GOVERNANCE OF THE
EXTENDED ENTERPRISE
Bridging Business and IT Strategies
IT Governance Institute
John Wiley & Sons
class="bi x0 y7 w3 h7"
GOVERNANCE OF THE
EXTENDED ENTERPRISE
class="bi x0 y7 w3 h7"
GOVERNANCE OF THE
EXTENDED ENTERPRISE
Bridging Business and IT Strategies
IT Governance Institute
John Wiley & Sons
This book is printed on acid-free paper.
Copyright © 2005 by the IT Governance Institute. All rights reserved.
Published by John Wiley & Sons, Inc., Hoboken, New Jersey.
Published simultaneously in Canada.
No part of this publication may be reproduced, stored in a retrieval system, or
transmitted in any form or by any means, electronic, mechanical, photocopying,
recording, scanning, or otherwise, except as permitted under Section 107 or 108 of
the 1976 United States Copyright Act, without either the prior written permission
of the Publisher, or authorization through payment of the appropriate per-copy fee
to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923,
978-750-8400, fax 978-646-8600, or on the web at www.copyright.com. Requests to
the Publisher for permission should be addressed to the Permissions Department,
John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, 201-748-6011, fax
201-748-6008, e-mail:
Limit of Liability/Disclaimer of Warranty: While the publisher and author have
used their best efforts in preparing this book, they make no representations or

IT Governance Institute
®
The IT Governance Institute (ITGI) (www.itgi.org) was established in 1998
to advance international thinking and standards in directing and controlling
an enterprise’s information technology. Effective IT governance helps ensure
that IT supports business goals, optimizes business investment in IT, and
appropriately manages IT-related risks and opportunities. The IT Governance
Institute offers symposia, original research, and case studies to assist enter-
prise leaders and boards of directors in their IT governance responsibilities.
Information Systems Audit
and Control Association
®
With more than 35,000 members in more than 100 countries, the Infor-
mation Systems Audit and Control Association (ISACA
®
) (www. isaca.org)
is a recognized worldwide leader in IT governance, control, security, and
assurance. Founded in 1969, ISACA sponsors international conferences,
publishes the Information Systems Control Journal
™
, develops international
information systems auditing and control standards, and administers the
globally respected Certified Information Systems Auditor
™
(CISA
®
) desig-
nation, earned by more than 35,000 professionals since inception, and the
Certified Information Security Manager
™

Governance Challenge 27
vii
Bridging the Gap between the Information Technology
Organization and Internal Clients 28
Making Strategy a Continual Process: Coevolving
and Patching 29
Managing Knowledge for Better Communication:
Knowledge Management 30
Sharing Knowledge through a Knowledge Portal 32
3 Value Creation and Management of Performance in the
Extended Enterprise 35
Vision and Mission 35
Value Creation and Strategy Implications 36
Necessity of a Core Repository of Knowledge Portal 37
Suggested Architecture for Performance Measurement 37
Delegate and Empower through Performance Management 39
Framework for Measurement 40
Control Objectives for Information and Related Technology 43
Monitoring: Measuring and Comparing Outcomes for
Improvements 44
Ongoing Strategy Process: Operational Performance
Monitoring 45
4 Operational Business Activities: Value Realization
for the Extended Enterprise 49
Value Realization 49
Blueprint for Knowledge Sharing in an Extended Enterprise 52
Objectives, Goals, and Expectations 54
Information and Knowledge Resources
(Intangible Business Resources) 54
Information Sharing Activities (Two-way Communication) 57

Establish Information Model and Data Model for
Quick Implementation of a Knowledge Base 102
Appendices
A Questions for the Board and Senior Management 105
B Performance Reference Model 113
C Organizational Structure Evolution: Core versus Central 123
D Framework and Quality Awards 127
E Business Reference Model 137
F Knowledge Work, Knowledge Management, and
Knowledge Portal 143
G Enterprise Architecture Processes at Different
Maturity Levels 151
H Maturity Model for Business Activities in the
Extended Enterprise 161
Contents ix
I IT Governance 167
J IT Governance Maturity Model 179
K COBIT Information Processes 185
Glossary 187
References 191
Other ITGI Publications 197
Index 201
x Contents
Acknowledgments
IT Governance Institute wishes to recognize:
Ⅲ
The Ministry of International Trade and Industry, Japan, for its
sponsorship of the project.
Ⅲ
The Board of Trustees, for its support of the project:

United States, Chair
Kiyoshi Endo, CISA, ChoAoyama Audit Corporation, Japan
John W. Lainhart IV, CISA, CISM, IBM, United States
Hugh A. Parkes, CISA, FCA, Stanton Consulting Partners, Australia
Deepak Sarup, CISA, FCA, Siam Commercial Bank, Thailand
Singapore
Patrick Stachtchenko, CISA, CA, Deloitte & Touche Solutions,
France
Hitoshi Takase, SAP, Japan
Thomas C. Lamm, Information Systems Audit and Control
Association, United States
Linda S. Wogelius, Information Systems Audit and Control
Association, United States
The authors wish to acknowledge the contributions of:
Susan Caldwell, Information Systems Audit and Control
Association, United States
Tomoyasu Eto, CISA, Computer Engineering & Consulting, Japan
Erik Guldentops, CISA, CISM, Belgium
Nobuko Kogori, INES, Japan
Lynn C. Lawton, CISA, BA, FCA, FIIA, PIIA, KMPG,
United Kingdom
J. Kristopher Lonborg, Ernst & Young, United States
Toru Maki, INES, Japan
Shuji Miyazawa, ITEC, Japan
Robert G. Parker, CISA, CA, FCA, CMC, Deloitte & Touche,
Canada
Tsutomu Suzuki, Cambridge Technology Partners, Japan
xii Acknowledgments
Ira R.Weiss, Ph.D., Dean, Northeastern University, United States
Paul A.Williams, FCA, MBCS, Paul Williams Consulting,

