Do regulators pay attention? An assessment of IT governance implementation in systemically important banks

Abstract

The large size and complexity of Information Technology systems in systematically important banks raise the need for creating an IT governance architecture that could make IT strategy aligned with business strategy and delivers value while it effectively identifies and manages IT risk. This study traces the links between IT governance and two more applied risk management frameworks, COSO and BCBS’s principles for managing IT risk. Then it argues due to the magnitude of potential losses caused by any weakness in IT governance in D-SIBs, the assessment of IT governance in these banks should be one of the main concerns of local regulators and supervisors. As a case study, it assesses the relative rank of D-SIBs in Iranian banking system to see where these banks would stand in an ordered list of the banks including both private and public banks in terms of IT governance implementation. The application of the Fuzzy AHP technique shows that IT governance practice in Iranian D-SIBs is not as good as the private banks while it outperforms some state-owned banks.