IT Governance, Ethics and Technology Management

Introduction

Information technology is no longer merely an operational support function. It influences how organisations create value, protect information, serve customers, comply with law, and manage environmental and social responsibilities. Consequently, business graduates must understand not only how technology works, but also how it should be governed and used responsibly.

IT governance is the system by which an organisation directs and controls information technology. It connects technology decisions with organisational objectives, assigns accountability, manages risk, measures performance, and ensures compliance. Technology management is the practical process of planning, acquiring, implementing, operating, renewing, and retiring technology assets and services.

Ethics provides principles for deciding what ought to be done, while governance establishes authority, policies, processes, and controls to make responsible behaviour consistent. Legal compliance is necessary but does not always guarantee ethical conduct. For example, an organisation may legally collect customer data while still using it in ways that customers would consider unfair or unexpected.

Learning Objectives

After studying this chapter, students should be able to:

1. Explain privacy, intellectual property, accessibility, sustainability, and responsible technology use.
2. Describe IT governance, policies, internal controls, and compliance.
3. Apply ethical reasoning to technology-related decisions.
4. Evaluate technology alternatives using cost, risk, lifecycle, and vendor criteria.
5. Recommend governance and technology-management practices for a business situation.

1. Ethical Foundations of Information Technology

1.1 Privacy and personal data

Privacy is the individual’s ability to control information about themselves and to participate meaningfully in decisions about its collection, use, disclosure, and retention. Personal data includes information that identifies, or can reasonably be linked to, a person. Examples include names, identification numbers, location records, purchase histories, biometric data, and online identifiers.

Privacy is broader than secrecy. A customer may willingly provide an address for delivery but not expect it to be sold to advertisers. Responsible data management therefore requires:

• Purpose limitation: collect data for specified and legitimate purposes.
• Data minimisation: collect only what is reasonably necessary.
• Transparency: explain what is collected, why, and with whom it is shared.
• Choice and control: provide appropriate consent, access, correction, and deletion mechanisms.
• Security: protect information against unauthorised access, alteration, disclosure, or loss.
• Retention control: delete or anonymise data when the legitimate purpose ends.
• Accountability: assign responsibility and maintain evidence of compliance.

Privacy risk increases when datasets are combined. Individually harmless data, such as approximate location and purchasing time, may identify a person when linked with other records. Anonymisation attempts to remove identifying links, whereas pseudonymisation replaces direct identifiers with codes but does not eliminate all re-identification risk.

A privacy impact assessment is a structured examination of how a proposed system will affect individuals. It should identify data flows, purposes, risks, affected groups, controls, retention periods, and residual risks before implementation.

1.2 Intellectual property

Intellectual property (IP) consists of legally protected creations and identifiers. Important categories include:

Owning a physical copy of software does not necessarily confer ownership of its code or unrestricted rights to copy it. A licence may limit installation, users, modification, redistribution, or commercial use. Open-source software is not automatically free of obligations. Licences may require attribution, disclosure of modifications, or distribution under the same licence.

Businesses should maintain software inventories, verify licence conditions, respect copyright, document ownership of employee-created work, and conduct due diligence on third-party components. Using unauthorised software can create legal liability, security vulnerabilities, reputational damage, and unexpected operational costs.

1.3 Accessibility and inclusion

Accessibility means designing technology so that people with diverse physical, sensory, cognitive, and learning abilities can use it effectively. It includes screen-reader compatibility, keyboard navigation, sufficient colour contrast, captions, alternative text for images, clear language, adjustable text size, and accessible authentication processes.

Accessibility differs from usability, although they overlap. Usability concerns how easily a target user can achieve a goal; accessibility specifically addresses barriers experienced by people with disabilities. Inclusive design considers diverse users from the beginning rather than adding expensive adaptations after deployment.

Accessibility is an ethical, social, and often legal responsibility. It also improves products for the broader population: captions help people in noisy environments, keyboard access helps power users, and clear interfaces reduce errors for everyone.

1.4 Sustainability

Technology has environmental and social impacts across its lifecycle. Manufacturing consumes minerals, energy, water, and labour; operation consumes electricity; disposal creates electronic waste. Sustainability therefore requires considering the complete lifecycle rather than only the purchase price.

