Content uploaded by Ofir Turel
Author content
All content in this area was uploaded by Ofir Turel on Apr 01, 2019
Content may be subject to copyright.
Board-level IT Governance
What your company should know and how it should act
Ofir Turel
California State University, Fullerton
Peng Liu
California State University, Fullerton
Chris Bart
The Directors College
Abstract:
This paper suggests that boards’ involvement with information technology (IT)
governance is often not at the needed level. It illuminates the differences between
board-level and executive-level IT governance, explains why both the board and
executives should be motivated to engage in IT governance, and provides board-level
IT governance structure, action and style suggestions. Building on a categorization of
different board governance styles, this paper also offers practical recommendations
including IT related areas and questions the board should focus on, as well as a set of
tools to choose and switch between governance styles.
STATUS QUO: BOARDS OF DIRECTORS STILL DO
NOT GOVERN IT TO THE NEEDED EXTENT
Information technology (IT) can create business value. However, successful outcomes of using
IT are not guaranteed; especially when IT is not governed properly. Poor IT governance can lead
to value destruction through lost opportunities or innovation lag, and increased exposure to IT
risks. The good news is that many companies started discussing IT issues in the boardroom.1 In
fact, the board of directors has a fiduciary duty to govern IT in order to create business value and
mitigate IT-related risks. The board of directors represents the shareholders and other key stake-
holders of a company. It is generally considered to be responsible for all corporate governance
matters, which include IT governance.2
Legislation such as the Sarbanes-Oxley and the Dodd–Frank Acts have shaped the structure and
actions of board corporate governance. They also mandated at least some IT governance as a
means to ensure the accuracy of financial reporting. Nonetheless, many IT governance domains,
such as value creation and performance measure, have been left out from this reform, despite
their importance. Indeed, several of our studies revealed that many board members still see IT as
an operational issue they should avoid. For example, one board member stated:
"IT is an operational matter and we leave it to management to make it work. If it fails we
hold management accountable. As long as it doesn’t bring the company down, why should
we get involved?"
This avoidance-by-the-board partly stems from embarrassment, different priorities and prefer-
ences, but also partly because board members often lack awareness, knowledge, skills, or a com-
bination of these factors to govern IT.3,4 Many are trained in accounting, finance, law and
strategic management and therefore tend to adopt a limited governance perspective. Indeed, for
this study we analyzed Standard & Poor's 500 companies; as of 2017, twelve years after the sem-
inal recommendations of Nolan and McFarlan2 were published, only 4.4 % had a board-level IT
committee. While this may not be indicative of the existence of IT governance, it is indicative of
the emphasis boards put on IT. Boards’ low involvement with IT governance seemed to be out of
step given the increased strategic importance of and risks presented by IT.
The objectives of this paper is to examine the status-quo in board IT governance research and
practice and provide additional recommendations derived from our research. In the sections that
follow, we illuminate the differences between board-level and executive-level IT governance,
and provide board IT governance structure, action and style suggestions.
IT GOVERNANCE BY THE BOARD OF DIRECTORS
IT governance includes organizational authority, structure, actions, relations and leadership to
ensure that IT sustains and extends the strategies and objectives of an organization.5,6 It is worth
noting that IT governance is different from IT management. While IT governance includes mak-
ing strategic IT decisions and providing guidelines for IT management, IT management involves
making specific IT decisions and supporting goals defined by governing bodies.7
IT governance is the responsibility of a company’s board of directors and top management
team.8 While symbiotic, the IT governance responsibilities of the top management team and the
board are distinct. Top management’s responsibilities include strategizing, planning, budgeting,
executing, controlling, communicating and reporting on IT projects and operations. They can use
one or more IT governance frameworks (methods, standards or best practices), such as COBIT
(Control OBjectives for Information and Related Technology), ITIL (IT Infrastructure Library),
and ISO/IEC 38500 (Standard for Corporate Governance of IT).
The board, in contrast, is absent from the day-to-day implementation of IT strategies. It instead
assumes the responsibilities of initiating and steering the needed planning at the executive level,
assessing top management and its plans, setting compensation schemas for executives, and meas-
uring top management and organizational performances. The board is also involved in creating
the mechanisms needed for effective IT management and operations. For example, the board can
approve CIO roles, appoint CIOs, and create a CIO compensation schema that supports desired
objectives. Moreover, the board should respond to top management IT-related queries and needs.
For instance, the board may be approached to find ways to finance a large IT project.
