Information Technology Governance for Higher Education Institutions: A Multi-Country Study

Round 1

Reviewer 1 Report

The authors have built on a very interesting and timely topic, that of information technology governance. Specifically, they examine the role of IT governance in higher education institutions and perform a multi-country study. I would like to commend the authors for their very well executed work and your interesting findings. I do however have some comments that you will need to address in a revision.

First, there is a lack of description regarding the contingencies of IT governance. This is something you might want to extend on a bit on this in section 2.2.

Weber, K., Otto, B., & Österle, H. (2009). One size does not fit all---a contingency approach to data governance. Journal of Data and Information Quality (JDIQ), 1(1), 1-27.

In terms of practical contributions, you might also want to add some points about how governance structures might influence performance. There is some work in other fields that shows that depending on the type of structural variations in performance might be observed such as the following:

Mikalef, P., Pateli, A., Batenburg, R., & van de Wetering, R. (2014). Business alignment in the procurement domain: a study of antecedents and determinants of supply chain performance. International Journal of Information Systems and Project Management, 2(1), 43-59.

I think with these changes you article will be in good shape to be published.

Author Response

Reviewer

Thank you for your review of our paper. We have answered each of your points below.

The authors have built on a very interesting and timely topic, that of information technology governance. Specifically, they examine the role of IT governance in higher education institutions and perform a multi-country study. I would like to commend the authors for their very well executed work and your interesting findings. I do however have some comments that you will need to address in a revision.

Response:  We much appreciated the comment. 

First, there is a lack of description regarding the contingencies of IT governance. This is something you might want to extend on a bit on this in section 2.2.

Weber, K., Otto, B., & Österle, H. (2009). One size does not fit all---a contingency approach to data governance. Journal of Data and Information Quality (JDIQ), 1(1), 1-27.

Response: Thank you very much for your comment. We included more information and details about contingencies of IT Governance (See Section 2.1) par (2) and Section 2.2 par (5). The changes in this version an in red. In addition, some new references were added to support the statements.

In terms of practical contributions, you might also want to add some points about how governance structures might influence performance. There is some work in other fields that shows that depending on the type of structural variations in performance might be observed such as the following:

Mikalef, P., Pateli, A., Batenburg, R., & van de Wetering, R. (2014). Business alignment in the procurement domain: a study of antecedents and determinants of supply chain performance. International Journal of Information Systems and Project Management, 2(1), 43-59.

Response: Thank you very much for your feedback. Indeed, those two suggest references bring important insights and contributions to this study. We added the two references in this article. In the Practical Contributions Section, we included more details and information (See par 2.)

I think with these changes you article will be in good shape to be published.

Response: Thank you very much for your comment. We hope that after these changes, the article is already done for publication.

This manuscript is a resubmission of an earlier submission. The following is a list of the peer review reports and author responses from that submission.

Round 1

Reviewer 1 Report

Review of the manuscript titled: "Information Technology Governance for Higher Education Institutions: A Multi-Country Study"

Applying Design Science Research (DSR), this study aims to identify the key IT governance practices that institutions in the higher education industry can leverage to improve IT/business alignment.  The paper focuses on the IT governance mechanism, one of the important three aspects of IT governance. The authors have focused on an important and interesting topic. Identifying IT governance practices, particularly for universities, has a significant contribution to the IT governance literature in IS field. The topic is also important from the perspective of its practical implications, especially during the current uncertain time that universities are forced to transit from conventional learning to online learning.

Listed below are my comments and suggestions to improve the paper.

