Executiveresearchreportsecondedition april2016 by Enterprise Governance

Governance of Enterprise Information and Technology New Core Competencies For Boards of Directors Executive Research Report 2nd Edition May 2016.

EGC

Enterprise Governance Consulting

EGC

Enter pri se Gover nance Con sulting

EGC

Enter pri se Gover nance Con sulting

Why and How to Build Director and Senior Executive Information and Technology Governance Capability • What digital disruption is and why new core capabilities are needed • The three areas of IT governance capability boards need to build • Nine actions boards can take.

Author

Dr Elizabeth Valentine (D.IT)

Web

www.enterprisegovernance.co

elizabeth.valentine@enterprisegovernance.co

Skype

lizziev

EGC

Enter pri se Gover nance Con sulting

Boards and information and technology governance With the level of digital disruption that is affecting businesses around the globe, you might expect high levels of Governance of Enterprise Information and Technology (GEIT) capability within boards. Boards and their senior executives know technology is important. More than 90% of boards and senior executives currently identify technology as essential to their current businesses, and to their organization’s future. But as few as 16% have sufficient GEIT capability. Global Centre for Digital Business Transformation’s recent research contains strong indicators of the need for change. Despite board awareness of both the likelihood and impact of digital disruption, things digital are still not viewed as a board-level matter in 45% of companies. And, it’s not just the board. The lack of board attention to technology can be mirrored at senior executive level as well. When asked about their organization’s attitude towards digital disruption, 43% of executives said their business either did not recognise it as a priority or was not responding appropriately. A further 32% were taking a “follower” approach, a potentially risky move as we will explain. Given all the evidence that boards know information and technology (I&T***) is vital, that they understand the inevitably, impact and speed of digital change and disruption, why are so many boards dragging their heels? Ignoring I&T disruption and refusing to build capability at board level is nothing short of negligence. Too many boards risk flying blind without GEIT capability [2]. To help build decision quality and I&T governance capability, this research: • Confirms a pressing need to build individual competency and cumulative, across-board capability in governing I&T

*** At times we use the terms I&T, IT and digital interchangeably. Technology (much of it digital) is the enabler; information is created, stored, accessed, used, shared and changed. Both I&T are assets with life cycles. This report introduces the topic and suggests practical solutions.

• Identifies six factors that have rapidly increased the need, risk and urgency • Finds that boards may risk not meeting their duty of care responsibilities when it comes to I&T oversight • Highlights barriers to building capability details three GEIT competencies that boards and executives can use for evaluation, selection, recruitment and professional development.

EGC

Enter pri se Gover nance Con sulting

Disruption is not new For as long as there have been businesses and industries, new information and technology has usually meant change and disruption. Disruption can increase both opportunities and risks for organisations of all type and size. But current and emerging I&T change impacted by data analytics, mobile, cloud, social media, the internet of things and the rapid rise of sensing technologies, is driving unprecedented change. Shifting stakeholder power, interconnected global markets, the blurring and converging of industry boundaries, and new rules and regulations are just some of the impacts. Such rapid change has had a dramatic effect. The average life expectancy of businesses has fallen. US data shows that in 1960 large business life expectancy averaged 60 years. By 2012 this level had fallen to just 15 years. The sobering reality for boards is that their size, brands and the established ways of doing things may no longer protect them when a disruptive hacker, new competitor or business model appears.

The good news is that digital leaders – those that include GEIT as a core competency - can provide strategy matching, prioritized digital investment and change capability.

Digital leaders are thriving Digital leaders financially outperform their peers by 9 percent, are up to 26 percent more profitable and enjoy up to 12 percent greater market valuation [3]. However, this leadership which came from the board and executive, only applied to 16 percent of organizations [3]. To come close, boards and executives in the other 84 percent must pay closer attention to their changing roles in the digital economy and build GEIT capability across the board [1]. Some of the successes started as digital businesses: think Uber, Amazon, Google, Facebook, Apple, Netflix, Expedia. Some have transformed: think Burberry, Nike, Ceasar’s Entertainment and Codelco. But on the flip side, the list of once-iconic brands that have either gone out of business or that have lost significant market share because they failed to keep up with technology is rapidly growing. ‘Ultrafades’ [4] include: Kodak, AOL, Nortel, RIM, Barnes and Noble, Gap, EMI, HMV, Sony, Sears, and Target. With the exception of Target, most of these firms didn’t make massive blunders even as their demise became marked or irreparable [4]. Yet, when as few as 16% of boards report having I&T capable people. Issues such as no sense of urgency, lack of a digital vision and unclear roles and responsibilities lead a long list of perceived organizational barriers to digital transformation [3], and longer term survival.

