# A Theoretical Framework for IT-Enabled and IT-Enforced Corporate Governance Compliance
## Utilizing BPMSs

Hendrik Willem Pretorius, Alta van Der Merwe

► To cite this version:

Hendrik Willem Pretorius, Alta van Der Merwe. A Theoretical Framework for IT-Enabled and IT-Enforced Corporate Governance Compliance Utilizing BPMSs. 19th Conference on e-Business, e-Services and e-Society (I3E), Apr 2020, Skukuza, South Africa. pp.301-312, 10.1007/978-3-030-44999-5_25 . hal-03222866

HAL Id: hal-03222866

https://inria.hal.science/hal-03222866

Submitted on 10 May 2021

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# A theoretical framework for IT-enabled and IT-enforced corporate governance compliance utilizing BPMSs

Hendrik Willem Pretorius¹[0000-0003-2051-5290] and Alta van der Merwe[0000-0002-3652-7512]

¹ University of Pretoria, Pretoria, South Africa
Henk.Pretorius@up.ac.za

**Abstract.** Corporate governance has been severely condemned, as a result of company failures around the world. Regulatory and legislative measure have been introduced in response to these failures. However, arguments by sceptics advocate that it is time consuming and costly to comply these legislative measures that cause overregulation. These measures further do not always add value to business initiatives and adherence to these measures cannot be enforced or guaranteed. This paper argues for the use of business process management systems (BPMSs) to improve corporate governance. The “dynamics capabilities theory model of IT-enabled organisational performance” [1] is applied in this study as theoretical underpinning. A theoretical framework is proposed for IT-enabled and IT-enforced corporate governance compliance using a BPMS, after collecting data from seven BPMS user companies and a BPMS vendor company in South Africa.

**Keywords:** fraud, electronic compliance, corporate governance, business process management systems, automation, corruption.

## 1 Introduction

Corporate governance is defined as the method by which corporations are controlled and directed [2]. Corporate governance in the United States (US), has been condemned because of corporation failures like Tyco, WorldCom, Enron, Global Crossing and Adelphia [3]. Furthermore, industries in the US lose around USD400 billion a year as a result of criminal and unethical behavior [4]. In the US, corporate irresponsibility and managerial negligence carries the blame after the arrest and resignation of top-level corporate US managers. This eroded trust in these corporations, domestically and internationally [5].

Parmalat was one of the biggest corporate failures in Europe [6]. In 2003, Parmalat collapsed showing a hole of 14 billion Euro in its accounts [8]. The Parmalat CEO, Calisto Tanzani, was arrested only hours after the bankruptcy of the corporation. Tanzani was imprisoned for ten years on charges of money laundering and financial fraud. The Parmalat group collapsed and many investors lost their investment money [6]. In the last 10 years, fraud and corruption has doubled in the United Kingdom, while it remained stabled or worsened in other European countries [29].
South Africa, like the US and Europe, experience similar corporate governance prob-
lems. In South Africa, particularly in the State Information Technology Agency (SITA),
IT vendors are frequently guilty of bribing government employees during tender pro-
cesses [7]. Around R10-billion was spent on ICT in the 10 years of existence of SITA
from 2002 to 2012 [8]. Vendors who want a share in the stake are very attracted to this
large amounts of money. The scenario led to numerous forms of fraud and corruption
within SITA, at the expense of improving service delivery to citizens of South African
[8]. Today, corruption and fraud cases are killing the dreams for a better South Africa
for many citizens of South Africa [30], [31]. The various forms of fraud and corruption
at SITA include but are not limited to extortion, bribery, nepotism, embezzlement, fa-
vouritism, abuse of power, collusion and over-or under-invoicing [8].

In reply to the many failures of corporations around the world, regulatory and legis-
lative changes were developed in numerous countries [3]. The Sarbanes-Oxley Act of
2002 (in the US) was developed to return confidence to capital markets in the US and
internationally [3]. Sceptics argue that compliance efforts are costly, timely and cause
overregulation [9, 10]. These efforts in many cases lack business value. Adherence to
these measures cannot be enforced, are ineffective, unnecessary and at best are seen as
an overreaction to the Enron failure [11].

