Корпоративтік басқарудың ақпараттық технологиялар саласы

Subset discipline of corporate governance

Information technology (IT) governance is a subset discipline of corporate governance, focused on information technology (IT) and its performance and risk management. The interest in IT governance is due to the ongoing need within organizations to focus value creation efforts on an organization's strategic objectives and to better manage the performance of those responsible for creating this value in the best interest of all stakeholders. It has evolved from The Principles of Scientific Management, Total Quality Management and ISO 9001 Quality management system. Historically, board level executives deferred key IT decisions to the company's IT management and business leaders. Short term goals of those responsible for managing IT can be in conflict with the best interests of other stakeholders unless proper oversight is established. IT governance systematically involves everyone: board members, executive management, staff, customers, communities, investors and regulators. An IT Governance framework is used to identify, establish and link the mechanisms to oversee the use of information and related technology to create value and manage the risks associated with using information technology. Various definitions of IT governance exist. While in the business world the focus has been on managing performance and creating value, in the academic world the focus has been on "specifying the decision rights and an accountability framework to encourage desirable behavior in the use of IT." The IT Governance Institute's definition is: " leadership, organizational structures and processes to ensure that the organisation's IT sustains and extends the organisation's strategies and objectives." AS8015, the Australian Standard for Corporate Governance of Information and Communication Technology (ICT), defines Corporate Governance of ICT as "The system by which the current and future use of ICT is directed and controlled. It involves evaluating and directing the plans for the use of ICT to support the organisation and monitoring this use to achieve plans. It includes the strategy and policies for using ICT within an organisation."

IT governance is often confused with IT management, compliance and IT controls. The problem is increased by terms such as "governance, risk and compliance (GRC)" that establish a link between governance and compliance. The primary focus of IT governance is the stewardship of IT resources on behalf of various stakeholders whose ranking is established by the organisation's governing body. A simple way to explain IT governance is: what is to be achieved from the leveraging of IT resources. While IT management is about "planning, organizing, directing and controlling the use of IT resources" (that is, the how), IT governance is about creating value for the stakeholders based on the direction given by those who govern. ISO 38500 has helped clarify IT governance by describing a model to be used by company directors. While directors are responsible for this stewardship it is not unusual to delegate this responsibility to management (business and IT) who are expected to develop the necessary capability to deliver the performance expected. Whilst managing risk and ensuring compliance are essential components of good governance, the primary focus is on delivering value and managing performance (i. e. "Governance, Value delivery and Performance management" (GVP)). Despite the efforts to manage performance and create value, a study focused on fraud in the UAE demonstrated that corporate governance does not play a major role in reducing fraud, indicating that there is no significant difference in comparison to other traditional techniques for fraud prevention. Researchers have contended that due to this lack of contributions, there should be better oversight from senior management.

Certified in the Governance of Enterprise Information Technology (CGEIT) is a certification created in 2007 by ISACA. It is designed for experienced professionals, who can demonstrate 5 or more years experience, serving in a managing or advisory role focused on the governance and control of IT at an enterprise level. It also requires passing a 4 hour test, designed to evaluate an applicant's understanding of enterprise IT management. The first examination was held in December 2008. COBIT5 Foundation, COBIT5 Assessor and COBIT5 Implementation are certifications created in 2012 by ISACA.