1. Introduction

Since the beginning of the 21^st century, organizations worldwide have been focusing on integrating Information Technology (IT) into organizational business processes. IT has emerged as one of the most important tools for organizations to retain and improve their competitive advantage. Rapid development in IT has enabled organizations to streamline their operations by improving organizational agility and information flow throughout the entire organization. Strategic alignment between business & IT strategies has become one of the main focuses of organizations in order to ensure that IT tools can be fully utilized to support business decisions. However, organizations have encountered more IT investment failures than expected. According to Aziz et al., [1], the number of IT failures has been growing since the last decade. Despite all the attention given, the implementation of IT governance (ITG) has not been easy, especially for developing country.

2. Problem Statement

The ITG concept has become increasingly well-known to worldwide organizations due to the importance of good IT governance that is constantly developing at a rapid pace in support of business decisions. The ITG concept has garnered increased attention from scholars and practitioners around the globe but the concept is still relatively new to Malaysia. There are numerous ITG frameworks that are readily available for adoption, such as Control Objectives for Information and Related Technologies (COBIT 5.0) and Information Technology Infrastructure Library (ITIL v3). The ITG concept has been constantly evolving as the COBIT and ITIL frameworks have already seen multiple updated versions up till now. Organizations have been trying to adopt various practices and frameworks for governance purposes. However, the implementation of ITG is a difficult process especially for organizations in developing country like Malaysia as there are various barriers to the adoption of ITG practices [2]. In addition, the number of studies on factors that inhibit the positive implementation of ITG has been less than ideal, and even worse for developing countries. ITG awareness and practices are severely lacking in the Asian region [3]. For a developing country like Malaysia, where ITG implementation is still at the infancy stage, more studies should be conducted to increase the understanding of ITG. Lacks of ITG awareness, guidelines and practices have also been reported concerning the public sector in Tanzania [4]. Therefore, this study attempted to examine and categorize ITG issues that are consistently faced by Malaysian organizations. This study also explained why most issues are interrelated and emphasized on how IT human capability can mitigate ITG implementation issues.

3. Research Context

3.1.  Information Technology Governance (ITG)

Due to the massive amount of attention given to the field of ITG, researchers and experts have given various definitions and expectations of ITG. One of the most accepted definition of ITG is “the distribution of decision rights and accountability in order to induce positive behaviour or patterns in managing and using IT resources” [5]. ITG is also defined as the “utilization of organizational capacity by the board, executives and IT management team to formulate and implement IT strategy as well as achieve strategic alignment between business and IT” [6]. ITGI defined ITG as an integral part of corporate governance aided by adequate leadership, structures and processes to ensure IT sustainability and act as an extension of an organization’s strategies and objectives [7].

3.2.  Information Technology Capability

Although IT capability has seen various definitions in previous studies, the definitions have been centred on “the ability to manipulate IT resources and costs” [8]. The definition was extended by stating that IT resources have been combined to support business-related decisions [9]. Both definitions referred to the ability to utilize and manipulate IT-related resources and other complementary resources to support businesses in value-added ways [10]. Aside from controlling IT resources, IT capability is specifically referred to as the ability to affect organizational goals through the control of IT-related costs [11].

IT capability is placed in between technical capabilities and IT-related organizational capabilities. However, most of the classifications included three of the following, namely IT infrastructure capabilities, IT human capabilities, and IT-enabled intangibles [8, 10-13]. IT infrastructure capabilities is defined as the ability to provide sustainable infrastructure services to support business-related processes or IT-related tangible assets that include IT systems, gadgets, and various tools and applications that form the very base of IT infrastructure and shared throughout the firm [8,12,14]. IT human capabilities refer to the combination of technical and managerial skills of IT professionals in solving and attending various organizational needs [8,12]. IT-enabled intangibles are referred to as intangibles made available due to the utilization of IT resources. These intangibles include knowledge assets, synergy, relationship assets, responsiveness and others [8,10]

3.3.  ITG Issues in Malaysia

Since the sources of information for ITG implementation issues were found to be lacking in the review process, data collected for this study included those from studies concerning various sectors, such as public, financial and higher education sectors. Most organizations in Malaysia are still in the infancy stage of ITG implementation, as reported by [2]; hence, the factor of sector diversity is expected to have minimal effect on the barriers to initially accept the basic implementation of ITG. This study has classified issues faced by organizations that implement ITG into two main categories. The first category is organizational-related, and the second category is human-related. Further details on the categorization and issues found will be discussed in the section on findings.

