Queensland University of Technology CRICOS No J ON GOVERNANCE STRUCTURES FOR CLOUD RESOURCES AND ASSESSING THEIR EFFECTIVENESS Acklesh Prasad QUT Business School – Queensland University of Technology, Brisbane, Queensland, Australia Peter Green Jon Heales UQ Business School – University of Queensland Brisbane, Queensland, Australia

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 Introduction Some Key Issues Shared ……. –Data Analytics –Big Data –Cost/Benefit –Data Mining and Fraud Detection –Dynamic –Sustainable Competitive Advantage –Version 1  Version 2 (No Money)

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 Introduction Cloud resources provide opportunities and challenges to businesses. However, acquiring IT resources as a utility from the cloud is gaining momentum. Cloud presents better and more economical ways to continue to embed modern IT resources in information systems (IS). Overall, organizations interest in cloud resources will continue to increase. –Gartner (2012)…. “Cloud computing to be a $206.6 billion business by 2016.” –Fratto (2012)… “Cloud computing is coming to your organization, like it or not.”

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 Introduction The resource is the same (IT), but the nature of commitment, relationship management, and expectation from the resource is different. Marston et al., (2011) “CIOs and CTOs should proactively develop an overall “cloud strategy” in order to determine a time-based plan about which of their applications they can move to the cloud, and the timeframes associated with each of them.” Governance structures for IT resources require consideration. Fratto (2012) “A governance plan gives the cloud IT the proactive control needed to proceed safely.” Eventually, it has to embed into organizations overall IT governance structures.

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 Introduction Focus of this research –Higher level of cloud governance consideration The current position on cloud governance: –Practice-based conceptual deliberations on the benefits of cloud services and the surrounding technologies (for example, KPMG and Gartner resources). –Academic contribution is starting to focus on business-related issues surrounding cloud computing (see for example, Brumec and Vrček, 2013; Marston et al., 2011; Misra and Mondal, 2011; Sultan, 2010). This research - to blend these thoughts and suggest appropriate higher level IT governance structures for cloud resources.

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 The Key Research Issue What are the appropriate IT governance structures for managing cloud resources to achieve cloud- related business objectives?

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 Conceptually….. Cloud-based business objectives - achieving outcomes relating to improved agility, better creativity and innovation, and simplicity of IT systems Cloud-related financial objectives - better returns on investment in IT, improvement in total IT lifecycle costs, and better response to economic conditions. Cloud Governance Structures Cloud-Based Business Objectives Cloud-Related Financial Objectives

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 What should be the Nature of Cloud Governance Structures? Cloud resources/adoption of cloud resources will be dynamic. –Robotics and Assurance Analogy To source “new” value: –Governance structures would need to be dynamic – Ability to build capacity to continue to leverage “new” value from the cloud resources. Resource-Centric View and Dynamic Capabilities Framework –New players with continuous commitment and engagement. Governance structures would have a relational component. Shared governance. Relational view of the firm

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 Investigation Approach A Triangulation approach A set of possible IT governance structures for managing cloud resources. Subsequent – Validation of the (model) with a field survey. Theoretical Underpinning Conceptual Deliberations Interpretive Approach

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 The Model of Cloud Governance Chief Cloud Officer (Initiation) Cloud Management Committee (Decision Making) Cloud Service Facilitation (Fit – Economic Issues) Cloud Relationship Centre (Continuity) Business Objectives Financial Objectives

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 The Model of Cloud Governance Chief Cloud Officer - expertise, initiator, the dynamic component, local expertise, proactive. Cloud Management Committee – overall cloud direction, strategy, steering role. Cloud Service Facilitation - issue resolution center, develop and administer performance monitoring, manage change facilitation, and consider tactical decisions relating to cloud services economics of cloud, (cloud provider risk assessment, and enterprise agreements.) Cloud Relationship Centre - relationship management, cloud service gateway, dynamic and continuous relationship between corporate IT and business units, communication of cloud related security, architecture standards, and integration requirements, and business unit compliance, security in cloud, the possibility of changing business models quickly.

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 Validation Approach Survey Perceptions of Actual and Potential Cloud Adopters on the suggested governance structures and the business and financial objectives

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 Cloud Governance Structures and Business Objectives RelationshipPath Coefficientp-valuesig. Chief Cloud Officer  Cloud-Related Business Objectives * Cloud Management Committee  Cloud-Related Business Objectives *** Cloud Service Facilitation  Cloud-Related Business Objectives * Cloud Relationship Management  Cloud-Related Business Objectives *** Explained Variance (R 2 ) * p<0.05, ** p<0.01, *** p<0.001

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 Cloud Governance Structures and Business Objectives Table 7. Cloud-Related Business Objectives  Cloud Related Financial Objectives - Hypothesis 5 Relationship Path Coefficient p- value sig. Cloud-Related Business Objectives  Cloud-Related Financial Objectives *** Explained Variance (R 2 ) * p<0.05, ** p<0.01, *** p<0.001

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 Discussion The impetus to seek cloud services is gaining momentum. A proactive approach to governance of cloud resources is desirable. Four cloud governance structures that focus on initiation  decision making  fit  relationship management. Overall - continuous and careful thought, perceived good fit of the prospective cloud resources, and subsequent actual implementation of the services into the business processes. Value Trajectory - cloud-related business objectives  cloud-related financial objectives.

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 Contributions Formal thought on and validation of possible cloud governance structures. Consideration on the element of dynamics in cloud governance structures  possible with the suggested four structures. The importance of managing relations with key stakeholders yet, owning cloud governance. Ways to determine whether path to the cloud is still feasible.

University of Waterloo Centre for Information Integrity & Information Systems Assurance 8th Biennial Research Symposium – 5 October 2013 Key Points Cloud computing is here to stay. Utility approach to acquiring IT resources will increase. Organizations responsibility of appropriately managing their IT resources remain With cloud resources –A proactive approach –A relational element –The importance of a dynamic element

Queensland University of Technology CRICOS No J Thank You Questions and Comments