• One of the major issues in the current version of the paper is regarding the definitions and terminologies. This issue (1) makes the paper hard to read and understand, and (2) it will cause confusion for future readers, particularly those who are not knowledgeable enough in the IT governance area and want to use this paper to learn it. IT governance comprises of three key aspects: (1) IT governance domains or focus of IT governance (what to govern), (2) IT governance archetype or the scope of IT governance (who to govern, or who governs), and (3) IT governance mechanism or the patterns of IT governance (how to govern) (Gregory et al. 2018; Jafarijoo and Joshi 2020; Weill and Ross 2004). Previous studies define three IT governance mechanisms, including structural, procedural, and relational mechanisms (De Haes and Van Grembergen 2009). These three IT governance mechanisms are a set of “practices” that help organizations align the interests of IT and business (De Haes and Van Grembergen 2009). Considering this definition provided for IT governance by previous literature, the current study suffers from the following issues:
  1. The communication approach developed by Weill and Ross (2004) and adopted by Wu et al. (2015) is a subsection of relational mechanism developed by De Haes and Van Grembergen (2009). While the focus of the current paper is on the relational mechanism, the authors borrowed the definition provided by Wu et al. (2015) (e.g., page 3). Thus, I suggest the authors use a definition consistent with the practices they identify in the current paper for establishing the relational mechanism.
  2. The paper identifies the best practices that universities can use to establish three IT governance mechanisms. However, the term "mechanism" is used in the paper to refer to practices. I suggest authors review the entire paper and use the term "mechanism" and "practice" appropriately. I suggest reconsidering the research question as well.
• Table 1 is confusing. To make it more clear, I suggest the following modification/explanation:
  1. It would be helpful if authors describe the content presented in each column. It seems the frequency column has been adapted from a literature review conducted in a previous study (i.e., Almeida et al. 2013). However, the numbers are showing in the table are not consistent with numbers reported by Almeida et al. (2013).
  2. Some practices are listed in Table1, which do not have any number under the frequency column and no reference under the reference column. I wonder in which study these practices have been identified and why they are listed in Table 1.
  3. The "centralized" and "decentralized", which are two types of IT archetype, have been listed under practices related to the structural mechanism. To be consistent with the IT governance definition, I suggest the authors remove the archetype from this table and discuss it separately.
  4. It would be helpful if the authors explain the measures/factors that they used to identify the effectiveness of the practices.
• In the first step of the study, the authors borrowed the 46 practices identified in Almeida et al. (2013), and then they did a literature review (including 27 papers) focusing on studies conducted in the higher education industry to identify the practices used in universities. Table 1 shows not all the 46 practices have been implemented by universities or have been considered effective for universities. However, in step 2, all 46 practices have been used. It would be helpful if the authors explained (1) why they did use all 46 practices in step 2 and (2) what was the purpose of the literature review conducted in this study. It should also be helpful if the authors (1) discuss how they select 27 papers and (2) provide the criteria used to pick them.
• Ten universities from five countries are picked to conduct the study. However, the rationality behind the case selection has not been discussed clearly in the study. Several factors influence the configuration of IT governance mechanisms. These factors include (1) internal factors such as organization size, (2) external factors such as culture, and (3) IT investment characteristics (Xue et al. 2008). Thus, it would be helpful if the authors (1) discuss the factors considered to select these ten universities and five countries, (2) report the descriptive statistics of the cases—for example, the size, the sector, and so on, and (3) how they control the influence of the contingency factors mentioned above.
• Eight new practices have been identified during the interviews. However, not all of these practices are among the most important practices identified by interviewees (Table 2). I wonder why these eight practices have been added to the final suggested best practices for universities (Figure 2). For instance, the "Process Management office" is among the bassline practices, but it is not among the practices reported in Table 2.
• On page 10, line 25, a guideline has been offered. However, it is not clear how these practices have been selected and recommended as a guideline for the implementation of ITG mechanisms at universities.
• It would be helpful if the authors provide more information regarding the universities and countries that are picked for the evaluation. For example, how many universities used for evaluation, and why those universities/countries have been selected?
• It should be noted along with industry; culture also influences IT governance. Thus, it would be helpful if the authors explain how they did control the role of culture. For example, the authors mention that (page 10 line 18): "The proposed ITG mechanisms baseline for universities is useful mainly for developing countries." I wonder what the rationality is behind this claim. Because not all universities picked for this study are located in a developing country.
• In the discussion section (page 12), the authors explain IT governance archetype of the cases. While the IT governance archetype is an important aspect in the structural mechanism configuration, I wonder if the IT archetype was also captured during the data collection. If so, it would be helpful if the authors report the IT archetype of the cases.

Minor comments

• The claim regarding De Haes and Van Grembergen (2009) 's work on page 10, Line 8 is misleading. De Haes and Van Grembergen (2009) identify the best practices for the banking industry in Belgium, not all the industries in Belgium.
• Page 10, Line 22 is referring to Table 3. However, I believe it means Figure 2.

