SAJEMS NS 12 (2009) No 1 115 Using information technology governance, risk management and compliance (grc) as a creator of bUsiness valUes – a case stUdy Osden Jokonya and Sam Lubbe School of Computing, UNISA Abstract The relationship between information technology (IT) governance, risk management and compliance (GRC) and organisation business values continues to interest academics and practitioners (IT Governance Institute, 2003). Like governance, risk management and compliance generally, IT GRC is about the decision rights and accountabilities that encourage desirable behaviour in the use of IT (IT Governance Institute, 2003). A case study approach was used in an organisation with many business units. The organisation selected is a mining company, RioZim, situated in Zimbabwe. Data was collected from business units on IT issues and business values. The interviews centred on the IT GRC practices based on responsibility and authority for IT decision-making. The results suggest that IT GRC does not adequately support business values. The study revealed that business values should drive IT GRC and IT GRC should be the responsibility of executives and all business units. JEL L20, L86 1 Background to the study Corporate executives and boards of directors look at IT as they would any other business unit, and they expect the same level of efficiency, reliability and economic return from IT as they do from other parts of their organisations. The main reason for this is that the IT Department has moved from being a commodity service provider to a strategic partner where IT is viewed as a tool for increasing business growth rather than just an expense (Weill, 2004). According to Ward and Peppard (2003), the position of IT resources in the organisational structure has been problematic since computing began. Peterson, O’Callaghan and Ribbers (2000) add that, as the business environment changes, technologies evolve to ensure that IT helps to sustain innovation (IT Governance Institute, 2005b). Investments in IT are growing, and business managers often worry that the benefits of IT investments might not be as great as expected. In order to address the concerns of business and IT executives about IT expenditure, IT GRC management should enable the business and IT to understand how IT contributes to the achievement of business values (Weill, 2004). 2 Background to the literature IT is a broad subject concerned with technology and other aspects of managing and processing information, especially in large organisations. IT deals with the use of electronic computers and computer software to store, process and transmit information. In the competitive market, IT-based real-time systems, which provide real-time access to information or data, are essential. McKenna (1997) claims that life in the high-tech information age is a real-time experience – events occur in real time. In highly technological industries, IT technical standards are established by dominant firms, 116 SAJEMS NS 12 (2009) No 1 thus giving them the monopoly. Silk (1991) classifies the generic IT impact, which he refers to as “benefit classes”. These classes are efficiency, effectiveness and competitive advantage. An efficiency impact is felt where IT has made savings on other resources. A strategic advantage impact can be detected where IT has changed some aspect of what a business does, by improving that business. This results in growth, defined as an increase in revenue, throughput or profit or whatever the relevant indicator is for the given organisation. 3 IT GRC Ross and Weill (2004) argue that IT GRC is a decision rights and accountability framework for encouraging desirable behaviour in the use of IT. IT GRC is seen as a framework that ensures that IT decisions consider the business goals and values. In the same way that compliance aids an organisation in ensuring that key decisions are consistent with the corporate vision, values and strategy, IT GRC ensures that IT-related decisions match companywide values. IT is a major component of large organisations’ capital spending. IT GRC should, therefore, be one of management’s significant concerns. The discipline of IT GRC is derived from corporate governance and deals primarily with the connection between the business focus and the IT management of an organisation. The IT Governance Institute (2003) adds that much of the complexity of IT GRC arises from the conflicting pressures of dealing with the different stakeholder groups, business executives, IT executives and users who all utilise and thus have legitimate and often vital interests in the IT systems within their companies. All the groups have conflicting goals, interests and incentives. The need for better management of IT is one of several reasons organisations around the world are taking a new look at IT GRC. IT has become a support and strategy tool, and few business processes can function without its support. According to the IT Governance Institute (2003) study, most organisations have not been very effective at IT GRC because many executives do not make decisions about IT – the IT Department is forced to make decisions regarding priorities and investments. IT