Abstract
Information Technology (IT) governance has risen in importance in recent years, driven by various trends in IT development. With rapid growth in the country and the globalization of the IT sector, there is growing interest in IT governance in Malaysia. This study aims to explore whether IT practitioners with different job functions, education levels, education areas of specialization, certifications and experience levels have different perceptions of IT governance effectiveness in their organization. The results reveal differences in perceived IT governance effectiveness between different job function groups, but not between groups with different education levels, certification or experience levels. The findings for education area of specialization are not conclusive. The findings of this study will help IT managers to identify areas of focus to maximize effectiveness of IT governance initiatives through their IT staff. The implications of the findings are discussed at the end of the paper.
Keywords
1. Introduction
IT governance has risen in importance in recent years, becoming a priority in most organizations [1]. In the information economy, intellectual assets, information and IT have become a strategic tool for competitive advantage [2]. Although value creation of IT investments is increasingly recognized as providing an important contribution to business, IT costs continue to rise [1] and have to be managed well.
Organizations are increasingly dependent on IT due to the pervasive use of technology [3]. Business operations are at risk due to exposure to threats to intellectual assets, information and IT from internal and external hackers, viruses, malware and phishing [4].
As a part of overall corporate governance, IT has been required to comply with tighter regulations for corporate governance since the Enron and WorldCom scandals (after, for example, the Sarbanes-Oxley Act of 2002). IT as the custodian of data has to comply with more and more information and privacy-related legislation, such as the Malaysian Personal Data Protection Act of 2010.
1.1 Rapid Growth and Globalization of the IT Sector in Malaysia
The IT sector in Malaysia is growing at a quick pace. Based on the latest annual report from the Multimedia Development Corporation [5], total revenue stands in excess of RM 30 billion, the highest figure since the financial crisis of 2008. The MDeC also reported a figure of RM 9.6 billion and 25% growth in the sector's contribution to Malaysia's Gross Domestic Product (GDP), compared to the previous year.
The IT sector in Malaysia is also undergoing rapid globalization. Exports grew by 9% to 10.12 billion, while investments grew at 69.2% to RM 2.5 billion [5]. Based on the Multimedia Super Corridor (MSC) company directory [6], there is one company of foreign origin for every two Malaysian companies.
1.2 Growing Interest in IT Governance in Malaysia
Early published research on IT governance in Malaysia began in the education sector [7, 8] and continues to be explored [9]. In 2006 studies on electronics manufacturing companies, Tan, Eze and Teo [10] and Teo and Tan [11] conclude that adoption of IT governance is at an early stage, and that there is room for improvement in familiarity with the technicalities of IT governance frameworks.
IT governance research for Small and Medium Enterprises (SMEs) in Malaysia has taken two different approaches: one approach attempts to generalize IT governance implementation in SMEs [12, 13], while the other seeks to tailor IT governance frameworks to suit specific characteristics of SMEs [14, 15].
IT governance research in Malaysia continues to receive increasing interest (see, for example, [16–21]).
1.3 Practitioner-centric Approach to IT Governance
IT governance begins with the board but action happens at the working level; this highlights the importance of IT practitioners in IT governance initiatives. This study examines IT governance from the perspective of IT practitioners. Dixon (2002) defines an IT practitioner as “someone who designs, develops, operates, maintains, supports, services, and/or improves IT systems, in support of end-users of such systems”. Based on this definition, various IT functions throughout an Information System's lifecycle fall within the scope of IT practitioners. These functions include strategy and planning, management and administration, development, implementation, and service delivery.
The objective of this study is to explore whether IT practitioners with different job functions, education levels, education areas of specialization, certifications and experience levels have different perceptions of IT governance effectiveness in their organization.
2. Literature Review
2.1 Perceived IT Governance Effectiveness
Prior studies examining the effectiveness of IT governance have taken different approaches. These focused on structures, processes and relational mechanisms [22], specific conditions under which these mechanisms work [23], IT capabilities [24] and culture [25].
As the dependent factor, effectiveness of IT governance is measured by perceived effectiveness [26]. The prior studies that have been mentioned examine the issue from the organizational perspective. Assessing the issue from the angle of IT practitioners gives another view.
