Keywords

1 Introduction

Over the years IT has globally influenced how organisations conduct their businesses and municipalities are not exempted from such impacts (Christiansen, 2013). As a result of the fundamental challenges that the world faces, all aspects of modern life are influenced by IT in one way or another (Lloyd, 2004). The development and evolution of IT has influenced how data and information are processed, which then impacts the decision-making processes within corporate spaces (Khemakhem & Fontaine, 2019).

The advent of IT has come with various advantages and disadvantages (Joseph, 2015), which the South African government has also been subjected to. Such advantages include improved productivity, decreased expenses (Grant & Chau, 2005; Mostert & Mutula, 2010) accelerating revenue flows (Tarek et al., 2017) improved information quality (Barnes & Vidgen, 2006) improved promotion of good governance (Bertot et al., 2010) ability to stamp out corrupt and fraudulent activities within organisations (Bertot et al., 2010; Sabani et al., 2019) and enabling innovation (Ravichandran et al., 2017). Kim et al. (2017) and Al-Salmi and Hasnan (2015) believe that the adoption of IT embedded with such advantages will significantly enhance the operational capacity of an organisation.

However, the lack or non-adoption of governance principles might contribute to the perception that IT is adding little or no organisational value despite substantial investments being made (Marnewick & Labuschagne, 2011). Riggins and Wamba (2015); Ndou (2004) highlights that there are significant challenges concerning the adoption and implementation of IT in government, accentuating the lack of skills in the public sector as a significant obstacle. Bakunzibake et al. (2019) emphasise change management as a key challenge to the successful implementation of IT. This constantly changing environment calls for effective governance, risk management and controls, such as cyber security management. Inuwa et al. (2019) believe that ungoverned IT can provide opportunities for corrupt bureaucrats to misuse it for personal gains. Effective governance not only relates to policies but also includes the culture and tone at the top of the governing body and the effectiveness of governance structures (such as internal auditing) in assisting with the assessment of IT related processes. However, with the increased adoption of IT in municipalities, there is limited research on the effectiveness of audit committee in IT governance. Through the lenses of agency theory, the study provides empirical evidence on the effectiveness of audit committees in IT governance and highlights the importance of building the minimum required skills and capacity for audit committee members in IT governance.

The paper begins by outlining the literature review and theory for the study, discussing IT as a concept, IT governance and the impact of effective IT governance. The study then discusses IT risk management and value delivery. Next, the theory on audit committee is discussed. Followed by examining the effectiveness of the audit committee pertaining to IT. The paper then describes the research design and approach, after which the research findings are presented. Finally, the paper provides concluding remarks and identifies areas for future research.

2 Literature Review and Agency Theory

As a result of the competitive advantage derived from the use of technologies, organisations have since adopted IT as key function of the business. Organisational reliance on IT resulted in challenges, to an extent that corporate governance cannot be addressed without IT governance being considered (Van Grembergen & De Haes, 2007). IT governance is cited as a strategic issue that requires commitment at a strategic level (Mohamed, 2012). Mikalef et al. (2018) support this, arguing that IT governance has been elevated to a primary concern for senior IT officials and business management. It is for these reasons that IT governance is high on the agenda of many organisations (Ali & Green, 2012) and it has similarly received much attention in academic spaces. This is evident in the variety of scholarly definitions of IT governance that exists in the literature the lack of consensus is apparent (Lee & Lee, 2009).

A variety of scholarly definitions of IT governance available, however according to Webb et al. (2006) that the various definitions do not all reflect crucial elements of the IT governance framework, possibly indicating that authors develop definitions that support their focus at the time of their research. Carr and Hayes (2015) and Alves et al. (2013) say although there is no commonly accepted definition of IT governance, commonly agreed upon definition of IT governance would be very useful and serve to develop and refine IT governance frameworks. These frameworks, as depicted in Fig. 1, would outline the processes and structures that have been put in place that enable IT and business to meet their objectives in terms of risk, resources and performance management while aligning with the business’ strategic objectives to enable the business to derive value from its IT investments. The effective functioning of the IT governance framework is reliant on the IT governance structures in place, as depicted in the Fig. 1 below. Audit committee is one of the key pillars of governance in any organisation.