“Too many current directors wear their lack of digital literacy like a badge of honour” (Participant P182)

EGC

Enter pri se Gover nance Con sulting

The transforming nature of digitization Information and technology-enabled markets move quickly: very quickly. They are more dynamic and more easily disrupted. New I&T-enabled business models can be developed and launched far more rapidly, from anywhere. Now, if demand surges, product and service delivery can be scaled in a matter of hours or even seconds. As illustrated in figure 1, now, by taking real-time advantage of sensing, the internet of things, analytics, the cloud, mobile and social media for example, smart start-ups and digital leaders are taking advantage of digital innovation and emerging trends. Where an industry or oganization finds itself on this curve depends on the extent to which both the organization and its customers have embraced digitization. There are those companies that embrace digital change and transformation, and those that do not. Once the organization and its customers have reached a tipping point of product or service innovation and use, laggers are left behind and risk going out of business.

Figure 1. Digital disruption and adaption curves While Figure 1 is illustrative, the curve demonstrates that where an industry may have been less exposed to digital disruption, or where digital change is really just starting to gather momentum, organizations may still have time to adapt and survive. There are two keys. The first is understanding and embracing the complexity of the digital world and all it has to offer. The second is having strong digital capability at all levels, especially across the board and executive.

EGC

Enter pri se Gover nance Con sulting

The complex world of digital leadership As can be seen in figure 2, boards and executives have to deal with significant and increasing complexity in a digital world. Executives with GEIT capability can apply the benefits of I&T across business strategy, IT alignment, prioritised investment and digital change leadership. They monitor and govern results and risk, fully cognizant of IT and its impacts. The depth and breadth of complexity should not be underestimated. Digital disruption is increasing. Unencumbered by legacy systems, new players are emerging to compete in previously unimagined, disruptive ways. Such significant change and disruption demands levels of capability. agility and resiliency never imagined even five years ago.

Based on Valentine and Stewart, 2015

Figure 2. The complex world of digital leadership In figure 2, vision and strategy on the left, is contextualized by the nexus of digital technologies on the right, with potential to disrupt or enhance their sector or organization. Information, data and technology assisted production and performance support are brought together to meet the I&T needs of the whole business together via the enterpriseâ&#x20AC;&#x2122;s architecture. At the next level of detail where performance measurement is a consideration, the main focuses for GEIT become more specific and distinct in the same way that they are for each main area of a boardâ&#x20AC;&#x2122;s enterprise performance monitoring: i.e. finance, legal, marketing, operations, human resources and business technology governance. Careful attention is paid to making sure structures and governance mechanisms support achievement and minimize risk. In understanding digital transformation and the complex world of GEIT, we discovered a chain of events that is dramatically increasing the need for three GEIT board capabilities.

EGC

Enter pri se Gover nance Con sulting

Six factors driving the need for GEIT capability level of need for GEIT competency grows

HIGH

LOW

Increase in brands going out of business - business life expectancy shortens

74.2% say boards need GEIT competency

4 3 2

Two whole US board and their C-Suite sued for breach of fiduciary care

“Governance by exception”- too slow- risk increased Information and Technology governance becomes integral to corporate governance

Increased scrutiny of boards

Increased digital disruption

level of governance board GEIT competency appears to remain static

HIGH

Figure 3. Six factors creating the need for GEIT as a core board capability [1]. The need for GEIT as a new core competency in boards is a also a complex issue. There are at least six GEIT change drivers. Figure 3 illustrates the drivers that have brought about a tipping point in the need for boards to become competent in governing both information and technology. In combination it has become increasingly difficult for boards and their executives to meet their responsibilities without GEIT capability. On the left, I&T capability need has increased dramatically, as identified as important or very important, by 74.42% research participants [1]. However, while the need is confirmed, it seems boards continue to procrastinate or deny the need to build capability. The bottom axis shows GEIT competency has remained static at between 16 – 20% [1] over the period 2012 to 2016, i.e. the life of the research project. This means as many as 80 - 84% of boards may not yet have sufficient GEIT capability.

“How can boards be expected to govern technology when they know so little about it? It’s changing so fast I have no clue where to start, and most of the directors of boards I’m involved with haven’t a clue either if they were honest.”