Figure 1: Systematic Literature Review Process

4. Systematic Literature Review

The methodology used in this study was the systematic literature review method. The guidelines for a systematic literature review were provided by Kitchenham [15]. This type of review is mostly used when the study intends to identify any research gap or interpret any area of interest in a span of time. This methodology helps the researcher to be better positioned for future research activities according to the research gaps found in the review process. The steps undertaken for systematic literature review in this study are as follows: i) Define the research questions; ii) Define key terms for searching the database; iii) First phase literature search and selection process; iv) Define inclusion and exclusion criteria for the second phase selection process; v) Data extraction and analysis; and vi) Report findings and discussions. Figure 1 illustrates the systematic literature review process undertaken in this study.

The first step in the systematic literature review is to define the research questions for the literature screening process involving the metadata in the first phase. The research questions set for literature screening are as follows:

1. Is the article related to information technology governance?
2. Are there any primary findings on the implementation of information technology governance?

• Did the study take place in developing countries or Malaysia?

The literature searches were conducted on 6 databases, which were IEEEXplore, ACM Digital Libraries, Scopus, Science Direct, Springer Link, and ProQuest. The initial search began in November 2018 and was updated in June 2019. Some of the terms used for literature searches only in the metadata are “information technology governance”, “information and communication technology governance”, “IT governance”, and “ICT governance”. Thus, if the initial search presented 500 or more hits, the term “Malaysia” is added to the search results, if available, or in the full text to limit the search results to the context of this study. Moreover, if the results yield less than 50 hits, the newly added term “Malaysia” is deleted, and the previous results are considered. As for the literature search in Science Direct, there were 1,297 hits after the term was added. The results were then filtered according to articles with open accessibility. The results of the literature searches are listed below:

1. IEEEXplore – 454
2. ACM Digital Libraries – 158

• SCOPUS – 97

1. ProQuest – 25

Next, initial screenings were carried out by referring to the research questions. After the initial screenings, the breakdown in the number of qualified articles were 16 articles from IEEEXplore, 7 from ACM Digital Libraries, 47 from SCOPUS, and 1 from the ProQuest database. The inclusion and exclusion criteria for the second phase of screening were then determined, as shown in Table 1 below.

Table 1: Inclusion and Exclusion Criteria

In the second phase, the criteria were used in the literature selection process after reading the full text. Finally, 11 articles were selected, and after removing redundant articles, 10 articles had fulfilled the criteria, and 2 additional articles outside the database were found from previous studies and referred by related authors in the qualified articles. A total of 12 articles had qualified for this study. As the study focused only in the context of Malaysian organizations, the number of qualified articles was low. Figure 2 illustrates the number of articles published per year.

Figure 2: Number of articles published per year

As shown in Figure 2, the number of articles published per year is unusually low, especially after 2014. This might be because most studies on ITG had focused on the benefits and impact of ITG on firm performance instead of barriers to ITG implementation. As reported in [16], most organizations that participated in the study had a low ITG maturity level. Therefore, this study attempted to summarize issues that consistently inhibited the process of ITG implementations and adoption, as well as to propose potential solutions for future studies.

Table 2 reveals that most of the articles reviewed had both organizational and human-related issues in ITG implementation with the exception of 2 papers where one focused solely on IT practitioners and the other focused more on structural issues, such as the lack of defined roles and responsibilities. Human-related issues were mentioned 21 times and organizational-related issues were mentioned 18 times in all 12 articles. Table 3 shows the issues that were found in each category, while Table 4 shows the classifications of key issues found in articles after the reviewing process.

4.1.  Organizational-related Issues

The issues in this category are regarded as issues faced during ITG implementation due to organizational decisions pertaining to the structure, guidelines and practices, as well as the support from top management. Organizational issues are related to top-down decision making where structures, responsibility and accountability, policy, guidelines and practices as well as direction and goals are determined by the top management to be implemented by the entire organization. Hence, organizational-related issues are mostly related to the upper level of an organization. The subcategories proposed by this study pertaining to organizational-related issues are structure, guidelines and practices and top management.