In this article, the authors develop a theoretical framework that utilize electronic,
cost-effective means in favor of good corporate governance and business value, assert-
ing that not all corporate governance problems can be resolved with IT or IT automa-
tion. Technology increases transparency, information delivery, accountability, pro-
motes efficiency and offers various levels of security [32]. A theoretical framework for
effective and improved corporate governance is developed by making use of a BPMS
approach that introduces automation, enforced compliance and electronic monitoring
to address the issues raised. However, it is unknown what the requirements and com-
ponents are for a framework like this, therefore the following research question:

What are the requirements and components of a theoretical framework for IT-
enabled and IT-enforced corporate governance compliance when using a BPMS ap-
proach?

## 2 Business Process Management Systems and its Architectural Components

A BPMS is defined as a general software information system which is used for the
management and automation of organisational processes [12]. A process is defined as
a collection of activities that takes various forms of input and generates value for a
customer [13]. A BPMS allows for rapid changes in business processes in an organi-
sation in a real-time business environment [14].

A BPMS consists of the *BPM Engine*, the *Database or Repository*, *Process model-ing*, *Software integration engine*, *Business rules* and *Frameshifters and Templates*, as illustrated in Fig. 1:
<figure><img src="image_2.png" /><figcaption>Fig 1: A BPMS and its architectural components [15][16]</figcaption></figure>

## 3 Theoretical Underpinning

A summary of the “dynamics capabilities theory of IT-enabled organisational performance” by Schwarz et al. [1] is offered in this section. This theory functions as the theoretical underpinning for the research study.

A business process is: “the specific ordering of work activities across time and space (or place), with a beginning and end, and clearly identified inputs and output” [17]. In the context of this study which is focused IT-enforced and IT-enabled business processes through automation, IT-enforced and IT-enabled business processes can be defined as the extent to which IT enforces and enables “the specific ordering of work activities across time and space (or place), with a beginning, an end and clearly identified inputs and outputs” (adapted from Davenport [17]).

Schwarz et al. [1] advocate that IT resources (including business applications) are responsible for the creation of automated or IT-enabled business processes, as depicted in Fig. 2. Automated processes is the degree to which IT allows for the specific ordering of business activities across space and time [1]. These activities have a beginning and an end with recognized inputs and outputs [1].

<figure><img src="image_3.png" /><figcaption>Fig. 2: A Dynamics Capabilities Theory Model: Information Technology-Enabled Organisational Performance [1]</figcaption></figure>
According to Schwarz et al. [1] automated business processes self, do not lead to gains in organisational performance, but it is the gains in operational efficiency through automated business processes that cause operational performance [1]. This is called the operational efficiency of business processes.

The theory model of Schwarz et al. [1] is appropriate to guide and inform this re-
search project, because the theory model later introduces a corporate governance di-
mension and perspective to the existing model, when demonstrating how business per-
formance and corporate governance are bettered through automated IT-enforced and
IT-enabled business processes using a BPMS (an electronic IT business application) in
the organisation.

4 Research Methodology

To conduct the research, which was to investigate how to utilize a BPMSs and its com-
ponents for improved corporate governance, the researchers used qualitative methods
and followed an interpretive research paradigm approach. Case studies of seven South
African companies (of varying industry sectors and sizes) that uses BPMS software and
one South African BPMS software vendor company were involved. Case study research
allows for a wider understanding of the research phenomenon through in-depth analysis
and review [18], [19]. Case study research informs the interpretive research stance well
and have the potential to improve on practice-based problems [18],[19].

Data was collected through surveys and interviews at the BPMS vendor company. This involved 12 developers (24%), 8 trainers (16%), 14 business analysts (29%), 12 managers (24%) and 3 other positions (7%). Data at the BPMS user companies, was also collected through surveys and interviews. This involved 17 business analysts (68%), 2 general managers (8%) and 6 IT managers (24%). In all of the case studies, the participants represent different genders, social backgrounds and language groups.

The data was systematically coded into categories and themes as it emerged from
the various case studies (thematic analysis), using the constant comparative method
[20].