(Participant S1-86)

EGC

Enter pri se Gover nance Con sulting

GEIT capability drivers explained 1. GEIT capability is essential in an operating environment where I&T is becoming more and more disruptive to those who lag behind. 2. Boards have also come under increasing scrutiny as a result of legislation such as the Sarbanes Oxley Act, and in-country voluntary governance codes. Director capability is of interest to investors. 3. Business strategy and planning and IT plans have become one in the same. Most IT change projects are simply business projects. GEIT is now integral to corporate governance. 4. The same ways of governing such as ‘governance by exception’ i.e., exception reporting, remains the predominant way in which boards receive their information. Only using traditional board procedures without implementing parallel, just-in-time emergency I&T risk procedures, can add layers of infrastructure, business continuity, information security and reputational risk. 5. Without board and executive capability these organisations risk being left behind, going out of business or losing significant market share. 6. Whether boards realize it or not, technology governance has been part of corporate governance for some time. However, in apparently not meeting their I&T fiduciary duty of care responsibilities, two whole boards and their senior executives were sued for breach of its fiduciary care in 2014 [1]. Both lawsuits relate to cyber security attacks. However, close analysis shows multiple layers of error.

Digital leaders Those organisations with tech-savvy boards and senior executives are more capable of providing digital leadership across the enterprise. Digital leaders know how to create strategic change and add value through digital transformation. ‘They combine a transformative vision, careful governance and engagement, with sufficient investment in new opportunities. Through vision and engagement, they develop a digital culture that can envision further changes and implement them wisely. By investing and carefully coordinating digital initiatives, they continuously advance their digital competitive advantage’ [2]. GEIT capability is key.

‘Most Boards do not have a clue about any of the issues surrounding technology investment and are, effectively, totally in the hands of management. Management frequently over-estimate their ability and it is therefore no surprise to see the constant write-offs or inadequate performance in pretty much every field’ (Participant S2-177)

“Our board added two new members recently, both with different skills and experience in the digital space. They have added huge value already, and we have started to have the CTO brief the board on a regular basis. Times have changed” (Participant SM 129)

EGC

Enter pri se Gover nance Con sulting

Is your board flying blind? Without GEIT capability across all aspects of the business, your board is likely flying blind when it comes to opportunity, disruption, risk and capably fulfilling your duty of care role. GEIT awareness and increased capability is necessary in all board director and executive roles finance, legal, marketing, operations, HR and IT. This is because digital disruption impacts all parts of organizations in all industries - no exceptions [2]. Further, a ‘token’ IT director won’t work. There needs to be more than one director with strategy-matching GEIT knowledge, skills and experience. Figure 4 outlines the three areas of capability required. More detail on pages 13-15.

Summary of the boards role in GEIT

External information and technology environment

Directing

Internal information and technology environment

Leading strategy & performance Meeting fiduciary responsibility Directing value creation

Governing Governing risk & compliance

Figure 4. Three areas of governance that require strategy matching I&T capability Figure 4 shows the competency areas required to capably meet a director’s duty of care responsibilities. The competencies support the board’s role in three areas: 1. Leading I&T enabled strategy and performance. This capability includes leadership from the board in aligning I&T as part of overall strategy, planning and change to improve performance 2. Governing I&T risk and conformance. This covers board oversight of a wide range of areas of I&T risk and compliance. These include: disruption and competitive I&T use, information security, business continuity, IT-infrastructure and reputational risk 3. Directing value creation. This capability includes understanding digital disruption and innovating to create value. While capability in all of the elements shown in figure 4 helps ensure the board and executive meets their responsibilities requirements do vary from industry to industry. But barriers remain, starting with boards continuing to ignore or delegate technology matters to management.

EGC

Enter pri se Gover nance Con sulting

Barriers to boards building GEIT competency Most barriers relate to board memberâ&#x20AC;&#x2122;s individual and collective beliefs and attitudes to their role in GEIT. Such attitudes are often founded on a lack of knowledge, skill and experience in the area, and a lack of a sense of urgency. Evidence of barriers can be found in the actions and priorities the board puts on I&T-related matters, including whether the topic makes it onto the board agenda. Table 1 outlines the barriers, symptoms and solutions for building GEIT competencies.

Barrier

Symptoms

Solutions

The board relies almost entirely on Review current governance structures and standard board paper reporting to reporting approaches to identify gaps that increase receive information about I&T risk. risk: Exception reporting and audit committees remain the main method of governing I&T risk.

