Corporate governance and the information system: how a framework for IT governance supports ERM

Abstract

Purpose – The purpose of this paper is to illustrate how information technology (IT) governance supports the process of enterprise risk management (ERM). In particular, the paper illustrates how the Control Objectives for Information and related Technology (COBIT) framework helps a company reach its objectives by integrating and supporting the Enterprise Risk Management by the Committee of Sponsoring Organizations (COSO ERM) framework. Design/methodology/approach – This paper explains how the integration between the two frameworks (COSO ERM and COBIT 5) can represent, for any organization, a good way to achieve the objectives of internal control and risk management and, more generally, corporate governance. Findings – The paper identifies some gaps in the COSO ERM and illustrates how the COBIT framework facilitates the implementation of an adequate system of internal control. Originality/value – The originality of the work presented here is in analyzing the COBIT 5 together with the COSO ERM framework. This paper highlights that is not enough to apply only an internal control framework for achieving the risk management and internal control system objectives. An IT governance framework, such as COBIT 5 is proposed as a tool that support risk management in order to develop an adequate system of internal control.

Pengendalian Internal Bisnis Startup Indonesia: Sebuah Konsep

“…Enterprise Risk Management (ERM) atau manajemen resiko perusahaan adalah satu dari beberapa instrumen valid intuk mendukung pengendalian internal yang lebih baik (Rubino & Vitolla, 2014a). is one of the valid instrument to better support internal control in a company.…”

Governança de tecnologia da informação como parte da governança corporativa, existe realmente relação? Estudo em organizações brasileiras.

“…Porém, o fato da empresa ter governança corporativa, ou seja, aplicar regras como leis do país onde atua ou requisitos para operar em bolsa de valores, não significa que ela seja madura, o que destaca a necessidade de avaliar o nível de maturidade da governança corporativa e da governança de TI antes de tentar identificar qualquer relação entre elas (Rubino & Vitolla, 2014). O próprio relatório de 'Fortalecimento dos códigos de Governança Corporativa na América Latina' da OCDE reforça isso, já que existem indícios de que altas taxas de implementação de não são necessariamente indicativas de boa governança (OECD, 2016).…”

“…Além disso, pesa ao seu favor o fato de ser baseado na análise e na harmonização dos padrões e práticas de TI existentes, adequando-se aos princípios de governança geralmente aceitos. Outro ponto considerado na escolha do Cobit como modelo de referência é a expressiva utilização no ambiente empresarial (Tarouco & Graeml, 2011;Rubino & Vitolla, 2014). Apesar disso, alguns pesquisadores criticam este framework devido a uma fundamentação teórica não tão consistente.…”

Exploring IT Governance Effectiveness: Identifying Sources of Divergence through the Adoption of a Behavioural-Based Organizational Routines Perspective

“…The notion of governing IT assets has become an increasingly common and prominent ideal within most organizations over the past decade. Interest in IT governance has been driven by an increased focus on risk aversion and mitigation, financial accountability and control, as well as a desire to ensure prudent and value-based investment in Information Technology (IT) assets (Brown and Grant 2005;ITGI 2006;Rubino and Vitolla 2014). Given the growing strategic importance of properly managing IT assets, combined with the fact that a significant portion of most of an organization's capital investment budget is spent annually on IT-related investments (Lunardi, Becker and Macada 2009;Gartner 2010;Debreceny 2013), executives and other organizational stakeholders have considerable interest in ensuring that the decision rights and accountability for these investments are properly established, monitored and controlled.…”

“…By providing transparency, consistency and rigour to IT decisions, the promises and advantages of "proper" IT governance are bountiful and appear to address the many pressures facing organizations. A few of the advantages cited by both industry and academics include: enhanced organizational and IT reputation (Schwarz and Hirschheim 2003;Bowen, Cheung and Rohde 2007), reduced organizational operating costs (Bowen, Cheung and Rohde 2007), increased IT project success (Johnstone, Huff and Hope 2006), better business performance (Weill and Ross 2004;Weill and Ross 2005;Prasad, Heales and Green 2010;Williams and Karahanna 2013;Lunardi et al 2014), increased return on IT investments Weill and Woodham 2002;Gu, Xue, and Ray 2008), sustained competitive advantage and market flexibility Weill and Ross 2005;Broadbent 2005) and the mitigation of corporate risk (ITGI 2003;Xue et al 2013;Rubino and Vitolla 2014).…”