Triangulation between findings of the seven BPMS user case study companies and the BPMS vendor case study company was applied to increase the validity and credibility of the research results, also providing a richer description of the research phenomenon and eliminating research bias [21]. Furthermore, in this study, triangulation assisted to present a more plausible and richer account of a research phenomenon [21].

Finally, the theory of Schwarz et al. [1], namely “dynamics capabilities theory model of IT-enabled organisational performance”, was used to synthesize the research results and to provide the base for developing a theoretical framework for IT-enforced and IT-enabled business processes for the improvement of business performance and corporate governance.
# 5 A Framework for IT-enabled and IT-enforced Compliance

This section describes a theoretical framework for IT-enabled and IT-enforced corporate governance compliance following a BPMS approach, as depicted in Fig. 3. The theoretical framework was developed from the research findings obtained from seven companies that uses BPMS software and a BPMS vendor company, while the theory of Schwarz et al. [1] was used as underlying theory to synthesize the different stages of the theoretical framework.

<figure><img src="image_4.png" /><figcaption>**Fig 3:** A theoretical framework for IT-enabled and IT-enforced compliance following a BPMS approach</figcaption></figure>

IT resources (see 1 in Fig. 3) consists out of technological artefacts and human agents that develop, configure, design and adapt the technological artefact for a specific purpose in the organisation. In this case, the artefact is a BPMS that is used in the automation of organisational processes. The result is IT-enforced and IT-enabled business processes managed by a BPMS.

IT-enforced and IT-enabled business processes is then used by users (see 2 in Fig. 3), which results in improved process governance and performance (see 3 in Fig. 3). Technological resource support is an essential condition for improved and automated process governance and performance. The efficient enforcement and ordering of work activities cannot be accomplished without these resources.

The control and efficiency gains of automated processes lead to improved governance, compliance, control and operational performance (see 4 in Fig. 3), particularly if aligned strategically to the objectives of the business [1]. These aspects improves organisational competitiveness.

To conclude, to adapt to the changing and flexible environments that businesses face, IT-resources need to adapt tactically to cater for the environmental changes, therefore the feedback loops in the theoretical framework, as indicated in Fig. 3. Furthermore, automated processes on a tactical and strategic level, must be adaptable to handle the dynamic, changing and competitive environments that organisations face for improvements in business compliance, control and performance [1]. The components of the theoretical framework (Fig 3) are now explained.

## 5.1 Context – Interplay of situated forces

There are continuous contextual forces, called situated forces that impact the design and usage of an IT artefact. Therefore, when such an artefact is designed and used for
better corporate governance, the contextual forces will also impact the artefact when it
is designed and used for the purpose to improve corporate governance.

Various frameworks and checklist have been developed as a way of categorizing
possible contextual forces that may impact an organisation. For example, A PEST anal-
ysis classifies situated forces as political, economic, social and technological. Two ex-
tra forces may be added, namely environmental and legal, to make the analysis a
PESTEL analysis, as showed in Fig. 4. The impact of each force on the organization
and their interplay with each other are studied and examined during a PESTEL analysis.
The forces influence organizational governance. Situated forces outside and inside the
organization must be understood better to manage them better with an IT artefact, such
as a BPMS, in support of corporate governance [23].

<figure><img src="image_5.png" /><figcaption>Fig 4: Context – interplay of situated forces</figcaption></figure>

Furthermore, an IT artefact, such as a BPMS, is embedded in various intersecting
social systems [24]. BPMS use within an organisation cause behavioural changes in
organisations and therefore, BPMS use may also cause corporate governance support-
ive or anti-supportive behavioural changes in the intersecting and overlapping social
systems of an organization. For example, investors outside an organization may have
better trust in an organization, if they know there are good corporate governance sup-
portive measures and practices in place.

## 5.2 Phase 1: IT Resources

As stated before, a generic software system, such as a BPMS can be used to manage,
configure design and execute organizational processes. (cf. Section 4). Orlikowski and
Iacono [22] state, when using an IT artefact such as a BPMS, one must admit that it
consist out of several components which may be fragile and fragmentary (cf. Section
4). A BPMS consist out of several architectural components namely the Process Mod-
eller, the BPM Engine, the Software Integration Engine, the Business Rule Engine,
Monitoring (Reporting Engine) and the Database or BPM Repository.

