Governance, Risk and Compliance (GRC) Information Systems (IS) as an integrated technology has been introduced recently to facilitate the demanding operational and financial environment of the enterprises. The implementation process and the adoption of such systems is considered as a significant parameter influencing the success of operational performance and financial governance and could support the competitive advantage practices within the organisations. However, GRC literature is limited regarding the analysis of the implementation and adoption success. Therefore, there is a need for further research and contribution about these systems and more specifically their implementation process. Consequently, this investigation and analysis can provide an insight of this process by examining the aspects of the implementation, the lifecycle phases followed and the enterprise value drivers in each of these phases. Therefore, a framework was developed for structuring the analysis of this implementation including all these three elements as these were provided by the theoretic background. The empirical context of this research includes three field investigation studies based on the experience of key implementation stakeholder groups as participants. These investigation studies were analysed using thematic techniques following an interpretative qualitative analysis approach. It was proved that organisations have, directly or indirectly, followed specific lifecycle phases when they implement GRC systems as these are also described in the framework. Also they should consider specific aspects about the GRC systems and enterprise value drivers for the different lifecycle phases but also for a holistic approach of the implementation process. Hence new GRC implementation projects can use the phases and the analysis of these elements to facilitate and ease their decision-making and strategic planning before launching the implementation project. The analysis of the GRC implementation proved that a strict GRC environment can be established in the organisations through the successful implementation of a GRC technology. The implementation process of such technologies would require a preparation for the organisational environment in order the implementation project to succeed the GRC goals and the system to be integrated and optimised harmoniously within the enterprise environment. This study provides insight of how this implementation projects could be planned and developed and gives a directive blueprint for preparing organisations hosting such technological initiatives. The results of all field investigation phases, which can be considered as the contributions to theory and practice of this research, can have twofold implications: initially the development of a theoretical framework based on enterprise systems theories, and also an analysis of the GRC implementation process in specific. The framework is designed to structure the analysis of the GRC implementation aspects, the lifecycle phases and the enterprise value drivers of the GRC implementation process. This framework is used for visualising and structuring a specific analysis of the GRC adoption and success, and therefore this analysis can be used by practitioners and researchers to further evaluate and analyse this process. Furthermore, organisations can use this analysis for decision-making processes; as this analysis can provide a primary view for the implementation projects.

This original, reflective practitioner study researched whether professionalising IA could be successfully achieved, in line with the UK Cyber Security Strategy expectations. The context was an observed changing dominant narrative from IA to cybersecurity. The research provides a dialectical relationship with the past to improve IA understanding. The Academic contribution: Using archival and survey data, the research traced the origins of the term IA and its practitioner usage, in the context of the increasing use of the neologism of cybersecurity, contributing to knowledge through historical research. Discourse analysis of predominantly UK government reports, policy direction, legislative and regulatory changes, reviewing texts to explore the functions served by specific constructions, mainly Information Security (Infosec) vs IA. The Researcher studied how accounts were linguistically constructed in terms of the descriptive, referential and rhetorical language used, and the function that serves. The results were captured in a chronological review of IA ontology. The Practitioner contribution: Through an initial Participatory Action Research (PAR) public sector case study, the researcher sought to make sense of how the IA profession operates and how it was maturing. Data collection from self-professed IA practitioners provided empirical evidence. The researcher undertook evolutionary work analysing survey responses and developed theories from the analysis to answer the research questions. The researcher observed a need to implement a unified approach to Information Governance (IG) on a large organisation-wide scale. Using a constructivist grounded theory the researcher developed a new theoretical framework - i3GRC™ (Integrated and Informed Information Governance, Risk, and Compliance) - based on what people actually say and do within the IA profession. i3GRC™ supports the required Information Protection (IP) through maturation from IA to holistic IG. Again, using PAR, the theoretical framework was tested through a private sector case study, the resultant experience strengthening the bridge between academia and practitioners.

Information Security nowadays is becoming a very popular subject of discussion among both academics and organizations. Proper Data Governance is the first step to an effective Information Security policy. As a consequence, more and more organizations are now switching their approach to data, considering them as assets, in order to get as much value as possible out of it. Living in an IT-driven world makes a lot of researchers to approach Data Governance by borrowing IT Governance frameworks.The aim of this thesis is to contribute to this research by doing an Action Research in a big Financial Institution in the Netherlands that is currently releasing a Data Lake where all the data will be gathered and stored in a secure way. During this research a framework on implementing a proper Data Governance into the Data Lake is introduced.The results were promising and indicate that under specific circumstances, this framework could be very beneficial not only for this specific institution, but for every organisation that would like to avoid confusions and apply Data Governance into their tasks. / <p>Validerat; 20151222 (global_studentproject_submitter)</p>