Chapter SEVENTEEN. ESA and IT Governance

In order to assert better control over IT, align it with business objectives, and keep its potential benefits and risks in balance, corporations in recent years have paid considerable attention to the issue of IT governance. Also spurring this renewed attention are financial regulations, such as Sarbanes-Oxley, which call for improved documentation of IT systems and tighter controls over who uses them and to what end. The result is that enterprises have sought to bring to IT the kind of streamlined and rigorously defined business processes and reporting structures that IT has helped to make possible just about everywhere else in the enterprise.

If a formal definition of IT governance is required, it's hard to top the one provided by Jeanne W. Ross and Peter Weil in their book, IT Governance (Harvard Business School Press): "specifying the decision rights and accountability framework to encourage desirable behavior in the use of IT."

IT governance, they elaborate, provides a framework in which the decisions made about IT issues are aligned with the overall business strategy and culture of the enterprise. Governance is concerned, therefore, with setting directions, establishing standards and principles, and prioritizing investments.

Throughout this book, we have talked about how ESA ushers in fundamental changes in every area. It changes the relationship between business and IT, a relationship that is at the heart of most governance issues. In this chapter, we will see that ESA greatly simplifies governance. How so? ESA changes how the enterprise perceives, organizes, and manages many aspects of IT, divvying up financial and managerial responsibilities in radically new ways.

In the past, when business asked IT for changes to an application or system, that system was monolithic, and consequently the implications of the changes required a great deal of study and consideration. Enterprise services are granular. Corporations will have many, many enterprise services running. But because the function of each is discrete and the relationships among them are well understood, the process of approving a new service is far easier than that of approving a change to an new application. Needless to say, the budgetary requirements of such changes are far less as well.

ESA doesn't change the questions that IT governance attempts to answer, but it does change the answersin important ways. The questions that are asked are fairly straightforward, even if different companies have answered them in different waysthrough tight central control and mandates, perhaps, or in a decentralized approach that gives business units a good deal of autonomy. Among these questions: what standards is the enterprise adopting and enforcing in IT? Who in the organization is responsible for defining and building which pieces of IT? Who pays for this or that application or service? When are specific functions to be centralized or decentralized? What is the relationship of any one part of the company to the other parts? What does each department owe the other?