4.1.1. Structure

Structure issues defined in this study refer to issues developed due to lack of assignation in accountability and responsibility in ITG. Structural issues are one of the most commonly found issues faced by newcomers to ITG implementations [4, 17-20]. As ITG is still a relatively new concept in Malaysia, organizations often struggle to develop appropriate structures or hierarchy of power in terms of ITG implementation. More often, a IT steering committee and IT strategy committee should be established by involving the Chief Information Officer (CIO). It was reported that structural issues were not functioning well as the CIO did not understand his/her role and responsibility in ITG [18]. Without an appropriate structure in place, there would be lack of transparency in the governance process and even difficulties in justifying IT-based decisions [19]. In addition, lack of structure can lead to communication issues [2]. Organizations will find it difficult to refer to the personnel in-charge as no one will assume the responsibility for related issues without a structure in place [18]. Similar issues were reported as there was a lack of a platform for management to discuss IT-related issues [21].

4.1.2. Guidelines and Practices

Guidelines and practices issues arise due to the lack of ITG guidelines and practices in the organization. Guidelines and practices are complementary factors to a reliable governance structure, which also contributes to the creation of transparency for justifying the ITG implementation processes [19]. The lack of strategic guidelines for IT funding in public universities was reported in [18]. It was revealed that IT projects that were initially approved or agreed by the IT committee were rejected eventually due to financial issues.

Miscommunication and improper guidelines led to a lack of coordination between departments and facilities regarding the utilization of IT resources. Guidelines and practices together with a reliable ITG structure prevent information disparity between the expectations of the CIO and implementation on the ground [21]. A study on Malaysia’s public sector revealed that 76.19% of organizations had a low ITG maturity level. Findings also showed that IT managers expected at least an average level of ITG practice despite the lack of proper mechanisms and exposure to ITG practices [16].

4.1.3. Top Management

ITG should be driven and initiated from the organization’s top level [19]. Top management support is classified as an organizational issue because top level executives are responsible for deciding organizational initiatives for moving forward in the right direction. Successful ITG implementation often depends on the top management’s initiative to offer sufficient support. In addition, ITG implementation is also influenced by internal organizational cultures and politics. It is important for top management to recognize the needs for ITG and assign appropriate accountability according to initiatives, beginning from the top of the organization [3].

Lack of support and commitment from top management is one of the current issues faced by Malaysia organizations when implementing ITG [2, 22]. Similar situations where the top management was lackadaisical in supporting ITG was also reported [1], which then resulted in a lack of adequate resources to manage assigned controls as the top management willingness to incorporate ITG into the organization’s future strategy is highly dependent on the recognition and knowledge about the importance of ITG.

Table 2: Key Findings

Table 3: ITG Issues According to Categories

Table 4: Classification of Key Issues

4.2.  Human-related Issues

Human-related issues refer to issues originating from human resources caused by the lack of quality, competency, and understanding required for managing and completing tasks required by organizations. Specifically, human-related issues in this study refer to barriers to ITG implementation due to insufficient personnel with quality to manage and govern IT-related resources and issues. In human-related issues, the personnel included in this study were the CIO and other personnel involved in ITG from the middle to the top management level. Three subcategories in human-related issues are competencies, awareness and understanding as well as leadership quality.

4.2.1. Competencies

Competency issues are often overlooked by organizations since most of the attention is placed on ITG frameworks and practices. Competency in this study refers to the ability of ITG personnel to manage and complete assigned responsibilities and practices related to ITG. The terms competency and capability are often used interchangeably due to how closely their interpretations are. Competence is defined as having the ability to utilize skills, knowledge and the capacity to satisfy or achieve current needs. Capability is defined as qualities, abilities, and the potential to develop accordingly to meet future needs by adapting to changes in a dynamic environment while generating new knowledge for improving working performance [23]. Therefore, in order to fit in the context of this study, where current ITG issues can be safely regarded as current ITG needs, the term competency is used in this subcategory. Most senior management and CIOs lack knowledge and experience in ITG because ITG is a relatively new concept compared to working skills and experience [1,3,17-18]. In addition, it was reported that the complexity of ITG practices was the highest ranked barrier from the technical aspect [22]. The prerequisites for ITG personnel have been elevated as ITG committees are required to plan, manage, and monitor IT initiatives. ITG personnel also need to master non-technical skills such as business strategic planning, leadership, and communication [16]. Hence, due to the increased prerequisites for ITG personnel, organizations have been lacking human resources equipped with proficient skills in technical and non- technical aspects to resolve ITG issues and challenges.