The technology, in its context, is typically configured by human agents called the
designers of the technology [24]. A technology therefore start to exist through human
creative action [25]. The technology is further sustained through on-going human adap-
tion and maintenance [25]. The technology designers, even under organizational di-
rective, make use of their situated knowledge and assumptions of the world when con-
figuring the technology for as specific context [24]. In other words, the technology
designers, proactively bring forth their own situated organizational realities of “how
things are” by using their own interpretive schemes, norms (including corporate gov-
ernance directives and principles) and organisational facilities, despite the reality of
how things really are [24]. Designers are therefore constrained by existing organiza-
tional structures, organizational norms, reality and by their own sense making.

<figure><img src="image_6.png" /><figcaption>Fig 5: IT resources configure and design the BPMS</figcaption></figure>

However, there are limits when inscribing norms and principles (e.g. King [11, 26, 27]) into a BPMS for better corporate governance. Business rules that are vague, ad-hoc, unstructured and abnormally complex may be difficult to configure or inscribe in a technology such as a BPMS by technology designers or users.

On the other hand, a technological artefact, such as a BPMS may address problems
for which solutions are logical, structured and programmable very well during the in-
scribing or configuration process. Programming involves externalised (not tacit), ex-
plicit, structured and logical solutions.

**5.3 Phase 2: IT-enabled and IT- enforced business processes**

This study investigated how to inscribe norms, such as principles of good corporate
governance into the architectural components of a BPMS. Now, when users (human
agents) use the system, they draw on the inscribed and configured properties (by de-
signers and users) of the IT artefact [24], as depicted in Fig. 6.

Users also draw on their own experiences, assumptions, power, abilities, skills, training, knowledge and expectations linked to BPMS use [24]. Finally, users, when using the IT artefact, may also draw on the situated facilities within their working and living contexts that is associated with social and cultural conventions [24]. In this manner, situated use of the BPMS, inscribed and configured (in this case also with corporate governance norms), becomes institutionalised in the organisational context, resulting in IT-enforced and automated processes.
<figure><img src="image_7.png" /><figcaption>Fig 6: Situated BPMS use</figcaption></figure>

**5.4 Phase 3: Business process governance and performance**

Orlikowski [24] states that the continuous use or enactment of an organizational tech-
nology, such as a BPMS, strengthens that technology in the organisation. After a while,
the technology becomes routinised and regularised (standard) through repeated and ha-
bitual use. The continuous use of the same technology reinforce that technology in the
organisation [24]. The technology, in such a way becomes taken for granted within the
organization [24]. The technology now dictates behaviour so that it becomes an inter-
pretive template for those that makes use of the IT artefact [24]. With regards to cor-
porate governance, the BPMS acts as a corporate governance behavioural template, as
indicated in Fig. 7.

However, when technology designers or users configure or inscribe the technology,
the outcome when the technology is used, may be different from that as what was orig-
inally anticipated. Then re-design or corrective action need to take place by the design-
ers of the technology, so that the users can use the technology in its anticipated and
intended way. In the case of corporate governance, to achieve the anticipated and de-
sired supportive governance behaviours. Corrective intervention is illustrated by a feed-
back loop in Fig.7, to accomplish the correct anticipated supportive governance behav-
iour, going back to the first phase.
<figure><img src="image_8.png" /><figcaption>**Fig 7:** Corporate governance supportive structure</figcaption></figure>

**5.5 Phase 4: Improved corporate governance and organisational performance**

The theoretical framework developed from this research caters for continuous change, as the designers and users reconfigure the technology (the BPMS) for organizational improvement [22][24]. Reconfiguration also occurs when users alter their habits of use or as economic, political and social practices (environmental forces) play out [22][24]. The findings of the research shows that organisational behaviour, different than expected may occur. As consequence, there may be various iterations of reconfiguration or inscribing to resolve the issues. One can therefore argue that the nature and role of BPMS's towards corporate governance is one of continuous improvement.

Continuous enhancement of IT-enabled (automated) organizational processes cause enforced and improved compliance to corporate governance objectives (acts, rules, legislation, etc.), business strategy and other business initiatives that may have value. Because of improved compliance to standardised processes (all process instances are performed in similar fashion), there may be fewer process exceptions and therefore better risk management.