References:

Almeida, R., Pereira, R., and da Silva, M.M. 2013. "It Governance Mechanisms: A Literature Review," International Conference on Exploring Services Science: Springer, pp. 186-199.

De Haes, S., and Van Grembergen, W. 2009. "An Exploratory Study into It Governance Implementations and Its Impact on Business/It Alignment," Information Systems Management (26:2), pp. 123-137.

Gregory, R.W., Kaganer, E., Henfridsson, O., and Ruch, T.J. 2018. "It Consumerization and the Transformation of It Governance," Mis Quarterly (42:4), pp. 1225-1253.

Jafarijoo, M., and Joshi, K. 2020. "It Governance: Review, Synthesis, and Direction for Future Research," in: GITMA 2020 Proceedings. p. 124.

Weill, P., and Ross, J.W. 2004. It Governance: How Top Performers Manage It Decision Rights for Superior Results. Harvard Business Press.

Wu, S.P.-J., Straub, D.W., and Liang, T.-P. 2015. "How Information Technology Governance Mechanisms and Strategic Alignment Influence Organizational Performance: Insights from a Matched Survey of Business and It Managers," MIS Quarterly (39:2), pp. 497-518.

Author Response

Reviewer 1

Thank you for your review of our paper. We have answered each of your points below.

Review of the manuscript titled: "Information Technology Governance for Higher Education Institutions: A Multi-Country Study"

Applying Design Science Research (DSR), this study aims to identify the key IT governance practices that institutions in the higher education industry can leverage to improve IT/business alignment.  The paper focuses on the IT governance mechanism, one of the important three aspects of IT governance. The authors have focused on an important and interesting topic. Identifying IT governance practices, particularly for universities, has a significant contribution to the IT governance literature in IS field. The topic is also important from the perspective of its practical implications, especially during the current uncertain time that universities are forced to transit from conventional learning to online learning.

Listed below are my comments and suggestions to improve the paper.

• One of the major issues in the current version of the paper is regarding the definitions and terminologies. This issue (1) makes the paper hard to read and understand, and (2) it will cause confusion for future readers, particularly those who are not knowledgeable enough in the IT governance area and want to use this paper to learn it. IT governance comprises of three key aspects: (1) IT governance domains or focus of IT governance (what to govern), (2) IT governance archetype or the scope of IT governance (who to govern, or who governs), and (3) IT governance mechanism or the patterns of IT governance (how to govern) (Gregory et al. 2018; Jafarijoo and Joshi 2020; Weill and Ross 2004). Previous studies define three IT governance mechanisms, including structural, procedural, and relational mechanisms (De Haes and Van Grembergen 2009). These three IT governance mechanisms are a set of “practices” that help organizations align the interests of IT and business (De Haes and Van Grembergen 2009). Considering this definition provided for IT governance by previous literature, the current study suffers from the following issues:

 Response: Thank you very much for your comment. We defined more clearly the concepts of IT governance in the article. Introduction section was tuned to be more precise on why to study ITG in university context as a complex organization. New references were added.

The communication approach developed by Weill and Ross (2004) and adopted by Wu et al. (2015) is a subsection of relational mechanism developed by De Haes and Van Grembergen (2009). While the focus of the current paper is on the relational mechanism, the authors borrowed the definition provided by Wu et al. (2015) (e.g., page 3). Thus, I suggest the authors use a definition consistent with the practices they identify in the current paper for establishing the relational mechanism.

Response: Thank you very much for your comment. We reviewed the definition adopted in this paper. More information was added at the end of section 1 and in the section of methodology.

The paper identifies the best practices that universities can use to establish three IT governance mechanisms. However, the term "mechanism" is used in the paper to refer to practices. I suggest authors review the entire paper and use the term "mechanism" and "practice" appropriately. I suggest reconsidering the research question as well.

Response:  Thank you for pointing this gap. We reviewed all these terms in the article as well as the research question to avoid confusion. In fact, sometimes we called mechanisms other practices. Thanks for the call.

Table 1 is confusing. To make it more clear, I suggest the following modification/explanation:

it would be helpful if authors describe the content presented in each column. It seems the frequency column has been adapted from a literature review conducted in a previous study (i.e., Almeida et al. 2013). However, the numbers are showing in the table are not consistent with numbers reported by Almeida et al. (2013).