4.2.2. Awareness and Understanding

As mentioned previously, top and senior management need to recognize the need for ITG to ensure smooth top-down implementation [3]. Such recognition requires adequate awareness and understanding about ITG. Awareness and understanding issues refer to issues that occur due to the lack of experience and understanding on the potential benefits of ITG in organizations. Awareness can elevate performance and allow accurate understanding of situations that can further lead to better decision making by leaders [3]. The authors had further revealed 3 level of ITG awareness in reference to Endsley’s theory of awareness [24]. The first level of awareness includes gathering perceptual information from the surrounding and focusing on elements that are beneficial and relevant. One example of this is to understand the availability of resources, infrastructure, and skills required to achieve current tasks. The second level of awareness includes integrating perceptual information with experiences and knowledge to assess the significance of the context, which is the role of ITG in organizations [25]. The third level of awareness includes projecting future elements by anticipating the changes that can be brought to the operational environment. Examples of third level awareness are management of IT resources that meet organizational needs, lead the initiative in addressing IT issues, ensure continuous alignment between business and IT, and leverage IT potentials to enhance business growth. It was found that top management perceives that there is no need for ITG as there is a lack of awareness and knowledge [2]. There were no efforts by the top management to create awareness about ITG adoption [21]. Instead, all the issues were thought to be an IT-only responsibility, which further leads to a disoriented alignment between strategic business and IT planning. Business executives did not understand the strategic value of IT as it was thought to be insignificant [26]. Business executives failed to understand IT issues and there was a severe lack of collaboration between business and IT. IT managers assumed a high-level of maturity for ITG but in reality, 76.19% of the organizations were still in position of low ITG maturity [16]. This could be due to different levels of understanding regarding the definitions of ITG and ITG itself. Most implementations were highly dependent on instructions, and there was a lack of initiative to actively seek improvement. All the issues mentioned above indicate that most organizations in Malaysia still lack ITG awareness and understanding.

4.2.3.  Leadership

Leadership quality in this study refers to the ability of top and senior management to spearhead the IT initiative in ITG implementation. As most of the organizations are still at the infancy stage of ITG, lower levels of the organization hierarchy need to be guided by top management. This requires top management to lead using the IT initiative and provide direction from the highest level of the organization [19]. For top management to lead, adequate knowledge about ITG is required. Therefore, a lot of issues arise because even the top management has a low understanding of ITG itself [18]. There is a possibility of a lack of official directives concerning ITG, which causes the lack of collaboration between business and IT [16]. Top management should always initiate the active involvement of stakeholders in ITG, while providing sufficient guides and empowering key personnel with expectations and support. As most personnel lack ITG knowledge and experience, top management plays a major role in ensuring the continuity and sustainability of ITG. Presence of the CIO was insignificant because the responsibilities were not up to a respectable standard [21]. There was no effort to create awareness and liaison between business and IT. Hence, the IT department assumed all responsibility for issues identified. Leadership in ITG is especially vital for organizations at the infancy stage as the top management is responsible for setting the guidelines and directions for organizations to move forward. Newcomers to ITG need explicit guidance or they would just become simple rule followers instead of skilled personnel actively seeking continuous innovation and improvement.

5. Role of IT Human Capability

IT human capability mentioned in this study refers to technical capabilities, business capabilities and behavioural capabilities [12]. Technical capabilities refer to technical skills and knowledge in a specific area of expertise. Business capabilities refer to the IT personnel’s ability to understand and manage overall business processes and environments. Behavioural capabilities refer to the IT personnel’s interpersonal ability to interact effectively with others. The results show that both organizational-related and human-related issues are major factors that help organizations to implement ITG in Malaysia. It is undeniable that both issues need unwavering attention from organizations in order to implement ITG and move it in the right direction.

