Canadian business perspectives on the governance of enterprise IT (GEIT)

www.pwc.com/ca/technology-consulting A PwC White Paper Canadian business perspectives on the governance of enterprise IT (GEIT)

2 Canadian business perspectives on the governance of enterprise IT (GEIT)

PwC conducted research for the 4th edition of the IT Governance Institute s (ITGI*) Global Status Report on the Governance of Enterprise IT (GEIT), which was published in January 2011. The ITGI report surveyed 834 business executives and heads of information technology (IT) from 21 countries, representing 10 industries, and both large and small scale enterprises, and asked them what they thought about the role of IT in their organization. The survey showed a significant level of agreement on the contribution of IT to business success, and provided insight on the challenges and opportunities connected with IT, the impact of the economic crisis and views on IT outsourcing, social networking and the cloud. This PwC report presents selected data from the survey for the 41 Canadian organizations that participated and provides a comparison with the global respondent base. *ITGI is the research affiliate of ISACA, a global non-profit, independent membership association with 95,000 constituents in 160 countries. The full report is available as a free download at www.isaca.org/itgi-global-survey-results. Canadian business perspectives on the governance of enterprise IT (GEIT) 3

Executive Summary PwC s research found that Canadian organizations need to specifically focus on two areas of IT governance. First, the optimal governance of enterprise architecture (EA) can ensure greater flexibility and agility so that IT can enable rapid business change. Secondly, the right governance mechanisms can play a significant role in cost reduction initiatives e.g. driving re-use, eliminating duplication or overlap between initiatives and having optimal investment evaluation processes. Further, over the next 12 months, large scale IT projects planned by Canadian organizations will require significant business-it interaction for which GEIT mechanisms will be critical. How does IT contribute to the business? The contribution of IT is widely recognized in Canadian organizations, with 93% of Canadian respondents citing the value creation of IT investments as one of the most important dimensions (Figure 1). IT enablement of rapid business change is the lowest scoring dimension (and lower than the global results), with 66% of Canadian respondents indicating that they agree or strongly agree with this statement, compared to 74% of global respondents. Many organizations are currently undertaking initiatives around enterprise architecture (EA) with a specific focus on increasing agility and flexibility. It is critical for Canadian organizations to ensure that they have the right GEIT mechanisms in place to govern EA. GEIT mechanisms should drive a focus on agility and flexibility in architecture-related decision-making, which will enable more rapid business change. The governance of enterprise architecture Defined technology standards and defined architecture processes were the most commonly cited measures used by Canadian respondents to govern EA. The most common planned measure is EA principles, which all IT initiatives need to comply with, followed by structures such as an architecture review board or committee. The existing use of defined architecture processes and defined standards is more prevalent in Canadian respondents than for the global respondent base, with architecture processes in existence in 53.8% of Canadian versus 42% of global respondents, and technology standards in existence in 61.5% of Canadian versus 53% of global respondents (Figure 2). Canadian organizations that want to improve the governance of EA, and increase their focus on agility and flexibility to enable rapid business change, should implement optimal decisionmaking structures such as an architecture review board, EA principles and a relevant framework for the governance and management of EA, such as The Open Group Architecture Framework (TOGAF). Figure 1 How does IT contribute to the business? Figure 2 The governance of architecture IT investments create value for the business IT service levels meet the business needs IT supports the business strategy IT enables rapid business change IT supports business regulation and compliance 2 7 59 34 15 51 32 A framework for the governance and management of EA, such as The Open Group Architecture Framework (TOGAF) Enterprise architecture principles with which all IT initiatives need to comply Structures such as an architecture review board or committee 23.1 11.6 46.1 34.6 26.9 15.4 2 17 44 37 30.8 19.2 30.8 5 29 44 22 Defined architecture processes 53.8 7.7 23.1 12 54 34 Defined technology standards 61.5 7.7 11.6 0 20 40 60 80 100 0 15 30 45 60 75 90 Strongly disagree/disagree/don't know Neither/nor Agree Strongly agree Exists Planned Does not exist 4 Canadian business perspectives on the governance of enterprise IT (GEIT)

