Governance, Ethics, Sustainability and Future Developments

Introduction

Information technology costing, budgeting and procurement are no longer limited to obtaining hardware and negotiating software prices. Contemporary organisations acquire cloud platforms, artificial intelligence (AI) services, managed security, data services, infrastructure, professional services and integrated digital ecosystems. These decisions create legal, ethical, environmental and strategic consequences that may continue for many years after a contract is signed.

Governance provides the structures through which technology decisions are directed, controlled and reviewed. Ethics addresses whether decisions are fair, honest, responsible and respectful of affected stakeholders. Sustainability considers the long-term environmental, social and economic effects of technology ownership and use. Procurement connects these principles to suppliers, contracts, payment mechanisms and operational performance.

A technically attractive purchase may be unacceptable if it exposes personal data to an unauthorised jurisdiction. A low-cost cloud contract may become expensive because of data egress charges, switching costs or service dependency. An AI service may improve productivity while introducing discrimination, opaque decision-making or uncontrolled disclosure of confidential information. Consequently, IT cost management must evaluate not only price, but also risk-adjusted value and organisational accountability.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the relationship between governance, ethics, sustainability and IT procurement.
2. Design approval rights, segregation of duties and audit trails for technology expenditure.
3. Evaluate compliance, conflicts of interest, fraud, data sovereignty, cybersecurity and third-party risk.
4. Develop sustainable procurement criteria and assess their financial implications.
5. Analyse composable platforms, AI services, green IT and outcome-based contracts.
6. Apply governance principles to a complex technology procurement decision.

1. Governance as a Decision and Accountability System

IT governance is the system by which an organisation ensures that technology supports strategy, creates value, manages risk and uses resources responsibly. It is broader than an approval committee. Effective governance defines who may decide, what evidence is required, how exceptions are handled, and how outcomes are monitored.

A useful governance chain is:

Strategic need → business case → sourcing decision → approval → contract → delivery assurance → benefits review → audit and learning

Governance should distinguish three related questions:

• Value: Will the investment contribute to organisational objectives?
• Risk: What could prevent the expected value or cause harm?
• Accountability: Who has authority and responsibility for the decision and its consequences?

A governance framework commonly contains the following bodies and roles:

1.1 Approval rights and decision thresholds

Approval rights should be based on value, risk and strategic significance rather than price alone. A modest contract involving sensitive health data may require more scrutiny than a larger purchase of standard office equipment. A decision matrix can combine financial thresholds with risk triggers.

For example, a policy may require:

• business-owner approval for operational purchases within an authorised budget;
• finance review where the purchase creates a new recurring commitment;
• legal, privacy and security review where regulated or confidential data is involved;
• executive approval for strategic platforms, material supplier dependency or multi-year commitments; and
• board or committee approval for investments exceeding the organisation’s defined materiality threshold.

Approval must not be confused with ownership. The person who approves expenditure should not be the sole person who creates the supplier, authorises receipt and releases payment.

1.2 Segregation of duties

Segregation of duties reduces the opportunity for error and fraud. At minimum, four activities should be distinguished:

1. requesting or designing the requirement;
2. selecting or contracting with the supplier;
3. confirming that goods or services were received; and
4. approving payment.

Small organisations may not have enough staff for complete separation. In that case, compensating controls include independent review, automated workflow, periodic supplier-master-file checks and post-payment audit.

1.3 Audit trails

An audit trail is a reliable chronological record of actions, evidence and approvals. For a major procurement, it should show the original need, alternatives considered, evaluation criteria, bids received, conflicts declared, approvals, contract changes, invoices, performance evidence and closure decision.

An effective audit trail has five properties:

• Completeness: material events are recorded.
• Integrity: records cannot be altered without detection.
• Attribution: each action is linked to an identifiable person or system account.
• Timeliness: records are created close to the event.
• Retrievability: authorised reviewers can locate evidence efficiently.

Digital signatures, immutable logs, version control and retention schedules can strengthen auditability. However, logging excessive personal data may create privacy risks; audit design must therefore follow data-minimisation principles.

2. Ethics, Compliance and Responsible Procurement

Compliance asks whether an action meets applicable law, regulation, policy and contract. Ethics asks whether it is responsible and justifiable, including where the law is silent. A procurement process can be technically compliant yet ethically questionable if it manipulates competition, disadvantages smaller suppliers without justification or hides material limitations from decision-makers.

