15. Doctoral Research and Future Directions in IT Governance

Introduction and Context

IT governance research has moved beyond the design of committees, policies, and control frameworks. Digital infrastructures now shape public administration, markets, scientific work, social interaction, and national security. Cloud platforms, algorithmic decision systems, connected devices, distributed ledgers, quantum computing, and autonomous agents create institutional conditions that earlier governance models did not fully anticipate. Consequently, doctoral research in IT governance must do more than apply established frameworks to new settings. It must question assumptions, generate credible evidence, explain institutional change, and design governance arrangements capable of operating under uncertainty.

The central research problem is not simply how organizations should manage technology. It is how authority, accountability, rights, knowledge, and responsibility should be constituted when technological systems cross organizational and national boundaries. A traditional governance arrangement assumes identifiable decision makers, relatively stable technologies, and traceable chains of command. Autonomous artificial intelligence can distribute decision authority across models, data, developers, deployers, and users. Decentralized systems can separate control from ownership. Geopolitical fragmentation can make common technical standards politically contested. Quantum technologies may alter the assumptions underlying cybersecurity and digital sovereignty.

This chapter examines how doctoral scholars can critique empirical literature and select research paradigms appropriate to these conditions. It also considers the design of qualitative, quantitative, mixed-method, design-science, and engaged studies. The objective is not to prescribe one superior method, but to show how research questions, ontological assumptions, evidence, and claims must fit together. The chapter concludes by identifying research opportunities concerning autonomous AI, quantum technologies, decentralized infrastructures, geopolitical fragmentation, and future digital institutions.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Critique empirical literature in IT governance by evaluating theory, evidence, design, measurement, and limitations.

2. Distinguish major research paradigms and explain their implications for knowledge claims.

3. Design rigorous qualitative, quantitative, mixed-method, design-science, and engaged research studies.

4. Evaluate validity, reliability, credibility, transferability, reflexivity, and research ethics in governance research.

5. Formulate original research questions concerning emerging digital technologies and institutions.

6. Assess practical and scholarly implications of research on future digital governance.

From Framework Adoption to Knowledge Creation

Much IT governance research is organized around recognizable frameworks, including strategic alignment, IT service management, information-security controls, enterprise architecture, risk governance, and technology governance principles. These frameworks are useful objects of study, but their presence does not itself establish governance effectiveness. A doctoral investigation should ask what a framework changes, for whom, under what conditions, and through which mechanisms.

A useful distinction is between descriptive, explanatory, predictive, evaluative, and design-oriented research. Descriptive research maps governance practices, roles, controls, or institutional arrangements. Explanatory research investigates why a governance outcome occurs. Predictive research estimates the likelihood of outcomes such as control failure, policy adoption, or incident escalation. Evaluative research judges whether an intervention achieves specified objectives. Design-oriented research develops and assesses an artifact, method, architecture, or governance mechanism.

The distinction between correlation and governance mechanism is particularly important. A study may find that organizations with stronger executive sponsorship report better digital outcomes. This association does not demonstrate that sponsorship caused the outcome. Executive sponsorship may be a proxy for organizational maturity, financial capacity, regulatory exposure, or leadership competence. Doctoral research should therefore articulate causal mechanisms, rival explanations, boundary conditions, and the level at which the claim operates: individual, team, organization, ecosystem, sector, or state.

Reading Empirical Literature Critically

A rigorous literature review is an argument about the state of knowledge, not a catalogue of publications. It should identify conceptual convergence, theoretical disagreement, methodological weaknesses, neglected populations, and unresolved causal questions. For each important study, the researcher should examine:

• the research question and its alignment with the selected method;
• the theoretical constructs and whether they are clearly distinguished;
• the population, sampling logic, and context;
• the quality and provenance of data;
• the operationalization of abstract concepts such as trust, accountability, resilience, or alignment;
• the treatment of alternative explanations and missing data;
• the relationship between evidence and conclusion; and
• the transferability or generalizability of the findings.

