Why Wasn't IT Being Governed?

Before IT ever came to be, every business had established some form of corporate governance. They applied a framework of rules and practices by which their board of directors ensured accountability, fairness, and transparency in the firm's relationship with all its stakeholders (financiers, customers, management, employees, government, and the community). Providing this accountability, fairness, and transparency required governance of every business unit in the company. Each business unit has always been required to provide the information necessary to enable this governance—each business unit except IT.

The financial oversight and audit conventions historically used to govern business units were not applied to IT. How could they be? The businesses who bore rise to these IT organizations barely understood the world of computers and information technology. They just knew that automated processes were far better and less costly than manual processes. They willingly made the investment in IT based on a tacit understanding, implicit belief, or fervent hope that information technology was good for the business. That agreement overshadowed, if not precluded, any call for governance resulting in the autonomy I noted earlier. Given this lack of governance, IT was not required to establish the processes necessary to ensure accountability, fairness, and transparency.