Proceedings

Enterprise Governance is a relatively new term that refers to the way an organization
is managed. “Enterprise Governance constitutes the entire accountability framework
of the organizations. There are two dimensions of enterprise governance –
conformance and performance that need to be in balance.” This statement captures the
essence of enterprise governance as described by the International Federation of
Accountants (IFAC) in the report “Enterprise Governance – Getting the Balance
Right”.
IT governance is an integral part of enterprise governance, a combined business and
IT issue which requires a business driven approach. According to ISACA, IT
governance has been defined as “the responsibility of the board of directors and
executive management, and consists of the leadership and organizational structures
and processes that ensure that the organization’s IT sustains and extends the
organizations strategies and objectives.” (ISACA, Board Briefing on IT Governance,
2 nd Edition, USA 2003) Furthermore, the implementation of IT governance ensures
that the IT function adds value to the company while balancing risks versus return.
IT governance is a comprehensive term that encompasses IT processes, IT resources,
information, business and legal issues, and all concerns stakeholders, senior
management, process owners, users, auditors and suppliers. A critical path to the
success of IT governance is an effective communication among all parties involved,
based on a common language, constructive relationship and commitment in
addressing the issues. Basically, the IT governance is made of two issues: IT delivers
value to the business and IT risks are mitigated to an acceptable level, which means
the strategic alignment of IT with the business and the establishment of accountability
within the enterprise.
IT governance integrates and institutionalizes best practices and is an enabler for the
company in taking full advantage of its information, thus maximizing benefits,
gaining competitive advantage and exploiting successfully the opportunities.
Business must deal with risks. Risk is an inherent part of business, brought to our
attention as a result of major events occurred over the past years: fraud incidents,
major credit failure, information technology exploits and information flows. In order
to put risk in the proper business context, the Committee of Sponsoring Organization
of the Tradeway Commission (COSO) issued in 2004 the Enterprise Risk
Management Integrated Framework, known as COSO ERM Framework, which
defines risk as follows: “Risk is the possibility that an event will occur and adversely
affect the achievement of an objective”.
According to COSO ERM Framework, the above mentioned process is defined as
follows: “enterprise risk management is a process, effected by an entity’s board of
directors, management, and other personnel, applied in strategy setting and across the
enterprise, designed to identify potential events that may affect the entity and manage
risk to be within its risk appetite, to provide reasonable assurance regarding the
achievement of entity objectives”.
Risk management is not something new to the business world. Several industries,
among them being the financial services, insurance services and the energy
~ 291 ~