INFORMATION TECHNOLOGY GOVERNANCE IN SMALL AND MEDIUM ENTERPRISES - A SYSTEMATIC MAPPING

Abstract

Information Technology (IT) governance in small and medium-sized businesses is a subject that still requires more effort. Many of the studies that deal with this subject refer to large companies. IT governance structures, originally developed for the context of large enterprises such as COBIT, ISO/IEC 35800 or ITIL, when applied to the context of small and medium enterprises, lead to undesirable results and failures in the deployment process. The objective of this work was to perform a systematic mapping on IT governance in small and medium enterprises between 2007 and 2017. Systematic mapping studies are useful for categorizing and summarizing the existing information concerning a research question in an unbiased manner. Thus, from an initial set of 63 papers, a total of 17 research papers were selected for the mapping study. The results obtained allowed us to reach conclusions concerning the state-of-the-art of IT governance mechanisms, theories applied in the context and the consequences of IT governance. From the results of this study it was possible to perceive the low use of relational mechanisms of IT governance in the studied context, the constant need to adapt frameworks such as COBIT and ITIL, so that they can adapt to the reality of SMEs, the wide variety of theoretical approaches and the importance, for SMEs, of the concept of IT value for the business.

Keywords
IT Governance; SME; Relational Mechanisms

INTRODUCTION

Small and medium-sized enterprises (SMEs) have played an important role in the economy, however they face difficulties to remain competitive in the market (Balestrin & Vargas, 2003; Andrade, Almeida, & Freitas, 2014). Ayat, Masrom, Sahibuddin and Sharifi (2011) argue that more than 90% of companies in all countries can be classified as SMEs. Despite the economic importance of SMEs to the national and regional economy, Santini, de Vasconcellos Favarin, Nogueira, de Oliveira and Ruppenthal (2015) affirm that there is a high mortality rate and that several factors can influence the end of activities of companies, among them the oppression of large companies, market limitations, difficulties in obtaining financial resources, managing working capital, high tax burden and low ability to manage business.

In an environment of high competition, the adoption of Information Technology (IT) tools has the power to change the performance and structure of the business (Junior, Reis, & Santos, 2016). However, SMEs have limited resources, especially financial, specialized personnel and management capacity (Wilkin et al., 2015). The effectiveness of converting IT investments into organizational productivity, improving organizational performance, or creating value for the business (Weill & Olson, 1989) is more urgent in this context of SMEs.

IT Governance IT is the responsibility of top management and part of corporate governance (Bergeron, Croteau, Uwizeyemungu, & Raymond, 2017). IT governance encompasses decision-making and accountability rights, so that desirable behaviors are encouraged by the IT sector (Bergeron et al., 2017; Weil & Ross, 2004). Thus, IT governance is as important to SMEs as it is to large companies, but literature fails to offer specific insights for IT governance in SMEs (Huygh & De Haes, 2016).

Taking as a starting point the calls for greater efforts in understanding the phenomenon of IT governance in the context of SMEs made by Bergeron et al. (2017) and Huygh and De Haes (2016), a systematic mapping was conducted on IT governance in Small and Medium Enterprises, in order to gather studies in the area, thus enabling a summary of the research and possible lines of action.

The objective of this work was to systematic mapping on IT Governance in SMEs between 2007 and 2017. As defined by Budgen et al. (2008), Petersen et al. (2008), and Kitchenham and Charters (2007), a systematic mapping provides an objective procedure for identifying the nature and extent of the research that is available to answer a particular research question.

The remainder of this paper is organized from the description of the context of small and medium-sized enterprises. Session 3 presents the concepts of IT governance. In section 4 the procedures adopted in the conduction of the systematic mapping are described. Then in session 5 are the data analysis and synthesis. Finally, in session 6, we present the conclusions of the study.

THE CONTEXT OF SMALL AND MEDIUM ENTERPRISES

The role of SMEs in economies is recognized in the literature. In the more developed economies, including micro, small and medium-sized enterprises, the total number of jobs generated reaches 60% of the workforce. In less developed economies, just over 30% of formal jobs are generated by companies classified as micro, small and medium (Sarfati, 2013).

