INFORMATION TECHNOLOGY GOVERNANCE a Discussion
Total Page:16
File Type:pdf, Size:1020Kb
INFORMATION TECHNOLOGY GOVERNANCE A Discussion Paper for Lawyers Rebecca Kacaba and Donald B. Johnston Aird & Berlis LLP Toronto, Canada INFORMATION TECHNOLOGY GOVERNANCE A Discussion Paper for Lawyers Rebecca Kacaba and Donald B. Johnston Aird & Berlis LLP Toronto, Canada1 The governance of information technology is not a subject that is well understood, and there exists a good deal of confusion about it, including among many information technology professionals. Moreover, it is a subject that seems odd to connect with lawyers, whose bailiwick does not, in the minds of most people, extend to bits, bytes, boxes and networks. Nevertheless, lawyers play an important role in the governance of information technology. Where Does IT Governance Fit? Information technology governance (which we will call IT Governance for the balance of this paper) is a subdivision of corporate governance – and, like corporate governance, has both internal and external aspects. Its primary purpose is to make it obvious to people who should care – management, shareholders, lenders and other stakeholders – that the information technology systems upon which a business relies transparently supports stated business objectives. Its secondary purpose is to ensure that information technology resources are both appropriate and sufficient, and are effectively and efficiently used. IT Governance is strategic business activity. As a bonus, IT Governance may help keep Directors and senior officers of public companies out of jail, which is often seen as a good thing. 1 Rebecca Kacaba is a student-at-law at Aird & Berlis LLP, Toronto, Canada. Donald B. Johnston is a partner, the leader of its Technology Industry Group and co-leader of its Corporate-Commercial Practice Group. 1 IT Governance is the decision rights and accountability framework for encouraging desirable behaviour in the use of information technology.2 It is not the decisions themselves, but the framework in an organization for making those decisions.3 Most businesses have some form of IT Governance in place, but research indicates that systems are not as efficient as they could be.4 A proper IT Governance system is imperative for effective internal control and accurate financial reporting. We have said that IT Governance is a subset of corporate governance. What we mean is that corporate governance (in the Sarbanes-Oxley | Basel II | Bill 198 sense that all lawyers care deeply about) cannot be carried on without IT Governance. Think about it. The U.S. Sarbanes-Oxley Act of 20025 (“SOX”) was an early response to massive failures of corporate governance that resulted in the overnight loss of billions of dollars in share value in companies such as Enron, WorldCom, Global Crossing and others. Transparency, accountability and proper internal controls were critically lacking in each case. In each case, no accountable body or person “owned” the governance process. In Canada, the Canadian Securities Administrators responded to the crisis by taking actions similar to the SOX initiative.6 Ontario initiated omnibus Bill 198 (“Bill 198”), which authorized the Ontario Securities Commission to create SOX-like regulations and guidelines. These 2 Jeanne Ross and Peter Weill, “How Effective is your IT Governance?” (2005) 5 MIT CISR Research Brief 1B, at page 1. 3 Focus on Ross, supra note 4. 4 Focus on Ross, supra note 4. 5 Also called the Public Company Accounting Reform and Investor Protection Act of 2002, Pub. L. 107-204, 116 Stat. 745 6 See Multilateral Instruments 52-111 (reporting on internal controls) and 52-109 (disclosure certification). Some of the provisions of MI 52-111 are now merged with MI 52-109. 2 resulted in requirements for CEOs and CFOs to certify the internal controls of “reporting issuers”, i.e., public companies, and set out certain other requirements. Non-compliant senior officers are now open to serious civil liabilities and/or jail time. While it is not the purpose of this paper to go into detail on the larger subject of corporate governance (which is the mother of IT Governance), it is worth considering what CEOs and CFOs of reporting issuers are now required to do. In rough terms, they must now certify personally: • that they have reviewed all public filings and that those filings do not contain any untrue material statements or omit any material statements • that the company’s financial information fairly represents the financial condition of the company • that they have implemented proper disclosure controls, tested them and set out their conclusions in the Management Discussion and Analysis report • that they have implemented internal controls over financial reporting, so that the public financial statements will fairly represent the financial condition of the company in accordance with generally accepted accounting principles • that all material changes to internal controls have been disclosed in the Management Discussion and Analysis report 3 These requirements are basically enforced on a “no-excuses-the-buck-stops-here” basis. As a result, senior