Important ethical principles include:

• Integrity: decisions are honest and evidence-based.
• Fairness: suppliers receive equal and relevant information.
• Transparency: criteria and material decisions can be explained.
• Accountability: named individuals own decisions and consequences.
• Proportionality: controls and obligations are appropriate to risk.
• Respect for persons: privacy, dignity, accessibility and labour rights are considered.
• Sustainability: present benefits do not impose unreasonable future costs or harms.

2.1 Conflicts of interest

A conflict of interest occurs when personal, financial, family or other relationships could influence—or appear to influence—a professional decision. A conflict is not automatically misconduct, but failure to disclose and manage it is a governance failure.

A sound policy requires personnel to:

1. declare actual, potential or perceived conflicts before participating;
2. record the declaration in a conflict register;
3. obtain an independent decision on mitigation;
4. withdraw from affected evaluation or approval where appropriate; and
5. update the declaration if circumstances change.

Mitigation may include reassignment, independent scoring, additional review or exclusion from the process. Gifts, hospitality, future employment discussions and supplier-sponsored travel require explicit thresholds and disclosure rules.

2.2 Fraud and procurement abuse

Common risks include collusive bidding, bid leakage, supplier-master-file manipulation, false invoices, duplicate payments, contract splitting to avoid approval thresholds, inflated change requests and delivery of inferior goods.

Preventive controls include competitive sourcing, supplier due diligence, independent bid evaluation, purchase-order controls, three-way matching and analytics over unusual transactions. In a basic three-way match, an invoice is compared with the purchase order and evidence of receipt. Exceptions should be investigated rather than automatically paid.

Data analytics can identify duplicate invoice numbers, unusual price changes, repeated awards to one supplier, round-dollar invoices or payments outside normal patterns. Analytics supports investigation; it does not prove fraud. Human review and due process remain necessary.

2.3 Compliance mapping

A compliance register should map each obligation to an owner, control, evidence source, review frequency and escalation route. Relevant obligations may include public procurement rules, competition law, tax requirements, records legislation, accessibility standards, data-protection law, export controls, intellectual-property law, labour standards and sector-specific regulation.

Organisations operating across jurisdictions should avoid assuming that the supplier’s location determines all legal obligations. The location of customers, data subjects, processing activities, infrastructure and decision-makers may all be relevant.

3. Data Sovereignty, Cybersecurity and Third-Party Risk

3.1 Data sovereignty and residency

Data sovereignty refers to the authority of the jurisdiction whose laws govern data. Data residency refers more narrowly to where data is physically or logically stored. These concepts are related but not identical. A service may store data in one country while being controlled by a company subject to another country’s disclosure laws.

A procurement assessment should identify:

• data categories and sensitivity;
• data owner and permitted processing purposes;
• storage, backup and support locations;
• subcontractors and onward transfers;
• government-access and disclosure risks;
• encryption and key-management arrangements;
• retention, deletion and portability rights; and
• evidence available for audit.

Contracts should specify breach notification, assistance with data-subject rights, deletion at termination, audit rights, subprocessor controls and lawful-transfer mechanisms where applicable. “Global cloud” should not be treated as a sufficient sovereignty description.

3.2 Cybersecurity as a procurement requirement

Security should be evaluated before contract award, not added after implementation. Requirements may address identity management, least privilege, multifactor authentication, secure development, vulnerability management, encryption, logging, backup, recovery, incident response and independent assurance.

Security requirements should be risk-based. A system processing public information need not have exactly the same controls as a system processing financial, health or classified information. Nevertheless, all suppliers should demonstrate basic security hygiene and disclose material incidents.

A useful contract structure distinguishes:

• mandatory controls that are conditions of award;
• scored controls that influence supplier evaluation;
• improvement obligations with deadlines; and
• evidence requirements, such as audit reports, test results or attestations.

3.3 Third-party and concentration risk

Third-party risk includes financial failure, cyber compromise, poor service quality, legal non-compliance, geopolitical disruption and dependency on subcontractors. Concentration risk arises when many critical services depend on the same provider, region, identity system or connectivity network.

Risk assessment should cover the entire service chain. A supplier’s certification is useful evidence, but it is not a substitute for understanding the organisation’s own configuration, responsibilities and exposure. Contracts should include service-level commitments, resilience testing, business-continuity obligations, step-in rights where feasible, exit assistance and notification of material ownership or subcontractor changes.