Unfortunately, compared with executive-level IT governance frameworks, there are fewer guide-
lines that clearly delineate what the boards should consider doing regarding IT. Current recom-
mendations (like the ones provided by CICA9 and ITGI8 and ISO/IEC 38500) focus on suggested
topics to discuss (IT committee, opportunities, and risks) and questions the board should address
in its meetings. Synthesizing extant suggestions and our own research-based insights, we use
Figure 1 to depict the board’s IT governance and its position in the big picture of responsibilities
related to IT governance and management.
Figure 1: Responsibilities related to IT governance and management
WHY BOARDS SHOULD CARE ABOUT IT
GOVERNANCE
Studies on board IT governance unanimously suggest that this practice improves organizational
performance in various settings, regardless of the industry sector to which a firm belongs, its
profit orientation (for profit or non-for profit) and its size.2,10,11 However, there is a gap between
what academics and consultants believe boards should do to govern IT and how they actually do
it. Most boards only pay attention to IT risks and ignore other topics, like IT vision, IT strategic
planning, and IT competitive advantage,4 and only 19.6% of boards are routinely informed about
the state of IT at their companies.5 This is also reflected by the low use of key board IT govern-
ance questions in board meetings.3,11
Given the accumulating evidence that firm performance is associated with board IT govern-
ance,2,10,11 we contend that boards should consider improving their IT governance. While this
connection is not obvious to all, some board members we interviewed for our studies started re-
alizing that IT governance is an important practice that is part of their duties. For instance, one
stated:
“Having participated on several boards, I have witnessed the spectrum of IT governance
knowledge, mostly lack thereof. Many board members feel the IT should be handled by
staff, while others have come to realize the importance of IT governance.”
RECOMMENDATIONS TO COMPANIES
We synthesize extant recommendations on the structure and actions of board IT governance, and
extend it to style aspects of human interaction (See Sidebar). Specifically, we provide additional
suggestions based on our research on board governance style (i.e., how boards should interact
with top management to govern IT). The focus is in line with recent research stressing the im-
portance of relational capabilities in IT governance.12
As Sidebar shows, the focus on governance style is worthy, because it is a modifiable aspect of
boards’ work that can help them achieve better results.13 To do so, boards only need to change
interpersonal interactions with executives. However, since governance style is flexible, its bene-
fits to the company may be temporary. New board member may prefer different styles and
boards may need to adjust styles to fit with changes in the business environment. In contrast, set-
ting up committees and performing governance actions can generate long-term benefits. Note
that board governance style complements IT governance structures and actions. Effective styles
can amplify the power of IT governance, whereas ineffective styles can suppress these effects.13
Hence, companies should implement all structure, action and style aspects of IT governance. Be-
low we make recommendations on these three aspects.
Board IT governance structure: setting up a standalone IT
committee
Since many boards lack IT knowledge, one possible solution is to add IT-savvy board members.
However, this solution is not always easy to implement. Many boards still do not want to give up
a seat to technologists who may have only IT knowledge. This argument is supported by the
facts that only 7.8% of companies prefer board members with IT experiences.5 In Standard &
Poor's 500 companies, 15% of new board seats were filled by IT-savvy directors,14 which equals
to 1% of the total number of directors.
Alternatively, we recommend boards to establish a standalone IT committee.2,8 This can reduce
the risk of IT security breaches.15 We also recommend the IT committee to include independent
directors and to be chaired by an independent director. All Standard & Poor's 500 companies
have independent directors on audit and compensation committees, the chairs of which are inde-
pendent directors as well. IT committee should work closely with the audit committee on risk
mitigation tasks. While over 80% of Standard & Poor's 500 companies had managers in execu-
tive IT positions, such as CIO and CTO,16 only 4.4% had board structures (IT committees) to
deal with IT. Therefore, we call for closing this gap by establishing more board IT committees.
Clearly then, having an IT-savvy board or a board IT committee is a manifestation of the highest
level of commitment with regard to IT governance. A board committee signals that the company
considers IT to be a strategic tool that merits attention from the upper echelons. This emphasis
can trickle down to executives, managers, employees and investors. Another advantage of such a
committee is that it may require a single person who is IT-savvy, and the rest may utilize his or
her skills and supplement them with their own (e.g., accounting, legal). This structure therefore,
better utilizes the scarce resource of IT-savvy directors.
