1. Foundations and Evolution of IT Strategic Planning and Governance

Introduction and Context

Information technology has moved from being a specialized support function to becoming a central mechanism through which organizations create value, manage risk, serve stakeholders, and compete. This transformation has altered the meaning of planning and governance. In an earlier era, an information systems plan might primarily have specified hardware purchases, application development schedules, and data-centre capacity. In a contemporary organization, strategic IT decisions may determine the design of a digital platform, the use of artificial intelligence, the structure of an ecosystem partnership, the treatment of personal data, and the resilience of essential services.

The distinction between technology as an operational resource and technology as an organizational capability is therefore fundamental. Technology can reduce transaction costs, enable new products, improve decision quality, and connect organizations with external communities. It can also create concentration risk, surveillance concerns, cyber vulnerabilities, algorithmic discrimination, regulatory exposure, and dependence on suppliers. IT strategic planning and governance provide the intellectual and institutional means to manage these opportunities and tensions.

This chapter establishes the conceptual foundations for the subject. It distinguishes strategy, planning, management, governance, architecture, policy, and control; traces the historical movement from data processing to platform- and ecosystem-based organizations; introduces major theoretical lenses; and examines how AI changes the scope and assumptions of governance. The central argument is that effective IT governance is not merely an administrative mechanism for approving projects. It is a system through which authority, accountability, evidence, and values are connected to the organization’s purpose.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Define and distinguish strategy, strategic planning, management, governance, architecture, policy, standards, procedures, and controls.

2. Explain how IT’s organizational role has evolved from data processing to digital platforms, ecosystems, and AI-enabled capabilities.

3. Apply major theoretical perspectives, including the resource-based view, dynamic capabilities, socio-technical systems theory, institutional theory, and agency theory, to IT decisions.

4. Analyze the relationship among business strategy, IT strategy, enterprise architecture, governance mechanisms, and operational execution.

5. Evaluate the benefits, risks, limitations, ethical issues, and regulatory implications of contemporary IT governance.

6. Use a governance-oriented approach to interpret an organizational scenario and recommend appropriate action.

The Conceptual Vocabulary of Strategic IT

Strategy and strategic planning

Strategy is a pattern of consequential choices through which an organization seeks to achieve a valued position over time. It involves purpose, scope, competitive or public-service logic, resource commitments, and choices about what not to do. Strategy is not simply a list of aspirations. A statement such as “become a digital leader” has strategic significance only when translated into choices concerning customers, capabilities, operating models, investment priorities, risk appetite, and measures of success.

IT strategy is the deliberate pattern of choices concerning information, digital capabilities, applications, infrastructure, people, sourcing, and technology-related risk. It should not be treated as an isolated technical plan. Its legitimacy derives from organizational objectives, while its distinctiveness arises from the particular opportunities and constraints associated with digital capabilities.

Strategic planning is the process by which an organization interprets its environment, clarifies objectives, assesses capabilities, develops options, allocates resources, and establishes mechanisms for review. Planning is a process; strategy is the resulting direction and pattern of choices. Planning may be formal and periodic, but strategic thinking must also occur continuously because technological and institutional conditions change between planning cycles.

Management and governance

Management concerns the planning, organizing, directing, and monitoring of resources in order to achieve agreed objectives. IT management includes service delivery, project execution, supplier coordination, incident handling, workforce development, budgeting, and operational performance. Management generally acts within an authority structure and is responsible for execution.

Governance concerns the exercise of authority, the distribution of decision rights, the setting of direction, and the monitoring of performance and conformance. IT governance answers questions such as: Who may authorize a major technology investment? Which risks are acceptable? How are competing business demands prioritized? Who is accountable for data quality? What evidence must be presented to the board? Governance is therefore concerned with both decision-making and accountability.

The distinction is not absolute. Managers participate in governance, and governing bodies depend on management information. Nevertheless, confusing the two produces predictable weaknesses. A committee that merely reviews project schedules may be called a governance board while exercising only coordination. Conversely, a board that approves technology without understanding delivery capacity may perform formal governance without effective oversight.