Head of IT as a member of the senior management team The Head of IT is more likely to be a member of the senior management team in Canadian respondents organizations, with 80.5% of Canadian respondents indicating the inclusion of their Head of IT in the team compared with 71.9% of global respondents (Figure 3). This may be indicative of the importance attached to IT in Canadian organizations. It may also provide an explanation for the role of IT being described as proactive by more Canadian respondents than global ones. Positioning the Head of IT as a member of the senior management team is important for technology enablement of rapid business change. As a member of the senior management team, the Head of IT can ensure that IT is involved as early as possible in the planning of new business ventures. In some more mature organizations, the CIO s role is being referred to as Chief Innovation Officer, relating to IT s ability to drive business innovation and ultimately competitive advantage. Role of IT in the organization Respondents were asked to characterize the current role of IT in their organization as either proactive or reactive (Figure 4). A higher percentage of Canadian respondents (both business and IT) described the role as proactive when compared to the global respondent base. This may be explained by more Canadian than global respondents citing the Head of IT as a member of the senior management team. In this position, the Head of IT has early insight, is part of defining business direction and planning, and can ensure that IT plays a proactive role in driving business opportunities enabled by IT innovation and emerging technologies. The role of IT is described as proactive by more IT than business respondents. Having the right GEIT mechanisms, such as governance structures and processes, can increase communication and ensure greater transparency on the role and value contribution of IT to the business. 63% of Canadian respondents described the role of IT as proactive. Figure 3 Head of IT as a member of the senior management team Figure 4 Role of IT in the organization Head of IT is a member of senior management team 71.9 80.5 Business respondents describing the role as proactive 45.3 53.3 0 20 40 60 80 100 Heads of IT describing the role as proactive 69.2 62.4 All respondents describing the role as proactive 54.6 63.4 0 20 40 60 80 Canadian business perspectives on the governance of enterprise IT (GEIT) 5

Planned IT initiatives In the next 12 months, the main initiatives planned by Canadian respondents include major system implementations or upgrades, data or information initiatives, and IT cost reduction initiatives. It is noteworthy that almost 40% of Canadian respondents are planning green IT or sustainability initiatives, compared with 25% of respondents globally (Figure 5). System implementation, upgrades and data or information initiatives reinforce the need for the proper governance of EA. The same holds true for green IT or sustainability having the right decision-making structures can ensure that sustainability is considered as a benefit that can be achieved by major initiatives. Many organizations who are operating globally are struggling with distributed data residing in different territories, and the resulting implications in terms of regulatory compliance, privacy and security. There is an increasing emphasis on data governance in the Canadian market, and this is one of the area where the right involvement of both business and IT stakeholders in decision-making is critical. IT cost reduction initiatives can be seen as a reaction to the global economic downturn, considering the period during which the survey was executed (2010). Specific initiatives that organizations have implemented in response to the crisis are identified later in this report. IT-related issues experienced in the past 12 months Increasing IT costs, an insufficient number of IT staff, and problems implementing new systems were the most prevalent IT-related issues experienced by Canadian respondent organizations in the past 12 months (Figure 6). Canadian respondents were more likely to suffer from increasing IT costs, with 56.1% of Canadian respondents identifying the issue versus 38.7% Figure 5 Planned IT initiatives in the next 12 months Figure 6 IT-related issues experienced in the past 12 months Green IT/ sustainability initiatives 25.2 39.0 Increasing IT costs 38.7 56.1 Outsourcing IT services Changing internal IT costing arrangments Data or information initiatives IT supported compliance initiatives IT risk management initiatives IT cost reduction initiatives Major IT system implementations or upgrades Major IT infrastructure initiatives 22.0 18.5 24.4 26.4 24.4 29.4 29.3 29.3 30.9 39.0 44.5 43.9 45.3 45.7 51.2 51.2 Return on investment not as expected Serious operational IT incidents IT security or privacy incidents Problems with external IT service providers Insufficient number of IT staff Insufficient IT skills Problems implementing new IT systems IT disaster recovery or business continuity issues None of the above 0 15 30 45 60 0 15 30 45 60 6 Canadian business perspectives on the governance of enterprise IT (GEIT) 4.9 13.7 12.2 14.4 17.1 18.9 17.6 17.1 18.6 22.0 24.4 28.5 28.7 31.7 31.3 39.0 34.4 36.7

