Pilot project for implementing corporate governance of IT

Abstract

This article presents the results of the IT Governance Enhancement Project (ITGEP) carried out in three Spanish universities (the University of Murcia, Jaume I University and the Polytechnic University of Cartagena) on the initiative of the IT Commission of the Spanish Association of University Rectors (CRUE). The aim of the project was to apply the reference framework of Governance of IT for Universities (GTI4U) in order to determine the best practices currently carried out in the three universities, as well as to ascertain their level of maturity of corporate governance of IT. The project also provides an empirical evaluation of the implementation process, the GTI4U framework and its tools. The GTI4U framework was implemented in each university in a four-stage process: first an IT Governance Committee (ITGC) was set up and given responsibility for carrying out the remaining stages; the ITGC members were then taught the basic notions of IT governance, the GTI4U framework and how to implement it; there followed a self-assessment process to determine the maturity level of corporate governance of IT and which best practices fit the needs of the university; finally an IT Governance Improvement Plan was drawn up for the university. The ITGC members had a high opinion of the GTI4U framework, awarding it a mark of 4.3 on a scale of 0 to 5. They regarded GTI4U as a “reference of the highest calibre” which aspires to the maximum level of IT governance, also considering that the recommended improvement actions correspond to the most demanding professional practices. In addition, they deemed the process designed to carry out the ITGEP to be efficient and satisfactory (awarding it a mark of 4.3) and they recommended that similar processes be implemented by other universities (4.6). As regards the best practices of IT governance applied in the three universities, it was observed that 1 of each 3 best practices proposed by GTI4U were applied in relation to the principle of Responsibility and Strategy in ISO 38500, while for the principles of Acquisition, Performance, Conformance and Human Behaviour 1 of every 4 best practices were applied. These results are a clear indication that these three universities are in the early stages of corporate governance of IT and need to implement new best practices. The current maturity of corporate governance of IT is also at the lower levels of the scale for all the principles of ISO 38500, in no case surpassing the “Repeatable” level (level 2 on a scale of 0 to 5). The aim of both the CRUE and the authors of the present article is that the pilot project (ITGEP) and the GTI4U framework should become a valid reference source and should be used in the near future by many other universities that are committed to improving their corporate governance of IT.