A useful formulation is that governance evaluates, directs, and monitors, whereas management plans, builds, runs, and improves. Governance does not mean that senior leaders make every technical decision. It means that decision rights are deliberately designed so that decisions are made at the appropriate level, with appropriate information and accountability.

Architecture, policy, standards, procedures, and controls

Enterprise architecture is the coherent description of an organization’s business, information, application, and technology domains, together with the principles and relationships that guide change. Architecture provides a bridge between strategic intention and technical design. It may define, for example, how customer identity is managed across channels, how data is shared, or which integration patterns are permitted.

A policy is an authoritative statement of intent or required behaviour. A privacy policy may establish that personal information must be collected for legitimate purposes and handled transparently. A standard specifies a mandatory or approved way of implementing policy, such as an encryption standard. A procedure describes the sequence of activities through which a task is performed. A control is a mechanism designed to prevent, detect, or correct undesirable conditions. Multi-factor authentication, segregation of duties, logging, and recovery testing are examples of controls.

These concepts form a hierarchy but should not be treated as interchangeable. A policy without implementation standards may remain symbolic. A control without a clear risk rationale may generate unnecessary cost. Architecture without governance may become an attractive diagram that does not influence investment. Effective strategic planning connects them:

• Strategy defines intended outcomes and priorities.
• Planning translates those intentions into choices, portfolios, and resource commitments.
• Architecture expresses the coherent design of capabilities and systems.
• Policy establishes required principles and behaviours.
• Controls reduce identified risks and provide evidence.
• Management executes, operates, and improves.
• Governance allocates authority and evaluates results.

Capability, portfolio, program, and project

A capability is an organizational ability to achieve an outcome. It includes people, processes, information, technology, and sometimes relationships with external parties. An application is not itself a capability; customer relationship management, for example, depends on data quality, sales practices, analytical skills, and governance as well as software.

A portfolio is a collection of investments or assets managed collectively to achieve strategic balance. Portfolio governance considers value, risk, interdependence, and capacity rather than examining projects in isolation. A program coordinates related projects and activities to realize benefits. A project is a temporary effort undertaken to create a defined product, service, or result. These distinctions matter because an organization can deliver projects successfully while failing to realize capability-level benefits.

From Data Processing to Digital Ecosystems

The data-processing era

Early organizational computing concentrated on automating repetitive, high-volume transactions such as payroll, inventory, accounting, and billing. The dominant logic was efficiency: process more transactions at lower cost, with greater consistency and fewer clerical errors. Systems were often centralized, data was organized around applications, and IT decisions were frequently separated from business strategy.

This period established enduring concerns: data integrity, availability, standardization, processing capacity, and internal control. However, technology was often viewed as a cost centre. Planning emphasized technical forecasts and replacement cycles rather than business-model innovation.

Management information and enterprise integration

As organizations accumulated digital records, attention shifted toward management information, decision support, and enterprise integration. Relational databases, enterprise resource planning, data warehouses, and communication networks enabled information to move across functional boundaries. The strategic question became not only whether transactions could be automated, but whether the organization could coordinate activities and make better decisions.

Integration also exposed governance problems. Shared data required ownership, common definitions, access rules, and conflict-resolution mechanisms. An enterprise system could standardize processes across units, but it could also impose inappropriate assumptions and reduce local autonomy. Strategic planning consequently became more concerned with operating models and organizational change.

The internet and the digital business

Internet technologies expanded the organization’s boundary. Websites, electronic commerce, online services, and digital communications changed relationships with customers, suppliers, regulators, and citizens. IT increasingly influenced channels, products, marketing, and service design. Outsourcing and cloud computing further complicated accountability because capabilities were distributed among vendors and partners.

The strategic unit of analysis began to shift from the internal firm to networks of organizations. Availability depended on telecommunications providers and cloud platforms; customer experience depended on payment networks and identity services; innovation depended on developers and data partners. Governance had to address contracts, interoperability, service-level expectations, concentration risk, and shared responsibilities.

Platforms and ecosystems

A platform is a technological and organizational foundation that enables interactions, transactions, or innovation among multiple participant groups. A platform may provide common identity, data, interfaces, rules, and services. Its value often increases as more participants use it, creating network effects. An ecosystem is the broader set of interdependent actors, institutions, technologies, and relationships that co-create value around a platform or domain.

