W. Alec Cram

Controlling information systems development: a new typology for an evolving field

This study explores how and why information systems development (ISD) approaches differ in their tactics to control the behaviour of development teams. Drawing from prior research on organisational control, we conduct qualitative case studies at four organisations to examine the extent that traditional and contemporary systems development approaches can highlight a unique combination of control attributes. Based on the data collected, we build an ISD control typology that differentiates ISD approaches on the basis of control objectives (product or process focused) and control practices (preventive or detective/corrective focused). The proposed typology can be used by practitioners to inform and guide more effective systems development control choices while providing researchers with a new model that recognises the unique control aspects of todays systems development approaches.

Hitting a moving target: a process model of information systems control change

Controls are widely regarded as a key factor in driving high performing organisational processes. However, because of ongoing changes within information systems (IS) processes, control modifications are commonly required in order to maintain performance levels. Although past research recognises the ongoing benefits derived from successful control changes, there is a limited understanding of the actual steps taken by organisations, particularly with regard to avoiding negative performance implications such as process delays or employee resistance. This research draws on empirical data from six case studies to propose a new process model that depicts the interconnected steps involved in control changes. Our findings suggest that the sources of IS control change may be more diverse than most past research suggests and that control changes within non‐project‐oriented processes (e.g. enterprise architecture) present additional challenges in comparison to project‐oriented processes (e.g. systems development). Insights from this research can aid practitioners in streamlining control changes as a means to improve effectiveness, whilst also contributing to research by uncovering an enhanced understanding of why and how control changes are made in IS processes.

Mindful revolution or mindless trend? Examining agile development as a management fashion

The growing adoption of agile methods of system development can be seen as broadly consistent with characteristics of a management fashion. However, the extent that fashions relate to how specific organizations actually adopt and use agile remains unclear. Based on five case studies, this research seeks to apply the concepts from management fashion theory to understand how organizations mindfully (or mindlessly) adopt agile methods. We find in some cases that agile appears to be characterized as a short-term, transitory trend, while in others it is embedded in an organization’s processes and culture. We identify three categories that distinguish between fashion patterns during agile adoptions: Crusaders, who exclusively adopt agile in a pure form; Tailors, who integrate agile and traditional approaches to fit their specific circumstances; and Dabblers who employ a few ceremonial agile activities alongside a traditional approach. The results from this study can encourage managerial awareness of the link between fashions and agile development, which can serve to highlight the unique opportunities to enhance mindfulness and avoid the pitfalls of mindlessness. By uncovering insights into the fashion-centric drivers of agile adoption, this research extends past theory related to both mindful innovation and management fashions.

Aligning organizational values in systems development projects

Purpose - The purpose of this paper is to examine the antecedents and implications of aligning the organizational values embedded in a systems development approach (e.g. agile) with the organizational values of project team members. Design/methodology/approach - A qualitative case study approach is used to examine systems development project teams at three organizations, each using a development approach that incorporates different organizational value dimensions. Interviews were conducted with developers, systems analysts, and managers regarding their systems development experiences. A structured coding of the interview transcripts was then completed to enable analysis of value dimensions. Findings - By comparing the dominant values between the project teams and their development approach, varying degrees of alignment were identified. Where alignment is high, perceptions of the systems development process are associated with satisfaction and enthusiasm; where alignment is low, perceptions focus on frustration and discontent. Research limitations/implications - Based on the studys findings, four propositions pertaining to the antecedents and implications of IS values alignment are outlined for examination in future research. Practical implications - The findings from this study can aid managers who are considering the use of a new systems development approach or evaluating the effectiveness of their current approach. By determining the degree of information systems (IS) values alignment, organizations may be able to customize their development approach to be more consistent with the teams values, in order to minimize negative development process perceptions and increase project performance. Originality/value - This research extends past studies of organizational values and alignment by introducing the concept of IS values alignment.