GRC provides a structure for ensuring that decisions about IT support business values. It ensures that the right projects get the funding they need to address competitive threats or pursue new opportunities. It ensures that the IT organisation and the lines of business share accountability for IT investments and it provides a framework for measuring IT effectiveness. According to Weill (2004), in deciding on the organisation of IT resources, the key questions are: what aspects of IT are best managed centrally and which are best devolved; and should IT activities be managed by specialist IT functions or should they be managed by business management? In addressing these questions organisations need to define the authority, responsibilities, policies, mechanisms and procedures surrounding IT. Organisations make major IT decisions on five IT management domains: principle, architecture, infrastructure, application and investment (Weill, 2004). According to Broadbent and Weill (1997) IT principles are high level statements about how IT is used in a business. Agarwal and Sambamurthy (2002) maintain that the strategic role of IT is to facilitate innovative business strategies and processes. Peppard and Ward (1999) indicate that, where an IT function is perceived as providing a value-added contribution to a business, IT has an impact on that business’s performance. It is advantageous for a business to have an objective view of the current role and contribution of its IT – the role and contribution of the IT function itself, and of the perception of this from the rest of the business. Return on investment analysis is often not meaningful in evaluating infrastructure investment since it does not measure the unquantifiable benefits of strategic systems. New methods for justifying IT investment which identify and quantify the intangible benefits are needed. Organisations need to understand the context in which an evaluation is taking place and then apply the appropriate technique (Brynjolfsson, 1993; Haynes & Thompson, 2000). According to Weill and Vitale (2002), the term IT architecture lacks a universally accepted definition. More often than not IT architecture SAJEMS NS 12 (2009) No 1 117 refers to an organisation’s list of technology standards. According to Sauer and Willcocks (2002), the power of IT architecture lies in synergy – aligning business goals (established and anticipated) and IT needs and resources. They highlight that the role of IT architecture is to bring order to the otherwise chaotic world of IT by defining guidelines and standards and then ensuring adherence to these. Organisations recognise that short-term profit maximisation is rarely the best approach to achieving sustained corporate growth and profitability. A key element in any business planning process is to set business values. These are usually described by reference to profitability, growth, market share and social responsibility. Business values must reflect the values held by the organisation, its management and major shareholders. In order to achieve their business values, organisations must measure the performance of their IT activities. According to Weill (2004), the best IT GRC is the one that is linked to corporate business values. Figure 1 Maturity levels of IT deployment (Source: Morton, 1991) Organisations first set those business values which are aligned with IT. Some of the organisation’s business values include the use of IT to enable the organisation to exploit business opportunities and maximise IT benefits. These values can be achieved through using IT resources responsibly and managing IT- related risks appropriately. IT activities increase automation, decrease cost and manage risk. The organisation will need to compare the set of values and IT activities to provide direction and measure performance. The role of IT GRC should therefore be to support business values (IT Governance, 2003). 3.1 Research questions Although in theory IT GRC can assist an organisation to achieve business values, this is not the case for many organisations. The main aim of this study was to determine if an organisation can benefit from IT GRC. The study objectives have been excluded from this 118 SAJEMS NS 12 (2009) No 1 report because of the limitation on the length of the publication; the objectives, of course, support the research questions. This study also aimed to answer the following research questions: 1. Are IT contributions the same for various business units and departments in the same organisation? 2. Are business units’ users aware of their business values and the importance of IT in achieving them? 3. Do business units know the value of IT committees for achieving their business values? 4. Are the business units within an organisation able to identify areas in which IT can help to achieve their business values? 