Platform governance extends beyond internal control. It includes participant admission, data access, interface rules, content or transaction standards, dispute resolution, pricing, monitoring, and sanctions. Platform owners face a strategic tension: openness can stimulate innovation and adoption, while control may protect security, quality, and the platform’s economic model.

The ecosystem perspective also challenges the assumption that one organization can optimize the entire value chain. A platform may create benefits for users while concentrating power in its operator. It may facilitate innovation while enabling exclusion, surveillance, or unfair contractual terms. Governance must therefore include stakeholder interests and public consequences, not only shareholder value.

AI-enabled organizations

Artificial intelligence adds a further change because decision capability itself can be partially automated. Machine-learning systems infer patterns from data and may support or make decisions involving fraud detection, recruitment, credit, health, logistics, or customer interaction. Generative AI can produce text, software, images, and analysis, changing the economics of knowledge work.

AI challenges traditional planning assumptions in several ways. System behaviour may be probabilistic rather than fully specified; performance may vary across groups and contexts; training data may embed historical inequities; and models can degrade as the environment changes. Accountability cannot be delegated to an algorithm or a vendor. Organizations need explicit ownership of model purpose, data provenance, validation, human oversight, monitoring, incident response, and retirement.

AI governance is therefore not a narrow technical activity. It connects enterprise purpose, risk appetite, legal obligations, professional ethics, model engineering, procurement, and organizational change. The relevant question is not simply whether AI can perform a task, but whether the organization should automate it, under what conditions, and with what recourse for affected people.

Theoretical Lenses for Understanding IT Governance

The resource-based view argues that sustained advantage may arise from valuable, rare, difficult-to-imitate, and organizationally embedded resources. Technology infrastructure alone is rarely difficult to imitate. Advantage is more likely to arise from combinations of proprietary data, domain knowledge, operating routines, trust, architecture, and skilled people. This perspective warns against equating the purchase of a technology with the creation of a strategic capability.

Dynamic capabilities theory emphasizes the ability to sense changes, seize opportunities, and transform resources. It is particularly relevant to digital organizations because static alignment between a business plan and an IT plan may become obsolete quickly. Governance should enable disciplined adaptation, not merely protect an established architecture.

Socio-technical systems theory views organizational performance as a product of interaction between social arrangements and technical systems. A technically efficient system may fail if it conflicts with professional norms, incentives, skills, or power relationships. IT planning must therefore examine work practices, participation, learning, and unintended consequences.

Agency theory highlights problems arising when one party delegates authority to another whose interests or information differ. Boards may not observe management’s technology decisions fully; executives may not observe vendor behaviour; users may not understand data practices. Governance mechanisms such as reporting, audit, incentives, contracts, and independent assurance reduce but do not eliminate these problems.

Institutional theory draws attention to legitimacy. Organizations may adopt governance structures because regulators, professional communities, customers, or peers expect them, even when practical implementation is weak. Certifications, committees, and policies can become ceremonial. A doctoral analysis should therefore distinguish formal structures from actual decision behaviour and outcomes.

Together, these theories provide a more critical view than a simple alignment model. Alignment remains important, but alignment with an inappropriate strategy can efficiently produce poor outcomes. Governance must consider capability, adaptation, social consequences, power, legitimacy, and evidence.

Strategic Alignment as a Living Relationship

Strategic alignment is often represented as a matching exercise between business objectives and IT objectives. A richer interpretation treats alignment as a continuing relationship among strategic intent, organizational capabilities, architecture, investment portfolios, and operational learning. Alignment may be deliberate, emergent, or negotiated. A new digital capability can create opportunities that were not visible when the business strategy was written.

A useful planning cycle begins with purpose and stakeholder outcomes. The organization then assesses its environment, regulatory conditions, competitive position, existing capabilities, technology debt, data assets, and risk exposure. It identifies strategic options and evaluates them against value, feasibility, resilience, ethics, and cost. Selected options are translated into a target operating model, architecture principles, investment portfolio, policies, measures, and implementation road map. Feedback from operations, users, incidents, and changing conditions then informs the next cycle.

