Integrating Internal Control Frameworks for Effective Corporate Information Technology Governance

Abstract

This paper analyzes and proposes how several internal control frameworks can be integrated to achieve effective corporate information technology governance. The fundamental tenet of the current literature in this area is that neither a single framework nor non-integrated multiple frameworks would suffice in achieving effective information technology security and governance. Using the extant literature, a deductive approach, and focusing on three popularized internal control frameworks ERM, COSO, and COBIT5, we propose a framework that can help organizations effectively and efficiently achieve information technology governance through their interaction. An integrated framework is one that links the key control objectives to strategic business objectives and, in doing so, addresses IT governance principles at both a strategic and operational level, whilst aligning IT and business management understanding of the key risk areas that characterize the organization's goals (Goosen and Rudman, 2013). In addition, this fundamental alignment is expected to eliminate unnecessary controls and processes which in turn help improving IT governance. We expect firms seeking to adopt the proper IT governance to utilize the proposed integrated framework.

Securing Cloud Computing Through IT Governance

“…Information security is not just an implementation of technology; there are other elements involved. Information security consists of technology, processes, and people [9]. Technical measures such as passwords, firewalls, network monitoring, and the likes are not enough to counter threats to information; therefore, organizations must consider a combination of measures to protect their information against theft and harm whether intentional or unintentional [9].…”

“…Information security consists of technology, processes, and people [9]. Technical measures such as passwords, firewalls, network monitoring, and the likes are not enough to counter threats to information; therefore, organizations must consider a combination of measures to protect their information against theft and harm whether intentional or unintentional [9]. Processes include things like user registration, deregistration, and organizations must consider people aspects such as compliance, training, and leadership by example instead of just deploying a solution that protects information from theft, loss, or misuse.…”

Securing Cloud Computing Through IT Governance

“…An information security framework should include comprehensive security for an organization's information. Moreover, researchers have identified components that make up the comprehensive security of information, and how should the organizations go about implementing them [9].…”

“…Information security needs executive sponsorship. Executive sponsor can help obtain a commitment from an organization's board and its management team [9]. With an active commitment, responsibility, and accountability of the board and the management team, information security becomes an active discussion in meetings of the board and the management team; therefore, this brings greater involvement of the board of directors, management team, and business process owners [61].…”

Surmounting Boundaries: Closing The Governance Gap Governance Arrangements In Public Sector Ict Shared Services

“…Other recent examples of research into the use of IT and corporate governance controls have explored the use of industry frameworks, particularly security and audit frameworks (De Haes & Van Grembergen, 2016;Ettish, El-Gazzar, & Jacob, 2017;Wilkin & Chenhall, 2019).…”