3.2 Summary Despite increasing recognition that IT and business are indivisibly linked, consolidating across-business IT processes and applications remains an on-going challenge for many organisations. The resulting IT complexity not only drives up redundancy and cost, but is also detrimental to the organisation’s competitive advantage. In order to address this challenge, since business and IT are increasingly interdependent environments, important responsibilities should fall within both camps. Business management cannot realistically formulate strategies without sufficient knowledge of the underlying IT issues and then expect the technology to deliver differentiation. In other words, business management cannot afford not to involve IT in business planning. 3.3 Research approach The case study approach was found to be more appropriate for the study of a single organisation with many business units. This study used both qualitative and quantitative research approaches. The qualitative approach was particularly concerned with the context in which events were taking place (Robson, 2002). Although the research adopted a mainly qualitative approach to data collection this does not mean that quantitative data were excluded. Quantitative data used in the research were obtained from primary document sources such as company accounts and a variety of secondary documentary sources including official reports. The case site was selected based on a combination of accessibility (to business executives and business managers), interest (in the issues of IT GRC) and diversity (diversity of business units in size and operation). The sampling frame was the current population of executives, business unit managers and functional heads within the organisation’s four strategic business units. The research collected the primary data from 30 respondents who represented the total population of heads of departments and sections from RioZim’s four strategic business units. Accessibility was made easier since the researcher had previously worked for RioZim. Apart from structured interviews, data were also gathered from a variety of sources (primary and secondary) including internal company reports, minutes from meetings and official reports. The researchers opened a research day-book in which notes, ideas and questions were recorded (Saunders, Lewis & Thornhill, 2003). Pattern matching was used to analyse qualitative data (Yin, 1994) and this involved reading respondents’ comments (questionnaires and interview transcripts). SPSS was used to analyse quantitative data. The summarised data were then subjected to a variety of statistical measures to identify patterns or trends (descriptive statistics) and assessed to determine what inferences could be made from the data about the general population (inferential statistics) (Ghauri, Gronhang & Kristianslund, 1995). 3.4 Demographics This section presents the frequencies of the demographic variables of the respondents in terms of age, sex, level of education and occupation. Thirty respondents participated as part of the census in the research. The majority (29) of the respondents were more than 30 years old. The number of respondents above 30 years is attributed to the fact that the research targeted the heads of the departments and sections in the organisation. The majority (27) SAJEMS NS 12 (2009) No 1 119 of the respondents were male. The gender imbalance can be explained by the fact that most mining environments are dominated by males. Few women are attracted to working in the mining environment. The majority (25) of the respondents have a bachelor’s degree or higher. Five of the respondents have college diplomas. Education and experience are often prerequisites for being a head of department or section. Seven of the respondents were engineers, either mechanical or electrical engineers. Four accountants, four personnel officers and four metallurgists also responded. Four IT administrators and three purchasing officers participated in the study. The remaining respondents were one geologist, one safety officer, one surveyor and one miner. 3.5 Data discussion The research collected the primary data from 30 respondents who represented the total population of heads of departments and sections. A third of the respondents were from administration and two-thirds of the respondents were from technical departments. This was found to be the case after the data were regrouped based on technical and non-technical employment. The distribution was based on the research design which had the objective of being representative of all departments and sections in the organisation (see Broadbent & Weill, 1997). Most respondents (24) argued that they were aware of their business values. Although the responses on values were evenly distributed, most of the respondents mentioned increasing production as their main business objective. Most of the respondents (29) noted that they considered IT to be important in achieving business values. When asked to explain the importance of IT in achieving their business values, eight said it was essential for communication, nine said IT was important for information availability and decision-making and six mentioned that IT helped in improving productivity. More than half of the respondents (18) were not sure if an IT committee existed. Interviews conducted with the directors revealed that the organisation does not have an IT committee but that the directors meet from time to time to discuss IT issues within