it has extended out into entities’ customers, trading partners and suppliers,
and the interdependencies that have been created. It provides new ideas and
ways to think, utilizing concepts that are familiar and accepted by business
and governmental entities. Although the topic of governance may be a famil-
iar concept, applying that outside of the physical walls of an organization,
and in tandem with a partner, supplier, or customer, is a relatively new con-
cept, and certainly one that is not well accepted yet in the marketplace.
However, the advent of the Internet, and the technologies related to it, has
created the opportunity and the need to seize the advantages of operating
in the extended enterprise. Globalization and worldwide communications
have overridden traditional boundaries. In many markets, these global
interdependencies (governmental, political, and business) are now so inter-
connected that they must be considered with almost any decision being
made. Additionally, information technology (IT) has moved from being an
enabler of organization strategy to a key element of it. The governance of
IT can no longer be easily separated from overall enterprise governance. It
is uncertain how well the current governance frameworks, developed to
serve the post-industrial society, can be adapted to serve the needs of the
globally extended information- and knowledge-based enterprises of today.
xv
Therefore, it is time to consider other ways of dealing with this changed
environment.
The text will assist readers in becoming familiar with the critical issues
of concern related to doing business, and doing it with world-class excellence
in this new environment called the extended enterprise. It has often been
stated that information is the grease that allows an enterprise to run effi-
ciently. This statement, when related to extended enterprises, can mean the
difference between success and failure, and profit or loss. A few examples
of what can happen when an effective governance approach is not in place to
deal with those issues that reside outside of the physical walls of the extended

ered and included. As such, it represents a major new knowledge resource
for enterprises, as well as opening up new avenues of practice in strategy
setting, enterprise management, control assessment, risk management and
xvi Preface
in providing assurance. The ultimate aim is to provide a benchmark against
which current enterprise practices can be compared and, as a corollary, im-
proved upon. As such, the book contains a number of suggested maturity
models that can be used and tailored. The book includes such topics as:
Ⅲ
Vision/leadership
Ⅲ
Strategy development with value innovation
Ⅲ
Performance management to ensure value creation
Ⅲ
Operational business activities which lead to the realization of value/
benefit
Ⅲ
Understanding of a governance structure, its criteria, and a suggested
framework
Ⅲ
Enterprise architecture, its importance to the business, and showing
how to implement an appropriate governance structure
Ⅲ
Questions of importance for boards and senior management related
to these issues
Preface xvii
class="bi x0 y7 w3 h7"
INTRODUCTION
The boundaries of today’s organizations are more flexible and dynamic

1
An overall competitive strategy must drive an effective knowledge man-
agement strategy and leadership. To achieve this, an organization must:
Ⅲ
Build an appropriate information organization to provide the infor-
mation required by senior management in decision making.
Ⅲ
Build an IT leadership team that will understand the business goals
and objectives, so that IT can be harnessed to support those goals
and objectives.
Ⅲ
Stay current with the technologies that support the business archi-
tecture and needs.
Ⅲ
Institute a business process to manage information technology
change.
Ⅲ
Improve the organization’s ability to perform its mission and indi-
rectly increase the information team’s effectiveness and credibility.
Michael Hammer, one of the world’s leading authors on business
strategy, stated that as global competition grows, organizations are turn-
ing to virtual integration, which lets them concentrate solely on the
processes in which they know they can be world-class and have a com-
petitive advantage. They will then rely on, or partner with, someone
outside the entity to perform the rest.
3
This phenomenon of extending
an organization outside its traditional boundaries is commonly described
as extended enterprise, virtual enterprise, or virtual integration enterprise.
As the diversity of the commerce environment proliferates, the real ben-

The change would include a new enterprise architecture, a new frame-
work, and a new enterprise hierarchy of business dynamics.
This guideline suggests the provision of a core repository of infor-
mation—referred to as a knowledge-portal knowledge base for the extended
enterprise. The core repository of information specifically focuses on:
Ⅲ
Vision/leadership
Ⅲ
Value creation and performance management
Ⅲ
Governance framework and criteria
Ⅲ
Governance officer
Ⅲ
Enterprise architecture implementation
VISION/LEADERSHIP
Organizations should seek to distribute power and function to the max-
imum degree and seek infinite durability, malleability, and diversity.
Transformation must involve the entire organization, with top man-
agement leading the effort. Only a new and shared perception of the
entity’s opportunities can lead to new ways to compete. Managers must
have a clear understanding of the elements of the transformation efforts.
If they cannot see and understand the future, they cannot create value
or innovation, let alone accept and own the transformation process.
Chapters 1 and 2 of the text deal with these concepts, drivers of change,
and lay out some suggested solutions for dealing with issues that might
be experienced by those enterprises, business as well as governmental,
looking to conduct business within the extended enterprise.
Introduction 3
VALUE CREATION AND PERFORMANCE MANAGEMENT

strategy implications, and various methods of performance measure-
ment and monitoring. Finally, operational business issues are described
and a blueprint for sharing and communicating in the extended enter-
prise is presented.
GOVERNANCE FRAMEWORK AND CRITERIA
The business world today is gripped by tremendous crosscurrents con-
cerning the philosophy and practice of governance. Many traditional
4 Governance of the Extended Enterprise