A common weakness in IT governance literature is construct ambiguity. Terms such as digital trust, maturity, agility, resilience, and responsible AI may be used as if their meaning were self-evident. A doctoral researcher should specify whether a construct is an organizational capability, an observable practice, a perception, an outcome, or a normative ideal. Measurement should then reflect that definition.

Another weakness is the use of maturity models as explanatory theories. Maturity models can support assessment and staged improvement, but a higher maturity score does not necessarily cause better performance. Stages may represent idealized progression rather than empirically observed sequences. Researchers should test whether maturity dimensions are formative or reflective, whether stages are genuinely ordered, and whether the model functions consistently across sectors and institutional contexts.

Research Paradigms and Their Consequences

A research paradigm establishes assumptions about reality, knowledge, evidence, and the relationship between researcher and researched. Paradigms do not mechanically determine method, but they influence the kinds of questions considered legitimate and the claims regarded as persuasive.

Post-positivist research treats an external reality as investigable while recognizing that measurement is imperfect and knowledge is provisional. It commonly uses hypotheses, statistical inference, systematic observation, and efforts to control bias. In IT governance, post-positivist studies may examine whether governance capabilities predict cybersecurity performance or whether regulatory pressure influences adoption of controls.

Interpretivist research investigates how actors construct meaning in particular social and institutional contexts. Governance is understood not only as formal authority but also as interpretation, negotiation, symbolism, and practice. Interviews, observation, documents, and discourse analysis are frequently used. An interpretivist study might examine how boards, developers, regulators, and affected communities understand accountability for automated decisions.

Critical research examines power, inequality, exclusion, ideology, and the distribution of benefits and harms. It asks whose interests are embedded in technical standards, procurement rules, data infrastructures, or risk classifications. Critical work may challenge the assumption that efficiency is a neutral governance objective.

Pragmatist research begins with a significant problem and selects methods capable of producing useful, credible knowledge about it. It is compatible with mixed methods, iterative inquiry, and collaboration with practitioners. Pragmatism is not methodological convenience; it requires an explicit account of how different forms of evidence contribute to problem resolution.

Design-science research treats the creation and evaluation of an artifact as a central means of knowledge production. The artifact may be a governance process, decision model, audit protocol, software tool, reference architecture, or institutional mechanism. Design science must contribute more than an implementation report: it should articulate design principles, demonstrate utility, and explain the conditions under which the artifact works.

Paradigm choice should be justified in relation to the research question. A question about the statistical effect of an independent assurance mechanism differs from a question about how assurance professionals negotiate responsibility in practice. Combining paradigms is possible, but philosophical assumptions should not be left implicit.

Designing Credible Doctoral Studies

Qualitative inquiry

Qualitative research is especially appropriate when governance arrangements are emerging, contested, sensitive, or poorly theorized. Case study, grounded theory, ethnography, institutional ethnography, process tracing, and discourse analysis can reveal how policies become practice.

A strong qualitative design specifies case boundaries, unit of analysis, access strategy, participant selection, data sources, analytic procedures, and the logic of comparison. Purposive sampling should seek information-rich variation rather than statistical representativeness. Interviews should not be the sole source of evidence where documents, meeting records, system logs, incident reports, observations, and user accounts can provide triangulation.

Analysis requires more than thematic labelling. Researchers should move from descriptive codes to categories, relationships, mechanisms, and theoretical explanations. Negative cases and disconfirming evidence should be actively examined. Reflexive writing is essential because access, professional identity, institutional affiliation, and the researcher’s assumptions may shape the data.

Quantitative inquiry

Quantitative research can test relationships, estimate prevalence, evaluate interventions, and model risk. Survey research requires careful construct definition, validated or transparently developed measures, appropriate sampling, and attention to common-method bias. Structural equation modelling may be useful where latent capabilities and mediated relationships are theoretically justified. Longitudinal designs are stronger than cross-sectional designs for studying governance change, although panel attrition and time-varying conditions must be addressed.

Causal inference requires design discipline. Randomized experiments may be feasible for training, interface, or decision-support interventions, but often are not appropriate for organization-wide governance reforms. Quasi-experimental strategies, such as difference-in-differences, regression discontinuity, matched comparison, or interrupted time series, can be considered when policy changes create defensible comparison conditions. Predictive accuracy should not be confused with causal explanation, and model performance should be assessed across relevant subgroups.