Additionally, Nogami, Medeiros and Faia (2014), argue that the importance of SMEs entrepreneurship can be even greater depending on the stage of development of the region where they are. Job creation and the development of regional entrepreneurship opportunities should make SMEs central to government policies.

Despite the economic importance, SMEs face high mortality rates, with several factors influencing the closure of companies such as the oppression of large companies, limitations of the market, difficulties in obtaining financial resources, working capital management, high tax burden and ability to manage the business. (Santini et al., 2015). The low capacity of management in small and medium-sized enterprises is also a factor cited by Silva and Araújo (2016).

Wilkin et al. (2015) argue that the limitation of resources in the context of SMEs represents a significant challenge in management and that this restriction must be recognized in order to understand the phenomenon of IT management. Additionally, Bergeron et al (2015) argue that SMEs have financial and human limitations, have characteristics of simple organizational structures, operate in local markets and have IT use characteristics other than large companies.

Concurrently, Huygh and De Haes (2016) summarize some of the characteristics/specificities they identified in a survey on IT governance and SMEs:

SMEs tend to adopt more operational visions than strategic ones, being, of course, more reactive;

SMEs tend to have simpler organizational processes;

SMEs operate, in general, without an in-house group of IT specialists;

SMEs tend to use more horizontal organizational structures, or even operate without a defined structure;

SMEs tend to have greater resource constraints;

The use of outsourced IT resources is more common in SMEs;

SMEs suffer more influence from the external environment than large companies.

It is essential to be aware that SMEs, despite the characteristics presented, do not represent a homogeneous group. In fact, the heterogeneity present in the group of SMEs is a phenomenon present in the studies. On the contrary, not all SMEs have specific characteristics and are isolated from the rest of the group, which would make the SME group completely different (Bergeron et al., 2017). There are specificities and commonalities, and it is up to the studies, in the present case of IT governance, to identify these points and present viable alternatives to management.

IT GOVERNANCE

The term IT governance has origins in corporate governance. IT governance has a close relationship with IT management, but are different concepts. The first time the term IT governance was used in IT literature was in 1991 from a definition by Venkatraman (1991), who described IT governance as the means used to describe how IT mediates business relationships by of an IT-based system.

According to Huygh and De Haes (2016), the definition of IT governance in academia is not yet a matter of consensus, but in general, IT governance must be an integral part of corporate governance, be present in the alignment between the use of IT resources and the strategic objectives of the organization and be the responsibility of the organization as a whole.

IT Governance is responsibility of top management team and part of corporate governance (Bergeron et al., 2017). IT governance encompasses decision-making and accountability rights, so that desirable behaviors are encouraged by the IT sector (Bergeron et al., 2017; Weill and Ross, 2004). IT governance aims to make sure that investments made in technology help companies in organizational goals, thus adding greater value to the organization's business (Lunardi et al., 2014).

For Silva et al. (2018), corporate governance plays a decisive role in the development of IT governance, with IT governance being a subordinate of corporate governance. IT governance is the responsibility of the company's top management team and cannot be solely under the responsibility of the IT team, because it deals with the definition of processes that can guarantee the support to organizational goals and strategies (Silva et al., 2018).

Effective IT governance is achieved through a mix of structural, procedural and relational mechanisms (Peterson, 2004; De Haes & Van Grembergen, 2006). In the context of SMEs, relational mechanisms are already present in several situations, making their implementation simpler and more context-sensitive (Wilkin, 2012).

Several studies indicate a relationship between IT governance and greater organizational performance (Bradley et al., 2012; Jewer & Mckay, 2012; Lunardi et al., 2014; Weill & Ross, 2004). In this way, efficiently managing the IT resources is critical to organizations.

Structural mechanisms of IT governance involve how the organization is structured as to the authority of IT decision-making. For Becherer, Haynes and Helms (2008), in small and medium-sized environments with few resources, physical, human and financial, the creation of committees and administrative councils seems to be beyond the reality of everyday life. However, it is possible to think of the creation of these mechanisms of structural governance, once the organization starts to support them, both financially and structurally.