ITG is more than just following rules and guidelines. ITG requires continuous commitment from organizations to ensure sustainability, and having competent human resources is one of the prerequisites for future sustainability, whether in business or ITG [25]. It has been stated that organizations might be governing IT with less than adequate prerequisites in terms of IT capabilities [10]. Development of ICT personnel has been one of the focuses of the Malaysian Strategic IT Plan 2011 [26]. However, findings indicate that there is a lack of effort or mechanisms for developing IT personnel in the area of ITG. Although issues have been categorized into organizational-related and human-related categories, both issues are interrelated as one issue can cause the other to surface.

One of the primary issues in organizational-related issues is the lack of adequate structure and accountability in ITG. The lack of organizational structure is not directly related to IT human capability, but it should be taken into consideration when forming the ITG structure. When forming the ITG structure, organizations should assess whether there are qualified personnel available and accountable for ITG implementation. It is undeniable that collaboration issues [21,26] have consistently emerged during ITG implementation. In the selection of qualified personnel for ITG, there is no doubt that at least certain levels of business and behavioural capability should be considered as ITG often requires collaborative efforts for strategic alignment purposes. This requires personnel to possess some level of business acumen and the capability to work well with other units when needed. It raises further questions on whether business or IT executives should be held accountable, as most business executives possess business capabilities without IT skills, and most IT executives possess IT capabilities without business skills. It does not mean that business executives are required to possess IT capabilities but at least they should be aware of the importance of ITG since IT executives are now required to extend their understanding of business knowledge [27]. It was also revealed that business and IT, which act in collaboration, can lead to ITG effectiveness and strategic alignment as knowledge sharing between business and IT executives lead to a better understanding of each other’s environment [28-29]. For example, it has been revealed that a web-based system developed in a university aligns the entire existing or new program with the Malaysian Qualification Framework (MQF) [30]. Similar web-based systems can be designed to monitor and align ITG prerequisites pertaining to certain personnel involved. Training should be given for those who do not meet the prerequisite capabilities for ITG.

Guidelines and practices are some of the most common issues faced when implementing ITG. Guidelines and practices are available through frameworks like COBIT 5.0 and ITIl.v3. However, despite the availability of frameworks in the market, not all practices and mechanisms are suitable for every organization. One main purpose of guidelines and practices is to help and give direction to organizations intending to implement ITG. It is also important to practice the relevant mechanisms that help develop positive IT behaviours throughout the entire organization. One of the common issues with the availability of frameworks is the lack of instructions on how to perform tasks with the right mind-set. ITG is more than just simply following rules and guidelines. Organizations must also implement various ITG mechanisms that help to develop individuals with adequate capabilities so that ITG efforts are sustainable in the future. It is important for organizations to develop enough ITG awareness among IT personnel through various practices and mechanisms. As reported, organizations with awareness imbue governance-related mind-sets into daily routines and practices [3]. Personnel with the ability to actively lead and think using IT initiatives are better than rule followers. Guidelines and practices provide the basis for incorporating ITG into daily routines, but it depends on the personnel’s capability to understand and manage tasks effectively. In addition, only qualified IT personnel who are aware of the importance of ITG will actively think of the processes and guidelines that need to be improved and adapted to the changing business process. Therefore, IT human capability is important for the continuous improvement of ITG implementation in an organization.

Gaining top management support has been an issue for organizations in Malaysia as top management lack the understanding of the importance of ITG. Moreover, lack of top management support directly affects the outcome of ITG implementation as resources are often procured with the approval of the top management. It is important to convince the top management about the implementation of ITG in order to gain their support. It has been proven that new IT deployment is easier with firm commitment from the top management [30]. However, it is not easy to convince the top management as ITG is a long-term project that requires various resources to succeed. Therefore, having capable human resources that are knowledgeable in ITG can ensure the continuity and success of ITG implementations, especially in the future. The CIO plays an important role in convincing top management as the CIO often acts as a liaison between business and IT executives. The CIO who is capable of recognizing, understanding, and relaying the importance of ITG to the top management ensures better allocation of resources for a smoother implementation process.