Researchers should report missing-data treatment, robustness checks, effect sizes, uncertainty, and model assumptions. Statistical significance alone does not establish practical or governance significance. A small effect on a high-volume automated system may be more consequential than a large effect in a low-impact setting.

Mixed-method research

Mixed methods is valuable when the breadth of a phenomenon and the meaning of its operation must both be understood. In an explanatory sequential design, quantitative findings guide qualitative follow-up. In an exploratory sequential design, qualitative inquiry informs instrument development or theory construction. Convergent designs collect different forms of evidence in parallel and integrate them during interpretation.

Integration is the defining feature. A study is not genuinely mixed method merely because it includes a survey and several interviews. The researcher should specify where integration occurs, how conflicting findings will be handled, and what each method contributes that the other cannot provide. Joint displays, case-ordered matrices, and integrated meta-inferences can make this reasoning visible.

Design science and engaged research

Design-science research begins with a relevant governance problem and proceeds through problem diagnosis, artifact design, demonstration, evaluation, and reflection. Evaluation may address functionality, usability, reliability, performance, adoption, fairness, explainability, or institutional fit. For governance artifacts, technical performance is insufficient. An audit tool that improves detection but creates unmanageable review burdens may fail institutionally.

Engaged research involves stakeholders as contributors to problem definition, interpretation, design, or evaluation. Participatory action research, action research, living laboratories, and community-based approaches are useful where affected groups possess essential knowledge or where the aim includes organizational change. Engagement creates obligations concerning representation, informed consent, ownership of outputs, and the distribution of benefits. Stakeholder participation should not be treated as a symbolic endorsement of a predetermined solution.

A Framework for Research Quality

Quality in IT governance research is multidimensional. Internal validity concerns whether a claimed relationship is credible within the study. External validity concerns the scope of transfer or generalization. Construct validity concerns whether the study actually captures the intended concept. Reliability concerns consistency of measurement or procedure. Qualitative studies additionally require credibility, dependability, confirmability, and transferability, supported by practices such as triangulation, audit trails, member reflection, thick description, and reflexivity.

A doctoral proposal should include a chain linking problem, question, theory, design, evidence, analysis, and contribution. The contribution may be theoretical, methodological, empirical, design-oriented, or practical. Claims should be proportionate to evidence. A single case can generate a powerful mechanism or conceptual model, but it cannot automatically establish prevalence. A large survey can identify patterns, but it may not explain how governance is enacted.

Open science practices strengthen credibility where confidentiality permits. These include preregistration, transparent protocols, codebooks, analysis scripts, data-management plans, replication materials, and clear disclosure of deviations from the original design. Sensitive governance data may require controlled access, aggregation, or synthetic release rather than unrestricted publication.

Emerging Objects of Governance Research

Autonomous and generative AI

Autonomous AI shifts governance from controlling a static application to governing an adaptive socio-technical system. Important research questions concern delegation thresholds, human oversight, model autonomy, agent-to-agent interaction, auditability, prompt and tool security, responsibility allocation, and the governance of models that are updated after deployment.

A promising research direction is the study of responsibility gaps. Responsibility may be distributed among model developers, data providers, platform operators, organizational deployers, supervisors, and users. Research should avoid assuming that a human in the loop automatically provides accountability. The human may lack time, expertise, authority, or meaningful ability to override the system. Empirical work should examine actual decision practices, not merely formal policy.

Quantum technologies

Quantum computing creates governance questions before large-scale practical deployment because current cryptographic assumptions may become vulnerable and migration requires long planning horizons. Research can examine post-quantum transition governance, cryptographic asset inventories, supply-chain dependencies, standards coordination, export controls, and national strategies. Quantum sensing and communications also raise questions about dual use, verification, sovereignty, and unequal access to strategic capabilities.