The research also shows that BPMS use, for improved corporate governance, resulted in behaviour supportive of corporate governance. This may result in contextual best practices for corporate governance.

On the other hand, in manual processes (not automated), there are reduced control, reduced monitoring, less process compliance, less corporate governance supportive behaviour, poorer risk management, etc., that will end in less best practices for corporate governance.

However, corporate governance initiatives must still be aligned to corporate strategy and business value initiatives for the corporation to perform better. If a corporation performs well in corporate governance and is still not aligned to value initiatives of the business (e.g. alignment to the strategic business objectives), the organisation have a greater risk to fail or perform poorly.

Long-term decisions making and activity planning within an organisation occurs on the strategic planning (SP) level of the organisation. The medium-term activities of the
organisation is controlled on the management control (MC) level (middle manage-
ment). Finally, the short-term activities is controlled within the operational control
(OC) level. As result, the scope of each function in an organisation narrows as one
moves down in the organisational hierarchy [28]. The operational-level (bottom-level)
managers deal with more detailed and complete data and shorter time spans than stra-
tegic-level (top-level) managers.

The result is that decisions making and control in upper levels are more unstructured
while at the lower levels it is more concrete and structured [28]. As consequence, a
BPMS may better support and enforce corporate governance at operational levels of the
organisation, where processes and information are more concrete, structured and easier
to automate, inscribe and configure in a BPMS.

<figure><img src="image_9.png" /><figcaption>Fig 9: Implications of using a BPMS in support of corporate governance</figcaption></figure>

To conclude, a holistic organisational approach to corporate governance, will con-
tribute to make the theoretical framework for IT-enabled and IT-enforced corporate
governance in organisations successful. A holistic approach to corporate governance
may include aspects and enablers such as change management, top-management sup-
port, leadership, resources to support the process system, a process and process thinking
culture and policies.

**6 Conclusion**

This paper proposed a theoretical framework for IT-enabled and IT-enforced corporate
governance, by applying a BPMS perspective. In answering the research question: The
components of a theoretical framework for IT-enabled and IT-enforced corporate gov-
ernance compliance when using a BPMS approach consist of an inscribing and auto-
mation component (Phases 1 and 2), an organisation performance component (Phases
3 and 4), a feedback component and a contextual influence component (Context), which
requires a holistic organisational approach to corporate governance, which may include
aspects such as leadership, resources, top-management support and change manage-
ment to support the process system.

The practical and theoretical contribution of this research lies in explaining the com-
ponents, insights and facets of a theoretical framework for IT-enabled and IT-enforced
corporate governance compliance, drawn from Orlikowski's [24] work to study and
address fraud, misconduct, corporate corruption and other corporate governance weak-
nesses.

References

1. Schwarz, A., Kalika, M., Kefi, H., Schwarz, C.: A Dynamic Capabilities Approach to Understanding the Impact of IT-Enabled Businesses Processes and IT-Business Alignment on the Strategic and Operational Performance of the Firm. Communications of the Association for Information Systems. 26(4), (2010).

2. Bajagai, R.K., Keshari, R.K., Bhetwal, P., Sah, R.S., Jha, R.N.: Impact of Ownership Structure and Corporate Governance on Capital Structure of Nepalese Listed Companies. In: Rajagopal and Behl, R. (eds.) Business Governance and Society. pp. 399–419. Springer International Publishing, Cham (2019).

3. Hough, J., Thompson, A., Strickland, A., Gamble, J.: Crafting and Executing Strategy (South African Edition). McGraw-Hill, Berkshire (2010).

4. Kreitner, R., Kinicki, A.: Organisational Behaviour. McGraw-Hill, New York (2018).

5. Michell, L.: Corporate irresponsibility: America's newest export. Yale University Press, New Haven, CT (2001).

6. Weeke, S.: Parma's god falls from the sky, (2019).

7. Jarvis, K.: IT vendors take rap for corruption. GovermentIT. 1(3), pp. 13 (2009).

8. Mtimunye, M.: SITA lays fraud and corruption ghosts to rest. GovermentIT. 1(3), pp. 15–16 (2009).

9. Kaplan, S., Holmstrom, B.: The State of U.S. Corporate Governance: What's Right and What's Wrong? The National Bureau of Economic Research (2003).