This cycle should not be interpreted as purely linear. Discovery may alter objectives; architecture constraints may change the business case; a regulatory decision may invalidate a proposed platform; and user adoption may reveal that the assumed benefit was unrealistic. Strategic planning is therefore a form of organizational learning.

A Governance Design Logic

A credible governance system can be examined through five questions. First, what outcomes and obligations matter? These may include financial value, public benefit, service quality, resilience, privacy, fairness, sustainability, and compliance. Second, what decisions are recurring and consequential? Examples include investment prioritization, architecture exceptions, data access, sourcing, model deployment, and risk acceptance. Third, who has the competence and legitimacy to make each decision? Decision rights should be assigned to the lowest appropriate level while preserving enterprise coherence.

Fourth, what information and evidence are required? Governance decisions should be supported by assumptions, costs, benefits, risk analysis, dependencies, user impact, and post-implementation evidence. Fifth, how will decisions be monitored and challenged? Metrics, assurance, audits, independent review, escalation, and benefits realization mechanisms provide feedback.

Decision-rights tools such as a RACI matrix can clarify responsibility, but they do not replace judgment. A committee may be responsible for approving a project while a product owner remains accountable for user value and a security officer retains authority over specific risk controls. The design must avoid both ambiguity and excessive centralization.

Applied Case: Meridian Public Services and the AI Benefits Platform

Background

The following is an illustrative case. Meridian Public Services is a fictional regional agency administering housing and income-support programs. Its legacy environment consists of separate systems for applications, payments, case management, and identity verification. Citizens complain about repeated requests for information and slow decisions. Operating costs are rising, and internal audits have identified inconsistent access controls and weak data definitions.

Situation and problem

Senior leaders propose a unified digital platform using cloud services, shared identity, analytics, and an AI model to prioritize cases for human review. The proposal promises faster service and improved fraud detection. However, the agency faces constraints involving privacy, accessibility, explainability, cybersecurity, procurement, and the risk that historical decisions may reproduce disadvantage. A technology steering committee initially treats the proposal as an implementation project and asks for a vendor quotation.

Analysis

A strategic analysis shows that the problem is not merely obsolete software. It involves fragmented capabilities, unclear data ownership, inconsistent processes, and limited trust among citizens and staff. The AI model cannot compensate for poor definitions or biased historical data. The platform also creates ecosystem dependencies involving the cloud provider, identity service, analytics vendor, case workers, and applicants.

Using the resource-based view, the agency identifies trusted data practices, domain expertise, and case-worker knowledge as strategic capabilities. Socio-technical analysis reveals that workers need to understand and challenge recommendations rather than receive unexplained scores. Agency theory highlights the need to prevent vendor incentives from determining public decisions. Institutional analysis warns that a new ethics committee would have little value unless it could influence deployment and require evidence.

Approach

Meridian establishes a governance arrangement with the following features:

• A governing board defines public-value outcomes, risk appetite, and non-negotiable rights.
• A cross-functional portfolio group evaluates the platform against service, cost, resilience, privacy, accessibility, and equity criteria.
• Data owners define quality, retention, access, and lineage responsibilities.
• A model-risk process requires documented purpose, data provenance, validation, subgroup testing, human review, appeal routes, monitoring, and retirement conditions.
• Architecture principles require modular interfaces so that the agency is not irreversibly dependent on one supplier.
• Procurement contracts specify audit access, incident notification, portability, security obligations, and restrictions on secondary use of public data.
• A pilot is conducted with representative cases, independent evaluation, staff participation, and public communication before wider deployment.

The AI system is initially restricted to prioritization assistance rather than automatic denial of benefits. Human decision-makers retain authority and must record reasons when departing from or accepting recommendations. Performance measures include processing time, error rates, appeal outcomes, accessibility, subgroup impacts, system availability, and realized benefits—not only model accuracy.

Outcome

The pilot does not produce the rapid cost reduction originally forecast. It does, however, reveal data-quality problems and reduce duplicate information requests in the participating offices. Several model features are removed because they act as proxies for protected characteristics. The agency delays full deployment until an appeal process and stronger supplier controls are implemented. The final platform is more modular and expensive initially, but leadership considers it more resilient and legitimate.