Relevant practices include energy-efficient infrastructure, equipment repair and reuse, responsible procurement, longer replacement cycles, renewable energy where feasible, secure refurbishment, certified recycling, and reduction of unnecessary printing and travel. Cloud computing may improve utilisation through shared infrastructure, but it is not automatically sustainable: energy sources, workload design, data retention, and provider practices matter.

Sustainability also includes social dimensions such as safe working conditions, responsible mineral sourcing, fair labour practices, and avoiding technology that excludes disadvantaged communities.

1.5 Responsible technology use

Responsible use means applying technology in ways that respect rights, safety, fairness, accountability, and human welfare. Important risks include surveillance without meaningful notice, discriminatory automated decisions, insecure systems, addictive design, misinformation, and inappropriate use of artificial intelligence.

A responsible-use assessment asks:

1. Who may benefit and who may be harmed?
2. Is the purpose legitimate and proportionate?
3. Is the system accurate enough for its consequences?
4. Can affected people understand, challenge, or appeal decisions?
5. Is human oversight meaningful rather than merely symbolic?
6. Are security, privacy, accessibility, and sustainability addressed?

Artificial intelligence requires particular care because training data may contain bias, outputs may be incorrect, and responsibility can become unclear. Human review is essential for high-impact decisions such as recruitment, credit, healthcare, discipline, or access to essential services. Organisations should document model purpose, data sources, testing, limitations, monitoring, and escalation procedures.

2. IT Governance

2.1 Meaning and purpose

IT governance is the framework of leadership, decision rights, accountability, processes, and controls used to ensure that technology supports organisational goals. Governance answers questions such as:

• Who approves technology investments?
• Which risks are acceptable?
• Who owns important data and systems?
• How is performance measured?
• How are legal and ethical obligations monitored?

Governance is distinct from management. Governance sets direction, priorities, accountability, and oversight. Management plans and executes activities within that direction. A board may govern cybersecurity risk appetite, while management implements access controls and incident procedures.

2.2 Governance principles

Effective governance generally involves:

• Strategic alignment: technology investments support business strategy.
• Value delivery: expected benefits are defined and realised.
• Risk optimisation: threats and opportunities are evaluated consistently.
• Resource stewardship: people, money, data, and infrastructure are used responsibly.
• Performance measurement: outcomes are monitored using meaningful indicators.
• Accountability: decision rights and ownership are explicit.
• Transparency: important assumptions, risks, and decisions are documented.

Governance frameworks such as COBIT, IT service-management practices, and information-security standards provide structured guidance. They should be adapted to organisational size, sector, risk profile, and regulatory environment rather than copied mechanically.

2.3 Policies, procedures, and standards

A policy is an authoritative statement of required principles or behaviour. A standard specifies mandatory technical or operational requirements. A procedure describes the steps for performing an activity. A guideline offers recommended but generally non-mandatory advice.

For example, an acceptable-use policy may prohibit unauthorised software installation. A standard may require multi-factor authentication for remote access. A procedure may explain how an employee requests access. Confusing these levels produces unclear accountability and inconsistent enforcement.

Useful policies include information classification, privacy, acceptable use, access management, backup, incident response, business continuity, records retention, procurement, remote work, and artificial-intelligence use. Policies should have an owner, approval authority, scope, review date, exception process, and consequences for non-compliance. Training is necessary because publication alone does not create understanding.

3. Controls, Risk, and Compliance

3.1 Internal controls

A control is a measure designed to prevent, detect, correct, or deter an unwanted event. Controls may be:

• Preventive: stop an event before it occurs, such as access restrictions.
• Detective: identify an event, such as audit-log review.
• Corrective: restore or repair, such as backup recovery.
• Directive: encourage desired behaviour, such as training and policy.

Controls may also be administrative, technical, or physical. Separation of duties is a key administrative principle: no single person should control all stages of a sensitive transaction. For example, one employee may prepare a payment while another approves it.