the organisation (also confirmed by ITGovernance, 2005c). However, there were no minutes to indicate that IT issues were being discussed as per their claims. All the respondents said they were not members of an IT committee. While the organisation does not have an IT committee, 17 of the respondents were members of other committees in the organisation. Ten respondents said that they discuss IT issues in their meetings. The remainder did not belong to any committees and was not therefore applicable. Most of the respondents (27) noted that IT committees are of benefit to organisations. The respondents argued that IT committees can help by discussing IT issues involving users and raising awareness of the capability of IT. The respondents (17) stated that their IT needs were not being met by the IT Department, particularly in the hardware, software and training areas (Peppard & Ward, 1999). Many respondents (22) stated that they were not consulted regarding decisions made on IT (see McKenna, 1997). Of those who felt they were consulted, their opinions were usually only sought on specialised systems such as SCADA and PLC systems. The respondents (11) from the technical departments noted that they want to be consulted on applications, hardware and training. The majority of the respondents (28) stated that users should be involved in IT issues within the organisation. About half of those who said users should be involved in IT issues highlighted that user involvement would benefit the organisation by ensuring systems that met users’ needs and thus improved IT delivery. When users were asked to rank five important areas where IT could assist their business units, 11 respondents argued that IT could assist in improving inventory and cost tracking and 13 respondents said IT could help to improve cost control in their departments. Many respondents (18) noted that IT could help to improve productivity. Half of the respondents indicated that IT is important in improving process controls within an organisation. 3.6 Cross-tabulation This section shows the results though cross- tabulation of the respondents’ answers by business units. It was crucial to establish whether 120 SAJEMS NS 12 (2009) No 1 the respondents’ answers were affected by their being in their individual business units. Sixty- seven per cent of the Head Office respondents knew their business values compared to 88 per cent for Msasa respondents, 89 per cent respondents for Empress Nickel Refinery (ENR) and 71 per cent respondents for the Renco Mine. ENR and Msasa had the highest percentage of respondents who knew their business unit values. The results of the cross- tabulation of departments and the importance of IT in achieving business values are as follows: 100 per cent of Head Office respondents, 100 per cent of the Msasa and Renco respondents, and 89 per cent of the ENR respondents stated that IT was important in achieving their business values. The results also show that most of the respondents thought that an IT committee would be of benefit to the organisation. Fifty per cent of the Head Office respondents said their IT needs were being met by the IT Department compared to 13 per cent for Msasa, 44 per cent for ENR and 71 per cent for Renco. Renco had the highest percentage of respondents whose IT needs were being met by the IT Department and Msasa had the lowest. One third of Head Office respondents had been consulted on IT decision-making issues compared to none for Msasa. Only 22 per cent of ENR respondents said they were consulted on IT decision-making issues whilst 57 per cent of Renco respondents said they were consulted. Renco had the highest percentage of respondents who were consulted on IT decision issues whilst Msasa had no respondents who were consulted. All of the Head Office and Renco respondents argued that user departments should be involved in IT issues, while 88 per cent and 89 per cent of the Msasa and ENR respondents respectively said users should be involved in IT issues in the organisation. 3.7 Areas IT can help improve per business unit The results are categorised by business unit. The majority (67 per cent) of the Head Office respondents said IT could improve inventory and cost tracking compared to 43 per cent of the Renco respondents. Msasa had the fewest respondents (13 per cent) who said IT could improve inventory and cost tracking followed by the ENR respondents (33 per cent). Many of the Head Office respondents (67 per cent) said IT could improve cost control compared to 57 per cent of the Renco respondents, 38 per cent of the Msasa respondents and 22 per cent of the ENR respondents. Some of Head Office respondents (67 per cent) said IT could help improve productivity in their business unit compared to 63 per cent of the Msasa respondents, 56 per cent of the ENR respondents and 57 per cent of the Renco respondents. Only 33 per cent of the Head Office respon- dents said IT could help improve process controls compared to half of the Msasa respondents. Most of the ENR respondents (56 per cent) and 57 per cent of the Renco respondents stated that IT could improve process controls. Only Head Office had less than half (33 per cent) of its respondents who thought IT could help improve process controls. Most (57 per cent) of the Renco respondents stated that IT could help improve business processes compared to 50 per cent of the Msasa respondents, 22 per cent of the ENR respondents and 17 per cent of the Head Office respondents. Most of the ENR respondents (67 per cent) said IT could help in early detection of potential production problems compared to 13 per cent of the Msasa respondents, 17 per cent of Head Office respondents and none of the Renco respondents. The reason why ENR has the highest percentage is that it is the only location with an automated manufacturing plant, hence the importance of early detection of potential problems. 