managers of a public company are highly motivated to ensure that internal controls are in place and properly functioning so that corporate governance “works”. How these requirements mesh with IT Governance should be intuitive (but probably isn’t for many managers for whom information technology systems are, essentially, magic). In large corporations, virtually the only way to implement fully functioning internal controls is to do so with the aid of information technology. While this is patently the most efficient (and sometimes the only) way to do it, it also presents senior management with a problem: how do they know that they can rely upon the information technology systems that the public company for which they are responsible implements as part of the internal control process? The answer is that they cannot know if they can rely upon their information technology systems unless they subject those systems to controls no less rigorous than the controls that are applied to financial matters. In short, they have to “own” responsibility for the information technology systems. That “ownership” is what IT Governance is all about. Is IT Governance Mere Regulatory Activity? While it might be convenient to think of IT Governance as one of the steps to avoid jail, large fines, civil liability and personal bankruptcy – none of which a wise executive will consider to be career-enhancing – it is far better to elevate IT Governance to a matter of principle rather than a mere compliance issue. Good IT Governance is good business. If you are a CEO or a CFO, IT Governance is your friend. It gives you a reliable handle on some of the most important 4 activities in the enterprise for which you are responsible.7 Good IT Governance is therefore not merely an important compliance exercise. It is strategic activity within the enterprise and should be regarded in that light. Who “owns” strategy? It is the Board of Directors and senior management who do. So, the Board and senior management must also “own” IT Governance. A proper IT Governance system also has significant profitability benefits. Research shows that the lack of value being attained from IT investments is due to bad planning or execution of projects, rather than bad choices of where to invest funds.8 IT Governance allows management and executives to view and evaluate the risks, budget and complexity of the proposed projects. It allows management to view the status, progress and issues that are being faced as projects are developed. Finally, proper IT Governance will allow review and evaluation of IT projects, so that their value can be assessed, future projects can be assessed with this knowledge and a company can maximize product lifecycle management.9 IT Governance is characterized by Board-imposed comprehensive control over the information technology assets used by the enterprise, by means of: • wise policies set by the Board of Directors with both internal and external assistance o clear aims and purposes of the policies so that responsible insiders understand them (this will likely include testing the extent to which they are understood) 7 The same argument has been made for privacy. A good manager knows that a mere “compliance” approach to privacy may keep an organization out of the deepest pitfalls, but that a proactive approach that elevates privacy to a matter of principle, and that implements privacy using a best practices model, cannot only keep the organization compliant with virtually all privacy regimes to which it may be subject over multiple jurisdictions but can also be something about which the organization can brag. In the right industry, it can be a competitive advantage. 8 Focus on Ross, supra note 4. 9 Origitano, supra note 7. 5 o oversight by the Board, to ensure that the policies are fully implemented, enterprise-hardened and enforced at all times • organizational structures that allocate isolate responsibility and “ownership” of IT Governance-related tasks, so that responsibility for such tasks is not diluted or diffused o must include the most senior management o responsible persons know what to do upon the happening of certain events • the implementation of decision-making and reporting rules, within such organizational structures, in accordance with the policies set by the Board • by virtue of the organizational structures, the decision-making and reporting rules, the Board of Directors and senior management know, at all relevant times, the state and reliability of the information technology systems upon which the enterprise relies10 • change management systems that allow the enterprise to be flexible, and to respond quickly, effectively, appropriately and predictably to requirements of business, competition and change of all kinds • a “life-cycle management” approach to information technology assets • testing and auditing of the information technology systems on a regular basis, with regular reports to the Board and senior management 10 Members of the Board and senior management don’t need to know how the IT systems work, of course, any more than the average driver needs to know how the family car works.