Among the process-related IT governance mechanisms, the literature cites the use of IT indicators, service level agreements, project management, recognized frameworks such as COBIT® or ITIL®, among others (De Haes; Van Grembergen, 2008b).

Finally, relational IT governance mechanisms include IT participation in business. This participation can take place from the managerial capacity of the IT sector manager, the mutual learning that occurs between IT and the business and communication between the parties (Bradley et al., 2012; Wilkin, 2012; Wu, Straub, & Liang, 2015). The link between structural and procedural mechanisms of IT governance is based on relational mechanisms (LUNARDI, 2008).

Jewer and McKay (2012) and Bradley et al. (2012) cite organizational performance as one of the consequences of IT governance. For Zarvić, Stolze, Boehm, and Thomas (2012), IT governance is about strategic control of the impact IT has on the organization and the value it brings to the business. Along the same lines, Weill and Ross (2004) add that it is necessary to effectively manage IT resources so that they can increase the value of the business, although this is a difficult task.

IT Governance is as important for small and medium-sized enterprises (SMEs) as it is for large companies (Huygh & De Haes, 2016). The need to effectively manage, and with expected returns, IT resources so that they can increase business value, make IT governance an important issue and still a difficult task (Weill & Ross, 2004; Van Grembergen & De Haes, 2010; Bergeron et al., 2015).

According to Blili and Raymond (1993), SMEs have specificities, among them are environmental, organizational, decision-making, informational, psychological and sociological. SMEs operate in local markets, have greater flexibility to adapt to changes, but have resource constraints.

However, it is important to emphasize that, despite their specificities, SMEs are not homogeneous, characterizing patterns different uses of technological resources (Bergeron et al., 2015). This perception of specificities is shared by Devos, Van Landeghem and Deschoolmeester (2012) and Wilkin (2012). Both studies cite specifically that a different approach to IT governance is required for SMEs, given the specificities that separate them from large organizations.

THE REVIEW PROCESS

As defined by Kitchenham, Budgen and Brereton (2011), evidence-based studies aim to apply an evidence-based approach to IT research and practice. Bombonatti, Goulão, & Moreira (2016) states that this paradigm advocates the objective evaluation and synthesis of empirical results of relevance to a particular research question. Kitchenham, Budgen and Brereton (2011) includes that, in this context, evidence is defined as a synthesis of best quality scientific studies on a specific topic or research question.

According to Nascimento and Silveira (2017), evidence-based studies is generally executed through a process of systematic review. Kitchenham, Budgen and Brereton (2011) contextualizes this method as the main form of synthesis in evidence-based studies, indicating that, in contrast to an expert review ad hoc literature selection, systematic mapping studies is a methodologically rigorous review of research results. In its turn, Bombonatti, Goulão and Moreira (2016) defines systematic mapping studies, also known as “scoping studies”, provides an objective procedure for identifying the nature and extent of the research that is available to answer a particular research question. These kinds of studies also help to identify gaps in current research in order to suggest areas for further investigation. They therefore also provide a framework and background in which to appropriately develop future research activities (Budgen et al., 2008). Petersen et al. (2008) state that the focus of systematic mapping is classification, thematic analysis and identification of existing publications in the area. Differently from a systematic review, where the aims to establish the state of evidence and identification of best practices based on empirical evidence.

In the systematic mapping, the theme and the categories existing in the articles researched are the focus, as well as the number of existing publications. The systematic review uses the meta-analysis method to perform the data extraction at a deeper level in each study identified in the research (Budgen & Brereton, 2006).

We have performed a systematic mapping study by considering the guidelines that are provided in works as those of Nascimento and Silveira (2017), Budgen et al. (2008), Petersen et al. (2008), and Kitchenham and Charters (2007). A systematic mapping study is a means of categorizing and summarizing the existing information about a research question in an unbiased manner. Our systematic mapping study was performed in three stages:

“Plan the Mapping” the objectives are to identify the need of the review, commission the review, specify research questions and review the protocol;

“Search Studies” the objectives are to collect the studies, select primary studies, apply quality assessment, and extract and synthetize data;

“Analyze Studies” the objective is to format and communicate results.