56 per cent of the ENR respondents argued that IT could improve equipment utilisation compared to 38 per cent of the Msasa respondents, 33 per cent of the Head Office respondents and 29 per cent of the Renco respondents. The higher percentage for ENR is attributed to the fact that IT is used for running their plant and maintenance systems. Many of the respondents (60 per cent) from the administration departments said they know their business values. The majority (90 per cent) of the respondents from the technical departments said they know their business values. The results show that, according to the respondent’s answers, a higher percentage of technical staff know their SAJEMS NS 12 (2009) No 1 121 business values. All of the respondents from the technical departments said they consider IT important in achieving their business values compared to 90 per cent of the respondents from the administration departments. Only 30 per cent of the respondents from the administration departments said they belong to a committee compared to 80 per cent of the respondents from the technical departments. The results show that technical departments have more committee members than administration departments. Most of the respondents (90 per cent) from both the administration and technical departments agreed that IT committees could be of benefit to the organisation. The results seem to support the literature review which indicates that committees are important for IT decisions in organisations. Half of the respondents from the administration departments said that their IT needs were being met by the IT Department compared to 40 per cent of the respondents from the technical departments. The results show that the administration departments have a higher percentage of respondents whose IT needs are being met by the IT Department. All (100 per cent) of the respondents from the administration departments said that the user departments should be involved in IT issues compared to 90 per cent of the respondents from the technical departments. 3.8 Areas of IT contribution More than half (60 per cent) of the respondents from the administration departments said IT could help in improving inventory and cost tracking compared to 30 per cent of the respondents from the technical departments. Many of the respondents (60 per cent) from the administration departments said IT could help improve cost control compared to 35 per cent of the respondents from the technical departments. Half of the respondents from the administration departments said IT could help improve productivity compared to 65 per cent of the respondents from the technical departments. The results show that productivity is important for the administration and the technical departments. Half of the respondents from both the administration and technical departments said IT could help improve process controls in the organisation. Forty per cent of the respondents from the administration departments said IT could improve inefficient business processes compared to 35 per cent of the respondents from the technical departments. Thirty-five per cent of the respondents from the technical departments said IT could improve the detection of production problems, while only 10 per cent of the respondents from the administration departments confirmed this. Early detection of potential production problems is the responsibility of the technical departments. 3.9 Correlation There is a positive correlation between know- ledge of business unit values and those who consider IT to be important in achieving business values (0.392*1). This suggests that those who know their business unit values believe that IT is important in achieving those values. There is a positive correlation (0.371*) between achieving business unit values and improving quality levels and reducing defects. The results show that respondents consider IT important in achieving the business unit values of improving quality levels and reducing defects. There is a positive correlation (0.467**2) between knowledge of business unit values and improving inefficient business processes. The result shows that the improvement of inefficient business processes is achieved through knowledge of business unit values; in order to improve the inefficient business processes it is necessary to know one’s business unit values. There is a positive correlation (0.418*) between membership of the specific business units and the belief that IT can be used to improve the control of labour costs. The results suggest that some business units consider IT important in achieving the objective of improving the control of labour costs. The differences in the units’ views can be attributed to the different natures of the individual business units. In operational business units where employees are paid daily, clocking systems can be important for the business units to control labour cost. Without integrated systems and processes business units will pay ghost workers. 