Unlike organizational-related issues, human-related issues are directly related to IT human capability. As mentioned before, competencies refer to the ability to satisfy current needs with skills and knowledge. Therefore, organizations need to develop current competencies into capabilities in order to adapt to future challenges. Currently, ITG is presented as a brand-new challenge that requires human resources with proficient skillsets and capabilities for organizations in Malaysia. Most Malaysian organizations lack competent human resources for implementing ITG. The lack of competency generally includes IT as well as managerial skills and knowledge, which are part of technical and business capabilities. The issues are especially troubling for the public sector as most public sectors have a more or less fixed number of staffs. Therefore, a recruitment of additional experts or capable personnel was less likely to occur unless external expertise is specifically consulted. Hence, organizations need to develop human resources that are proficient in ITG supplemented by the help of various practices and mechanisms. However, competency issues consistently emerge from organizations suggesting that organizations are more focused on setting rules and guidelines rather than developing capable human resources that are supposedly accountable for ITG tasks. This creates the culture of passive governance where actions are only taken based on rules and instructions. As mentioned earlier, personnel involved in ITG should be equipped with business knowledge and ITG awareness. This can be achieved with job rotations and cross training between business and IT units [27]. A web-based system can be developed to record all qualifications and skills of related personnel. All training and rotations should be provided based on specific skills that are lacking. Qualified personnel with cumulated experience in the task can improve the efficiency of the process and are more inclined to offer and seek improvements for ITG.

Another factor of passive governance comes from the lack of awareness and understanding of ITG. ITG requires leaders with enough understanding and knowledge about the ITG concept to lead with IT initiative and active thinking in order to create a good culture of governance. Results revealed that the importance of ITG was severely underestimated by organizations. Few cases reported that senior management did not recognize the importance of ITG and felt that ITG was unnecessary [3,26]. There was also a case where ITG was thought to be only as an IT responsibility [21]. Issues like this clearly show that the roles of ITG in organizations were ambiguous to entire organizations, or at least to the top management and business executives. For ITG implementation to be successful, ITG awareness must be spread throughout the organization so that strategic alignment between business and IT can be achieved. Organizations must reach consensus on the role of ITG, and how it can affect organizations moving forward. As mentioned previously, awareness allows organizations to imbue certain mindset into daily practices. For this case, ITG awareness prevents the culture of passive governance and allows personnel to be actively involved in the governance process moving forward. In this case, awareness and understanding must be included as part of IT human capability as both play a big role in adapting to new challenges.

In this study, leadership is listed under behaviour capability since leadership is an essential ability to lead and interact with others. From the leadership aspect, the CIO is expected to be in the midst of ITG implementation. However, previous articles reveal that CIOs in Malaysian organizations lacked leadership qualities, especially in terms of IT initiative [16, 18-19]. In ITG’s infancy stage, leadership plays one of the most important roles in ITG implementation as beginners in the organization need more guidance than ever. The CIO is seen by practitioners as the main driver in ITG [27]. However, the CIO should not be the only one to be held responsible for leadership issues. Anyone in the organization who is aware of the importance of ITG should be leading-by-example in order to create more ITG exposure. As mentioned previously, ITG should be driven from the top management downwards. Therefore, the top management must take responsibility in leading the IT initiative by recognizing the importance of instilling a successful ITG.

Finally, as mentioned by [10], the use of IT capability has been ambiguous in the ITG literature. Therefore, this study attempted to clear the ambiguity by exploring and explaining the role of IT human capability in ITG implementation. This study can contribute to future studies on the relation between ITG and IT human capability.

6. Conclusion

In conclusion, this study explained the interrelated relations between organizational-related and human-related issues by justifying the role of IT human capability. This study also clarified the ambiguity concerning the use of IT capability on ITG literature. Through systematic literature review, it has become clear that structure and guidelines help ITG to consistently move in the right direction. However, without specific capabilities, such as business, technical, and behavioural capabilities possessed by related personnel, ITG cannot be implemented effectively since most ITG implementation and practice requires collaboration from both business and IT units for the sake of strategic alignment. Therefore, it can be concluded that both organizational and human factors are important for the consistency, efficiency and effectiveness of ITG. Additionally, researchers are encouraged to commit further studies on IT human capability and ITG implementation in Malaysia in order to compensate the lack of proven ITG studies in the Malaysian context.  This study also attempted to further highlight the importance and role of IT human capability in the midst of ITG implementation and mechanisms in order to garner more attention toward human-related issues since developing countries like Malaysia are affected by issues such as the lack of qualified human resources. Therefore, organizations should pay equal attention to both organizational and human-related issues in order to create a well-built structure, framework, and environment that are well-suited for ITG implementation at the infancy stage.