Weill and Ross [27] argue that the ultimate outcome of successful IT governance is the effective delivering of four objectives: cost, growth, asset utilization and business flexibility. This could be extended to the level of individual IT practitioners, where perceived IT governance effectiveness is the outcome.
2.2 Job Function
IT governance standards and best practices for specific aspects of the IT function do exist; however, the specific nature of such regulations, standards and best practices imposes different extents of influence on the day-to-day work of the IT practitioner based on his/her job function.
Examples of standards and best practices for IT governance include ISO/IEC 38500:2008 “Corporate governance of information technology” [28] and Control Objectives for Information and Related Technology (COBIT) [29]. In the area of IT service management, the IT Infrastructure Library (ITIL) is widely used [30] as well as ISO/IEC 20000, the international standard for IT service management [31].
For project management, two popular project management best practices are Project Management Body of Knowledge (PMBOK) [32] and Projects IN Controlled Environments (PRINCE) [33]. For software development, there is Capability Maturity Model Integration (CMMI) [34]. These are just several examples to highlight the variety of standards and best practices in IT.
It is hypothesized that perceived IT governance effectiveness differs among IT practitioners with different job functions, relating for example to infrastructure, application, projects, or service.
2.3 Education Level
Formal education provides foundational knowledge for IT practitioners. This foundational knowledge prepares them for a fast-changing world with the ability to learn new skills when needed. On the other hand, IT governance initiatives in organizations require skills with specific strategies, objectives and processes. Therefore, it is hypothesized that education level does not translate into differences in perceived IT governance effectiveness.
2.4 Education Area of Specialization
In the previous section, it was hypothesised that perceived IT governance effectiveness would not differ according to the education level of IT practitioners because formal education provides foundational knowledge, whereas IT governance initiatives in organizations require specific skills. Consequently, it is also hypothesised that area of specialization does not differentiate perceived IT governance effectiveness among IT practitioners, either.
2.5 Certification
Certifications provide third-party recognition that an IT practitioner is competent in the area of certification. These cover diverse functions in IT, for example IT governance-relevant functions such as project management, service management and security management. Therefore, it is hypothesized that perceived IT governance effectiveness does not differ among IT practitioners according to certifications.
IT practitioners are classified in groups: no certification at all, certification which is not directly related to IT governance, certification which is related to IT governance (e.g., project management, service management and security management) or certifications specific to IT governance.
2.6 Experience Level
IT practitioners are expected to bring knowledge and skills with their related work experience. However, previous studies have not found prior experience to have as positive an impact as expected [35]. Research carried out on call centre employees found that the effect of prior related experience on task-relevant knowledge and skills was overall less as expected [35].
In anticipating whether experience level has an effect, two issues are considered. Firstly, IT practitioners with IT work experience do not necessarily have specific experience in IT governance. Secondly, IT governance at the organizational level is usually directed at specific processes and procedures imposed on the IT practitioners. This research covers IT practitioners in general; therefore, it is hypothesized that perceived IT governance effectiveness does not differ between groups of IT practitioners with different levels of experience.
3. Methodology
3.1 Population and Sample
The sampling frame consists of IT practitioners in Malaysia according to the definition by Dixon [36]. Due to the limitation of not having a national registry of IT practitioners, purposive sampling was used to solicit potential respondents from Multimedia Super Corridor (MSC)-status companies in Cyberjaya, Malaysia.
Eligible respondents received e-mail invitations to the online survey website. Out of 198 invitations, 167 valid responses were received, representing a response rate of 84%, which is very good (see [37]). The high response rate was expected because respondents had agreed to participate during survey sign-up.
Non-response bias was checked based on the assumption that characteristics of non-respondents were similar to those of late respondents, as suggested by Armstrong and Overton [38]. An independent samples t-test confirmed that none of the demographics are statistically significant (p > 0.05, two-tail tests) thus suggesting that non-response bias may not exist.
3.2 Measurement Instrument
Perceptual measure of perceived IT governance effectiveness was adapted from Weill and Ross [27]. The questionnaire was designed with a five-point Likert scale to measure the multi-item constructs (1 = strongly disagree and 5 = strongly agree). The survey questionnaire used is included in the appendix.
3.3 Respondent Profile
The respondent profile is shown in Table 1. The majority of respondents have job functions in the area of application and infrastructure. A small number of them are in project management and service management. The others have cross-functional job functions.