of global respondents. Similarly, Canadian respondents cited problems implementing new systems and IT disaster recovery or business continuity issues more frequently as compared with the global group of respondents, but had far fewer serious operational IT issues (4.9% versus 17.6%). The fact that increasing IT costs are experienced by more Canadian respondents may be related to the initiatives that they are planning to undertake: a higher percentage of Canadian than global respondents are planning data/information initiatives, major systems implementations or upgrades, and major infrastructure initiatives. These are all cost-intensive initiatives where the payback period may be long. The lower incidence of serious IT operational issues could be reflective of the high level of maturity of many Canadian organizations in IT operations. These organizations should ensure that the same level of maturity is targeted for IT build (development and implementation) and IT plan domains. Prematurely ended IT projects One-eighth or 12% of Canadian respondents noted ending an IT-related project prematurely before it was fully implemented compared with one fifth or 21% of all global respondents (Figure 7). This question only applied to incomplete projects, and did not include projects that were completed, but were considered unsuccessful (not within time or budget, or not achieving objectives). Many larger Canadian organizations have implemented or are in the process of implementing Project Management Offices (PMOs) which drive project management processes and standards, and could be a contributing factor to the lower incidence of premature project termination. Project management frameworks and certifications such as the Project Management Professional (PMP) and Projects in Controlled Environments (PRINCE2) are also widely used in many Canadian organizations. Drivers for GEIT activities Alignment with business needs and the avoidance of negative incidents are the most important drivers for the GEIT activities of Canadian respondents (Figure 8). The avoidance of negative incidents is a stronger driver for Canadian respondents than the global base, while the management of cost is a less important driver. Figure 7 Prematurely ended IT-related projects Figure 8 Drivers for GEIT activities Percentage of respondents mentioning the premature termination of an IT-related project 12.2 21.0 0 5 10 15 20 25 Avoiding negative incidents Managing costs Ensuring that current IT functionality is aligned with current business needs 10.3 9.8 19.5 20.1 41.5 37.9 Increasing agility to support future changes in the business 12.3 11.6 Achieving better balance between innovation and risk avoidance to improve return 9.8 9.5 Complying with industry and/or governmental regulations 7.3 8.5 0 10 20 30 40 50 Canadian business perspectives on the governance of enterprise IT (GEIT) 7

Canadian organizations should focus on future business needs and agility to support these changes. As stated previously, increasing IT costs is an issue for more Canadian than global respondents (56.1% versus 38.7%), yet managing IT costs is seen as a driver for GEIT activities by a far fewer proportion of Canadian respondents. Possibly, Canadian organizations are not fully realizing the role that GEIT activities can play in managing IT costs. This is especially critical for organizations with global operations. For example, having the right decision-making structures that involve all of the right business and IT stakeholders from relevant parts of the organization can reduce duplication or overlap between initiatives in different territories, and can increase re-use which can lower both implementation and maintenance costs. It is positive that alignment with current business needs is a driver for so many Canadian respondents. However, as business cycles are shortening in many industries and the pace of change is everincreasing, these organizations need to ensure that the focus on alignment with current business needs is balanced with a view on future needs, specifically, increasing agility to support future changes in the business. Level of GEIT measures in place GEIT is a priority for Canadian organizations with 63% of respondent organizations having some degree of GEIT measures in place. At the same time, there are more Canadian respondents that do not consider GEIT to be important compared to the global respondents (Figure 9). Also, none of the Canadian respondents indicated that they are at a level of maturity where they are continuously optimizing governance of IT processes, compared to 7.2% of global respondents (Figure 10). Since many of the initiatives that Canadian respondents are planning are projects where significant business-it interaction is required (e.g. major system implementations or upgrades, data or information initiatives, IT cost reduction initiatives, etc.), Canadian organizations need to ensure that the right GEIT mechanisms are in place, and that they are continually monitored and improved. Figure 9 Level of GEIT measures in place Figure 10 Level of GEIT practices in place by maturity of organization We do not think that this is important 4.9 12.2 Maturity <500 FTEs >500 FTEs We understand that this is an issue but are just starting to assess what needs to be done 22.0 22.7 We do not think this is important 21.1% 4.5% We understand this is an issue, but are just starting to assess what needs to be done 42.18% 4.5% We are well aware that this is important and we have a number of ad hoc measures in place We have well-defined governance of IT measures and processes in place We have well-functioning governance of IT processes and a performance measuring system in place Our processes relating to governance of IT are continuously optimized 4.9 8.5 7.2 22.7 26.8 31.7 29.0 We are well aware this is important and we have a number of ad hoc measures in place We have well-defined governance of IT measures and processes in place We have well-functioning governance of IT processes and a performance measurement system in place Our processes relating to governance of IT are continuously optimized based on performance measurement results 26.3% 36.4% 10.5% 40.9% 0% 9.1% 0% 0% Don't know 2.4 5.0 0 5 10 15 20 25 30 35 8 Canadian business perspectives on the governance of enterprise IT (GEIT)