While investment in IT might be 1. Make sure there is a current I&T disaster recovery heavy, most have no clue if itâ&#x20AC;&#x2122;s a good, plan. Review it regularly. Implement RRR roles and adhoc or disconnected investment. procedures to enable rapid escalation of serious risk, such as a major cyber-security breach, to the Rapid Risk Response (RRR) board. procedures are not in place. 2. Ensure those responsible for security have the skill and authority to enact emergency measures. 3. If appropriate, implement a separate I&T subcommittee with capable people. 4. Review I&T capability to middle management.

Director capability and board culture

Organisation structure and board membership.

Technology matters seldom make it into board papers or discussions, despite evidence of increasing technology driven change in the industry or competitive environment.

Review company strategy and ask the hard questions about whether the current board culture enables or prevents digital leadership.

Evaluate whether the current board has the capability to provide effective governance oversight Directors can ask questions, but have of all areas of information and technology-related: little capability to evaluate answers. infrastructure risk; competitive risk; IT project risk; Beliefs and discussions reflect IT information security risk; reputational risk; and, being a cost to manage rather than a business continuity risk. strategic or value creating asset. If I&T risk is assessed, it does not Establish a GEIT board committee and monitor its have its own committee, but is likely effectiveness. part of the Audit and Risk committee. Check that major IT project management reporting IT management and project and board governance reporting are connected governance, and corporate and that project reporting and risk informs board governance structures are risk registers and discussions for early detection of disconnected. possible IT project failure. Implement RRR. IT is still treated like a separate part of the organisation rather than a core, strategic capability that is measured and monitored along with finance and legal.

Check capability across the board. Use the competency set to analyse this, and to make sure that any gaps are prioritized and internal and external solutions found. Buy in talent and upskill the whole board and executive if necessary. Remember all roles including non-IT execs may need awareness building.

EGC

Enter pri se Gover nance Con sulting

Nine practical steps boards can take Boards already know about corporate governance. Getting up to speed may not be as big a leap as many directors assume. It’s all about good governance in a digital world. Taking appropriate steps towards digital transformation can make a significant difference, no matter what size or type of organisation, or what industry sector.

Take the first steps towards digital transformation 1.

Start the digital transformation process by hiring a skilled consultant to conduct a I&T maturity audit. This will help your organisation understand the focus and effectiveness of previous investment, and your organisation’s digital change capability and risk.

Conduct an audit of current board GEIT capability using the three competencies (pages 12-14) . This will help identify whether you build capability through director professional development or need to recruit talent.

Evaluate the digital capability of your executive team 3.

Your chief executive’s digital capability is critical. If he or she is not tech-savvy they could be filtering critical information out of board papers. Such filtering can impact investment priority, risk responses or value creation opportunities. Equally, because technology impacts all parts of operations, the currency of all executives should be checked and professional development needs critically reviewed.

Review the current CIO’s position in the organisation structure. Do they report directly to the CEO? Is she or he capable of cross-functional partnering? Is IT still considered an operational cost rather than a strategic asset? Is there a need for a Chief Security Officer?

Create a vision of your digital future 5.

A digital vision is not some ‘pie in the sky’ exercise. This is where your organizational strategy and digital future come together and stay together as an aligned, complete view of your organisation as a digital leader. What are I&T leaders doing in your sector? What disruption is on the horizon?

Use the results of 1 – 5 above to craft a flexible but measurable vision and plan that forms the basis of your organization’s review of I&T investment, governance and board reporting. Use figure 3 as a check-list for completeness and alignment.

EGC

Enter pri se Gover nance Con sulting

Review board governance structures and processes 7.

Check that board governance structures and processes will support the plan and are appropriate to a digital business. Incorporate digital leadership and governance effectiveness measures into your performance scorecard. Do you have the right governance structures in place.

Review the structure and membership of board committees. Consider establishing a technology governance committee to focus on digital opportunity and risk. Review the capability profile of your board.

Make sure RRR risk and security alert procedures are in place outside of normal board reporting. This ensures emergency responses will help meet technology-related duty of care responsibilities.

“What amazes me is that some board members wear their lack of technology knowledge and skills like a badge of honour!” (Participant P2.) “Even if we did get some IT person on the board, some of us would struggle to get up to speed with what they’re talking about. No one likes to look as though they’re not up with the play in front of their colleagues.” (Participant SM 58).