Respondent profile, normality, mean and standard deviation of perceived IT governance effectiveness for practitioner profiles
Notes:
1. Abbreviations used: ITG (IT Governance); PM (Project Management); SM (Service Management).
2. * p≥0.05 indicates normality is met.
3. Entries without Kolmogorov-Smirnov statistics indicate that these are not calculated due to the small number of respondents in these categories.
Most respondents have a bachelor degree. They mainly studied IT and related majors, with only a small number studying non-IT related majors. The remainder had a mixed education background.
Certification is relatively widespread, with nine of ten respondents having one or more certifications. However, IT governance certification is rare. More than half of respondents have project management, service management or security certifications.
The respondents represent a relatively young IT workforce, with the majority within the ten-year experience band. Respondents with two to five years of work experience constitute the largest group, followed by those in the five to ten years category. Overall, the different experience levels are adequately represented.
3.4 Results
Analysis of Variance (ANOVA) is a parametric test used to test differences between two or more groups. When assumptions of ANOVA are not met, the equivalent non-parametric test should be used. Kruskal-Wallis is used for comparing more than two samples that are independent.
In this research, Kolmogorov-Smirnov with Lilliefors Significance Correction and Shapiro-Wilk are used for testing normality. Based on the results shown in Table 1, none of the profiles or categories are normally distributed according to both Kolmogorov-Smirnov and Shapiro-Wilk tests. Since assumptions of normality are not met, the non-parametric test should be used instead of ANOVA.
The significant results of the Kruskal-Wallis test indicate that at least one of the samples is different from the other samples. As shown in Table 2, the Kruskal-Wallis test is significant for perceived IT governance effectiveness by job function and education area of specialization. This indicates that at least one job function group is different from the other groups. A similar outcome applies to education area of specialization.
Results of independent-sample Kruskal-Wallis test
Based on the mean values of perceived IT governance in Table 1, respondents with infrastructure and project management as their job scope perceive that IT governance initiatives in their organizations are more effective compared to the other groups. Also, the relatively large standard deviations for application and project management job function groups indicate variability in perceptions of IT governance effectiveness within these groups.
Similarly, respondents with non-IT-related majors reported a higher perceived IT governance effectiveness compared to their counterparts with IT-related majors. However, it should also be noted that the group with IT-related majors has a relatively large standard deviation, hence also indicating variability in perceived IT governance effectiveness within this group. In addition, the group with IT-related majors is much larger(145) than the non-IT-related major (8) and mixed (14) groups.
In contrast, the results of the independent-sample Kruskal-Wallis test are not significant for education level, certification or experience level. The outcome of the hypothesis testing is summarized in Table 3. Out of the five hypotheses, three are supported while two are not.
Results of hypothesis testing
4. Discussion
The results show that there is a difference in perceived IT governance effectiveness between IT practitioners with different job functions. This is expected because there are IT governance frameworks for specific aspects of IT, imposing different extents of influence on IT practitioners' jobs.
The hypothesis that the education level of IT practitioners does not matter in the perception of IT governance effectiveness is also supported. Formal education only provides foundational knowledge to IT practitioners, which is not specific to IT governance.
As was hypothesized, there is no difference in perceived IT governance effectiveness between IT practitioners with different levels of experience. This is expected, since IT practitioners with work experience do not necessarily have specific experience in IT governance. Furthermore, IT governance initiatives are possibly specific to the organizations they are currently operating in.
The surprising finding is that perceived IT governance effectiveness is far more differentiated by education area of specialization than by certification. The group with non-IT-related majors showed higher perceived IT governance effectiveness than the group with IT-related majors. These results are inconclusive because the non-IT-related major group is insufficiently represented. Furthermore, there is high variability in perceived IT governance effectiveness within the group with IT-related majors.
The next hypothesis was that perception of IT governance effectiveness is differentiated by certification, but the results show that certification does not matter. More than half of the respondents possess one or more certification related to IT governance (such as project management, service management, security management or IT governance certifications), but there is high variability among these respondents in perceived IT governance effectiveness. This implies that a greater level of certification alone does not correlate with a higher perception of IT governance effectiveness.