4. Sustainable IT Procurement

Sustainable procurement integrates environmental, social and economic considerations throughout the life cycle of a technology product or service. The relevant life cycle may include raw materials, manufacturing, transport, deployment, energy consumption, maintenance, upgrades, reuse and disposal.

4.1 Environmental dimensions

Important criteria include:

• energy efficiency and renewable-energy sourcing;
• greenhouse-gas emissions across the life cycle;
• product durability, repairability and modularity;
• recycled and responsibly sourced materials;
• packaging and transport impacts;
• water use and hazardous substances;
• equipment reuse, refurbishment and recycling; and
• software efficiency, utilisation and workload scheduling.

A simple life-cycle energy estimate is:

Here, E_total is estimated life-cycle energy, E_embodied is energy associated with manufacture and preparation, P_i is the rated or measured power of component i in kilowatts, t_i is operating time in hours, u_i is the average utilisation or load factor between 0 and 1, E_network is network-related energy, and E_disposal represents end-of-life energy. The result is in kilowatt-hours when power is measured in kilowatts and time in hours. The estimate is only as reliable as its boundaries and data; rated power should not be treated as actual consumption without justification.

For financial evaluation, energy cost can be estimated as:

where C_energy is energy cost in currency units and p_e is the price per kilowatt-hour. This excludes other operating costs unless explicitly included.

4.2 Social and economic sustainability

Social criteria may include modern-slavery prevention, worker safety, fair wages, accessibility, inclusion, responsible mineral sourcing and community effects. Economic sustainability includes maintainability, predictable operating cost, supplier viability and avoidance of premature obsolescence.

Sustainability requirements must be verifiable. A procurement document should identify evidence, such as product environmental declarations, energy measurements, repair-time commitments, workforce policies, audit reports or recognised certification. Vague claims such as “eco-friendly” have little decision value unless defined.

4.3 Total cost and sustainable value

Sustainable choices may have higher purchase prices but lower energy, maintenance, disposal or reputational costs. Conversely, a premium-labelled product may not create value if it is underutilised or difficult to repair. The appropriate comparison is life-cycle value, not purchase price alone.

5. Emerging Procurement Models and Technologies

5.1 Composable platforms

Composable architecture uses modular capabilities that can be assembled, replaced and recombined through standard interfaces. Examples include API-based business services, modular data platforms and independently deployable cloud components.

Advantages include flexibility, faster experimentation and reduced dependence on a single monolithic application. Risks include integration complexity, inconsistent security controls, observability gaps, fragmented contracts and cumulative consumption charges. Procurement must therefore assess interface standards, portability, identity integration, data models, version policy, support boundaries and exit feasibility.

A platform should not be called composable merely because it has many features. Genuine composability requires meaningful modularity, documented interfaces and the practical ability to change components without disproportionate disruption.

5.2 AI services

AI procurement introduces risks concerning data use, model behaviour, intellectual property, bias, explainability, security and accountability. Before acquisition, the buyer should determine:

• whether prompts, inputs or outputs are retained for training;
• where processing occurs and who may access it;
• how confidential or personal information is protected;
• whether outputs may infringe third-party rights;
• how accuracy and harmful failure are tested;
• whether human review is required for consequential decisions;
• how model changes are communicated; and
• how records and explanations will be preserved.

AI contracts should allocate responsibility for testing, monitoring, incident reporting, model updates, audit access and termination. A supplier’s statement that a model is “enterprise grade” is not a measurable control.

A responsible AI business case should compare productivity benefits with validation, governance, integration, training, monitoring and remediation costs. It should also identify use cases where automation is inappropriate because the consequences of error are severe.

5.3 Green IT and sustainable digital operations

Green IT includes efficient data centres, workload optimisation, virtualisation, renewable electricity, equipment life extension and responsible disposal. Software design also matters: inefficient code can increase compute, storage and network demand.

Relevant indicators may include energy per transaction, utilisation rate, equipment life, percentage of refurbished assets, renewable-energy proportion, data-retention volume and emissions per service unit. Metrics need a stable boundary and consistent measurement period. A reduction in energy per transaction may coexist with an increase in total energy if demand grows rapidly; both intensity and absolute consumption should therefore be monitored.