EGC

Enter pri se Gover nance Con sulting

A new core board competency Governing Enterprise Information and Technology governance This new core competency “Governing Enterprise Information and Technology” and the three supporting sub-competencies was identified and rated in 2 separate surveys by industry participants. All sub-competencies were rated as somewhat or very important by an average of 90.40% i.e., 160 out of 177 of survey two participants. This provided substantial agreement to the perceived importance of the whole set, with an overall, average rating of 4.45 out of 5 where is 5 ‘very important’. When this result is triangulated with74.42% of survey one participants who indicated a strong need for GEIT competencies boards and those who provide education services to them can have confidence in the ‘fitness-for-purpose’ of the set [1].

Competency one Direct and govern information and technology-enabled strategy.

Definition Direct and govern technology-enabled strategy to maximize the advantages of technology and enhance performance at all levels of the organization.

Competency two Direct and govern business information and technology investment and risk.

Definition Understands and uses information and data to evaluate, direct, monitor, and analyze information provided by management, supply partners, and advisors. Can ask probing questions and critically analyze management and external advisor responses. Can contribute to discussion to ensure that decisions about technology-related performance and risk oversight meet governance performance and conformance requirements.

Competency three Direct and govern information and technology enabled innovation and value creation

Definition Understands and can provide oversight of technology-enabled product and service innovation and development to ensure investment delivers value in the form of improved business process efficiency, and improved and better targeted stakeholder engagement.

EGC

Enter pri se Gover nance Con sulting

Detail of knowledge, skills and experience needed Each of these three competencies has industry ranked and rated descriptions of the knowledge, skills and experience that directors require. Perhaps not all of the descriptions are a priority for your organization. The key is to work out as a board, what combination of the descriptors will best help the board lead and govern in a digital world. What combination is strategy matching? Competency 1

Knowledge, skill or experience required to direct and govern information and technology-enabled strategy

Descriptor C1-1 Knowledgeable about current and emerging digital technologies and their potential to add organizational, customer and stakeholder value, C1-2 Skilled in business, environmental, and competitive analysis including how industry sector and similar organizations are using new and emerging technologies and information, C1-3 Skilled in overseeing the inclusion of current and future technologies into the organization’s strategy, business plan development, organizational performance measures, and management key performance indicators, C1-4 Knowledgeable about the digitization of business processes that underpin peak performance and their relationship to overall corporate governance, C1- 5 Knowledgeable about and skilled in evaluating the level of information and technology dependency the organization has now, and may need in the future, C1-6 Experienced in selecting, implementing, and monitoring the effectiveness of enterprise information and technology governance mechanisms (systems and processes), C1-7 Able to oversee technology acquisition, implementation, maintenance, and disposal to meet the board’s fiduciary, regulatory, compliance, ethical, contractual, and legal obligations (based on ISO/IEC, 2008), C1-8 Knows what to measure and monitor and how to interpret business technology performance data against plans and policies to derive expected benefits, and ensure strategic intent is achieved.

EGC

Enter pri se Gover nance Con sulting

Competency 2

Knowledge, skill or experience required to: direct and govern inDescriptor formation and technology investment and risk. C2-1 Understands how prioritized technology infrastructure investments help to achieve enterprise business goals and reduce risk. C2-2 Able to evaluate and mitigate infrastructure, information, privacy, data security, and reputational risk ensuring the continued operation of the business. C2-3 Knows what areas of IT risk to measure, monitor, and report on, and how processes and policies support the board in meeting its fiduciary responsibilities in a timely manner. C2-4 Demonstrates an understanding of technologies for identifying, tracking, mining and exploiting the data and information relevant to the organization’s needs. C2-5 Knowledgeable about the unique issues associated with digital technology investment and digital change capability to better focus and prioritize digital transformation initiatives.

Competency 3

Knowledge, skill or experience required to direct and govern information and technology-enabled innovation and value creation.

Descriptor C3-1 Provides strategic leadership of an organizational culture that champions digital-business technologies, and uses data and information for decision making and change leadership. C3-2 Demonstrates knowledge of the implications, costs and benefits of digital technologies such as business applications, mobile and social technologies, the cloud and outsourced services, and the Internet of things. C3-3 Understands how to derive business value from technology investments, balancing risk and opportunity. C3-4 Experienced in board-level governance oversight of large-scale IT projects to ensure promised outcomes are achieved. C3-5 Knowledgeable about value creation through digital product, system, or service development. Can provide guidance to management in considering their value-creating uses for strategic advantage. C3-6 Oversees technology asset life-cycles to derive expected returns.