Board IT governance actions: what can boards do to govern IT
Based on interviews with and surveys from boards and synthesizing recommendation regarding
board IT governance,8,11 we provide a list of IT governance actions from which boards can
choose (see Table 1). These actions belong to the five domains of IT governance proposed by
ITGI: (1) IT resource management, (2) IT performance measurement, (3) IT strategic alignment,
(4) IT value delivery, and (5) IT risk management.8 The first domain ensures that IT resources
are sourced responsibly. IT resources include equipment, hardware, software, cloud-based stor-
age, and IT staff and knowledge. The acquisition and sourcing of IT resources often involve ma-
jor decisions on IT investment that require board approval. The second domain focuses on
ensuring that IT activities, services, and processes are performed, measured and assessed
properly. The third domain focuses on ensuring that IT is well integrated with and supportive of
business objectives. The fourth domain focuses on one of the ultimate goals of IT governance,
which is that companies successfully derive value from IT. This value includes better financial
performance, customer satisfaction, compliance, and/or operational excellence. The fifth domain
focuses on ensuring that IT related risks are managed and reasonably mitigated. IT Risks include
service disruption, technical malfunctions, cybercrimes, cyberattacks, industrial espionage, elec-
tronic fraud, faulty service, denial of service, incorrect data modification, and unauthorized data
disclosure.
Table 1. Board-level IT Governance knowledge domains and actions
Skills
Board-level IT Governance Actions
IT Resource
Management
/oversight
Create and ensure financial viability of the IT function
Approve/reject major (transformative or risk-related) IT decisions
Approve/reject IT investment budgets
Provide access to external IT resources and knowledge
IT Performance
Measurement
/oversight
Motivate top management and CIO (e.g., via compensation
structure)
Monitor IT deliverables against business objectives
Ask for state-of-IT reports from top management
IT Strategic
Alignment
Ensures reasonable IT goals and strategic plans
Encourage the CIO to interact with top management
Develop shared understanding and collaboration between the
CIO and top management
Create an atmosphere of joint accountability and support regard-
ing IT
IT Value
Delivery
Bring IT value creation insights from other organizations
Advise top management and CIO on strategic IT matters
Direct executives’ attention to IT innovation and trends
Identify possible IT opportunities and ask the executives to ex-
plore them
Respond to positive changes in the environment
IT Risk
Management
Review IT risk management policies and plans
Bring IT risk management insights from other organizations
Direct executives’ attention to IT issues and risks
Identify possible IT threats
Respond to negative changes in the environment
Board IT governance styles: how should boards interact with
top management to govern IT
Effective interaction between the board and top management can help the board understand the
full IT landscape and to better communicate its intentions and directives to executives. It also
helps management to be better receptive to and follow the directives and spirit of the board.
However, current board IT governance research and practice largely ignore style aspects of IT
governance. In our interviews and empirical studies, we found that boards need to give serious
consideration to this aspect.11,13
Applying Baumrind’s typology of parental supervision styles to the board,17 there are two over-
arching dimensions of board governance style: monitoring and advising, both of which are prime
responsibilities of the board.18,19 Being high or low in these two dimensions produces a 2x2 table
with four prototypical board governance styles: authoritarian, authoritative, permissive and ne-
glectful. Authoritarian boards mainly perform a monitoring role; authoritative boards engage
highly in both monitoring and advising roles; permissive boards concentrate on an advising role;
and neglectful boards are low in both monitoring and advising roles. One use of this table is to
locate where a company's governance style falls. This can be accomplished by boards’ self-as-
sessments and/or top management surveys. After estimating the extant governance style, it is
possible to switch to a style that better fits current needs and the business environment.
Another use of the table is to helpWith the help of four governance styles, boards can decide
what to do and what to avoid. It is well-accepted that both the monitoring and advising roles of
the board are important,18,19 and therefore boards should avoid adopting a neglectful style. Nev-
ertheless, some board members adopt a neglectful style regarding IT (see the first quote on page
2), and this can hurt the organization.2,10,11
Moreover, findings suggest that authoritarian style can be harmful to firm performance.13 It in-
creases the over-reporting burden on executives. That is, too much monitoring can result in ex-
cessive reporting and reduce management’s ability to deal with daily IT management and
operations.20 Directors are therefore advised not to engage in authoritarian style. If the board
governance of a company involves these two styles, it is time for this board to make changes
(e.g. to adopt an authoritative style). The changes can be initiated by either board members or top
management through an open discussion. In contrast to the two styles mentioned above, an au-
thoritative governance style can help a company achieve significant performance gains, because
when employed, the board plays a fairly balanced role in governance. We contend that the dual
emphasis on monitoring and advising not only can improve board oversight, but also lead the
board to provide appropriate strategic advice and support.
The effectiveness of authoritative style seems to suffer only when the company experiences a
turbulent environment with significant changes and uncertainties (e.g., new entrants, disruptive
technologies, big changes in competitors’ behaviors and customer demands). In such turbulent
environments, the board should ideally be more permissive and demonstrate that style by having
more tolerance and providing more advice to top management, while putting less emphasis on
immediate monitoring. The reason is that in such circumstances advising and supporting the ex-
ecutives is more important, and at the same time, monitoring (which includes mostly looking at
the past) can be fruitless and time consuming, given the significant changes.20 Ultimately, when
boards attempt to engage in these different IT governance styles, we recommend that they con-
sider the balance between their monitoring and advising roles.