Fig. 1
A cycle diagram presents an I T governance framework and model. It begins with strategic alignment, followed by value delivery, risk management, resource management, and performance management, and then returns to strategic alignment.

IT Governance Framework and Model. Source: IT Governance Framework and Model, 2020

Full size image

2.1 Governance and Audit Committees

Governance structures and processes are crucial for fostering transparency, accountability, and effective decision-making within organizations (Ananny & Crawford, 2018). Within governance framework, the audit committee holds a key role as part of governance, overseeing and providing guidance on various aspects of organizational operations, including IT governance. IT governance encompasses the framework and processes through which an organization manages and controls its IT systems and operations (Weill & Ross, 2004). The audit committee’s responsibility lies in ensuring the presence of appropriate controls and processes that align IT strategically with business needs and objectives, deliver value through IT investments, identify, and manage IT risks effectively, and promote efficient resource and performance management (Iliescu, 2010).

To effectively fulfil their responsibilities, the audit committee must possess the necessary qualifications and skills in IT governance, as emphasized by Chen et al. (2022a, 2022b). This expertise enables audit committee members to comprehend and evaluate IT-related risks and controls, as highlighted by Lankton et al. (2021). The existing literature mainly discuss the importance of expertise and skills in audit committees, but there is limited studies which address IT governance skills. Several studies, including those by Ojeka et al. (2021) and Hadden and Hermanson (2003), emphasize the importance of including IT risk and control discussions in the audit committee agendas. Omer et al. (2020) further assert that the audit committee must have a solid understanding of IT risk management and controls. Additionally, Brand (2016) emphasizes the significance of conducting independent IT audits at regular intervals, separate from financial audits. This separation allows the internal audit function to provide objective and independent evaluations of IT controls and processes, serving as a source of assurance for the audit committee. The capacity and effectiveness of the internal audit function are crucial considerations for the audit committee in fulfilling its responsibilities.

The audit committee plays an advisory role in evaluating the adequacy of disaster recovery and continuity plans, ensuring the organization has robust measures in place to mitigate IT-related disruptions and protect critical systems and data (Contessotto & Moroney, 2014). Additionally, the audit committee actively supports management in addressing IT risks by regularly testing and evaluating cyber security threats, recovery plans, systems, and processes through the internal audit function (Zanzig & Francia III, 2022). However, while having a well-resourced internal audit function is important, it may not be sufficient for providing valuable if the audit plans are not reviewed and approved by the audit committee. (Herdan, 2008). To address this, the audit committee should review the internal audit function’s plans to ensure adequate coverage of IT governance, risks, and controls, as highlighted by Abbott et al. (2010). This assessment helps identify any gaps or areas that require additional attention in the governance of IT within the organization. However, there is a gap in the literature regarding how effective the audit committee is in executing their IT governance role, especially in the South African local municipality context.

2.2 Agency Theory & the Role of Audit Committee in Enhancing IT Governance

The audit committee is a board subcommittee responsible for matters relating to financial reporting and audits (Oji & Ofoegbu, 2017; Spira, 2003). Agency theory, which postulates that conflicts of interest between management and shareholders can arise due to divergent objectives and information asymmetry (McColgan, 2001), can be a useful lens to study IT governance and the role of audit committees in organisations. The literature review in this study highlights the importance of IT governance in maximising the value of IT investments, managing IT risks, and ensuring the overall effectiveness of an organisation’s IT systems. In the context of agency theory, these issues can be viewed as potential conflicts between managers, who may seek to maximise their own utility and shareholders, who desire maximum value from their investments.

The role of the audit committee in IT governance can be understood through the lens of agency theory as a mechanism to align the interests of management and shareholders by providing oversight and guidance on IT risk management, internal controls, and IT investment decisions (DeZoort et al., 2002; Moloi, 2014; Oji & Ofoegbu, 2017). The audit committee’s expertise in IT and cybersecurity (Ashraf et al., 2020; Legodi, 2021) helps to mitigate the information asymmetry that can exist between management and shareholders with respect to IT-related decisions, thereby reducing the potential for conflicts of interest.