A good starting point is defining key decision points in different domains (such as strategy, architecture, security), who needs to be involved in each of these from both the business and IT, and the optimal structures or other decisionmaking mechanisms that can be used to facilitate the required interaction. When comparing the results of smaller organizations (less than 500 FTEs) and larger organizations (more than 500 FTEs), it was found that larger Canadian organizations have higher maturity profiles. Over 86% of respondents from larger enterprises have at least ad hoc GEIT measures in place, while only 36.8% of respondents from smaller organizations claim this level of maturity. Factors that influence the implementation of GEIT practices The culture of the organization, its ways of working, and human factors most influence the implementation of GEIT practices for Canadian respondents, followed by the organization s business objectives or strategy (Figure 11). Business objectives or strategy was mentioned as a driver by fewer Canadian than global respondents, whereas the opposite is true for culture and human factors. PwC s experience in helping organizations to implement or improve their GEIT mechanisms has shown that sufficient attention to communication and change management is a critical success factor for GEIT implementation projects. Outcomes of GEIT practices The most commonly experienced outcomes of GEIT practices for Canadian respondents are improvements in two key areas: management of IT-related risk and IT delivery of business objectives (Figure 12). This corresponds well with the top drivers for implementing GEIT mechanisms for Canadian respondents (ensuring that current IT functionality is aligned with current business needs, and avoiding negative incidents), showing that the implemented mechanisms efficiently perform their intended functions. Smaller Canadian organization respondents have a significantly lower GEIT maturity profile. Figure 11 Factors that influence the implementation of GEIT practices Figure 12 Outcomes of GEIT practices The culture of the organization, its way of working and human factors The regulatory environment and specific compliance requirements The business objectives or strategy Industry or market forces 26.8 24.2 34.1 33.7 49.6 51.2 56.1 57.0 0 15 30 45 60 Improved management of IT-related risk Improved return on IT investments Lower IT costs Improved transparency of IT and its activities Improved communication and relationships between business and IT Improved tracking and monitoring of IT performance Improved IT innovation Improved IT delivery of business objectives Improved business competitiveness None of the above 9.8 7.7 17.1 22.2 24.4 24.4 27.1 29.3 28.8 28.1 31.7 31.7 34.5 38.0 36.6 39.6 41.5 37.3 46.3 42.2 0 10 20 30 40 50 Canadian business perspectives on the governance of enterprise IT (GEIT) 9

Improved communication and relationships between business and IT, improved IT innovation and improved return on IT investments are also frequently experienced by Canadian respondents. The survey shows that Canadian respondents are more likely to experience improved IT innovation than the global respondent base, but less likely to have lower IT costs or improved transparency of IT and its activities as an outcome. The higher figures for improved IT innovation may be related to Canadian respondents being more likely to describe the role of IT as proactive in their organizations. In order to improve the transparency of IT and its activities, Canadian organizations should review the current level of business involvement in IT, and especially in the governance of enterprise IT. Participation in GEIT structures is still highly IT-centric within many organizations and requires greater business contribution and input. Lower costs could be driven by a range of governance decisions such as driving adherence to architecture standards, or having optimal investment evaluation and portfolio management processes that help to prevent duplication between initiatives. Challenges implementing GEIT The main challenges experienced by Canadian respondents in implementing GEIT mechanisms are trying to do too much at once and communication issues (Figure 13). Canadian respondents suffer more from trying to do too much at once than their global counterparts. It is important that the implementation of GEIT practices be viewed and managed as any other project care should be taken to properly scope GEIT implementations, ensuring that objectives are attainable and that the pace of change can be absorbed by the organization. Figure 13 Challenges implementing GEIT Figure 14 Outsourcing of IT-related activities (Canada vs. Global) Change management 29.3 38.1 Canada 53.1 33.8 6.2 6.9 Communications issues 41.5 41.2 Global 73.0 20.0 5 2 Lack of senior management commitment and support Difficulty demonstrating value and benefits Getting required business participation Ineffective current enterprise governance High levels of organization complexity (operating model, organizational) Trying to do too much at once 7.3 14.1 22.0 24.3 26.8 30.8 31.7 30.3 29.3 26.7 38.4 48.8 0 20 40 60 80 100 Fully outsourced Partially outsourced Not outsourced Don t know Figure 15 Outsourcing of IT-related activities by activity type Infrastructure provisioning 46.2 42.3 3.8 Infrastructure maintenance Application development and/ or maintenance IT help desk 53.8 34.6 3.8 26.9 65.4 3.8 69.2 15.4 7.7 Don't know 2.4 4.2 End user support 69.2 11.5 11.5 None of the above 9.8 6.4 0 10 20 30 40 50 0 20 40 60 80 100 Fully outsourced Partially outsourced Not outsourced 10 Canadian business perspectives on the governance of enterprise IT (GEIT)

