## 4 Discussion, Limitations, Conclusions, and Future Works  
The Compliance Evaluation Sheets provide the first set of findings. As stated earlier, the average value of the satisfaction and contribution are higher in Phase II after use, indicating that the framework is positive in the dimensions under consideration. This is probably the most significant outcome of the study, considering this was the aim of this work. Anyhow, it should be noted that, according to the variable of satisfaction on compliance management in the cloud, it is possible that the most significant variable in the questionnaire, apart from a better score (reaching 4.10 from the prior value of 3.52), the standard deviation, was also lower (.625 compared to 0.814). This situation can be seen in the satisfaction with the cloud service too, but provided less variations in the standard deviation scores. The improvement in satisfaction and involvement of the framework is supported by the fact that there were significant differences in three of the four variables analyzed when comparing the pre and post scenarios (satisfaction on compliance management in CC, t (20) = \(-2.553\), \(p\) < 0.05; contribution of compliance management in CC to IT quality of service, t (20) = \(-3.255\), \(p\) < 0.05; and contribution of compliance management in CC to the organizational compliance management, t (20) = \(-3.960\), \(p\) < 0.05). Anyhow, it should be noted that the employment of the framework did not influence the satisfaction of the cloud service in a noteworthy way. Since the mean was enhanced and the standard deviation was slightly lower, it was not statistically significant according to the Student T test results (t (20) = \(-1.639\), \(p\) > 0.05). Regarding the limitations and threats of validity, the construction of the framework was performed using qualitative methods and threats of validity must be analyzed from this viewpoint. Regarding credibility (as opposed to internal validity of quantitative research), the authors underline that the variety of organizations involved in the construction reduce their influence in the results. Moreover, experts present comparable levels of competence. This leads us to the asseveration that the results are credible from the participants' viewpoint to believably rule out different explanations. With regards to transferability (external validity in quantitative approaches), again the limited number of subjects in the construction of the framework could harm its transferability. However, again, their comparable level of knowledge and experience improves the generalizability of the artefacts. On the other hand, subjects were invited and selected in a non-random way, so generalization is \begin{table}
\begin{tabular}{c c c} \hline \hline
**Metric** & **Phase I** & **Phase II** \\ \hline Avg. time between identification of external compliance issues and resolution & 42 & 40 \\ \# of compliance issues where employees seek guidance/assistance & 15.5 & 15.5 \\ \# of reports of alleged or actual compliance violations & 82 & 59.5 \\ \% of compliance opportunities implemented & 74.5 & 78.5 \\ Yearly compliance reviews & 9 & 9 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Compliance metrics, comparison of phases. Inter case. not guaranteed; however, replication is possible given the relatively common conditions in which it was defined. Finally, concerning confirmability (statistical conclusion validity in the quantitative arena), the authors assigned an external auditor in the process to increase the extent in which results could be corroborated. The validation of the framework was conducted by means of two case studies using quantitative approaches. This needs to be analyzed from the perspective of common quantitative threats. With regards to content validity, the instrument was developed considering current scientific literature, but was also assessed by experts to ensure its content validity.