The literature review also highlights the need for a more integrated approach to IT governance, risk management and control, in which the audit committee plays a central role. This aligns with the agency theory perspective that calls for monitoring mechanisms to mitigate conflicts of interest and ensure that management actions are consistent with shareholder interests (Jensen & Meckling, 1976; Fama & Jensen, 1983; McColgan, 2001). By overseeing IT risks and controls, as well as promoting good IT governance practices, the audit committee can help to ensure that management’s actions align with the strategic objectives of the organisation, which ultimately benefits shareholders.

Furthermore, the literature review emphasises the importance of IT audit specialists and the use of computer-assisted audit techniques (CAATs) in enhancing the effectiveness of internal audit processes (Janvrin et al., 2008; Asniarti & Muda, 2019). In the context of agency theory, these tools and specialists can be seen as additional mechanisms to reduce information asymmetry and provide greater assurance to shareholders that management is effectively managing IT risks and controls.

The agency theory provides a useful framework for understanding the role of the audit committee in IT governance and the mechanisms through which it can help to align management and shareholder interests. By providing oversight, guidance and expertise in IT-related matters, the audit committee serves as a crucial monitoring mechanism to mitigate potential conflicts of interest and ensure the effective management of IT resources and risks within the organisation.

An effective audit committee needs competent and qualified members with the authority and resources to protect stakeholder interests by ensuring reliable financial reporting, internal controls and risk management through its diligent oversight efforts (Moloi, 2014; DeZoort et al., 2002). According to Roussy and Rodrigue (2018) and Moorthy et al. (2011), the audit committee is ultimately responsible for implementing governance structures to evaluate the effectiveness of an organisation’s internal control systems, identify errors and inefficiencies and design system controls that prevent defects. However, the role of the audit committee has evolved over the years since the emergence of IT. As a result, IT expertise has become an integral component of the audit committee’s skill set that is essential to its effective advisory and oversight role.

Ashraf et al. (2020) examined whether IT expertise of audit committees impact the reliability and timeliness of financial reporting through the difference-in-differences analysis. The study found that audit committee IT expertise resulted in a reduction in the likelihood of material restatement and a reduction in the likelihood of IT-related material weaknesses. The findings supported their assertion that the quality of financial reporting is significantly improved by the presence of an IT expert in the audit committee.

Additionally, audit committees IT skills must include cyber security insight (Legodi, 2021). Ojeka et al. (2017) shared similar sentiments rising from their study that assessed whether a relationship exists between cyber security and audit committee effectiveness using audit committee independence, technological expertise, and financial expertise characteristics as independent variables. The variable used to measure the dependent variable is cyber security compliance. 13 banks listed on the Nigerian stock exchange were selected. The empirical analysis was carried out using product moment correlation and ordinary least square regression analysis methods. The results showed that audit committee characteristics measured by independence, financial expertise and technological expertise all have a nonsignificant negative relationship to cyber security in the Nigerian banking sector. The study recommended that the composition of the audit committee in Nigeria be worked on to deliberately incorporate needed technological and financial experts who can ask probing questions and offer their wealth of experience in safeguarding the shareholder’s interest. The severe impacts of cybercrime and the growth of cyber threats have resulted in a need for organisations’ boards of directors to be involved in IT governance (Corradini, 2020); such involvement by the board may better equip the organisation to deal effectively with the challenges that come with IT. However, little is known about the audit committee’s role in IT governance (Lankton et al., 2021).

In organisations, a documented audit committee charter defines the purpose, structure, internal controls and roles and responsibilities of audit committee members (Deloitte, 2017). Lankton et al. (2021) investigated the influence of security breaches and board-level technology committees on disclosing IT general controls roles in the audit committee charter using efficiency and institutional theories using a sample of 189 firms. The finding pointed out that those organisations with an IT committee that experienced a data breach are more likely to disclose IT governance roles in the audit committee charter. The findings suggest that firms experiencing a data breach realise their vulnerability and because they already have oversight at the board level, it is more natural for them to increase oversight by assigning IT governance roles to the audit committee.