Conflict of Interest

The authors declare no conflict of interest.

Acknowledgment

Special thanks to University Tun Hussein Onn Malaysia (UTHM) for assisting in the completion of the paper.

1.  K. A. Aziz, M. B. Norhashim, E. M. Halim, “Information security and information technology governance: a Malaysian case study” International Journal of Management Practice, 4(4), 331, 2011. https://doi.org/10.1504/ijmp.2011.039204
2.  M. F. I. Othman, T. Chan, E. Foo, “IT Governance Adoption in Malaysia: A Preliminary Investigation” in 2011 22nd Australasian Conference on Information Systems (ACIS), Sydney, Australia http://aisel.aisnet.org/acis2011/69
3.  Y. M. Lin, N. H. Arshad, H. Haron, Y. B. Wah, M. Yusoff, A. Mohamed, “IT Governance Awareness and Practices: an Insight from Malaysian Senior Management Perspective” Journal of Law and Governance, 5(1), 2010. https://doi.org/10.15209/jbsge.v5i1.177
4.  E. N. Nfuka, L. Rusu, “Critical Success Factors for Effective IT Governance in the Public Sector Organizations in a Developing Country: The Case of Tanzania” in 2010 ECIS 18th European Conference on Information Systems, Pretoria, South Africa, 2010. https://doi.org/10.1080/1097198X.2013.10845642
5.  P. Weill, J. W. Ross, “It Governance on One Page” MIT Sloan Working Paper No. 4517-04; Research Working Paper No.349, 2004. http://dx.doi.org/10.2139/ssrn.664612
6. W. V. Grembergen, S. D. Haes, “Exploring the relationship between IT governance practices and business/IT alignment through extreme case analysis in Belgian mid-to-large size financial enterprises” Journal of Enterprise Information Management, 22(5), 615-637, 2009. http://doi.org/ 10.1108/17410390910993563
7. ITGI, Board Briefing on IT Governance, 2nd Edition, 2003.
8. A. S. Bharadwaj, “A Resource-based perspective on information technology capability and firm performance: an empirical investigation” MIS Quarterly, 24(1), 169-196, 2000. http://dx.doi.org/10.2307/3250983
9. V. Sambamurthy, W. Zmud, “Arrangements for information technology governance: A theory of multiple contingencies” MIS Quarterly, 23(2), 261-290, 1999. http://dx.doi.org/10.2307/249754
10.  K. Hiekkanen, J. Korhonen, E. Patricio, M. Helenius, J. Collin, “IT Governance, Decision-Making and IT Capabilities in 2013 Proceedings of The 9th European Conference on Management Leadership and Governance, Klagenfurt, Austria, 2013.
11.  Z. Aiqun, “An IT capability approach to informatization construction of higher education institutions” Procedia Computer Science, 131, 683–690, 2018. https://doi.org/10.1016/j.procs.2018.04.312
12.  D. Ko, D. Fink, “Information technology governance: An evaluation of the theory-practice gap” Corporate Governance: The international journal of business in society, 10(5), 662–674, 2010.https://doi.org/10.1108/14720701011085616
13.  J. S. Chen, H. T. Tsou, “Performance effects of IT capability, service process innovation, and the mediating role of customer service” Journal of Engineering and Technology Management, 29(1), 71-94, 2012. https://doi.org/10.1016/j.jengtecman.2011.09.007
14.  L. Fink, S. Neumann, “Gaining agility through IT personnel capabilities: The mediating role of IT infrastructure capabilities” Journal of the Association for Information System, 8(8), 440-462, 2007. https://dx.doi.org/10.17705/1jais.00135
15. B. Kitchenham, S. Charters, Guidelines for Performing Systematic Literature Review in Software Engineering, Software Engineering Group, University of Durham, 2007.