Organizational information security policies: a review and research framework

A major stream of research within the field of information systems security examines the use of organizational policies that specify how users of information and technology resources should behave in order to prevent, detect, and respond to security incidents. However, this growing (and at times, conflicting) body of research has made it challenging for researchers and practitioners to comprehend the current state of knowledge on the formation, implementation, and effectiveness of security policies in organizations. Accordingly, the purpose of this paper is to synthesize what we know and what remains to be learned about organizational information security policies, with an eye toward a holistic understanding of this research stream and the identification of promising paths for future study. We review 114 influential security policy-related journal articles and identify five core relationships examined in the literature. Based on these relationships, we outline a research framework that synthesizes the construct linkages within the current literature. Building on our analysis of these results, we identify a series of gaps and draw on additional theoretical perspectives to propose a revised framework that can be used as a basis for future research.

Information systems control alignment

This study presents a new concept called information systems control alignment, which examines the degree that the underlying characteristics of four main information systems (IS) control dimensions are mutually complementary. Using three case studies, our research uncovers two high-functioning control patterns - one with traditional characteristics and one with agile characteristics - that demonstrate positive alignment among the control environment, control mechanisms, socio-emotional behaviors, and execution of controls. By better understanding the circumstances that contribute to control conflicts, organizations can be increasingly mindful of cultivating a complementary relationship among the control dimensions when designing, implementing, monitoring and adjusting controls within IS processes.

Addressing the Control Challenges of the Enterprise Architecture Process

ABSTRACT:  This paper examines the enterprise architecture process from the perspective of information systems controls, which refer to attempts to influence the behavior of employees in order to achieve organizational goals. Although controls have been extensively studied in processes such as systems development, there is little research examining control within the enterprise architecture process, despite its rising importance in todays organizations. This paper examines how enterprise architecture controls are employed in practice and considers the challenges faced in their design and operation. Drawing on empirical data from two in-depth case studies, enterprise architecture controls are classified and analyzed using COBIT 5. Our findings identify a series of specific challenges with enterprise architecture controls. Based on these challenges, we outline recommendations to practitioners in overseeing the enterprise architecture process and develop propositions to help guide future research initiative...

A Method to Evaluate Information Systems Control Alignment

ABSTRACT: Advocated by auditors and regulators, information systems (IS) controls can mitigate risk and improve performance. But controls can just as easily lead to problems, slowing processes with unnecessary bureaucracy or overwhelming checks and balances. Managers can avoid these problems by understanding how to design and implement IS controls that align with important factors within the settings that they operate, such as organizational structure, staff expectations, and technical innovations. We address this challenge by operationalizing a method to evaluate control alignment within IS processes. The results can aid in determining the degree of complementarity between IS controls, organizational, staff, and process characteristics.

Teaching Information Security in Business Schools: Current Practices and a Proposed Direction for the Future

The growing importance of information security as a business issue has encouraged instructors to extend their courses beyond a hands-on, technical model to one that considers managerial and risk-based issues. In business schools, this shift has presented the pedagogical challenge of balancing the technical content fundamental to information security with the managerial content that the profession increasingly values. To draw on the best practices currently being undertaken in the classroom, we examine 44 information security course syllabi from business and other schools (i.e., computer science, engineering, information science, law, and mathematics). Using a qualitative approach, we identify the definitive technical and managerial-focused aspects of information security courses. Based on the results, we propose an introductory information security course that balances technical and non-technical content for business school students and that integrates the most innovative techniques used by today’s information security instructors.

Aligning Organizational Values in Systems Development Projects: An Empirical Study

This paper examines the concept of alignment between the organizational values embedded in a systems development approach and the organizational values of a project team. Though past research has suggested that firm performance relates to the degree of strategic and structural alignment, the role of organizational values alignment remains ambiguous at the project level. Using a multiple case study approach, this research explores systems development project teams at three organizations, each using a development approach that incorporates different organizational value dimensions. By comparing the dominant values between the project teams and their development approach, we find varying degrees of alignment. Where alignment is high, perceptions of the systems development process are associated with satisfaction and enthusiasm; where alignment is low, perceptions focus on frustration and discontent. Based on the studys findings, four propositions are outlined for examination in future research.