Research on IT Governance, Risk, and Value: Challenges and Opportunities

This theme issue of the Journal of Information Systems sees the publication of seven papers that cover a variety of facets of research on the governance of information technology. IT governance (ITG) is the process by which organizations seek to ensure that their investment in information technology facilitates strategic and tactical goals. IT governance is a subset of broader corporate governance, focusing on the role played by information technology within the organization. There are several important dimensions of ITG. Arguably the most important element of ITG is the design of decision rights and organizational structures. What role do governing bodies, such as the Board of Directors, play in the oversight and direction of IT? What roles and responsibilities for IT does the governing body assume and what is delegated to senior and operational management? How is IT to be structured within the organization? Is the provision of IT to be centrally organized within a single, functional IT organizational unit? Or, perhaps, is provision of IT to be largely distributed to operational or administrative units within the organization? Other dimensions of ITG, as noted by Wilkin and Chenhall (2010), include strategic alignment between organizational goals and needs and IT outcomes; management of risk; value delivery; and measurement of performance. ITG has become more important within organizations as the important role that IT plays in adding organizational value has become increasingly clear (Brynjolfsson and Saunders 2010; Masli et al. 2011; Tambe and Hitt 2012). Investment in IT is a significant proportion of current and capital spending in most industries, giving additional impetus to ITG. IT is also subject to high levels of environmental instability. How are organizations to respond to the insourcing/outsourcing nexus, cloud computing, virtualization, and mobile computing among other environmental challenges? Equally, the compliance requirements arising from overall (e.g., SOX) and industry (e.g., HIPAA, Basel II, PCI) regulatory regimes have given an added impetus to ITG efforts. Given that IT both mitigates risk (e.g., by supporting internal control processes) and creates risk (e.g., by exposure of corporate IT systems to external threats), there is an increased understanding that IT is an important component of enterprise risk management (Parent and Reich 2009; Wilkin and Chenhall 2010). While these challenges are compelling for many organizations and particularly for governing bodies, they are shared by a wide variety of organizations. While there may be entity, industry, or national differences, all entities must address questions such as ‘‘how is IT to be organized?’’ or ‘‘how much of the provision of IT should we move to cloud providers?’’ There are also many aspects of IT provision (e.g., security, enterprise architecture, user management, software