10. Park, D.: Overregulation, The Final Straw For Aspiring Entrepreneurs. In: Capitalism in the 21st Century Why Global Capitalism Is Broken and How It Can Be Fixed. pp. 107–110. World Scientific Publishing Co. Pte. Ltd (2019).

11. King III Report: King Code of Corporate Governance in South Africa 2009 and the King Report of Corporate Governance in South Africa. Institute of Directors in Southern Africa, Johannesburg, South Africa (2009).

12. Weske, M., Van der Aalst, W., Berbeek, H.: Advances in business process management. Data & Knowledge Engineering. 50, pp. 1–8 (2004).

13. Hammer, M., Champy, J.: Reengineering the Corporation: A Manifesto for Business Rev-
olution. Harper Business, New York (2006).

14. McGoveran, D.: Enterprise integrity. BPMS Concepts, Part1-8. EAI Journal. January-August 2001, (2001).

15. Business Process Trends: https://www.bptrends.com/bpt/wp-content/uploads/01-20-14-BPMSEvalART-Miers-Harmon.pdf, last accessed 2020/1/6.
16. Business Process Trends - The 2007 BPM Suites Report: http://www.bptrends.com/reports_landing.cfm, last accessed 2020/1/6.

17. Davenport, T.H.: Process innovation: reengineering work through information technology. Harvard Business School Press, Boston, Mass (1993).

18. Kwon, T., Zmud, R.: Unifying the Fragmented Models of Information System' Implementation. In: Critical Issues in Information Systems Research. Wiley and Sons, New York (1987).

19. Schultze, U., Orlikowski, W.J.: A Practice Perspective on Technology-Mediated Network Relations: The Use of Internet-Based Self-Serve Technologies. Information Systems Research. 15(1), pp. 87–106 (2004).

20. Strauss, A., Corbin, J.: Basics of Qualitative Research: Grounded Theory Procedures and Techniques. SAGE, Newbury Park, CA (2014).

21. Jonny Hollard Homepage - How to combine multiple research methods: Practical Triangulation. http://johnnyholland.org/2009/08/practical-triangulation/, last accessed 2020/1/6.

22. Orlikowski, W., Iacono, C.: Research Commentary: Desperately Seeking the “IT” in IT Research - A Call to Theorizing the IT Artifact. Information Systems Research. 12(2), pp. 121–134 (2001).

23. Pearce, J., Robinson, R.: Strategic Management. McGraw-Hill, New York (2014).

24. Orlikowski, W.J.: Using Technology and Constituting Structures: A Practice Lens for Studying Technology in Organizations. Organization Science. 11(4), pp. 404–428 (2000).

25. Orlikowski, W.: The duality of technology: rethinking the concept of technology in organisations. Organization Science. 3(3), pp. 298–427 (1992).

26. King I Report: The King Report on Corporate Governance for South Africa. Institute of Directors in Southern Africa, Johannesburg, South Africa (1994).

27. King II Report: The King Report on Corporate Governance for South Africa. Institute of Directors in Southern Africa, Johannesburg, South Africa (2002).

28. Ahituv, N., Neumann, S., Riley, H.: Principles of Information Systems for Management. Wm C Brown Communications, Dubuque, USA (1994).

29. Financier Worldwide: https://www.financierworldwide.com/annual-review-corporate-fraud-corruption-2019#.XhRD1vzRbIU, last accessed 2020/1/6.

30. GAN - Business Anti-Corruption Portal: https://www.ganintegrity.com/portal/country-profiles/south-africa/, last accessed 2020/1/6.

31. The University of the Witwatersrand: https://www.wits.ac.za/news/latest-news/opinion/2019/2019-09/why-corruption-killed-dreams-of-a-better-south-africa.html, last accessed 2020/1/6.

32. Diligent Insights: https://insights.diligent.com/corporate-governance/achieving-strong-corporate-governance-through-technology, last accessed 2020/1/6.