Decentralized systems

Distributed ledgers, decentralized autonomous organizations, decentralized identity, and token-based infrastructures complicate conventional accountability. Code may enforce rules, but code is not equivalent to legitimate governance. Protocol developers, validators, token holders, users, foundations, and regulators may exercise different forms of power. Research should investigate constitutional design, dispute resolution, emergency intervention, concentration of influence, privacy, and the relationship between on-chain rules and off-chain institutions.

Geopolitical fragmentation

Digital governance increasingly reflects competing regulatory regimes, national security priorities, industrial policies, and data-sovereignty claims. Fragmentation can produce duplicated compliance, incompatible standards, restricted data flows, and divergent definitions of trustworthy technology. Comparative research should avoid treating one jurisdiction as the universal benchmark. It should examine how organizations translate, negotiate, or resist conflicting rules across institutional environments.

Future digital institutions

Future digital institutions may include algorithmic regulators, interoperable public digital infrastructures, transnational assurance networks, machine-readable laws, and hybrid human-machine administrative bodies. The key research issue is institutional legitimacy. Efficiency, scalability, and technical reliability do not by themselves establish legitimacy. Research should examine representation, contestability, due process, transparency, rights protection, resilience, and democratic control.

Illustrative Case Study: Governing an Autonomous Public-Service Platform

Background

The following is a fictional illustrative case. Northbridge, a regional public authority, introduces an AI platform to assess applications for housing assistance. The platform classifies applications, requests missing evidence, detects suspected fraud, and prioritizes cases for human review. It uses historical administrative data and connects to several government databases.

Situation and problem

After deployment, processing time falls substantially, but community organizations report that applicants with unstable employment, disabilities, or limited digital access are disproportionately asked for additional evidence. Caseworkers also discover that the system’s confidence score is treated informally as a recommendation, although policy documents describe it only as decision support. Responsibility is unclear: the vendor controls the model, the authority controls deployment, and individual officers approve final decisions.

Analysis

A narrow technical evaluation would examine classification accuracy and processing speed. A governance study must also investigate error distribution, appeal outcomes, data provenance, discretion, organizational incentives, and the lived experience of applicants. The unit of analysis is not only the model; it is the complete decision system comprising data, software, staff, procedures, legal rules, and affected communities.

A mixed-method design would be appropriate. Quantitative analysis could compare approval, delay, request-for-evidence, and appeal rates across relevant groups before and after implementation. Qualitative interviews and observations could examine how caseworkers interpret scores and how applicants experience the process. Document analysis could compare formal policy with actual operating procedures. A design-science component might produce an appeal-and-audit protocol, evaluated through a pilot.

Approach and solution

Northbridge establishes a multidisciplinary governance board with authority to suspend particular uses of the system. It introduces impact monitoring, mandatory reasons for adverse recommendations, an applicant-facing appeal route, periodic independent audits, model-change documentation, and a rule that confidence scores cannot substitute for legally required reasoning. The authority also creates a data-quality remediation process and includes community representatives in review sessions.

Outcome

The fictional case does not claim a universal solution. Its principal outcome is a more defensible governance arrangement: performance is assessed jointly with fairness, explainability, contestability, and institutional accountability. Some automation benefits are retained, while high-impact decisions receive stronger human and procedural safeguards.

Learning points

First, governance research should study the deployment context rather than treating technology as an isolated object. Second, formal human oversight is inadequate if organizational practice converts recommendations into automatic decisions. Third, affected communities are sources of evidence, not merely recipients of governance. Finally, evaluation criteria should be defined before implementation and should include the possibility that the system ought to be redesigned or withdrawn.

Challenges, Ethics, and Common Errors

Emerging-technology research faces access barriers, rapidly changing systems, proprietary data, security restrictions, and difficulty identifying stable populations. Longitudinal research may be undermined by model updates, regulatory changes, or organizational restructuring. Researchers should document version histories and treat technological change as part of the phenomenon rather than simply as noise.

Ethical issues include privacy, surveillance, re-identification, discriminatory impact, informed consent in organizational settings, and the risk that publication may expose vulnerabilities. Governance researchers may encounter confidential incidents or politically sensitive evidence. Data minimization, secure storage, role-based access, impact assessment, and responsible disclosure are essential. Ethics review should consider not only participant risk but also downstream institutional consequences.