Asking key IT governance questions (e.g., similar to the ones listed in Table 2) and setting up IT
governance structures (e.g., a committee) are effective ways to initiate board IT governance.8
Note that by asking the same questions but while employing different styles, the board can con-
vey its emphasis on the monitoring and advising aspects of governance style. The monitoring
role is covered in columns 1 and 3, while the advising role is covered in columns 2 and 3. For
example, the board can ask “What is the frequency of reporting …” to show monitoring role, and
it can ask “Are you comfortable with the frequency of reporting…” or "what can we do to help
you with this IT matter" to adopt an advising role. The board can also provide insights from
other companies or based on prior executive-level experiences its members possess, say regard-
ing reporting, to enhance or reduce the two roles. We acknowledge that this table artificially sim-
plifies the complex interactions between the board and the executives. However, it is used to
provide examples and represents a first step forward improving the effectiveness of board IT
governance. Ideally, boards should ensure style consistency throughout all interactions with ex-
ecutives.
Table 2. Examples of showing monitoring role and advising role
Monitoring Role
Advising Role
Board IT governance questions and statements
What is
Are you com-
fortable with
the frequency of reporting the matters related to the
company’s IT resources to the board
Did you know
We can help
you to clarify
the value of the company’s IT resources
the strategic importance of IT resources to the com-
pany
How did you
Do you need
help to
develop and implement the company’s IT strategy
ensure the company’s IT strategy is aligned with the
company’s overall strategy
develop shared understanding between CIO and top
management on strategic IT matters, trends, innova-
tions, issues and risks
measure the contribution provided by the company’s IT
resources
assess emerging technologies and trends, and their po-
tential impact on the company
monitor and report the performance of the company’s
IT resources, processes and projects
protect the confidentiality of intellectual and infor-
mation assets
monitor legal, regulatory and contractual obligations
related to IT resources
Did
We can help
ensure that
the investment in IT resources meet(s) the business’s
requirements to process information
the company’s IT resources and initiatives allow com-
pany to capitalize on, and adapt to marketplace forces,
trends and opportunities
its information and IT resources, systems and technolo-
gies keep pace with changing business needs and ena-
bling the organization’s success
Is/are there
We can guide
you to set up
appropriate collaboration and accountability for identi-
fying, acquiring and deploying IT resources and capa-
bilities to meet the needs of the company
We can help
you develop
adequate plans (e.g. business continuity plan and disas-
ter recovery plan) to enable continuity of critical busi-
ness operations
IT risk assessment plan and IT security policies
We can help
you access
sufficient IT resources and knowledge including succes-
sion plans for key IT personnel
What are
We can help
you choose
measures to enhance, preserve and safeguard the in-
tegrity and reliability of the company’s data and IT re-
sources
Note: “You” refers to executives, and “we” refers to the board. Some of the questions and statements are adapted
from “20 questions directors should ask about IT”.9
What should CEOs and CIOs do regarding Boards’
involvement with IT
CEOs and CIOs and other senior executives should push their boards to spend more time on IT
matters during board meetings and eventually, if needed, establish a dedicated board IT commit-
tee. Although, executives also need to spend extra amounts of time and effort to report to and
interact with the board when it starts discussing IT, the executives can benefit from IT resources,
guidance and advice provided from their board members. This is especially true if their compen-
sation is tied to long-term performance, in which case it is in their best interest to request and
motivate board IT governance. After all, board IT governance is associated with firm perfor-
mance.2,10,11
CONCLUSION
In this article we posit that board involvement with IT governance is often not at the needed
level. We illuminate the differences between board-level and executive-level IT governance, ex-
plain why the board and the management team should be equally motivated to engage the board
in IT governance, and outline board IT governance structure, action, and style recommendations.
REFERENCES
1. Paredes, D. (2016). Tech disruption and cybersecurity top boardroom agenda in NZ.
CIO. Retrieved July 17, 2018, from https://www.cio.co.nz/article/593402/tech-
disruption-cybersecurity-top-boardroom-agenda-nz/
2. Nolan, R., & McFarlan, F. W. (2005). Information Technology and the Board of
Directors. Harvard Business Review, 83(10), 96-106.
3. Bart, C. K., & Turel, O. (2010). IT and the Board of Directors: An Empirical
Investigation into the ‘Governance Questions’ Canadian Directors Ask About IT.
