Guidance on the Role of a Governing Body

Good governance of IT projects alone would increase GDP in Australia by 1.6% and excellent governance would increase GDP by 3.1%! – Dr Raymond Young, Assistant Professor at University of Canberra

Mark Toomey, who represented the Australian Institute of Company Directors (AICD) and worked with Dr Young on the Standards Australia committee that developed the world's first jargon-free standard for effective corporate governance of the use of IT (AS 8015), and co-authored and edited the largely unchanged successor to that standard, ISO/IEC 38500, observed:

"Organizations that consistently have trouble with IT also consistently behave poorly when evaluated through the lens of ISO/IEC 38500. Examination of many IT problems, with both projects and operations shows that in every case, at least one and often, several of the principles has been violated." - Mark Toomey, in Waltzing with the Elephant

Mark has published the results of a recent international survey and provided additional commentary in his April newsletter:

• Only 37% of boards have effective oversight of the use of IT
• Only 27% of boards have the necessary skills and knowledge to provide that oversight
• Only in 38% of firms do executive management have the requisite skills and knowledge to keep control over the use of IT
• Only in 25% of firms are executives seen as having a good understanding of the costs, risks, opportunities and value associated with its portfolio of IT assets

"The survey results point to considerable gaps in the ability of boards to provide appropriate oversight of IT, compounded by corresponding weakness in executive management’s capability to set appropriate direction, control and monitor the IT agenda."

Lest we think it is just IT that organizations have problems with, I’m reminded of John Kotter's research that revealed only 30% of organizational change programmes succeed. Despite the thousands of books and courses dedicated to managing change since Kotter’s work, a 2008 survey by McKinsey found that still only one transformation in three succeeds.

These are perennial governance and leadership issues and boards of directors have a responsibility to properly address them. Being only 15 pages of jargon-free guidance for boards and executives, putting the ISO/IEC 38500 standard for corporate governance of IT in the hands of every serious director is not a bad way to start.

Waltzing with the Elephant

Mark Toomey's latest newsletter is a good, easy to read summary of the major issue in getting value from IT; that business leaders must be engaged in directing and controlling their organisation’s use of IT to achieve their business goals. That is fundamentally what governance of IT is about.

The article refers to Sir Peter Gershon's address to the ISACA Oceania conference in Canberra, where the Elephant in the Room was identified in the context of public sector governance of IT but applies equally in business:

"Realising the dream of world class governance of IT in the public sector largely depends on the behaviour of those at the top."

The article goes on to explain why leadership in governance is needed; Directing and controlling the use of IT is part of the much bigger picture of directing and controlling the business.

"IT is an enabler of radical change. But, the mere act of buying or building an IT solution does not of itself deliver the change – a reality that has been proven again and again through the failures of projects where there seems to have been a delightfully naïve expectation that this would indeed be the case."

After reading the article I'm looking forward to reading Mark Toomey's new book, Waltzing with the Elephant.