4.1 Contribution
This study presents an alternative view on IT governance. It serves to bridge the gap between direction and execution, helping to translate strategy into action. The findings from this study help IT management to identify areas of focus to maximize effectiveness of IT governance initiatives through their IT staff.
4.2 Implications
There are two implications to be considered. Firstly, since IT practitioners with different education levels, certifications and experience levels do not have different levels of perceived IT governance effectiveness, management should not give too much attention to these factors. However, the findings for education area of specialization are not conclusive.
Secondly, IT practitioners with different job functions reported different levels of perceived IT governance effectiveness. Although IT governance best practices have different levels of impact on different job functions, management guidance in the form of organizational structures, processes, goals, reward system and learning and development could be considered to improve perceived IT governance effectiveness. Continuous commitment from management is needed. IT governance is usually a long and arduous journey. Without continuous commitment, such initiatives are not sustainable.
5. Limitations and Suggestions for Future Research
Since no register of IT practitioners is available in the population, purposive sampling was used, which is a non-probability technique that limits generalizability.
This limitation is mitigated to some extent through the representativeness of the sample, since the demographics of the respondents are comparable to the workforce demographics of MSC-status companies. Caution should be observed when generalizing these conclusions to apply to organizations with very different organizational contexts to these MSC-status organizations.
This study only considers certain IT practitioner factors, which are mainly demographic in nature. Future IT governance research on IT practitioners could consider the characteristics of the practitioners themselves, as well as management guidance factors.
6. Appendix: Survey Questionnaire
Note: Only questions which are relevant to this article are included here. The complete survey questionnaire can be obtained from the corresponding author.
About This Survey
IT governance initiatives include a wide range of processes and practices in the day-to-day delivery of IT services, including project management, IT operations management and IT investment decisions. Significant research has been carried out to study the organizational and management aspects of IT governance. This survey is intended to help us gain an insight into IT governance from the perspective of IT practitioners. It is structured in five sections and will take approximately 20 minutes to complete.
Target Respondents
This survey is intended for IT practitioners (non-managerial level, i.e., main job function is not to manage people) working full time (either permanent or contract) at an MSC-status company.
The job function of IT practitioners includes one or more of the following activities for IT systems:
Design Development Operation Maintenance Support Service Improvement
The scope of work of IT practitioners covers one or more of the following IT functions throughout an Information System lifecycle:
Strategy & planning Management & administration Development Implementation Service delivery.
Statement of Confidentiality
Your response will be kept strictly confidential. Any form of identification code is only used to ensure no duplicates in data collection.
I work in an MSC-status company. My job function and scope of work fulfil the definition of IT practitioner described above.
Yes (start the survey now) No (decline participation in the survey)
Section 1: Respondent profile
With a sum of 10, please indicate your day-to-day job functional areas.
Service desk/Helpdesk/Call centre__________ Server/database/network operation__________ Desktop support (e.g., PC, laptop, mobile devices) __________ Application operation/support__________ Software design and development__________ Project management__________ What is your highest education level?
High school/SPM Diploma/Pre-university/STPM Bachelor Master degree Doctorate degree What was your field of study at all previous education levels? Please indicate all applicable answers.
Computer Science/Information Technology/Information Systems/Software Engineering (technical specialisation) Management Information Systems/Information Technology (business/management specialization) Electrical/Electronics/Computer Engineering Engineering (Others) Business Mathematics/Statistics Other If you possess IT certifications, please indicate here.
Database/systems administration (e.g., MCSE, RHCE, MCDBA, OCP, VMware) Software development (e.g., MCSD) Network (e.g., CCNA, CCNP, CCIE) Security (e.g., CISA) Application (e.g., SAP) Project management (e.g., PMP, PRINCE2, IPMA) IT service management (e.g., ITIL) IT auditing (e.g., CISA) IT governance (e.g., CGEIT) Other How long have you been working in IT-related fields?
Less than 1 year 1-2 years 2-5 years 5-10 years 10-20 years More than 20 years
Your anonymity is absolutely assured. Personal data is collected only to ensure the uniqueness of the response and that the respondent has a job title that fulfils the research requirements.
Corporate E-mail Address ______________________________
Job Title ______________________________
Thank you for participating in the survey. In the meantime, if you wish to get in touch with the research team, feel free to e-mail