no way supported by a theoretical context delivering theoretical propositions to support the deduced steps.

The implicit presence of a theory in an IT-related goals, makes that the framework cannot be forced into favourable statements. So the normative character of COBIT should come from the theories in the first place. However this means that deducing practical propositions from theories can lead to complete other goals. It is not impossible that the stakeholders from an organization put goals in place that cannot be reached. As an example we can take IT projects that in a traditional perspective should be managed according the old-style trinity of constraints in budget, time and quality. However we see in reality that more than 50% of all IT projects do not fit in such a pre-designed management model. Other theories, such as sense making (Cicmil and Hodgson 2006) and real option management (Benaroch 2002) are popping up to counter this dark side of IT management. These theories should be much more embraced by IT practitioners communities.

The generalization of our results can be an issue. We think we made a generalization from empirical statements to theoretical statements or a ET-generalization according to Lee and Baskerville (2003). (Lee and Baskerville 2003). This is a type of generalisation in the sense of the analytical or theoretical generalisation of Yin (2003). (Yin 2003, Dube and Pare 2003)

This research has offered a positive answer to our research question if COBIT could be more founded with IS theories. However the quest to these theoretical foundations have raised a multitude of new questions. First of all we could ask what other theories are present in COBIT? When we disseminated this work to a limited group of peers some suggestions of candidate theories pop up, such as Resource Based Theory, Transaction Economics, and Structuration Theory. These theories, who have been used many times in IS research should been researched to see if they can contribute to this work or to a more general contribution of a cumulative theory. Second we can pose some questions to our assessment model of scoring the presence of a theory in COBIT. We believe that this model can be fine-tuned. Third, it is not impossible that our research method can be of use for other practitioners frameworks which are also created without a firm theoretical foundation (e.g. ITIL).

Finally we must think about the managerial contribution of doing this sort of theoretical work. This brings us to the question if COBIT should not be adapted to a more intensive use of IS theories and thereby gain a stronger validity. It is our believe that IS scholars and practitioners should try to work more closely together. After all, our discipline of information systems is still shaped by a very practical kernel of IT artefacts and systems and is still in an urgent need for good describing, predicting and explaining theories.

References

References

Alves, V., Ribeiro, J. and Castro, P. (2012) Information Technology Governance - A Case Study of the Applicability of ITIL and COBIT in a Portuguese Private School, translated by Madrid, SPAIN.

Avison, D., Gregor, S. and Wilson, D. (2006) 'Managerial IT unconsciousness', Communications of the Acm, 49(7), 89-93.

Benaroch, M. (2002) 'Managing information technology investment risk: A real options perspective', Journal of Management Information Systems, 19(2), 43-84.

Cabukovski, V. and Tusevski, V. (2011) 'Introducing the COBIT Framework into a IT Academic Education', Education and Education Management, 1, 167-170.

Chen, J. and Shen, L. (2010) 'Assessment Model of Corporate Governance with COBIT-Based IT Governance', Nanotechnology and Computer Engineering, 121-122, 550-557.

Choi, W. and Yoo, D. (2009) 'Assessment of IT Governance of COBIT Framework', U- and E-Service, Science and Technology, 62, 82-89.

Cicmil, S. and Hodgson, D. (2006) 'New Possibilities for Project Management Theory: A Critical Engagement', Project Management Journal, 32(3), 111-122.

Conboy, K. (2010) 'Project failure en masse: a study of loose budgetary control in ISD projects', European Journal of Information Systems, 19(3), 273-287.

Cross, T. (2011) 'A Rush To Failure?', Harvard Business Review, 89(4), 127-131.

Davis (1986) 'A technology acceptance model for empirically testing new end-user information systems: Theory and results.',MIT, Doctoral Dissertation.

De Haes, S. and Van Grembergen, W. (2010) 'Analysing the Impact of Enterprise Governance of IT Practices on Business Performance', International Journal of IT/Business Alignment and Governance, 1(1), 14-3838.

Dube, L. and Pare, G. (2003) 'Rigor in information systems positivist case research: Current practices, trends, and recommendations', Mis Quarterly, 27(4), 597-635.

Dwivedi, Y. K., Zinner Henriksen, H., Wastell, D. and De', R. (2013) Grand Successes and Failures in IT: Public and Private Sectors - IFIP WG 8.6 International Conference, Springer.

Eisenhardt, K. M. (1989) 'Agency Theory: An Assessment and Review', Academie of Management Review, 14(1), 57-74.

Fiedler, F. E. 1964. A Contingency-Model of Leadership Effectiveness. Advances in Experimental Social Psychology, 1, 149-190.

Frooman, J. (1999) 'Stakeholder influence strategies', Academy of Management Review, 24(2), 191-205.

Goldschmidt, T., Dittrich, A., Malek, M. and Ieee Computer, S. O. C. (2009) 'Quantifying Criticality of Dependability-Related IT Organization Processes in CobiT', Ieee 15th Pacific Rim International Symposium on Dependable Computing, Proceedings, 336-341.

Hoogervorst, J. (2008) 'De ongemakkelijke waarheid omtrent IT-goverance', Informatie, 03/2008.

ISACA (2012a) COBIT 5 - A Business Framework for the Governance and Management of Enterprise IT, Rolling Meadows, IL, USA: ISACA.

ISACA (2012b) Cobit 5 - Enabling Processes, Rolling Meadows, ISACA.

ISO/IEC (2003) 'ISO/IEC 15504-2-2003 - Information technology - Proces Assessment - Part 2: performing an assessment', 16p.

Jensen, M. C. and Meckling, W. H. (1976) 'Theory Of Firm - Managerial Behavior, Agency Costs And Ownership STRUCTURE', Journal of Financial Economics, 3(4), 305-360.

Kerr, D. S. and Murthy, U. S. (2013) 'The importance of the CobiT framework IT processes for effective internal control over financial reporting in organizations: An international survey', Information & Management, 50(7), 590-597.

Larsen, K. R., Allen, G., Vance, A. and Eargle, D. (2014) 'Theories Used in IS Research Wiki', [online], available: http://istheory.byu.edu [accessed: 9/04/2014]

Laudon, K. C., Laudon, J. P. and Brabston, M. E. (2012) Management Information Systems: Managing the Digital Firm, Pearson Education Canada.

Lee, A. S. and Baskerville, R. L. (2003) 'Generalizing generalizability in information systems research', Information Systems Research, 14(3), 221-243.

Mitchell, R. K., Agle, B. R. and Wood, D. J. (1997) 'Toward a theory of stakeholder identification and salience: Defining the principle of who and what really counts', Academy of Management Review, 22(4), 853-886.

Penrose, E. 1959. The theory of the growth of the firm, New York, Oxford University Press.

Ridley, G., Young, J. and Carroll, P. (2008) 'COBIT 3rd Edition Executive Summary', Australian Accounting Review, 18(4), 334-342.

Truex, D., Holmstrom, J. and Keil, M. (2006) 'Theorizing in information systems research: A reflexive analysis of the adaptation of theory in information systems research', Journal of the Association for Information Systems, 7(12), 797-U26.

Weill, P. & Ross, J. 2004. IT Governance: How Top Performers Manage IT Decision Rights for Superior Results, Harvard Business Press.

Yin, R. K. (2003) Case Study Research: Design and Methods, Applied Social Research Methods Series, Third Edition ed., Thousand Oaks, London, New Delhi: Sage Publications, Inc.