© This competency set and all preceding and future derivatives are copyright to Dr Elizabeth L H Valentine 2013–2016 all rights reserved. Copyright © 2012- 2015. Dr Elizabeth Valentine and Enterprise Governance Consulting. 15 All Rights Reserved.

EGC

Enter pri se Gover nance Con sulting

There’s much more detail to help build skills Detailed behavioural descriptions The full competency set details exactly what boards need to know or do to demonstrate capability. The descriptors have changed quite significantly since first published. The set now reflects many of the rich comments, feedback and suggestions gathered from industry participants. In addition, the set has been validated by 177 participants from a wide variety of directors and executives from public, private and not-for-profit organisations and multiple different industries. They are now prioritized and also have key questions to help make the set easy to use.

Using the competency set and behavioural descriptions Specific competencies of this type can be used to evaluate board membership when the goal is to match board membership with strategy achievement. The set can be integrated into a board’s overall competency profile. The competency profile should provide a clear and strategy-matching view of the knowledge skills and experience the board needs to lead and govern success, now and in the future. The set can also be used for director and executive selection and recruitment, and for professional development. EGC offers face to face and online coaching in how to build information and technology governance capability. We also provide in-person consulting that delivers results.

Each of these three capability areas is described in greater depth, with: detailed skill, knowledge and experience descriptions, questions and simple processes. Watch out for Elizabeth’s upcoming new book, due for release late 2016. Receive news and discounts by filling in your name and email address in the simple Sign Up tab at the bottom of our website. We promise we won’t spam you or share your details! In EGC’s elearning module we provide examples and ideas of how to up-skill for all board members - those from different areas of skills and specialization. This self-paced learning is available now on our website www.enterprisegovernance.co

EGC

Enter pri se Gover nance Con sulting

EGC

Enter pri se Gover nance Con sulting

About Dr Elizabeth Valentine & Enterprise Governance Consulting Dr Elizabeth Valentine is an experienced chief executive, company director, change project leader, and online IT governance and digital leadership executive coach. She is an innovative, tech-savvy problem solver who has consistently delivered results in largescale, complex projects including public/private collaborations, most with a significant technology component. She has been consultant and advisor to public, private and industry sector organizations in New Zealand, Australia and Europe. Elizabeth has a first class MBA from Henley (UK) and in 2016, completed a Doctor of Information Technology degree from Queensland University of Technology (Australia). In 2015, Elizabeth brought together her long-time boutique organisation change consulting business and her online research practice to form Enterprise Governance Consulting (EGC). EGC provides research, resources, consulting, executive coaching and professional development opportunities to chairmen, directors, governance committee members and senior management. We help you build on your existing governance knowledge and build new skills in governing enterprise technology. References 1. Valentine, E., Enterprise Technology Governance: New information and technology core competencies for boards of directors, Thesis: Science and Engineering Faculty, Information Systems School. 2016, Queensland University of Technology: Brisbane, Australia. 2. Carter, C. B., & Lorsch, J. W. (2004). Back to the drawing board: Designing corporate boards for a complex world. Boston MA: Harvard Business School Press. 3. Fitzgerald, M., et al., Embracing digital technology: A new strategic imperative. MIT Sloan Management Review, 2014. 55(2): p. 1-12. 4. Keen, P., & Williams, R. (2013). Value architectures for digital business: beyond the business model. MIS Quarterly, 37(2), 643-647. 5. Trautman, L.J. and K. Altenbaumer-Price, The boardâ&#x20AC;&#x2122;s responsibility for information technology governance. John Marshall Journal of Computer & Information Law, 2011. 29.

This governance research project set out to establish whether boards of directors needed to become involved in governing technology and if so, what competencies would support them in doing this effectively. Until the first version of this set was published in December 2013, no board-level GEIT competencies were found. The research, development and validation of the competency set used both quantitative and qualitative approaches to involve industry. To obtain potential user input, qualitative methods were used. Qualitative methods provided sources of content for the set. Quantitative methods were used to determine the strength of need for and the importance of GEIT competencies, as well as to provide statistical ranking to test and validate the set. A total of 419 chairmen/ women, directors, chief executives, experienced IT and non-IT executives and consultants participated. Obtaining real-world feedback is particularly important in this type of competency development. This is because the end users must be able to understand and apply the resulting set. With thanks to Prof. Glenn Stewart, Dr Greg Timbrell and Prof. Peter Green, my Queensland University of Technology supervisors.