Outsourcing of IT activities Outsourcing is widely prevalent, with 53.1% of Canadian respondents having fully outsourced one or more of their IT service areas and a further 33.8% that have partially outsourced one or more of their IT service areas. The prevalence of full outsourcing is lower for Canadian respondents than for the global respondent base (53.1% versus 73%), whereas Canadian organizations are more likely to have partial outsourcing (33.8% versus 20%) (Figure 14). Partial outsourcing may be preferred by Canadian organizations as a mechanism to lower the risks associated with outsourcing. This is an area where GEIT mechanisms can add significant value, especially in complex sourcing environments (such as those involving multiple vendors), where some organizations have implemented structures dedicated to sourcing, (e.g. External Service Management Committee). The objectives for these structures include the definition of standards and policies to control thirdparty services, approving service level agreements (SLAs) and reviewing SLA performance. The IT help desk and end-user support are the IT activities most likely to be fully outsourced by Canadian organizations, followed by infrastructure provisioning (Figure 15). When considering both full and partial outsourcing, application development and/or maintenance are most likely to be outsourced. Current and planned use of cloud computing Very similar to the global respondent base, almost 60% of Canadian respondents are currently using or planning to use cloud computing for non-mission critical IT services, while 36% use it or plan to use it for missioncritical IT services (Figure 16). Those Canadian respondents who are not planning to use cloud computing cited data privacy and security concerns as the main reasons. Canadian respondents are generally more concerned about data privacy than the global respondent base, but less concerned about legacy infrastructure investments. Data privacy and security are complex decision-making areas touching many different parts of the business and IT within organizations. GEIT can be an enabler for cloud computing adoption a clear decision model Full outsourcing is less prevalent for Canadian respondents. Figure 16 Current and planned use of cloud computing Figure 17 Concerns regarding cloud computing For mission-critical IT services (Global respondent base) 12.4 30.1 57.5 Security concerns 47.2 55.6 For mission-critical IT services (Canadian respondents) For non-mission critical IT services (Global respondent base) For non-mission critical IT services (Canadian respondents) 9.1 27.3 63.6 19.4 40.6 40.0 18.2 40.9 40.9 0 20 40 60 80 100 Currently using Planning to use Not planning to use Data privacy concerns Compliance concerns Reliability concerns Legacy infrastructure investments 11.1 15.7 22.2 34.6 44.4 41.7 49.6 77.8 Other 22.2 25.2 0 20 40 60 80 Canada Global Canadian business perspectives on the governance of enterprise IT (GEIT) 11