122 SAJEMS NS 12 (2009) No 1 There is a correlation (0.415*) between IT’s importance in achieving business values and improving the control of labour costs. The results suggest that IT is considered important in achieving business values since it assists in improving the control of labour costs in the business units. The results suggest that those who consider IT important for the organisation to achieve business values believe it can improve control of labour costs. There is a positive correlation (0.411*) between those who think IT can improve inefficient business processes and those aware of their business unit values. Those who know their business unit values believe that IT is important to improve inefficient business processes. The results suggest that IT is important in achieving business unit values through improving inefficient business processes. There is a strong positive correlation (0.541*) between membership of committees in the organisation and a belief in IT improving inefficient business processes. Most of the members of the various committees believe that IT is important in improving inefficient business process within the organisation. The results suggest that members of committees are more aware of IT’s contribution to improving inefficient business processes than those who are not members of any committees. 3.10 Analysis of variance (ANOVA) According to the results from Table 1 there is a difference between the administrative business units and the operational business units in terms of knowledge of business unit values, as shown by an F value of (0.003). In addition there were differences in the perceptions of the contribution of IT in achieving business values on inventory control, as shown by an F value of (0.010). The F value indicates that there is a significant difference among three or more sample means. The degrees of freedom indicate the effective number of observations which contribute to the sum of squares in the analysis. The large effect leads to significance as shown by the F–test. The results suggest that there is a variation in the awareness of business unit values and of IT’s role in improving inventory control, the variation is based on business unit function. The result shows that IT contributes differently to different business units. Table 1 ANOVA by business unit function Sum of Squares df Mean Square F Sig. Are you aware of your business unit values? Between Groups 5.952 1 5.952 .003 .958 Can using IT improve inventory and cost tracking? Between Groups 2.381 1 2.381 .010 .923 There are differences in the departments’ perceptions of IT’s contribution to business values for two variables. The differences are in the perceptions of IT improving process controls, shown by an F value of (0.049) and IT improving business processes, shown by an F value of (0.035). The results suggest that there is variation in the perception of IT’s contribution to improving process controls and inefficient business processes based on department. This means that IT’s contribution is not the same for all departments. 4 Discussion Although the literature review indicated that IT GRC can add more value in IT investments, whether business units in organisations agreed was another matter. The researchers addressed this matter in several phases. Firstly, the researchers analysed the importance of IT in the organisation to each business unit and department. Variables that were used to indicate the IT contribution to the organisation were SAJEMS NS 12 (2009) No 1 123 extracted from the literature analysis. However, there were some weaknesses in the research caused by sample size. Some departments had fewer respondents. This affected the statistical results. Furthermore, based on the literature review of IT GRC, much attention was paid to the nature of the mining industry and the different contributions that IT can make to organisations in this industry, as this may have some effect on the level of IT contributions in RioZim. Secondly, a research methodology was designed. Thirdly, the data collected were analysed and interpreted. 