The audit committee should scrutinise IT-related risks (Ashraf et al., 2020). Turel et al. (2017); Ramamoorti and Weidenmier (2004) point out that the role of the audit committee and internal auditors nowadays lies in scrutinising IT solutions brought into the business environment (Abu-Musa, 2008). An audit committee should be a team of experts with sufficient skills, abilities and knowledge to recommend the most effective systems (Chen & Komal, 2018; Bierstaker et al., 2001). In other words, most authors suggest that the audit committee should now move from the traditional role of only overseeing accounting reports and principles to include overseeing the IT solutions of an organisation (CFA Institute, 2021; Moorthy et al., 2011; Jackson, 2004).

According to Moorthy et al. (2011), the change of role for the audit committee has been a challenge. Huff et al. (2006) conducted a study to determine if the audit committee gives attention to their new roles related to IT governance. Their study interviewed board chairs and members of 17 medium-to-large corporations, most with global operations. The findings suggested that the audit committee is not allocating adequate attention to its role in IT governance. The study further suggests ways in which the audit committee can adopt and adapt to the newly transferred oversight role in IT governance, one of them being to include IT controls and risk as agenda items for discussion in board meetings. Legodi (2021) concurs to the recommendation, stating that IT should be a standing agenda item in the audit committee meetings (Legodi, 2021). This recommendation is in line with the guidelines of King IV, that the audit committee should discuss the IT related risks and controls (IoD, 2010).

According to Moorthy et al. (2011), the audit committee is ultimately responsible for implementing governance structures to evaluate the effectiveness of an organisation’s internal control systems, identify errors and inefficiencies and design system controls that prevent defects. This applies even with regard to IT control environments. With the increasing adoption of information systems and technology, independent IT audits should be carried out at regular intervals and given special attention (Byrnes et al., 2018). Internal audit reviews are regarded as audit committee comfort providers (Susanto, 2020). IT audits are regarded as an integral part of internal audits. Thus, the audit committee should discuss these in their meetings and be in a position to support the audit department in being able to conduct the internal audit reviews relating to the IT environment of the municipality. This can be achieved by ensuring that the internal audit department of the municipality has and uses efficient IT audit resources to enable them to review the municipality’s IT related controls effectively and efficiently (Weidenmier & Ramamoorti, 2006). Resources include the use of IT audit specialists where necessary. Janvrin et al. (2008) found that the use of IT specialists is common, even among auditors who are assigned to examine complex IT systems. According to Asniarti and Muda (2019), operational internal audit reviews of IT are improving due to better CAAT use. This may be the root cause of why studies have found that the IT audit may not be conducted to the required level and depth (Hadden et al., 2003).

Muchenje (2013) says that there are advantages to using IT; however, there are inherent business risks that must be managed effectively. According to Tarek et al. (2017), ensuring that the right people oversee IT risks at an organisation is essential and the audit committee is rightfully charged with this oversight role by the charter. The audit committee is responsible for setting the tone for the risk culture in the organisation (Cassidy et al., 2001). Seale (2017) studied factors influencing the decision to adopt an IT risk management framework at universities in South Africa. The study used a deductive approach and found that the key staff members responsible for ratifying the adopted enterprise risk management framework were audit committees, risk committees and senior IT management committees, amongst others.

Furthermore, audit committees should oversee and advise on hardware and software security. Software security should be prioritised in an organisation (Reeder et al., 2017; Mead et al., 2008). Software security measures such as encryption can be used to control access to files, as can firewalls that help give access only to authorised users. Physical security should also be improved, such as by locking doors and restricting computer room access (Alqatamin, 2018). Such physical and software risks and controls, therefore, need to be addressed by the audit committee in fulfilling its fiduciary role (Cohen et al., 2017; Hadden, 2002). The other responsibility of the audit committee is to provide confidence to customers involved in e-commerce transactions with the organisation. Moreover, it is an internal control measure to provide reliable financial statements (Bananuka et al., 2019). In addition, there is enterprise risk management, which the audit committee must deal with in real-time (Ojeka et al., 2017). According to Tarek et al. (2017), ensuring that the right people oversee IT risks at an organisation is always essential.