Learning points

The case illustrates that strategic IT governance begins before procurement and continues after implementation. A platform decision is simultaneously an architecture decision, a data-governance decision, a public-policy decision, and a capability-development decision. It also demonstrates that responsible delay can be a governance success when it prevents an organization from scaling an unsafe or poorly understood system.

Risks, Limitations, and Common Mistakes

A major mistake is treating technology expenditure as strategy. Buying fashionable tools without a capability hypothesis creates fragmented portfolios and technology debt. A second mistake is confusing compliance with governance. Compliance establishes minimum obligations; governance must also address value, prioritization, resilience, and ethical consequences.

Over-centralization is another risk. Enterprise standards are valuable, but a central authority that approves every decision can suppress innovation and encourage workarounds. The opposite problem—uncontrolled local autonomy—creates duplication, inconsistent data, and security exposure. Federated governance seeks common principles with delegated decisions.

Organizations also overvalue business cases based on optimistic benefits and undervalue transition costs, adoption barriers, data migration, supplier dependence, and decommissioning. Measures can become distorted when teams optimize visible indicators rather than outcomes. For example, reducing project delivery time may increase defects or reduce user value.

Further limitations arise from the theories and frameworks themselves. No single model captures power, culture, technical complexity, and public interest simultaneously. Maturity models can encourage organizations to pursue a higher score rather than better outcomes. Risk matrices can create false precision when likelihood and impact estimates are weak. Architecture frameworks can become documentation exercises. Governance must therefore remain evidence-seeking, context-sensitive, and open to challenge.

Ethics, Regulation, and Professional Responsibility

IT governance allocates power over information and decisions. Ethical governance requires attention to autonomy, privacy, fairness, non-discrimination, transparency, security, accessibility, sustainability, and the ability of affected people to obtain explanation or remedy. These principles may conflict. Extensive data collection may improve service personalization while increasing surveillance risk; strict security controls may protect systems while excluding users with limited access to authentication technologies.

Legal requirements vary across jurisdictions, but common governance concerns include data protection, records retention, intellectual property, accessibility, sector regulation, cybersecurity notification, consumer protection, and competition. Legal compliance is necessary but not sufficient. A practice may be lawful and still be unreasonable, discriminatory, or inconsistent with professional standards.

Professional responsibility requires practitioners to communicate uncertainty, disclose conflicts, protect confidential information, challenge unsafe instructions, and maintain competence. Senior leaders are responsible for creating conditions in which concerns can be raised without retaliation. In AI-enabled settings, accountability should be assigned to identifiable people and institutions, not attributed to the autonomy of a model.

Current Developments and Emerging Directions

Several developments are reshaping IT strategic planning. Cloud and edge architectures distribute processing and increase dependence on external providers. Open-source and composable technologies accelerate innovation while complicating support, licensing, and supply-chain security. Digital public infrastructure and shared identity systems create new opportunities for scale but require strong institutional trust.

Generative AI is making experimentation inexpensive, encouraging decentralized adoption and creating “shadow AI” outside formal governance. Organizations need proportionate controls that distinguish low-risk assistance from high-impact automated decision-making. Model inventories, data lineage, evaluation protocols, human oversight, and continuous monitoring are becoming strategic governance concerns.

Sustainability is also moving from a peripheral consideration to a planning constraint. Data-centre energy use, hardware lifecycles, electronic waste, and the environmental cost of computation affect architecture and sourcing decisions. Cyber resilience is increasingly understood as an organizational capability rather than a narrow security function, requiring preparation, response, recovery, and learning across the ecosystem.

The future of governance is likely to be more continuous and instrumented. Real-time risk signals, automated policy enforcement, architecture analytics, and AI-assisted assurance may improve visibility. They will not eliminate judgment. Automated governance can reproduce flawed assumptions at scale, so human accountability, independent challenge, and institutional learning remain essential.

Practices for Durable IT Strategic Planning

Durable planning begins with organizational outcomes rather than products. It treats data, architecture, skills, operating routines, and relationships as capabilities and explicitly identifies dependencies. It uses a portfolio perspective to balance innovation, modernization, resilience, compliance, and technical debt.