4.1 Research questions This section presents the findings obtained regarding the research questions which formed the basis of this research project. Are business units’ users aware of their business values? The results of the study have shown that respondents are aware of their business units’ values. The majority of the respondents (24) knew their business values. In addition 29 of the respondents considered IT important in achieving their business values. Although the results showed that respondents believe that IT can contribute to achieving their business values, the results varied by business unit and department. This is an indication that business units and departments have different views of IT’s contributions. This agrees with the literature review which indicated that IT is viewed differently by different business units. Ross and Beath (2002) argue that organisations should distinguish IT investments from one another. Even though they may be simultaneous, these investments will deliver different values to different parties. Do business units know the value of IT committees? Whilst the organisation does not have an IT committee the results show that the business units view IT committees as important in achieving their business values. The respondents mentioned that IT committees would help them to discuss IT issues thereby involving users in IT decision making. The results agree with the literature that committees are important for IT decision-making in organisations. Ward and Peppard (2003) note that steering committees appear to be an obvious necessity in managing IT resources. Marchand, Kettinger and Rollins (2000) add that organisations must emphasise the importance of a strong business/ IT relationship and instil appropriate behaviours and values regarding information and its use in the organisation. Gupta and Raghunathan (1989) conclude that steering committees are among the most effective ways of improving an organisation’s IT planning, by assisting the integration of the IT function with business and by coordinating planning activities. 4.2 Areas IT can help improve per business unit The results of the study showed that business units can identify areas in which IT can help achieve business values. Many respondents indicated that productivity and cost control were areas where IT could help in achieving business values. Whilst respondents were able to identify areas where IT could help, further analysis using cross-tabulation revealed that these areas differ by business unit and department. The results show a positive correlation between business and the control of labour costs. This agrees with the literature which says that IT can help in achieving business values. According to the literature IT can be used to support organisational strategies such as low cost strategies or differentiation strategies. This supports Guldentops’s (2003) view that IT can offer means of increasing productivity besides supporting and shaping new strategies. Applegate, McFarlan and McKenney (1999) add that IT should be positioned with respect to the importance it holds in the business under review. They add that organisations must classify their IT needs. 4.3 Managerial guidelines For organisations to benefit from IT investment they must implement IT GRC structures. The IT GRC structure will assist by clarifying decision rights in matters relating to IT within 124 SAJEMS NS 12 (2009) No 1 the organisation. In order to involve business in IT issues organisations should establish IT committees which will provide a platform for discussing the organisation’s IT issues. IT committees will help in identifying users’ needs which may vary per business unit. The results of the study show that IT GRC can help organisations to achieve their business values through user involvement. By involving business units in IT decisions, organisations can identify areas where IT investment can contribute more to achieving their business values. The findings of the study suggest that organisations should invest in IT based on the contributions of IT to their business values. This is supported by Agarwal and Sambamurthy (2002) who say that the strategic role of IT is to facilitate innovative business strategies and processes. The IT Governance Institute (2003) highlights that those organisations that actively design top-level IT GRC structures make and implement better IT-related decisions. The Boston Consulting Group (2004) adds that successful companies have established business and IT interfaces to help reach consensus. 4.4 Managerial implications Although this research cannot claim to be fully representative of all companies, given that it was based on only one organisation, its depth of investigation into IT GRC’s contribution to business values serves as testimony to the relevance of the research project. From a managerial perspective, business leaders need to understand the value of the contribution of IT GRC to achieving their business values. Organisations should pay attention to how IT GRC can help them in achieving their business values through business unit involvement. According to the literature review, IT GRC can add value to IT investments in organisations taking into account the different levels of contributions needed which are based on the natures of the individual business unit and department values. However, the results of the data analysis indicate that most respondents in the study believed that IT GRC was important in achieving their business values. They highlighted that IT is important in that it provides up-to-date information for decision-making. Furthermore, business units and departments have different perceptions about IT’s contribution to their business values. As observed from the study