Foreword

IT governance is one of these concepts that suddenly emerged and became an important issue in the information technology (IT) era. I am not sure as to when the concept surfaced. Gartner introduced the idea of "improving IT governance" for the first time in their Top 10 CIO Priorities for 2003; it was then ranked third. In 1998, the IT Governance Institute¹ was founded to generate awareness of the IT governance concept. In academic and professional literature articles titled with IT governance began to emerge in the late 1990's. In the context of the 2002 Hawaii International Conference of System Sciences (HICSS), I defined IT governance as "the organisational capacity exercised by the board, executive management and IT management to control the formulation and implementation of IT strategy and in this way ensuring the fusion (alignment) of business and IT'². During the last six years that I have been involved with this issue, I witnessed that many organizations started with the implementation of IT governance in order to achieve a better alignment between business and IT. Today, because of the pervasive use of technology and in many cases the critical dependency on information technology, IT governance is high on the agenda and many organizations are implementing IT governance practices.

From my practical experience, I have seen that these IT governance implementations are often driven by IT, while one would expect that the business would take a leading role here as well. This leading role of IT appears to be a paradox, but the same thing happened in the era of business process reengineering, where also in many cases IT took a leading role in reinventing the business processes. After many years of work in this field, I have come to the point to acknowledge that IT is likely (or should be) a very good "change agent" in the organization to get these business challenges realised.

IT governance can be deployed using a mixture of various structures, processes, and relational mechanisms. IT governance structures include mechanisms for connecting and enabling contacts between business and IT such as business/IT steering committees. IT governance processes refer to the formalization of business/IT decision making and monitoring such as portfolio management. The relational mechanisms finally are about the collaborative relationship among business and IT such as joint training. Recent PhD studies³ have studied in detail these IT governance mechanisms and explored their relationship with business/IT alignment, which should ultimately lead to higher business outcomes. Various chapters in this book also contain further research on the relevance of the IT governance practices.

For many years, I have been involved in the development of two leading IT governance frameworks, COBIT and VALIT⁴. Both best practices frameworks are developed by practitioners and originate respectively from the mid-1990's and from 2006. They describe a set of best practices for management, control and security of information technology with COBIT focusing on the IT processes itself and VALIT on the IT related business processes. The growing importance of the COBIT and VALIT frameworks is also acknowledged in this book by several chapters discussing specific issues about these frameworks. As there is still little academic research available around these frameworks, so hopefully this book will initiate further research in this domain.

The important message from both COBIT and VALIT is that IT has to deliver and run applications efficiently and that business value from these applications can only be reached through business change management projects by the business. It is therefore that business or corporate governance of IT is probably a better term for IT governance indicating more clearly that IT governance is a joint operation of business and IT and that both have to develop and implement specific processes for this. It is worthwhile to note here that currently an ISO Standard Corporate Governance of IT focusing on the business audience is under development.

After all, the crucial question about IT Governance or better Business Governance of IT remains whether IT governance practices can help in generating business value from investments in IT. As already indicated in this foreword, this is a rather complex relationship. Currently, I am conducting within my IT Alignment and Governance (ITAG) Research Institute⁵, practice-oriented research on this issue by investigating the relationship between the use of COBIT/VALIT practices and business/IT alignment and ultimately how this impacts business outcome.

I hope that this book may help business and IT practitioners in implementing the right IT governance practices and that it may motivate academics to further research the IT governance implementations and to explore the relationship with business and IT alignment and business outcome.

ENDNOTES

¹ see www.itgi.org

² Van Grembergen, W. (2002). Introduction to the minitrack: IT governance and its mechanisms. In Proceedings of the 35^th Hawaii International Conference on System Sciences.

³ De Haes, S. (2007). The impact of IT governance practices on business/IT alignment in the Belgian financial services sector. University of Antwerp. Bjorn, C. (2007). Business-ICT alignment. Practices and determinants. Katholieke Universiteit Leuven.

⁴ see www.isaca.org

⁵ see www.uams.be/itag

Wim Van Grembergen
University of Antwerp (UA)
University of Antwerp Management School (UAMS)

Wim Van Grembergen is professor at the Business Faculty of UFSIA (University of Antwerp) and is a guest professor at the University of Leuven (KUL). He teaches information systems at the undergraduate and executive level, and researches in business transformations through information technology, audit of information systems, and IT evaluation. Van Grembergen presented at the European Conference on Information Systems (ECIS) in 1997 and 1998 and at the Information Resources Management Association (IRMA) Conferences in 1998, 1999, and 2000. He was Track Chair of "IT Evaluation Methods and Management" for the 2000 and 2001 IRMA-conference. He published articles in journals such as Journal of Strategic Information Systems, Journal of Corporate Transformation, Journal of Information on Technology Cases and Applications, IS Audit & Control Journal and EDP Auditing (Auerbach). He also has several publications in leading Belgian and Dutch journals and published in 1997 a book on business process reengineering in Belgian organizations and in 1998 a book on the IT Balanced Scorecard. Currently, he is editing a book on IT evaluation. He is engaged in the development of COBIT 3rd Edition. Until recently he was academic director of the MBA program of UFSIA and presently he is coordinator of a master program on IT-audit. Professor Van Grembergen has consulted with a number of organizations and is a member of the board of directors of an IT company servicing a Belgian financial group.