Figure 18 Initiatives implemented in response to the economic downturn Reduced permanent staff numbers Reduced contractor staff numbers Consolidated sites/ data centres Consolidated infrastructure (servers, networks, etc.) 19.5 17.4 31.7 28.3 27.2 29.5 31.7 41.5 that delineates responsibilities and accountabilities for and in these decisions can significantly facilitate addressing these concerns. The fact that 88.5% of Canadian respondents mentioned that infrastructure provisioning is either fully or partially outsourced in their organizations may account for a lower level of concern about legacy infrastructure investments compared to the global respondent base. Reduced application licenses Consolidated the application portfolio Optimized the project portfolio Implemented stricter investment evaluation measures Centralized IT procurement Redefined service level agreements (SLAs) with external service providers Redefined SLAs with the business to better manage demand Invested in technologies that can reduce process or business cost Changed sourcing arrangements Changed approach to governance of IT None of the above Don't know 4.9 4.0 9.8 12.2 13.7 12.2 10.9 9.8 14.6 14.6 15.2 14.6 12.4 12.2 16.4 22.0 18.7 21.1 19.8 19.5 19.1 17.1 23.4 29.3 0 10 20 30 40 50 Initiatives implemented in response to the economic downturn The survey data shows that the global economic downturn has had an effect on IT activities. Reducing contractor and permanent staff numbers and consolidating infrastructure were the main initiatives that both Canadian and global survey respondents reported implementing in 2009 and 2010 to combat the economic downturn (Figure 18). Almost 30% of Canadian respondents also invested in technologies that could reduce process or business costs. It is a positive finding that Canadian organizations have made these investments during the economic downturn, when the first reaction of many global organizations was to cut costs. This is also in-line with the finding that 93% of Canadian respondents felt that IT investments created value for the organization. Canadian organizations were more likely to reduce contractor staff numbers and invest in technologies that can reduce process or business cost 12 Canadian business perspectives on the governance of enterprise IT (GEIT)

compared with the global respondent base, but less likely to optimize their project portfolio, implement stricter investment evaluation measures, or change their sourcing arrangements. The higher incidence of reducing contractor staff numbers could be due to a higher use of contractors in Canadian organizations, before the crisis, compared to the global respondent base. Optimization of the areas of project portfolio management, investment evaluation and sourcing arrangements could present key opportunities for Canadian organizations. All would require adequate focus on GEIT to ensure the involvement of the right stakeholders in decision-making. Mechanisms to promote IT innovation IT respondents in the survey were asked a question about mechanisms their organization had already implemented or planned to implement to promote IT innovation. Training for IT managers to better understand how IT innovations can create business opportunities, and assigning responsibilities for monitoring emerging technologies and their potential business application were the most frequently planned or implemented mechanisms for Canadian respondents (Figure 19). Compared to the global IT respondent base, Canadian IT respondents were less likely to have, or plan to implement, mechanisms to promote IT innovation (Figure 20). With new technologies constantly emerging, shortening business cycles, and increased competition in many industries, this is an area where IT can contribute significantly to the business. GEIT enablers, such as investment processes or project selection structures, can ensure that there is an adequate focus between IT innovation and runthe-business initiatives. GEIT can be an important enabler for IT innovation. Figure 19 Mechanisms to promote IT innovation Figure 20 Are you planning to implement initiatives to promote innovation? Training for IT managers to better understand how IT innovations can create business opportunities 30.1 30.2 Canada 66.6 20.0 13.4 Assigned responsibilities for monitoring emerging technologies and their potential business application Special investment appraisal and funding mechanisms to perform pilots with emerging technologies 15.4 24.9 30.1 34.0 Global 45.3 41.7 13.0 0 20 40 60 80 100 Yes No Don t know Allocation of time to spend working on experiments or trying out ideas 23.1 28.9 Collaborative programs where IT and business staff can work together on innovation 26.9 33.3 Other 4.7 7.7 Don't know 4.7 11.5 None of the above 7.7 16.0 0 5 10 15 20 25 30 35 40 Canadian business perspectives on the governance of enterprise IT (GEIT) 13

Business respondents were asked whether their organization had implemented or was planning to implement initiatives to promote innovation (without specifying the nature of the initiatives). Two-thirds of Canadian business respondents indicated that their organization had implemented or were planning to implement such measures. Canadian business respondents were more likely to have planned or implemented IT innovation measures as compared to the global respondent base. This is in contrast to the view of IT respondents. This aligns with the finding that a higher percentage of Canadian respondents experienced improved IT innovation as an outcome of GEIT practices than the global respondent base. Views on employee use of social networking Only one in eight or 12.2% of Canadian respondents believe that the benefits of social networking by employees outweigh the risks, compared with 20% of global respondents. More than half of Canadian respondents believe the opposite: that the risks outweigh the benefits, compared with 40.6% of global respondents (Figure 21). Canadian respondents appear to be more risk averse when it comes to emerging technologies, such as social networking tools, than their global counterparts. The right GEIT mechanisms may be an enabler for the process of monitoring and managing the adoption of emerging technologies. An example is ensuring that optimal communication channels and mechanisms exist between all the required stakeholders in the organization, enabling a balanced view of risks and benefits. Figure 21 Views on employee use of social networking The benefits of employees using social networking outweigh the risks 12.2 19.2 The risks of employees using social networking outweigh the benefits 40.6 51.2 The risks & benefits of employee use of social networking are appropriately balanced 26.8 34.3 Don't know 9.8 5.9 0 15 30 45 60 14 Canadian business perspectives on the governance of enterprise IT (GEIT)