5.4 Outcome-based contracting

Traditional contracts pay for inputs, such as staff hours, licences or infrastructure capacity. Outcome-based contracts link payment or incentives to agreed results, such as reduced processing time, improved availability, increased customer adoption or lower energy use.

Benefits include stronger alignment with business value and greater supplier innovation. Risks include disputes over attribution, measurement manipulation, external influences and incentives to optimise the metric rather than the mission.

A robust outcome contract specifies:

1. the baseline and measurement method;
2. the target and time period;
3. data ownership and verification;
4. the supplier’s controllable contribution;
5. exclusions and force-majeure conditions;
6. payment bands, caps and floors; and
7. remediation and termination rights.

Outcomes should be balanced. For example, a service provider rewarded only for speed may reduce quality or increase security incidents. A balanced scorecard may combine speed, accuracy, user satisfaction, resilience and compliance.

6. Integrated Evaluation and Decision Model

A procurement evaluation can combine financial, strategic, risk, ethical and sustainability dimensions. A weighted model is useful when criteria are sufficiently comparable and weights are agreed before evaluation.

S_j is the total score for option j, w_k is the weight for criterion k, and r_jk is option j’s normalised rating on that criterion. Weights should sum to 1, and ratings must use a defined scale. This model assumes that criteria can reasonably be represented on a common scale and that weighted trade-offs are acceptable. It should not override mandatory pass/fail requirements such as legal or security conditions.

For example, an organisation may weight total cost of ownership at 30%, security at 25%, strategic fit at 20%, sustainability at 15% and supplier resilience at 10%. A supplier failing a mandatory privacy requirement should be excluded even if its weighted score is high.

Risk-adjusted evaluation can supplement scoring. A simplified expected-loss estimate is:

where EL is expected loss, p_l is the estimated probability of loss event l, and i_l is its financial impact. This is a decision aid, not a prediction. Probabilities and impacts are uncertain, and catastrophic low-probability events may require separate treatment rather than simple averaging.

7. Illustrative Case: National Health Service Cloud Procurement

Background

A fictional national health service, MedCore, operates ageing data centres and plans to procure a cloud platform for appointment scheduling, analytics and selected clinical support services. The proposed contract is financially attractive and promises rapid deployment. However, the services will process sensitive personal and health information.

Problem

The initial business case focuses on subscription price and data-centre closure. It does not identify backup locations, subcontractors, AI training practices, exit costs, energy assumptions or responsibility for security configuration. The preferred supplier also offers a free executive workshop to the evaluation team, creating a perceived conflict of interest.

Analysis

MedCore establishes a cross-functional governance group including clinical leadership, finance, procurement, privacy, security, architecture, sustainability and internal audit. The group identifies four decision gates:

1. Need and options: confirm whether cloud, upgraded on-premises infrastructure or a hybrid model best meets requirements.
2. Supplier and contract: assess security, sovereignty, resilience, sustainability, pricing and exit provisions.
3. Implementation readiness: verify identity controls, data classification, logging, backup and staff capability.
4. Benefits and assurance: review actual cost, service quality, incidents, energy performance and portability.

The evaluation excludes any supplier that cannot identify processing and support locations, provide appropriate incident notification, permit independent assurance or support secure deletion. The executive workshop is declined, and all evaluators sign conflict declarations.

Approach and solution

The contract separates restricted clinical workloads from lower-risk public information services. It requires encryption, customer-controlled key options for high-sensitivity data, multifactor authentication, privileged-access monitoring, tested recovery, subprocessor notification and documented exit assistance. AI features are disabled by default until a separate privacy, safety and clinical validation review is completed.

The financial model includes subscription charges, migration, integration, training, network connectivity, backup, data egress, monitoring, security tooling, internal staff and exit preparation. Sustainability requirements include utilisation reporting, renewable-energy disclosures, equipment life-cycle evidence and quarterly energy-performance reporting.

Payments are partly linked to verified availability, recovery performance and successful migration milestones. Availability alone is not sufficient for payment; security and data-integrity requirements remain mandatory.

Outcome

MedCore selects a hybrid design rather than the cheapest full-cloud proposal. The option has a higher first-year cost but reduces sovereignty and concentration risk, improves exit feasibility and provides clearer accountability. After implementation, quarterly reviews identify unexpected data-egress growth, leading to architectural changes and revised workload placement.