Controls must be proportionate. Excessive controls can obstruct legitimate work, encourage workarounds, and increase cost. Weak controls expose the organisation to fraud, outages, privacy breaches, and regulatory penalties.

3.2 Risk management

Risk is the possibility that uncertainty will affect objectives. A practical risk process identifies assets, threats, vulnerabilities, consequences, likelihood, existing controls, and treatment options.

A simple prioritisation model is:

Likelihood and impact must be defined on consistent scales, such as 1 to 5. The score is a prioritisation aid, not a precise probability of loss. It assumes that the scales are meaningful and that multiplication is suitable for the organisation’s decision purpose.

Risk responses include:

• Avoid: discontinue the risky activity.
• Reduce: implement controls to lower likelihood or impact.
• Transfer: shift some consequences through insurance or contracting.
• Accept: consciously retain the risk within approved tolerance.

Residual risk is the risk remaining after controls. Acceptance should be made by an authorised owner, not silently created by inaction.

3.3 Compliance and assurance

Compliance means meeting applicable laws, regulations, contracts, standards, and internal requirements. Requirements differ by industry and jurisdiction, so organisations should consult qualified legal and compliance professionals. Common compliance concerns include privacy, financial reporting, cybersecurity, electronic transactions, records retention, accessibility, employment, and intellectual property.

Compliance is supported by evidence: access reviews, training records, risk assessments, change approvals, incident logs, supplier assessments, and audit reports. An audit tests whether controls are appropriately designed and operating effectively. Certification may provide assurance, but certification does not eliminate all risk or guarantee ethical behaviour.

4. Technology Management and Investment Decisions

4.1 Total cost of ownership

The purchase price is only one component of technology cost. Total cost of ownership (TCO) includes acquisition, implementation, integration, training, support, upgrades, security, downtime, migration, and disposal.

The categories must be defined consistently and measured over the same period. For alternatives with different lifespans, annualised cost or present-value analysis may be more appropriate. A simple average annual cost is:

This measure ignores the time value of money and should not be treated as a full financial appraisal.

Worked example. A system has an acquisition cost of $40,000, implementation cost of $15,000, operating cost of $12,000 per year for three years, and disposal cost of $2,000.

TCO = $40,000 + $15,000 + (3 × $12,000) + $2,000 = $93,000.

Average annual cost = $93,000 ÷ 3 = $31,000 per year. The organisation should also assess benefits, risks, tax effects, financing, and service quality before deciding.

4.2 Lifecycle management

Technology passes through stages: planning, selection, design, acquisition, implementation, operation, maintenance, renewal, and retirement. Lifecycle management prevents obsolete, unsupported, or insecure assets from remaining unnoticed.

A lifecycle register should record asset owner, location, supplier, version, dependencies, support status, renewal date, data classification, and disposal method. Retirement must include data migration, secure deletion, contract closure, licence termination, and environmentally responsible disposal.

Projects should define expected benefits and measurable outcomes. Benefits may include reduced processing time, improved customer satisfaction, lower error rates, stronger compliance, or reduced operating cost. Post-implementation review compares actual outcomes with the business case and records lessons for future investments.

4.3 Vendor and outsourcing evaluation

Vendor selection should consider more than price. Important criteria include:

A weighted scoring model can make evaluation transparent:

Weights should sum to 1, and ratings must use a defined scale. The model assumes criteria are sufficiently independent and that weighted addition is a reasonable approximation. It supports judgement; it does not replace due diligence.

Contracts should address confidentiality, data ownership, location, breach notification, service levels, business continuity, subcontracting, audit, intellectual property, price changes, data portability, and secure deletion. Vendor concentration is a strategic risk: excessive dependence on one supplier may reduce bargaining power and make failure difficult to manage.

5. Applied Case: Selecting a Customer-Service Platform

This is an illustrative case. BrightCall, a medium-sized service company, plans to replace spreadsheets and email with a cloud customer-service platform.

Background and problem

Customer records are duplicated, support responses are slow, and managers cannot reliably measure service quality. The proposed platform will store names, contact details, service histories, and recorded communications. Three vendors offer broadly similar features.