16. R. A. Razak, M. S. Zakaria, “The Information and Communication Technology Governance Maturity Level for Malaysian Public Sector” in Proceedings of the Second International Conference on Internet of Things, Data and Cloud Computing, Cambridge, United Kingdom, 2017. https://dx.doi.org/10.1145/3018896.3018967
17. S. Ismail, R. A. Alias, A. A. Rahman, “IT Governance Implementation in the Malaysian Ministry of Education” in 2008 Postgraduate Annual Research Seminar (PARS ’08). Johor Bahru, Malaysia, 2008.
18. N. A. Ismail, “Information technology governance, funding and structure” Campus-Wide Information Systems, 25[3], 145-160, 2008. https://dx.doi.org/10.1108/10650740810886321
19. R. A. Razak, M. S. Zakaria, “The critical success factors for effective ICT governance in Malaysian public sector: A Delphi study. International Journal of Economics and Management Engineering” 8(11), 2014. http://www.waset.org/publications/9999698
20. A. R. Ahlan, B. A. Ajayi, H. Hussin, “Roles of Governance, Ethics and Integrity in Managing Information Technology Resources: Muslim Practitioner’s View” in 2013 5th International Conference on Information and Communication Technology for the Muslim World (ICT4M), Rabat, Morocco, 2013. https://doi.org/10.1109/ICT4M.2013.6518926
21. A. R. Ahlan, Y. Arshad, and B. A. Ajayi, “IT governance in a Malaysian public institute of higher learning and intelligent decision making support system solution,” Engineering and Management of IT-based Service System, 19(33), 2014. https://doi.org/10.1007/978-3-642-39928-2_2
22. M. F. I. Othman, “Using analytical hierarchy process (AHP) to evaluate barriers in adopting formal IT governance practices” Journal of Telecommunication, Electronic and Computer Engineering (JTEC), 10, 35-40, 2018.
23.  R. Nagarajan, R. Prabhu, “Competence and capability- a new look” International Journal of Management (IJM), 6(6), 7-11, 2015.
24.  M. R. Endsley, “Measurement of situation awareness in dynamic systems.” Human Factors, 37(1), 65-84, 1995.https://doi.org/10.1518/001872095779049499
25.  W. L. Teo, A. A. Manaf, P. L. F. Choong, “Perceived effectiveness of information technology governance initiatives among IT practitioners. International Journal of Engineering Business Management, 5(1), 1–9, 2013. https://doi.org/10.5772/56661
26.  J. Kaur, S. A. H. Bahri, “Implementation of Information Technology Governance in the Malaysian Public Sector Practice” in Pacific Asia Conference on Information Systems (PACIS), Chengdu, China, 2014. http://aisel.aisnet.org/pacis2014/119
27. B. A. Ajayi, H. Hussin, “IT governance from practitioner’s perspective: sharing the experience of a Malaysian university” Journal of Theoretical and Applied Information Technology, 88(2), 219-230, 2016.
28. J. Kaur, N. Mohamed, A. R. Ahlan, “A Confirmatory Factor Analysis of the Information Technology Governance Effectiveness: Evidence from Malaysia” in 2011 International Conference on Research and Innovation in Information Systems, Kuala Lumpur, Malaysia, 2011. http://dx.doi.org/10.1109/ICRIIS.2011.6125666
29. M. A. J. Sabegh, S. M. Motlagh, “The role and relevance of IT governance and IT capability in Business- IT alignment in medium and large companies” Business and Management Review, 2(6), 16-23, 2012.
30. N. Musa, D. H. A. Ibrahim, N. A. Bolhassan, J. Abdullah, N. Kulathuramaiyer, M. N. Khairuddin, “An IT Governance Framework for Achieving the Development of Academic programme in Higher Institutions: A Case of Universiti Malaysia Sarawak (UNIMAS)” in The 5th International Conference on Information and Communication Technology for the Muslim World (ICT4M), Kuching, Malaysia, 2014. http://dx.doi.org/10.1109/ICT4M.2014.7020673

(Click Here)

(Click Here)