Key considerations The survey highlights a number of areas that Canadian organizations could focus on from a governance of enterprise IT perspective: The governance of EA, where the right GEIT mechanisms can ensure a focus on agility and flexibility to enable more rapid business change. Specifically, Canadian organizations should focus on decision-making structures such as an Architecture Review Board, EA principles, and a framework for the governance and management of EA such as TOGAF. Rapid business change can also be better enabled by having the Head of IT as a member of the senior management team, and taking on the role of Chief Innovation Officer. The right GEIT mechanisms can improve communication between business and IT and ensure greater transparency of IT s contribution and value-add to the business. The most important initiatives planned by Canadian respondents in the next 12 months all require significant business-it interaction. An optimal decision-making model can ensure the involvement of the right stakeholders in the best possible solutions. The most common IT-related issue experienced was increasing IT costs, yet it is not reported as a significant driver for GEIT activities. The right governance mechanisms can play a significant role in cost reduction initiatives, e.g. driving reuse, eliminating duplication or overlap between initiatives, and having optimal investment evaluation processes. Canadian respondents from smaller organizations have a much lower average maturity profile than those from larger organizations when it comes to the governance of enterprise IT. Since IT-related decisionmaking may currently be more ad hoc and informal in smaller organizations, they should ensure that all required parties are involved in decision-making. Canadian organizations are cognizant of the influence of the culture of the organization, its way of working, and human factors on GEIT implementation. However, more attention should be paid to managing a GEIT implementation like any other IT project scoping the initiative properly, ensuring that objectives are attainable, and ensuring that the pace of change is realistic. GEIT mechanisms can also help drive business growth through the proper governance and management of IT innovation and emerging technologies. Outsourcing is widely prevalent among Canadian respondents. Governance mechanisms dedicated to sourcing can add significant value in complex, multi-vendor sourcing environments. Canadian respondents appear to be more risk averse when it comes to emerging technologies (such as social networking tools) compared to their global counterparts. The right GEIT mechanisms could be an enabler for the adoption of emerging technologies. For example, organizations should ensure optimal communication channels and mechanisms exist among all the required stakeholders, in order to achieve a balanced view of risks and benefits. Canadian business perspectives on the governance of enterprise IT (GEIT) 15

Where to start PwC advises organizations to start by defining key IT-related decisions that need to be made in different domains, including strategy, EA, sourcing, security, and applications. The involvement of different business and IT stakeholders in these decisions then needs to be considered in a decision model. This will bring clarity by identifying who is accountable, responsible, consulted or should be informed regarding various decisions. Stakeholders could include both individuals (e.g. CFO, CIO, Head of Development, etc.), and current governance structures, such as an IT Steering Committee. The decision model will enable the right governance structures to be defined this could include changes to the mandates or roles of current structures, or the definition of new structures like an Architecture Review Committee. Once governance structures are in place, processes, policies, standards and priciples need to be defined. These will support the governance of enterprise IT structures, and will guide the execution of decisions made within the structures. Taking a holistic approach to these different dimensions and enablers of GEIT can help Canadian organizations achieve the governance objectives of value delivery, risk management, and resource optimization. Contacts Author Gert du Preez 403 509 7579 gert.du.preez@ca.pwc.com Philip Grosch 416 814 5855 pgrosch@ca.pwc.com Tony Balasubramanian 403 509 6607 tony.r.balasubramanian@ca.pwc.com or visit us at www.pwc.com/ca/technology-consulting 2011 PricewaterhouseCoopers LLP. All rights reserved. PwC refers to PricewaterhouseCoopers LLP, an Ontario limited liability partnership, which is a member firm of PricewaterhouseCoopers International Limited, each member firm of which is a separate legal entity. 0985-01 0211