Response:  Thank you very much for your comment. We clarify that we adapted ITG practices from Almeida et al. (2013) and provided more details about the process in each column. Please see the section.

1. Some practices are listed in Table1, which do not have any number under the frequency column and no reference under the reference column. I wonder in which study these practices have been identified and why they are listed in Table 1.

• Response: Thank you for your comment. We clarify the process giving more information.  Some practices the others studies did not implement, in this case there is no  frequency of implementation in this column.

When the practices did not get to be implemented but they were recognized by the people involved in the cases and by the researchers’ evaluation as essential to be adopted and expected to have a positive impact in the organization, they were taken in account for our evaluation.

Effective – If the practice is implemented and has a positive impact on IT governance in the institution in terms or if it is recommended.

Not Effective – If the practice is implemented and has a negative impact on IT governance in the institution. 

No significant results – if the practice is implemented but no positive or negative impact has been found in the institution.

No evidence – If there is not clear evidence of the impact or the results on IT governance practices in the institution as well as the importance of this mechanism for IT governance.

The analysis process was based on the findings in each mechanism. Quotes were identified for all practices. For instance, “IT strategy is necessary to be clear and understood by the board of directors” (Fraser and Tweedale 2003). This example shows that the IT strategy committee is effective because it ensures the IT strategy on the agenda of the institution.

Another example is the relational mechanism, knowledge management (in ITG). The quote identified in the article is:  “Knowledge about IT governance should not be only created inside the research community but disseminated through dialogue and collaboration between the academic community and industry” (Ko and Fink 2010). Findings in this quote reveal that the knowledge of IT Governance needs to be shared. Therefore, this mechanism was considered as effective for IT governance.  This strategy was followed for all practices

To identify if the practices were presented in the case study the following notation was adopted:

• When the practice is totally implemented in the case study, the cell is filled with “x”
• When the practice does not exist, the cell is left as empty
•  
1. The "centralized" and "decentralized", which are two types of IT archetype, have been listed under practices related to the structural mechanism. To be consistent with the IT governance definition, I suggest the authors remove the archetype from this table and discuss it separately.

• Response: Thank you for your opinion. This table aimed to provide information that a decentralized archetype is not effective in universities. It is not the aim of this paper to discuss the IT archetype, since we have published a paper with focus on it.

1. It would be helpful if the authors explain the measures/factors that they used to identify the effectiveness of the practices.

Response: Thank you very much for you comment. We include more details about the criteria and the process to identify the effectiveness of the ITG practices.

• In the first step of the study, the authors borrowed the 46 practices identified in Almeida et al. (2013), and then they did a literature review (including 27 papers) focusing on studies conducted in the higher education industry to identify the practices used in universities. Table 1 shows not all the 46 practices have been implemented by universities or have been considered effective for universities. However, in step 2, all 46 practices have been used. It would be helpful if the authors explained (1) why they did use all 46 practices in step 2 and (2) what was the purpose of the literature review conducted in this study. It should also be helpful if the authors (1) discuss how they select 27 papers and (2) provide the criteria used to pick them.

Response: Thank you for your opinion. We clarify in the text to avoid confusion. In the literature review, some practices, even though indicated that they are implemented, share no evidence about their effectiveness in IT governance in the case studies. For example, the following process mechanisms: the “IT audit committee”, “IT project steering committee”, “IT security steering committee”, “Architecture steering committee”, “Business/IT relationship managers” and “IT investment committee”. Process Mechanisms: “Charge back”, “Service level agreement”, “IT governance assurance and self-assessment, “Business/IT alignment model”, “Demand management” and “Architectural Exception Process”. Relational mechanisms: “Job-rotation”, “Business/IT account management”, “IT governance awareness campaigns”, “Partnership rewards and incentives” and “Senior management announcements”.

Therefore, more empirical studies are necessary to comprehend the effectiveness of these practices as well as the importance of ITG in universities.  In order to do this, we carried out multiple case phase to accomplish this gap.

