IT balanced scorecard dimensions 

Context in source publication

Context 1

... standards setting body. Within the IT realm, the Information Systems Audit and Control Association (ISACA) has also been proactive on an international basis in terms of providing guidance to management and auditors on effective IT governance and control frameworks. In some cases, the two organizations have worked together in the development of guidance for managing IT (e.g. IFAC, 1999; ISACA, 2001; IT Governance Institute, 2001). In this section, the guidance for management and auditors are each reviewed. IFAC None of provides these guidelines a central are distribution particularly point novel for to guidance IT researchers, on IT but governance, what is important bringing together from the perspective the contemporary of inter-organizational thinking of multiple systems bodies is that on an strategies enterprise for should establishing also be corporate interested in governance the effectiveness over IT. with In an which early supply guideline chain issued partners for and executive outsourcing management, partners IFAC adhere focused to these guidelines. on the IT The planning guidelines process are focused and on the internal importance corporate of monitoring focusing IT of investments planning, but on it is strategic unlikely alignment that strategically (IFAC, aligned 1999). The interorganizational guidelines focus systems on several that core link principles two or more for enterprises IT planning, in the including: supply chain through B2B e-commerce can be successful if both (1) enterprises alignment are with not business following direction good planning of enterprise; processes. Similarly, the core principles for (2) IT governance relevance of 1 and planning 4-10 from scope; the aforementioned IFAC guidance are critical to both enterprises (3) relevance and of if planning either timeline; enterprise’s alignment is not in place with joint interorganizational (4) identification systems of how business benefits objectives will be realized; and principles 4-10 are not in place to assure (5) alignment achievability is achieved, of plan; then success can be hindered for both enterprises. (6) The basis subsequent for measuring release of and the monitoring IT Governance performance; framework[3] by the IT Governance Institute (7) period (2001) reassessment broadens the of view plan; of IT Governance and prescribes a much broader view, (8) albeit dissemination at a high level of plan prescription. to create internal Figure 1 awareness; reflects the framework put forth in the 2003 (9) guideline. accountability; Note there and are five main focus areas that are key to responding to stakeholder (10) management value drivers. commitment IT strategic to plan alignment implementation relates to is a clear. focus on aligning IT with the business strategy. IT value delivery is concentrated on optimizing expenses and None of these guidelines are particularly novel to IT researchers, but what is important from the perspective of inter-organizational systems is that an enterprise should also be interested in the effectiveness with which supply chain partners and outsourcing partners adhere to these guidelines. The guidelines are focused on internal corporate monitoring of planning, but it is unlikely that strategically aligned interorganizational systems that link two or more enterprises in the supply chain through B2B e-commerce can be successful if both enterprises are not following good planning processes. Similarly, the core principles for IT governance 1 and 4-10 from the aforementioned IFAC guidance are critical to both enterprises and if either enterprise’s alignment is not in place with joint interorganizational systems business objectives and principles 4-10 are not in place to assure alignment is achieved, then success can be hindered for both enterprises. The subsequent release of the IT Governance framework[3] by the IT Governance Institute (2001) broadens the view of IT Governance and prescribes a much broader view, albeit at a high level prescription. Figure 1 reflects the framework put forth in the 2003 guideline. Note there are five main focus areas that are key to responding to stakeholder value drivers. IT strategic alignment relates to a focus on aligning IT with the business strategy. IT value delivery is concentrated on optimizing expenses and proving the value of IT. Risk management is fairly narrowly defined as the safeguarding of IT assets and disaster recovery. Performance Measurement relates to the processes in place to track project delivery and monitor IT services. Resource management (the overarching consideration for the other focus areas) relates to optimizing knowledge and infrastructure from available IT resource investments. Perhaps one of the more beneficial extensions put forth by the governance framework is the focus on performance measurement in that it takes a position emphasizing a balanced scorecard approach to assessing performance. This balanced scorecard approach (see Figure 2) takes a broader look beyond the financial performance criteria to recognizing the value accrued from meeting customer needs, examining alignment and support of internal business processes, and how IT supports organizational learning and innovation. Notable again in this framework, and the discussion supporting the framework, is the focus on internal processes, internal value, and internal alignment of processes. While clearly there is value from assessing internal systems, the framework again assumes an enterprise centric model and ignores the implications of interorganizational systems. Also of note, is the general tone taken within the discussion of the framework that addresses IT risk as a separate and distinct subset of It is of note that the latter principle does extend beyond traditional IT controls to recognize a business issue that may arise from e-commerce relationships. IFAC’s information processing risk principles include: . completeness; . accuracy; . timeliness; . accessibility; . maintenance of chronological order; and . inalterability of data. The focus on information security and processing for the principles and criteria for e-business and accounting is curious given that the whitepaper expressly recognizes that IT systems include three basic elements: (1) IT business processes; (2) IT applications; and (3) IT infrastructure. business It The However, is focus of note risk. the on that However, information three the components latter enterprise security principle systems are and does fairly processing have extend narrowly reshaped beyond for the defined most principles traditional organizations to focus and IT controls criteria on over the the for IT to past recognize e-business components decade a and to business and the accounting not point the issue where integration. is that curious the may enterprise given Similarly, arise that systems from the the e-commerce three whitepaper establish basic the relationships. elements expressly business are recognizes rules viewed IFAC’s and the information that from business IT the systems enterprise processing processes include centric risk three cannot view principles basic be and elements: cleanly risks include: from separated the partner from the on the enterprise other end systems of an supporting e-business (1) . completeness; IT business relationship and driving processes; are those not business considered processes. other than This to consider integrated the nature need to of capture IT and business electronically (2) . accuracy; IT processes applications; received necessitates transaction and that data business from risk the partner. be assessed from such an integrated perspective. (3) One . timeliness; IT quote infrastructure. in the IT Governance report should resonate heavily with management and researchers, IFAC . accessibility; has “In recognized IT, if you that are e-business playing the alters game the and risk not model. keeping In a white score, paper you are entitled: only “E-Business practising” . maintenance (IT and Governance the of chronological Accountant” Institute, order; (IFAC, 2001). and 2002a) The notes corporate that governance risks increase guidelines in an e-business . inalterability environment of data. and management has a responsibility to manage the ensuing risks. The principles and criteria for e-business still treat IT risk as a distinct subset of business risk, though, as it examines the reliability of information security and information processing. The security risk principles include: . integrity; . availability; . confidentiality; . authenticity; . authorization; and . non-repudiation. However, the three components are fairly narrowly defined to focus on the IT components and not the integration. Similarly, the three basic elements are viewed from the enterprise centric view and risks from the partner on the other end of an e-business relationship are not considered other than to consider the need to capture electronically received transaction data from the partner. One quote in the IT Governance report should resonate heavily with management and researchers, “In IT, if you are playing the game and not keeping score, you are only practising” (IT Governance Institute, 2001). The corporate governance guidelines presented through the series of guidance documents reviewed to this point all provide valuable information and discussion to support initial IT governance strategies. However, these guidelines still fall short of addressing IT corporate governance needs in enterprise systems and extended-enterprise systems environments. Research is desperately needed that will help guide management in assessing risk in environments where business processes are supported and driven by enterprise systems, and where the two are essentially inseparable and must be jointly assessed. Research is also desperately needed to assist in the development of risk models that recognize that in extended-enterprise ...