Therefore, based on the literature review, it is critical that the audit committee has IT knowledge and can provide adequate oversight. Limited studies have been conducted on the effectiveness of audit committee in providing IT governance oversight, especially in the South African local municipality context. Based on the above discussion, the study aims to provide empirical evidence.

on the effectiveness of audit committees in IT governance and highlights the importance of building the minimum required skills and capacity for audit committee members in IT governance.

3 Research Methodology

The data of the audit committee activities in enhancing IT governance were collected by means of a Likert scale survey questionnaire at the Sekhukhune District municipality in the Limpopo province of South Africa. The municipality consists of four local municipalities, namely Fetakgomo/Tubatse, Ephraim Mogale, Elias Motsoaledi and Makhuduthamaga. The questionnaires were distributed to all local municipalities and primarily completed by the audit committee members, internal audit staff, municipal management officials and the operation staff members who are exposed to the work of the audit committees. The largest group of respondents (74.4%) had more than 5 years of working experience in the similar position while 17% consisted of those with at least 3 years’ experience. This indicates that the responses come from knowledgeable and experienced individuals, making them reliable. Furthermore, 44.7% of the respondents have undergraduate qualifications (up to NQF level 7), while 34% possess postgraduate qualifications at NQF level 8 and 21.3% of the respondents hold master’s degrees. Effectively, most respondents have at least the minimum required qualifications for their respective positions. This ensured that the data obtained were reliable to address the research problem and to achieve the research objectives. The target population of the study is displayed in Table 1 below.

Table 1 Target population and sample size in selected municipalities
Full size table

The researcher is knowledgeable about the audit committee activities and their working relationships with other stakeholders; hence, the purposive sampling of stakeholders was used. Participants were drawn from all the municipalities and consisted of the members of the audit committees, the Chief Financial Officers, Accounting Officers, Chief Audit Executives, internal auditors, and the Heads of Departments/divisions.

The study applied positivist paradigm and quantitative methodology. Quantitative research is predicated on the assumption that there is an objective to study, a research problem to examine and an obligation to manage and measure the data collected (Babbie, 2020). Data were analysed through descriptive and inferential statistics employed by the researcher. Stata/SE version 16 software was used to analyse the statistical data obtained through the survey questionnaires.

Descriptive analysis was produced using frequency tables. The chi-square test was used for inferential statistics to measure the significant relationship between two factor variables. The effect factor analysis and correlations were measured to understand how the different underlying factors influence the variance amongst the variables. Exploratory factor analysis was used as the extraction method with varimax rotation conducted to determine the dimensionality of each of the subsections; factors with Eigen values above 1 (Kaizer criterion) were accepted. The Cronbach alpha coefficient was used to determine the internal consistency (reliability) of each of the identified factors using the agreed thresholds stated in the literature as 0.5 (acceptable); 0.6 (satisfactory for exploratory research) and 0.7 (most used instrument) (George & Mallery, 2003).

4 Findings

The literature section of this study outlined the existing literature regarding the role of the audit committee in IT governance. The literature was used to inform the development of the questionnaire used to collect the data on the audit committee activities in enhancing IT governance. The results of the response analysis are presented in Fig. 2 and further discussed in this section.

Fig. 2
A horizontal stacked bar graph of the percentage of respondents who agreed or disagreed on the effectiveness of audit committee activities versus 12 activities. The majority of respondents agree with all activities, with 60.4 percent agreeing on providing adequate I T risk and control coverage.

Descriptive statistical presentation of the responses. Source: Researcher’s own illustration

Full size image

Figure 2 illustrates that a significant majority of respondents (65.9%) agreed or strongly agreed that at least one member of the audit committee must have appropriate qualifications and skills in IT and governance, A larger majority (83.3%) agreed that audit committee meeting agendas include the IT risk and controls as discussion points, 20.4% were neutral, 64.6% agreed that independent IT audits are carried out at regular intervals, 71.5% agreed with the municipality on the appropriateness of its disaster recovery and continuity plans, 51% disagreed with the security audit committee’s substantive reports on the organisation’s top cyber-threat risk management priorities and 38.8% argued that internal audit uses efficient IT audit tools to enable them to effectively review the municipality’s IT related controls. A solid majority of the respondents (68.7%) agreed either way.