• Ten universities from five countries are picked to conduct the study. However, the rationality behind the case selection has not been discussed clearly in the study. Several factors influence the configuration of IT governance mechanisms. These factors include (1) internal factors such as organization size, (2) external factors such as culture, and (3) IT investment characteristics (Xue et al. 2008). Thus, it would be helpful if the authors (1) discuss the factors considered to select these ten universities and five countries, (2) report the descriptive statistics of the cases—for example, the size, the sector, and so on, and (3) how they control the influence of the contingency factors mentioned above.

Response: Thank you for your opinion. Indeed, several factors influence the implementation of ITG. We considered these factors to identified the ITG practices as well as to evaluate the model. We included more information about the cases in the Table 2. In the Research Methodology section, the authors made it now clear that we adopted a multiple case approach of exploratory nature. We included information on how we selected the ten cases looking for better representativeness of higher education institutions across different countries when comparing with previous studies. Convenience sampling was adopted to select a variety of universities from different contexts with a variation in institutional size, culture, control type, and IT organisation structure to reduce contextual bias (Creswell, 2013; Dubé & Paré, 2003). See Methodology Section. 

• Eight new practices have been identified during the interviews. However, not all of these practices are among the most important practices identified by interviewees (Table 2). I wonder why these eight practices have been added to the final suggested best practices for universities (Figure 2). For instance, the "Process Management office" is among the bassline practices, but it is not among the practices reported in Table 2.

• Response:  Thank you for point this gap. We clarify this table as well as the ITG mechanisms that emerged from the exploratory study.

• On page 10, line 25, a guideline has been offered. However, it is not clear how these practices have been selected and recommended as a guideline for the implementation of ITG mechanisms at universities.

 Response:  Thank you very much for your opinion. In the section, we clarify how these practices have been recommended since it is qualitative study, we present with more details the guideline.

• It would be helpful if the authors provide more information regarding the universities and countries that are picked for the evaluation. For example, how many universities used for evaluation, and why those universities/countries have been selected?

 Response:  Thank you for your opinion. Due the length of the paper, in the first version, we did not include, in this version we added more details about universities in the evaluation section.

• It should be noted along with industry; culture also influences IT governance. Thus, it would be helpful if the authors explain how they did control the role of culture. For example, the authors mention that (page 10 line 18): "The proposed ITG mechanisms baseline for universities is useful mainly for developing countries." I wonder what the rationality is behind this claim. Because not all universities picked for this study are located in a developing country.

 Response:   Thank you your comment.  We clarified, that from our point of view, the baseline may be applied to all universities. However, it is not a “silver bullet” for university IT governance implementation.  Of course, some particular mechanisms may have to be attuned to each university's context. Our statement was a quite confused, we would argue that mainly developing countries could take more advantage in this baseline, since the level of ITG maturity in these countries is low with few studies about the topic.To the author’s best knowledge, the proposed model can be useful to help universities to implement ITG or even to shape their actual IT governance model, however it is conceivable that the proposed model would not solve all problem of universities IT governance, but it could be a good starting point. Furthermore, change is a constant and the effective ITG implementation at universities always depends on the human resources, time, management's support, ITG maturity level, among others.

• In the discussion section (page 12), the authors explain IT governance archetype of the cases. While the IT governance archetype is an important aspect in the structural mechanism configuration, I wonder if the IT archetype was also captured during the data collection. If so, it would be helpful if the authors report the IT archetype of the cases.

 Response:  We included the Table 2 with the information about universities as well as the IT archetype of the cases. Due to length in the first version of article, the authors did not add in-depth details. However, in this version, more information is provided about the process.

Minor comments

• The claim regarding De Haes and Van Grembergen (2009) 's work on page 10, Line 8 is misleading. De Haes and Van Grembergen (2009) identify the best practices for the banking industry in Belgium, not all the industries in Belgium.

 Response: We corrected this issue. Thank you for the call.

• Page 10, Line 22 is referring to Table 3. However, I believe it means Figure 2.

 Response:  Thank you for pointing this gap. We corrected this reference. Thank you for the call.

In addition, we reviewed entirely the English in the article as well as the references.

References:

Almeida, R., Pereira, R., and da Silva, M.M. 2013. "It Governance Mechanisms: A Literature Review," International Conference on Exploring Services Science: Springer, pp. 186-199.

De Haes, S., and Van Grembergen, W. 2009. "An Exploratory Study into It Governance Implementations and Its Impact on Business/It Alignment," Information Systems Management (26:2), pp. 123-137.