Analysis

The selection team identifies privacy, accessibility, integration, availability, subscription escalation, vendor lock-in, and data-export risks. It classifies customer records as confidential and requires role-based access, multi-factor authentication, encryption, audit logs, retention controls, and documented breach procedures. Because customers with disabilities use the service, accessibility is included as a scored requirement rather than an optional feature.

The financial analysis includes subscription charges, migration, training, integration, support, and exit costs. The team asks vendors to demonstrate deletion and export rather than relying on written claims. Legal and procurement staff review data-processing terms and subcontractors.

Approach and solution

The organisation establishes a steering committee consisting of the service manager, IT manager, privacy officer, finance representative, and user representatives. It uses weighted criteria: functional fit 25%, security and privacy 25%, lifecycle cost 20%, integration 10%, accessibility 10%, and vendor resilience 10%. A pilot is conducted with non-sensitive data, followed by user testing and an accessibility review.

The chosen contract includes service levels, incident notification, data portability, audit rights, price protections, continuity obligations, and secure deletion at termination. A phased deployment is used, with staff training and a post-implementation review after three months.

Outcome

The platform reduces duplicate records and improves response tracking. However, the review identifies that some staff created informal workarounds because the approval process was slow. BrightCall revises procedures, improves training, and monitors access logs and service indicators. The case demonstrates that successful technology management requires governance, not simply procurement.

Learning points

1. Requirements must include ethical, security, accessibility, and lifecycle concerns.
2. TCO includes transition and exit costs.
3. Vendor claims require evidence and testing.
4. Governance must continue after implementation.
5. User participation improves adoption and reveals hidden risks.

6. Challenges and Contemporary Issues

Technology governance faces several persistent challenges. Rapid innovation can outpace policy development. Cloud and platform services may obscure where data is processed and who controls it. Remote work expands the attack surface. Automated systems can make decisions at scale without adequate explanation. Global supply chains complicate accountability for labour, environmental effects, and software components.

Organisations should therefore adopt adaptable policies, continuous monitoring, risk-based controls, supplier oversight, and periodic review. They should maintain an inventory of systems and data, test incident and continuity plans, conduct independent assurance, and provide safe channels for reporting ethical concerns.

Good governance also recognises power differences. Customers, employees, contractors, and communities may have limited ability to refuse surveillance or negotiate data practices. Ethical decision-making must therefore consider fairness, vulnerability, proportionality, and the distribution of benefits and harms—not merely formal consent.

Chapter Summary

IT governance aligns technology with organisational objectives through decision rights, accountability, risk management, controls, performance measurement, and compliance. Ethical technology management requires respect for privacy, intellectual property, accessibility, sustainability, and human welfare. Policies, standards, procedures, and guidelines translate principles into expected behaviour, while preventive, detective, corrective, and directive controls support reliable operation.

Technology decisions should consider total cost of ownership, risk, benefits, lifecycle obligations, accessibility, sustainability, security, and vendor resilience. Vendor evaluation must address contracts, data ownership, portability, continuity, subcontractors, and exit arrangements. Responsible use of artificial intelligence and other technologies requires transparency, human oversight, monitoring, and mechanisms for challenge. Effective governance is continuous: it begins before acquisition and continues through operation, review, renewal, and retirement.

Key Terms

Privacy: Control over the collection, use, disclosure, and retention of personal information.

Personal data: Information that identifies or can reasonably be linked to an individual.

Intellectual property: Legally protected creations, inventions, identifiers, and confidential knowledge.

Copyright: Protection for original expression such as software, text, and graphics.

Licence: Permission defining how intellectual property may be used.

Accessibility: Ability of people with diverse abilities to use technology effectively.

Sustainability: Management of environmental, social, and economic impacts across a technology lifecycle.

Responsible technology use: Technology use that respects rights, safety, fairness, accountability, and welfare.

IT governance: Direction and control of technology through authority, accountability, processes, and oversight.

Policy: An authoritative statement of required principles or behaviour.

Standard: A mandatory technical or operational requirement.

Procedure: Ordered steps for performing an activity.

Internal control: A measure designed to prevent, detect, correct, or direct behaviour.

Risk: The effect of uncertainty on objectives.