Learning points

• The lowest subscription price is not necessarily the lowest total cost.
• Mandatory legal and security requirements should not be diluted by weighted scoring.
• AI functionality requires separate governance from ordinary software features.
• Sustainability must be measured over the life cycle and not inferred from marketing language.
• Contract governance continues after award; it is not completed by signature.

8. Implementation Guidance and Limitations

Organisations seeking to improve governance should begin with an inventory of technology contracts, data flows, critical suppliers, renewal dates and approval rights. They should then identify control gaps and prioritise high-impact services. Policies should be supported by workflow tools, contract repositories, supplier-risk registers and management reporting.

Common implementation failures include excessive bureaucracy, duplicated reviews, poorly defined ownership, reliance on supplier certifications, unrealistic sustainability claims and metrics that reward local optimisation. Governance that delays every decision may encourage shadow procurement and unauthorised software adoption. Controls should therefore be risk-based, automated where possible and periodically tested for usability.

No framework eliminates uncertainty. Risk estimates may be unreliable, supplier disclosures may be incomplete, and sustainability data may use different boundaries. Weighted scoring can create false precision, while audit evidence can confirm process compliance without proving real-world outcomes. Professional judgement, independent challenge and continuous learning remain essential.

Contemporary Direction

Future IT procurement is likely to be shaped by sovereign cloud initiatives, energy and carbon reporting, AI regulation, software supply-chain security, digital product passports, confidential computing, open standards and stronger right-to-repair expectations. Organisations will increasingly need to govern ecosystems rather than individual suppliers.

The strategic capability is not simply negotiating lower prices. It is the ability to connect investment decisions with public trust, resilience, lawful data use, environmental responsibility and measurable organisational outcomes. Mature procurement treats suppliers as accountable participants in a governed operating model while preserving the buyer’s ability to inspect, challenge, change and exit.

Chapter Summary

IT governance establishes decision rights, accountability, risk oversight and evidence requirements across the technology life cycle. Effective controls include approval thresholds, segregation of duties, conflict declarations, supplier due diligence, three-way matching, secure audit trails and independent assurance.

Ethical procurement extends beyond legal compliance by requiring fairness, transparency, integrity, proportionality and respect for affected stakeholders. Data sovereignty requires analysis of jurisdiction, processing locations, subcontractors, access rights and deletion obligations. Cybersecurity and third-party risk must be addressed before contract award and monitored throughout the relationship.

Sustainable procurement evaluates environmental, social and economic effects across the technology life cycle. Energy, emissions, repairability, utilisation, labour conditions and end-of-life management should be supported by verifiable evidence. Composable platforms, AI services, green IT and outcome-based contracts can create strategic value, but they also introduce integration, dependency, measurement and accountability risks.

A mature decision combines total cost of ownership, mandatory compliance conditions, weighted value criteria and risk analysis. Governance is continuous: it begins with the business case and continues through implementation, performance management, renewal, exit and post-contract learning.

Key Terms

Governance: Structures and processes used to direct, control and review organisational decisions.

Segregation of duties: Distribution of incompatible responsibilities among different people or systems.

Audit trail: Chronological evidence showing actions, approvals, decisions and changes.

Conflict of interest: A personal or external interest that could influence, or appear to influence, professional judgement.

Data sovereignty: The authority of a jurisdiction whose laws govern data or its processing.

Data residency: The location where data is stored or processed.

Third-party risk: Risk arising from reliance on external suppliers, subcontractors or service providers.

Concentration risk: Exposure created by excessive dependence on one provider, technology or region.

Sustainable procurement: Acquisition that considers environmental, social and economic life-cycle effects.

Life-cycle assessment: Evaluation of impacts from production through use and disposal.

Green IT: Design, operation and disposal of technology to reduce environmental impact.

Composable platform: A modular technology environment whose capabilities can be assembled and replaced through interfaces.

Outcome-based contract: An agreement linking payment or incentives to verified results rather than inputs alone.

Total cost of ownership: All relevant acquisition, implementation, operation, risk, transition and disposal costs.

Residual risk: Risk remaining after controls are implemented.

Subprocessor: A third party engaged by a supplier to process data or deliver part of a service.

Three-way match: Comparison of purchase order, receipt evidence and invoice before payment.

Responsible AI: Development and use of AI with attention to safety, fairness, privacy, transparency and accountability.