Good practice also separates decision types and assigns clear authority. Strategic choices belong with leaders accountable for organizational outcomes; technical design should be delegated to competent architects and engineers within approved principles; operational decisions should be close to service delivery. Exceptions should be visible, time-bound, risk-assessed, and reviewed.

Plans should contain assumptions and indicators, not only activities. Benefits should have owners, baselines, and review dates. Governance forums should receive concise evidence and should be willing to stop, redesign, or defer initiatives. Finally, organizations should regard users, employees, suppliers, regulators, and affected communities as sources of knowledge rather than merely audiences for completed decisions.

Chapter Summary

IT strategic planning concerns the choices and processes through which technology-related capabilities support organizational purpose. Governance establishes authority, direction, accountability, and oversight, while management executes and improves agreed activities. Architecture connects strategy with system design; policies express required intent; standards, procedures, and controls make that intent operational.

The role of IT has evolved from transaction automation and internal data processing through enterprise integration and internet-enabled services to platforms, ecosystems, and AI-enabled organizations. Each stage expanded both the strategic potential and the governance boundary of technology. Resource-based, dynamic-capability, socio-technical, agency, and institutional perspectives explain why technology value depends on embedded capabilities, adaptation, social arrangements, accountability, and legitimacy.

Effective governance is a living relationship among outcomes, decision rights, evidence, risk, architecture, investment, and learning. Contemporary practice must address privacy, fairness, cybersecurity, supplier dependence, sustainability, and AI accountability. The central lesson is that IT governance is not a bureaucratic overlay on technology; it is a way of shaping organizational capability and the consequences of digital action.

Key Terms

Strategy: A pattern of consequential choices intended to achieve valued long-term outcomes.

IT strategy: Choices concerning technology, information, digital capabilities, sourcing, and related risk in support of organizational purpose.

Strategic planning: A process of assessing conditions, selecting priorities, allocating resources, and reviewing progress.

IT management: The planning, execution, operation, and improvement of IT resources and services.

IT governance: The system by which authority, direction, decision rights, accountability, and oversight for IT are established.

Enterprise architecture: A coherent description of business, information, application, and technology domains and their relationships.

Policy: An authoritative statement of required intent or behaviour.

Standard: An approved and often mandatory specification for implementing policy or practice.

Procedure: A defined sequence of activities for performing a task.

Control: A mechanism that prevents, detects, or corrects an undesirable condition.

Capability: An organizational ability to achieve an outcome through combined resources and routines.

Portfolio: A collection of investments or assets managed collectively for strategic balance.

Platform: A technological and organizational foundation enabling interactions among participant groups.

Ecosystem: A network of interdependent actors, technologies, institutions, and relationships.

Dynamic capabilities: The abilities to sense change, seize opportunities, and transform resources.

Socio-technical system: An arrangement in which social and technical elements jointly shape performance.

Technology debt: The future cost and constraint created by expedient or outdated technology decisions.

Model governance: Oversight of an AI or analytical model’s purpose, data, performance, risk, and lifecycle.

Benefits realization: The process of ensuring that intended outcomes from an investment are achieved and evidenced.

Risk appetite: The amount and type of risk an organization is willing to pursue or retain.

Review Questions

Short Answer Questions

1. Distinguish IT governance from IT management.

2. What is the relationship between enterprise architecture and IT strategy?

3. Define a digital platform and explain one governance issue it creates.

4. Why is a capability different from an application?

5. What does dynamic capabilities theory contribute to IT strategic planning?

Long Answer Questions

1. Trace the evolution of IT from data processing to AI-enabled organizations and explain how governance requirements changed at each stage.

2. Explain the differences among strategy, strategic planning, policy, standards, procedures, and controls.

3. Compare the resource-based view and socio-technical systems theory as perspectives on digital capability.

4. Discuss why strategic alignment should be understood as a continuing relationship rather than a one-time matching exercise.

5. Evaluate the governance requirements of platform-based ecosystems, including supplier and stakeholder considerations.

Analytical / Application Questions

1. An organization has many successful IT projects but declining customer satisfaction and rising technology debt. Diagnose the governance and planning weaknesses that may explain this result.