Journal of Information Systems, 24(2), 147-172.
4. Huff, S. L., Maher, M. P., & Munro, M. C. (2006). Information technology and the
board of directors: is there an IT attention deficit?, MIS Quarterly Executive, 5(2),55–
68.
5. Andriole, S. J., & Bojanova, I. (2014). Optimizing operational and strategic it. IT
Professional, 16(5), 12-15.
6. De Haes, S., & Van Grembergen, W. (2009). An Exploratory Study into IT
Governance Implementations and Its Impact on Business/IT Alignment. Information
Systems Management, 26(2), 123-137.
7. Weill, P., & Ross, J. W. (2004). IT governance: How top performers manage IT
decision rights for superior results. Harvard Business Press.
8. Information Technology Governance Institute (ITGI). (2003). Board briefing on IT
governance. Retrieved July 17, 2018, from https://www.isaca.org/knowledge-
center/research/researchdeliverables/pages/board-briefing-on-it-governance-2nd-
edition.aspx
9. CICA. (2004). 20 Questions Directors Should Ask About It. Canadian Institute of
Chartered accountants (CICA), Toronto, ON, 1–16.
10. Jewer, J., & McKay, K. N. (2012). Antecedents and Consequences of Board It
Governance: Institutional and Strategic Choice Perspectives. Journal of the
Association for Information Systems,13(7), 581-617.
11. Turel, O., & Bart, C. (2014). Board-Level It Governance and Organizational
Performance. European Journal of Information Systems, 23(2), 223-239.
12. Kude, T., Lazic, M., Heinzl, A., & Neff, A. (2018). Achieving IT‐based synergies
through regulation‐oriented and consensus‐oriented IT governance capabilities.
Information Systems Journal, Forthcoming.
13. Turel, O., Liu, P., & Bart, C. (2017). Board-Level Information Technology
Governance Effects on Organizational Performance: The Roles of Strategic Alignment
and Authoritarian Governance Style. Information Systems Management, 34(2), 117-
136.
14. Spencer Stuart (2016). Spencer Stuart Board Index A Perspective on U.S. Boards.
Retrieved July 17, 2018, from https://www.spencerstuart.com/~/media/pdf%20files/
research%20and%20insight%20pdfs/spencer-stuart-us-board-index-2016.pdf
15. Higgs, J. L., Pinsker, R. E., Smith, T. J., Young, G. R. (2016). The relationship
between board-level technology committees and reported security breaches. Journal of
Information Systems, 30(3), 79-98.
16. Banker, R. D., Feng, C. Q., & Pavlou, P. A. (2011). CIO Educational Background,
Strategic Positioning, and Stock Performance. Working paper. Retrieved July 17,
2018, from https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1910387
17. Baumrind, D. (1971). Current Patterns of Parental Authority. Developmental
psychology, 4, 1-103.
18. Eisenhardt, K. M. (1989). Agency Theory: An Assessment and Review. Academy of
Management Review, 14(1), 57-74.
19. Davis, J. H., Schoorman, F. D., & Donaldson, L. (1997). Toward a Stewardship
Theory of Management. Academy of Management Review, 22(1), 20-47.
20. Ghasemaghaei, M., Hassanein, K., & Turel, O. (2017). Increasing Firm Agility
through the Use of Data Analytics: The Role of Fit, Decision Support Systems, (101),
95-105.
ABOUT THE AUTHORS
Ofir Turel is a professor at the Information systems and Decision Sciences Department,
California State University, Fullerton. Before joining the academia, he held senior positions
in the information technology and telecommunications industries. His research interests in-
clude a broad range of behavioral, bio-physiological, and managerial issues in various infor-
mation systems contexts. He has published over 90 articles in various journals. Contact him
at oturel@fullerton.edu.
Peng Liu is an assistant professor at the Information systems and Decision Sciences De-
partment, California State University, Fullerton. His research interests include IT govern-
ance, business value of IT, organizational routines and capabilities, and trust in
technologies. Contact him at peliu@fullerton.edu.
Chris Bart is a retired professor of Strategic Market Leadership (Strategy and Governance)
at the DeGroote School of Business, McMaster University, Hamilton, Ontario, and is the
Principal with Corporate Missions Inc. (http://www.corporatemissionsinc.com). He is also
the Founder of The Directors College: Canada’s first university accredited director educa-
tion program. He is the author of the Canadian Business #1 best seller, “A Tale of Two Em-
ployees and the Person Who Wanted to Lead Them.” He has also published over 100 other
articles, cases, and reviews. Contact him at chris.bart@thedirectorscollege.com.