Gregory, R.W., Kaganer, E., Henfridsson, O., and Ruch, T.J. 2018. "It Consumerization and the Transformation of It Governance," Mis Quarterly (42:4), pp. 1225-1253.

Jafarijoo, M., and Joshi, K. 2020. "It Governance: Review, Synthesis, and Direction for Future Research," in: GITMA 2020 Proceedings. p. 124.

Weill, P., and Ross, J.W. 2004. It Governance: How Top Performers Manage It Decision Rights for Superior Results. Harvard Business Press.

Wu, S.P.-J., Straub, D.W., and Liang, T.-P. 2015. "How Information Technology Governance Mechanisms and Strategic Alignment Influence Organizational Performance: Insights from a Matched Survey of Business and It Managers," MIS Quarterly (39:2), pp. 497-518

Reviewer 2 Report

The article investigates the role of information technology governance for higher education. The authors argue that understandign which are the right ITG mechanisms is a complex task. To this end they build on a design science research approach which developes a baseline with advised mechanisms for the univesrity sector. Eight new mechanisms emerge from this study and is assessed through a group of experts.

Overall the article is very well written and presents a very interesting topic. The paper is in a goo shape but needs some minor changes. First, please try to use less paragraphs tin the introduction and more focused ones.

In the background section, I would argue that it is important to make some mention to information/data governance, since more and more organizations need to develop mechanisms for handling the data artifact which is part of the IT governance. For instance there is some very itneresting work from Tallon et al., (2013), and empirical work from Mikalef et al., (2018, 2020) documenting the effects of information governance on performance measures.

You should also present a section with the theoretical and practical implications of your work.

Tallon, P. P., Ramirez, R. V., & Short, J. E. (2013). The information artifact in IT governance: toward a theory of information governance. Journal of Management Information Systems, 30(3), 141-178.

Mikalef, P., Boura, M., Lekakos, G., & Krogstie, J. (2020). The role of information governance in big data analytics driven innovation. Information & Management, 57(7), 103361.

Mikalef, P., Boura, M., Lekakos, G., & Krogstie, J. (2018). Complementarities between information governance and big data analytics capabilities on innovation. In proceedings of the European Conference on Information Systems (ECIS).

Author Response

Dear Reviewer 2,

Thank you for your review of our paper. We have answered each of your points below.

The article investigates the role of information technology governance for higher education. The authors argue that understandign which are the right ITG mechanisms is a complex task. To this end they build on a design science research approach which developes a baseline with advised mechanisms for the univesrity sector. Eight new mechanisms emerge from this study and is assessed through a group of experts.

 Response:  We much appreciated the comment. 

Overall the article is very well written and presents a very interesting topic. The paper is in a goo shape but needs some minor changes. First, please try to use less paragraphs tin the introduction and more focused ones.

Response:  We much appreciated the comment. We review the introduction to become more focused. Introduction section was tuned to be more precise on why to study ITG in university context.

In the background section, I would argue that it is important to make some mention to information/data governance, since more and more organizations need to develop mechanisms for handling the data artifact which is part of the IT governance. For instance there is some very itneresting work from Tallon et al., (2013), and empirical work from Mikalef et al., (2018, 2020) documenting the effects of information governance on performance measures.

Response:  We much appreciated the comment.  We included more information and mention about data governance as well as included the references suggested below. Thanks for this interesting perspective about the topic.

You should also present a section with the theoretical and practical implications of your work.

Response:  Thank you for your comment. In the first version of the article, we had already the Section 7.1 Contributions with the Theoretical contributions and Practical contributions of this study We agree with your opinion and we reinforce theoretical and practical implications in these sections. 

In addition, we review all the references and the english.

Tallon, P. P., Ramirez, R. V., & Short, J. E. (2013). The information artifact in IT governance: toward a theory of information governance. Journal of Management Information Systems, 30(3), 141-178.

Mikalef, P., Boura, M., Lekakos, G., & Krogstie, J. (2020). The role of information governance in big data analytics driven innovation. Information & Management, 57(7), 103361.

Mikalef, P., Boura, M., Lekakos, G., & Krogstie, J. (2018). Complementarities between information governance and big data analytics capabilities on innovation. In proceedings of the European Conference on Information Systems (ECIS).