2. Design a decision-rights and assurance approach for deploying an AI system that recommends eligibility decisions in a regulated service.

3. A business unit wants to adopt a cloud platform independently of enterprise architecture standards. Analyze the benefits, risks, and conditions under which the exception should be approved.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes governance from management in IT?

A. Governance executes operational tasks, while management defines organizational purpose.

B. Governance allocates authority and monitors direction, while management executes and improves activities.

C. Governance is limited to cybersecurity, while management covers all technology.

D. Governance and management are interchangeable terms for project administration.

Correct Answer: B. Governance allocates authority and monitors direction, while management executes and improves activities.

Question 2

An organization purchases an AI tool but lacks data ownership, skilled users, and redesigned work practices. Which conclusion best follows from the chapter?

A. The tool automatically constitutes a strategic capability.

B. Technology value depends on complementary organizational capabilities.

C. Architecture is irrelevant once a vendor supplies the tool.

D. Governance should focus only on reducing purchase cost.

Correct Answer: B. Technology value depends on complementary organizational capabilities.

Question 3

Which sequence most accurately expresses the relationship among policy, standard, procedure, and control?

A. A control establishes intent, a policy executes it, and a procedure audits it.

B. A procedure establishes intent, a standard assigns accountability, and a policy detects violations.

C. A policy states required intent, a standard specifies implementation, a procedure describes activities, and a control manages risk.

D. All four terms describe identical governance documents.

Correct Answer: C. A policy states required intent, a standard specifies implementation, a procedure describes activities, and a control manages risk.

Question 4

Why does platform governance extend beyond internal IT governance?

A. Platforms eliminate the need for internal controls.

B. Platforms involve rules and relationships among multiple participant groups.

C. Platforms are always operated by governments.

D. Platforms cannot be evaluated using strategic criteria.

Correct Answer: B. Platforms involve rules and relationships among multiple participant groups.

Question 5

A board approves every minor technology configuration decision, causing delays and workarounds. What governance problem is most evident?

A. Excessive decentralization

B. Inadequate data lineage

C. Over-centralization of decision rights

D. Insufficient platform network effects

Correct Answer: C. Over-centralization of decision rights

Question 6

Which theoretical perspective most directly emphasizes the interaction between technical design and work practices?

A. Socio-technical systems theory

B. Agency theory

C. Institutional theory

D. Resource-based view

Correct Answer: A. Socio-technical systems theory

Question 7

In the Meridian case, restricting AI initially to prioritization assistance primarily demonstrates which principle?

A. All automated decisions should be accepted without review.

B. High-impact automation should be proportionate, monitored, and subject to human accountability.

C. Model accuracy makes appeal processes unnecessary.

D. Vendor contracts eliminate the agency’s responsibility.

Correct Answer: B. High-impact automation should be proportionate, monitored, and subject to human accountability.

Question 8

What is the strongest reason for managing IT investments as a portfolio?

A. To ensure every project receives equal funding.

B. To evaluate value, risk, dependencies, and capacity across investments.

C. To prevent all local innovation.

D. To replace benefits measurement with project scheduling.

Correct Answer: B. To evaluate value, risk, dependencies, and capacity across investments.

Question 9

Which statement best captures the effect of AI on traditional governance assumptions?

A. AI systems are fully specified and therefore require fewer controls.

B. AI removes the need to assign accountability to people.

C. AI may produce probabilistic, changing, and potentially biased outcomes requiring lifecycle oversight.

D. AI governance is solely a software engineering concern.

Correct Answer: C. AI may produce probabilistic, changing, and potentially biased outcomes requiring lifecycle oversight.

Question 10

An organization has an impressive governance maturity score but repeatedly ignores its own approval rules. Which insight from institutional theory is most relevant?

A. Formal structures may provide legitimacy without changing actual behaviour.

B. Higher maturity scores always prove effective governance.

C. Technical architecture prevents symbolic compliance.

D. Institutional pressures have no effect on governance.

Correct Answer: A. Formal structures may provide legitimacy without changing actual behaviour.