Residual risk: Risk remaining after controls are applied.

Compliance: Meeting applicable laws, regulations, contracts, standards, and internal requirements.

Total cost of ownership: The complete cost of acquiring, operating, transitioning, and retiring technology.

Lifecycle management: Planning and controlling technology from selection through disposal.

Vendor due diligence: Investigation of a supplier’s capability, risk, security, and contractual position.

Data portability: The ability to retrieve and transfer data in a usable form.

Review Questions

Short Answer Questions

1. What is the difference between privacy and data security?
2. Distinguish a policy, standard, and procedure.
3. What is residual risk?
4. Why is accessibility relevant to technology design?
5. Name four components of total cost of ownership.

Long Answer Questions

1. Explain how IT governance differs from IT management and describe why both are necessary.
2. Discuss the ethical and operational importance of privacy, data minimisation, and retention control.
3. Explain the major categories of intellectual property relevant to business technology.
4. Describe how internal controls support compliance and risk management.
5. Develop a vendor-evaluation framework for a cloud business application.

Analytical / Application Questions

1. A proposed employee-monitoring system is legally permitted but collects continuous location data. Analyse the privacy, ethical, proportionality, and governance issues and recommend safeguards.
2. Compare two technology proposals using acquisition cost, operating cost, security, accessibility, sustainability, vendor resilience, and exit risk. Explain why the lowest purchase price may not be the best choice.
3. Design a lifecycle and control plan for retiring an outdated system that contains confidential customer information.

Multiple Choice Questions with Answers

Question 1

Which statement best describes IT governance?

A. The technical installation of computer hardware

B. The direction and control of IT through accountability, decisions, and oversight

C. The daily coding activities of software developers

D. The replacement of all manual business processes

Correct Answer: B. The direction and control of IT through accountability, decisions, and oversight

Question 2

Which practice best reflects data minimisation?

A. Collecting every possible customer detail

B. Keeping all data indefinitely

C. Collecting only data necessary for a specified purpose

D. Selling data to finance system costs

Correct Answer: C. Collecting only data necessary for a specified purpose

Question 3

Which is an example of a preventive control?

A. Reviewing an incident after it occurs

B. Restoring data from backup

C. Blocking unauthorised access with authentication

D. Writing an incident report

Correct Answer: C. Blocking unauthorised access with authentication

Question 4

A system costs $20,000 to acquire, $10,000 to implement, $8,000 per year for two years, and $2,000 to retire. What is its TCO?

A. $40,000

B. $48,000

C. $50,000

D. $58,000

Correct Answer: C. $50,000

Question 5

Which intellectual-property category most directly protects original software code?

A. Copyright

B. Trademark

C. Patent in every case

D. Trade tariff

Correct Answer: A. Copyright

Question 6

What is the main purpose of a privacy impact assessment?

A. To calculate employee salaries

B. To identify and address privacy risks before implementation

C. To guarantee that a system never fails

D. To eliminate the need for security controls

Correct Answer: B. To identify and address privacy risks before implementation

Question 7

Which vendor criterion addresses the ability to leave a supplier without losing usable information?

A. Data portability and exit planning

B. Logo design

C. Office location alone

D. Advertising expenditure

Correct Answer: A. Data portability and exit planning

Question 8

Which statement about sustainability is most accurate?

A. Sustainability concerns only electricity consumption during use

B. Cloud services are always sustainable

C. Sustainability considers environmental and social impacts across the lifecycle

D. Sustainability is unrelated to procurement

Correct Answer: C. Sustainability considers environmental and social impacts across the lifecycle

Question 9

A risk score calculated as likelihood multiplied by impact is best understood as:

A. A guaranteed financial loss

B. A prioritisation aid based on defined scales

C. A legal judgement

D. A replacement for management judgement

Correct Answer: B. A prioritisation aid based on defined scales

Question 10

Why is human oversight important in high-impact AI decisions?

A. AI systems are always unbiased

B. Human review can identify errors, unfairness, and inappropriate outcomes

C. It removes the need for documentation

D. It guarantees that predictions are correct

Correct Answer: B. Human review can identify errors, unfairness, and inappropriate outcomes