Review Questions

Short Answer Questions

1. What are the main purposes of IT governance in procurement?
2. Why is segregation of duties important in technology purchasing?
3. Distinguish data sovereignty from data residency.
4. Identify four environmental dimensions of sustainable IT procurement.
5. What information should an outcome-based contract define?

Long Answer Questions

1. Explain how approval rights, audit trails and independent assurance work together to reduce procurement risk.
2. Critically evaluate the ethical responsibilities of an organisation procuring AI services.
3. Discuss how cybersecurity and third-party risk should be incorporated into a cloud procurement life cycle.
4. Explain why total cost of ownership may produce a different decision from purchase-price comparison.
5. Compare traditional input-based contracts with outcome-based contracts, including their principal risks.

Analytical / Application Questions

1. An organisation proposes a low-cost global cloud service for sensitive citizen data. Design a due-diligence and contract-control framework addressing sovereignty, security, subcontractors and exit.
2. A supplier receives a high weighted evaluation score but fails a mandatory privacy requirement. Should it be selected? Justify your answer using governance principles.
3. Construct a sustainability evaluation approach for replacing 2,000 employee laptops, including life-cycle criteria, evidence requirements and post-award metrics.

Multiple Choice Questions with Answers

Question 1

Which control most directly prevents one employee from creating a supplier, confirming delivery and authorising payment?

A. Segregation of duties

B. Weighted scoring

C. Carbon reporting

D. Data residency

Correct Answer: A. Segregation of duties

Question 2

Which statement best distinguishes data sovereignty from data residency?

A. Sovereignty concerns governing legal authority, while residency concerns location of storage or processing

B. Sovereignty concerns energy use, while residency concerns supplier profitability

C. Sovereignty concerns software licensing, while residency concerns hardware repair

D. They are identical terms with no practical distinction

Correct Answer: A. Sovereignty concerns governing legal authority, while residency concerns location of storage or processing

Question 3

In the life-cycle energy estimate E_total = E_embodied + ∑(P_i × t_i × u_i) + E_network + E_disposal, what does u_i represent?

A. The electricity price

B. The average utilisation or load factor

C. The number of suppliers

D. The disposal period

Correct Answer: B. The average utilisation or load factor

Question 4

Why should a weighted procurement score not override a mandatory security requirement?

A. Weighted scores can only be used for environmental criteria

B. Mandatory requirements define conditions that must be met regardless of comparative preference

C. Security requirements are always more expensive than other requirements

D. Weighted models cannot include supplier information

Correct Answer: B. Mandatory requirements define conditions that must be met regardless of comparative preference

Question 5

Which practice is most appropriate for managing a declared conflict of interest?

A. Ignore it if the employee believes they are impartial

B. Record it and determine mitigation such as reassignment or independent review

C. Disclose it only after contract signature

D. Allow the employee to score the supplier privately

Correct Answer: B. Record it and determine mitigation such as reassignment or independent review

Question 6

What is a principal risk of a composable platform?

A. It cannot use standard interfaces

B. It may create integration complexity and fragmented accountability

C. It always eliminates supplier dependency

D. It prevents modular replacement

Correct Answer: B. It may create integration complexity and fragmented accountability

Question 7

Which item is most important when procuring an AI service that processes confidential information?

A. The supplier’s marketing slogan

B. Whether inputs are retained or used for model training

C. The colour of the user interface

D. The number of pages in the proposal

Correct Answer: B. Whether inputs are retained or used for model training

Question 8

Which feature best characterises an outcome-based contract?

A. Payment is linked only to staff hours

B. Payment or incentives are linked to verified results

C. The supplier is never measured after award

D. The buyer pays before defining the desired result

Correct Answer: B. Payment or incentives are linked to verified results

Question 9

What does a three-way match compare?

A. Budget, strategy and risk appetite

B. Purchase order, receipt evidence and invoice

C. Energy, emissions and water use

D. Supplier, auditor and regulator

Correct Answer: B. Purchase order, receipt evidence and invoice

Question 10

Why should both energy intensity and absolute energy consumption be monitored?

A. Efficiency improvements can occur while total consumption rises with demand

B. Absolute consumption is unrelated to workload volume

C. Intensity metrics cannot be calculated

D. Energy intensity always increases when total consumption falls

Correct Answer: A. Efficiency improvements can occur while total consumption rises with demand