Common mistakes include choosing a method before formulating a question, equating compliance with effective governance, relying on executive perceptions alone, using maturity scores without validation, ignoring negative cases, treating AI explainability as a complete accountability mechanism, and making universal claims from a single institutional setting. Another error is normative overreach: researchers may present a preferred governance model as empirically proven when it is actually a value-based proposal.

Best Practices for Doctoral Researchers

A strong doctoral project should:

• define the governance problem in institutional and socio-technical terms;
• distinguish normative arguments from empirical claims;
• make constructs, assumptions, and units of analysis explicit;
• align research questions, paradigm, method, and evidence;
• use multiple data sources where feasible;
• investigate mechanisms, boundary conditions, and rival explanations;
• involve affected stakeholders responsibly;
• predefine evaluation criteria for governance interventions;
• report uncertainty, limitations, and negative findings;
• protect sensitive data and disclose conflicts of interest; and
• connect scholarly contribution to a real governance decision or institutional need.

The most valuable future research will not simply ask whether a technology is safe, efficient, or innovative. It will ask what institutional arrangements make those properties meaningful, who has authority to decide, how affected parties can contest decisions, and how governance can remain legitimate when technological systems evolve faster than formal rules.

Chapter Summary

Doctoral IT governance research requires more than applying established frameworks. It involves critically evaluating empirical literature, clarifying constructs, identifying mechanisms, and matching research questions with defensible paradigms and methods. Qualitative, quantitative, mixed-method, design-science, and engaged approaches each support different forms of knowledge and can be combined when integration is explicit.

Research quality depends on validity, credibility, transparency, reflexivity, ethical conduct, and proportionate claims. Emerging areas such as autonomous AI, quantum technologies, decentralized systems, geopolitical fragmentation, and future digital institutions require socio-technical and institutional analysis. The central challenge is to design governance that is not only technically effective but also accountable, contestable, inclusive, resilient, and legitimate.

Key Terms

Paradigm: A set of assumptions about reality, knowledge, evidence, and inquiry.

Construct: An abstract concept operationalized for research, such as trust or resilience.

Governance mechanism: The process through which an arrangement produces an institutional outcome.

Internal validity: The credibility of a causal or explanatory claim within a study.

External validity: The extent to which findings can transfer or generalize beyond the study setting.

Construct validity: The degree to which measures represent the intended concept.

Reflexivity: Critical examination of how the researcher influences and is influenced by the research.

Triangulation: Use of multiple data sources, methods, researchers, or theories to strengthen interpretation.

Mixed-method research: Inquiry integrating qualitative and quantitative evidence in one study.

Design science: Research that creates and evaluates artifacts to address significant problems.

Engaged research: Inquiry conducted with meaningful participation by practitioners or affected stakeholders.

Causal mechanism: A process explaining how one condition contributes to an outcome.

Maturity model: A structured representation of progressive capability levels.

Responsibility gap: Uncertainty or absence of accountable responsibility within a socio-technical system.

Contestability: The ability of affected parties to question, appeal, or seek review of a decision.

Digital sovereignty: Institutional or national capacity to control critical digital resources and decisions.

Post-quantum governance: Governance of the transition to technologies and controls resilient to quantum threats.

Decentralized governance: Coordination in which authority is distributed across multiple participants or nodes.

Institutional legitimacy: Acceptance of authority as appropriate, justified, and procedurally fair.

Socio-technical system: A system in which technical components and social, organizational, and institutional elements interact.

Review Questions

Short Answer Questions

1. Why is framework adoption alone insufficient to demonstrate effective IT governance?

2. What distinguishes descriptive research from explanatory research?

3. Define construct validity and explain its importance in governance research.

4. Why is integration necessary in mixed-method research?

5. What is meant by a responsibility gap in autonomous AI governance?

Long Answer Questions

1. Compare post-positivist, interpretivist, critical, pragmatist, and design-science paradigms in relation to IT governance research.