The main findings form the results illustrate that participants are concerned about the audit committee’s effectiveness in enhancing IT governance where it concerns cyber security and in ensuring that the internal audit function is adequately resourced and skilled to assist in proving assurance regarding the IT risks and control environment of the municipalities. As outlined in the literature review, Brand (2016) and Abbott et al. (2010), it is important for audit committees to ensure that the internal audit function is adequately resourced to address IT governance issues.

EFA was used to summarise the variables included on the questionnaire and develop factors and make meaningful factors for further analysis. Table 2 presents the factor loadings, and the discussion then follows:

Table 2 Exploratory factor analysis for IT and audit committee
Full size table

Table 2 shows that the audit committee’s influence on the original variables for IT and audit committee is shown to be significant, with two factors accounting for 77.8% of the variance. The first factor is the direct correlation between independent IT audits, management’s top cyber-threat risk management priorities, internal audit tools and internal audit resourced with IT specialists. The second factor is a positive correlation between variables, with at least one member of the audit committee having appropriate qualifications and skills in IT and its governance, activities including IT risk and controls, meetings, discussions, disaster recovery and continuity plans and supports municipality’s efforts to address IT risks. This factor represents the audit committee’s IT governance skills, experience, and expertise.

Table 3 shows that each factor variable had instances where either all the respondents or none of the respondents agreed with the individual variables that were encompassed by the questionnaire’s statements. Instances where not a single participant agreed with the statement should raise red flags because this may be an indication of ineffective performance on the part of the audit committee. The relationship between factor variables was determined using a Pearson correlation coefficient, which indicates the direction and strength of the relationships between the factors (Table 4).

Table 3 Descriptive statistics for factor variables
Full size table
Table 4 The relationship between factor variables correlations
Full size table

The table reveals a strong positive relationship between audit committee IT governance skills, experience and expertise and oversight responsibility. This suggests that more audit committees are more likely to effectively execute their roles and activities in a way that enhances IT governance in the municipalities. These findings are consistent with literature as outlined by Chen et al. (2022a, 2022b) in saying that IT expertise enhances the audit committee’s monitoring ability and oversight of cybersecurity risks.

5 Conclusion and Recommendations

The study found that the audit committee is effectiveness is limited as a result of inadequate IT audits and assurance reviews, under-resourced IT audit department and inadequate auditing tools. Furthermore, statistical analysis revealed a relationship between audit skills and expertise, audit committee interpersonal skills and how the audit committee execute their oversight role in IT governance. These results are consistent with the findings of Ashraf et al. (2020) and Chen et al. (2022a, 2022b), who found that financial and risk monitoring responsibilities are enhanced by the presence of IT governance skills, experience, and expertise. The findings validate the Agency theory to some extent. They suggest that deficiencies in IT audits, under-resourced IT audit departments, inadequate auditing tools, and the importance of audit skills and expertise all influence the effectiveness of audit committees in IT governance. These findings highlight the significance of appropriate monitoring and control mechanisms in mitigating agency problems and aligning the interests of principals and agents within organizations.

In order for audit committees to effectively fulfil their role and responsibilities in IT governance, it is crucial for them to continuously enhance their skills and knowledge in IT risks, particularly cyber threats. Additionally, it is essential for these committees to ensure the efficient functioning of the internal audit function by providing adequate resources, both in terms of technology and human capital, to conduct IT assurance reviews. By doing so, audit committees can effectively contribute to the overall IT governance organizations.

6 Recommendations for Future Research

Audit committee roles could be studied further in South Africa to expand their role beyond traditional internal control, financial reporting, and IT areas. Qualitative research could be used to gain an in-depth understanding of the impact of audit committee activities on local government governance. This could help to identify the strengths and weaknesses of audit committees, as well as improve audit outcomes despite the introduction of Operation Clean Audit Outcomes in 2014. Based on the findings of the study, a study can be conducted to assess the effectiveness of internal audit functions in conduct IT audit assurance, with specific focus in local government.