6.1Corporate management & governance

An IT strategist is not merely someone who designs information systems but a participant in the mechanisms that discipline management, making strategic recommendations to executives and the board. The framework by which a firm manages responsibly toward shareholders, employees, customers, and society is corporate governance, and what assures that daily operations are conducted properly and efficiently under it is internal control. Further, this section tests the ability to grasp the whole picture of corporate management—social responsibility (CSR/SDGs/ESG), preparation for contingencies (BCP), the improvement cycle (PDCA), and rapid decision-making (OODA)—and to judge what to recommend to management as the situation demands.

6.1.1Corporate governance and internal control

• Corporate governance is the mechanism that supervises and disciplines management, prevents executive overreach or misconduct, and protects the interests of shareholders and other stakeholders. Its core is oversight of management by outside directors, auditors, and audit committees, raising the transparency and accountability of management.
• Internal control is a mechanism embedded in the organization to achieve effectiveness and efficiency of operations, reliability of financial reporting, legal compliance, and safeguarding of assets. Segregation of duties (splitting ordering, receipt inspection, and payment approval among different people so they check one another) is a leading example, preventing concentration of authority in one person that would let fraud or error slip through.

6.1.2Social responsibility, business continuity, and improvement cycles

• CSR (corporate social responsibility), SDGs (sustainable development goals), and ESG (environment, society, governance) are management agendas that pursue medium-to-long-term enhancement of corporate value and risk reduction through consideration of the environment, society, and governance, not just short-term profit. Increasingly they tie directly to investor evaluation (ESG investing).
• BCP (business continuity plan) is a plan to continue or quickly recover core operations even in emergencies such as disasters, failures, or cyberattacks. It sets recovery-time objectives (RTO) and recovery-point objectives (RPO), and which operations to recover with priority under limited resources. It goes beyond merely taking backups.
• PDCA (plan-do-check-act) is a cycle suited to continuous improvement of stable operations. OODA (observe-orient-decide-act) is a rapid decision loop suited to situations that change moment to moment and demand immediate response (such as incident handling). They are used selectively according to the situation.

An IT strategist, investigating business processes for a purchasing-and-payment system overhaul, finds that a single person performs all three of "placing orders," "inspecting deliveries," and "approving payment." In this state, there is a risk that fraud or error—fabricating a nonexistent transaction and self-approving its payment, or inspecting leniently and letting defects through—passes with no one checking. The judgment the strategist should make here is neither to endorse the status quo because "the person is trustworthy," nor to "unify authority by eliminating approval for efficiency." This is a deficiency in segregation of duties, the very foundation of internal control, and the correct judgment is to recommend to the board that ordering, receipt inspection, and payment approval be separated among different people, embedding a structure of mutual checks in line with the system overhaul. Crucially, this is not a mere shop-floor operational improvement but a governance matter for which management (the board) must bear responsibility, bearing on the reliability of financial reporting and the safeguarding of assets. The ultimate responsibility for designing and operating internal control lies with management, and the IT strategist makes the deficiency visible to management and recommends building the controls into the system (approval workflow, separation of authority, audit-trail logging). Conversely, leaving the concurrent roles in place by trusting the individual leaves a "structure in which fraud, if it occurs, cannot be detected" even if that person is honest, and the control deficiency is not resolved. The basic philosophy of governance and internal control is that control is assured by mechanisms, not individual goodwill.

6.1.3Section summary

• Corporate governance supervises and disciplines management; internal control (segregation of duties, etc.) assures propriety of operations by mechanism
• ESG/SDGs are management agendas tied to long-term value and risk; BCP plans continuity and quick recovery of priority operations
• Use PDCA for continuous improvement of stable operations and OODA for fast-moving situations demanding immediate response