and literature, some departments or business units need IT more than others. Nevertheless, the results of the data analysis show that all the business units agreed that IT GRC could make a contribution to their business values. The results of the data analysis show that there are significant differences between business units regarding the contributions of IT GRC to achieving their business values. The differences are based on the nature of the core business of the strategic business’s operation. Organisations should therefore address IT issues at different levels if they are to realise high returns on IT investments. With IT providing a competitive advantage to industries, organisations should address the needs of business units individually. This is more critical if the organisation has diverse business units. Failure to do so may result in missed opportunities in IT investment. In addition, organisations should involve users in IT decisions if they are to gain from IT investments. Endnotes 1 *correlation is significant at the 0.05 level 2 ** correlation is significant at the 0.01 level References AGARWAL, R & SAMBAMURTHY, V (2002) “Principles and models for organizing the IT function”, MIS Quarterly Executive, 1: 1-16. APPLEGATE, LM; MCFARLAN, FW & MCKENNEY, JL (1999) “Corporate Information Systems Management: Text and Cases” (5th ed.) Homewood, IL: Irwin. THE BOSTON CONSULTING GROUP (2004) “From IT complexity to commonality: Making your business more nimble”, available online at: http://www. bcg.com [accessed 22 September 2005]. BROADBENT, M & WEILL, P (1997) “Management by maxim: How business and IT managers can create IT infrastructures,” Sloan Management Review, 38(3): 77-92. BRYNJOLFSSON, E (1993) “The productivity paradox of information technology” Communications of the ACM, 36(12): 67-77. SAJEMS NS 12 (2009) No 1 125 GHAURI, PN; GRONHANG, K & KRISTIANSLUND, I (1995) Research Methods in Business Studies, London: Prentice Hall. GULDENTOPS, E. (2003) Governing Information Technology through CobiT, Idea Group Publishing: Hershey, PA. GUPTA YP & RAGHUNATHAN TS (1989) “Impact of information systems steering committees on IS planning”, Decision Sciences 20 (1989), pp. 777–793 HAYNES, M & THOMPSON, S (2000) “The productivity impact of IT deployment: An empirical evaluation of ATM”, Introduction Oxford Bulletin of Economics and Statistics, 62(5): 607-619. IT GOVERNANCE INSTITUTE (2003) Board Briefing on IT Governance (2nd ed.) available online at: http://www.itgi.org/template_ITGI.cfm?/Template= /Search/ITGISearchDisplay.cfm [accessed 22 September 2005]. IT GOVERNANCE INSTITUTE (2005b) “IT governance domain practices and competencies – Optimizing value creation from IT investment”, available online at: http://www.itgi.org_Template_ ITGI.cfm_Section=ITGI&Template=_ ContentManagement_ContentDisplay.pdf.pdf [accessed 04 December 2005] IT GOVERNANCE INSTITUTE (2005c) “IT governance domain practices and competencies – Measuring and demonstrating the value of IT”, available online at: http://www.itgi.org_ Template_ITGI.cfm_Section=ITGI&Template=_ ContentManagement_ContentDisplay.pdf [accessed 04 December 2005] MARCHAND, DA; KETTINGER, W & ROLLINS, JD (2000) “Information orientation: People, technology and bottom line’, Sloan Management Review: 69-80. MCKENNA, R., (1997) Real-Time, Preparing For the Age of the Never Satisfied Customer, Boston: Harvard Business School Press. MORTON, MS (1991) The Corporation of the 1990s: Information Technology and Organizational Transformation, New York: Oxford University Press. PEPPARD, JW & WARD, JM (1999) “’Mind the gap’: Diagnosing the relationship between the IT organization and the rest of the business”, The Journal of Strategic Information Systems, 8: 29-60. PETERSON, RR; O’CALLAGHAN, R & RIBBERS, PMA (2000) “Information technology governance by design: Investigating hybrid configurations and integration mechanisms”, proceedings of the 21st International Conference on Information Systems, Australia, Brisbane, Queensland, pp. 435-452. ROBSON, C. (2002) “Real World Research” (2nd ed.) Blackwell: Oxford. ROSS, JW & BEATH, CM (2002) “Beyond the business case: New approaches to IT investment”, MIT Sloan Management Review, 43(2): 51-59, [accessed 04 December 2005] . ROSS, J & WEILL, P (2004), “Recipe for good governance,” CIO Magazine, 15 June, available online at: http://www.cio.com/archive/061504/keynote.html SAUER, C & WILLCOCKS, LP (2002) “The evolution of the organizational architect”, Sloan Management Review: 41-49. SAUNDERS, M; LEWIS, P & THORNHILL, A (2003) Research Methods for Business Students (3rd ed.) London: Prentice Hall. SILK, DJ (1991) Planning IT: Creating an Information Management Strategy, London: Butterworth- Heinemann. WARD, J & PEPPARD, J (2003) Strategic Planning for Information Systems (3rd ed.) Chichester: John Wiley & Sons Ltd. WEILL, P (2004) “Don’t just lead, govern: How top performing firms govern IT”, MIS Quarterly Executive, 8(1): 1-17. WEILL, P & VITALE, M (2002) “What IT infrastructure capabilities are needed to implement e-business models?”, MISQ Executive (1:1): 17-34. YIN, RK (1994) Case Study Research (2nd ed.) Newbury Park, CA: Sage Publications.