2. Explain how a doctoral researcher should critically evaluate empirical literature on IT governance maturity models.

3. Discuss the design requirements of a rigorous qualitative study examining accountability for automated decisions.

4. Explain how geopolitical fragmentation changes the research agenda for digital governance.

5. Evaluate the institutional and ethical requirements for governing future autonomous AI systems.

Analytical / Application Questions

1. Design a mixed-method study to investigate whether an AI-supported public-service system produces unequal outcomes. Specify the research questions, data sources, sampling, analysis, and integration strategy.

2. A decentralized identity network has technically reliable infrastructure but no clear process for resolving disputes or correcting harmful records. Analyze the governance problem and propose a design-science research project.

3. A multinational organization faces conflicting national requirements concerning data localization and AI assurance. Develop a research framework for studying how the organization negotiates these requirements and assessing the legitimacy of its response.

22. Multiple Choice Questions with Answers

Question 1

Which research question is most clearly explanatory rather than descriptive?

A. What governance committees exist in large hospitals?

B. How many organizations have adopted an AI policy?

C. Why do organizations with similar AI policies produce different accountability outcomes?

D. Which countries publish digital governance strategies?

Correct Answer: C. Why do organizations with similar AI policies produce different accountability outcomes?

Question 2

A researcher studies how caseworkers interpret algorithmic recommendations through interviews, observations, and documents. Which paradigm is most directly aligned with this purpose?

A. Interpretivist

B. Post-positivist

C. Experimental

D. Purely predictive

Correct Answer: A. Interpretivist

Question 3

What is the defining feature of mixed-method research?

A. Using a large sample

B. Collecting data only at multiple time points

C. Integrating qualitative and quantitative evidence in interpretation

D. Using statistical software and interview software together

Correct Answer: C. Integrating qualitative and quantitative evidence in interpretation

Question 4

Which action best strengthens causal inference in a study of a new IT governance policy?

A. Using only executive opinions

B. Comparing outcomes over time with a defensible comparison group

C. Increasing the number of policy documents reviewed

D. Replacing all qualitative evidence with prediction

Correct Answer: B. Comparing outcomes over time with a defensible comparison group

Question 5

In design-science research, a governance artifact should be evaluated primarily for which combination?

A. Novelty alone

B. Technical performance only

C. Utility, quality, and fit with the institutional problem

D. Popularity among technology vendors

Correct Answer: C. Utility, quality, and fit with the institutional problem

Question 6

Why can a maturity model not automatically be treated as an explanatory theory?

A. Maturity models cannot contain categories

B. Higher maturity scores do not by themselves establish causal effects or ordered development

C. Maturity models are always qualitative

D. Maturity models cannot be used by public organizations

Correct Answer: B. Higher maturity scores do not by themselves establish causal effects or ordered development

Question 7

In the illustrative Northbridge case, why was measuring classification accuracy alone inadequate?

A. Accuracy is unrelated to technology

B. The platform had no data

C. Governance also required examining unequal impacts, appeals, discretion, and accountability

D. Accuracy can only be measured in laboratories

Correct Answer: C. Governance also required examining unequal impacts, appeals, discretion, and accountability

Question 8

Which issue is most characteristic of quantum-technology governance research?

A. Replacing all organizational controls with blockchain

B. Managing the transition to cryptographic protections resilient to future quantum threats

C. Eliminating the need for standards coordination

D. Treating quantum systems as ordinary office applications

Correct Answer: B. Managing the transition to cryptographic protections resilient to future quantum threats

Question 9

What does contestability mean in digital governance?

A. The ability to increase system processing speed

B. The ability of affected parties to question, appeal, or seek review of decisions

C. The ability to conceal model operations

D. The ability to prevent all human intervention

Correct Answer: B. The ability of affected parties to question, appeal, or seek review of decisions

Question 10

Which is a common doctoral research error identified in the chapter?

A. Reporting limitations and uncertainty

B. Using multiple evidence sources

C. Choosing a method before formulating a well-defined research question

D. Including affected stakeholders responsibly

Correct Answer: C. Choosing a method before formulating a well-defined research question