The activities concerning the planning and conducting stages of our systematic mapping study are described in the following sub-sections.

Plan the Mapping

This phase occurs the selection of the research questions that determine the scope of the study, defining one or more questions. Then, the research sources were selected, as were as the kind of search that was performed. The search can be automatic in digital libraries, where the results are collected through a search query execution, or manual, where the results are collected manually in the selected conferences and journals databases. Typically, both alternatives are selected, but in this we opted for an automatic search in digital libraries. Complementing this phase, the search strings and the extraction strategy were identified. In this stage, the criteria for inclusion and exclusion of selected articles were also defined.

Research questions

The objective of the research was to perform a systematic mapping on IT governance in the context of SMEs between 2007 and 2017. Additionally, some complementary objectives can be listed as what dimensions of IT governance mechanisms are present in the context of SMEs, which are the consequences of these mechanisms and what theoretical perspectives are used to study IT governance when it comes to small and medium-sized enterprises. In order to reach these objectives, a central research question was formulated and two complementary research questions to be answered through the collection of articles. The selected questions are:

Main research question: What are the mechanisms used to address IT governance in the context of SMEs?

Complementary research question: What are the consequences of these IT governance mechanisms in the context of SMEs?

Complementary research question: What are the theoretical approaches used in IT governance articles in the context of SMEs?

Search sources

The searches were carried out in indexing tools of scientific articles, all of them of high value for the scientific community. The selected databases were ACM Digital^® library, IEEExplore^®, Science Direct^® (Elsevier), Scopus^® and EBSCO^®. In addition, complementary searches were performed on the Google Scholar mechanism, in order to provide incremental support for articles that were not present in the selected databases. Finally, articles published outside the scope of searches, such as book articles, were added manually so that the final search result was obtained.

Inclusion and exclusion criteria

The objective this phase is establish a set of criteria to filter out unnecessary studies. Because even after refining the search queries, the resulting number of papers can still be refined through a set of inclusion and exclusion criteria (Table 1), to guarantee minimal quality of the results. In addition, only articles published from January 2007 to November 2017 were included in the final list of articles.

Table 1
Inclusion and exclusion criteria

Criterion	Detail
Inclusion 1	IT governance studies in SMEs
Exclusion 1	Studies that do not address SMEs
Exclusion 2	Studies that do not address IT governance
Exclusion 3	Retreat articles, news, secondary literature
Exclusion 4	Articles in languages other than selected
Exclusion 5	Duplicate articles
Exclusion 6	Original document not found

• Source: Research data.
• Search arguments

In order to identify the search arguments used in the selected indexing tools, an initial search was performed on the Google Scholar mechanism. From the identification of the arguments to be used, the search was performed on each indexer. Due to small details in each indexing tool, the final search argument had minor changes to each of the tools. The list of searches performed is available in Table 2.

Table 2
Search arguments

Database	Search arguments
EBSCO	TI IT AND TI Governance AND ( (framework* or mechanism*) ) AND small
ACM Digital library	(framework mechanism) AND acmdlTitle:(+governance +IT) AND (small)
IEEExplore	(("Document Title":IT AND "Document Title":Governance) AND (mechanism* OR framework*) AND (small))
Science Direct (Elsevier)	(TITLE("IT") AND TITLE("governance")) AND ("framework" OR "mechanism") AND ("small")
Scopus	TITLE ( governance ) AND TITLE ( it ) AND ( TITLE-ABS-KEY ( mechanism* ) OR TITLE-ABS-KEY ( framework* ) ) AND TITLE-ABS-KEY ( small ) AND PUBYEAR > 2006

• Source: Research data.

Search for Studies

The searches were conducted in the first fortnight of December 2017. Overall, 63 articles were obtained. After applying the inclusion and exclusion criteria listed in table 1, 12 articles were selected. To the selected articles, 5 articles were manually added. These were added in a complementary way, since they are presented in other search engines, have good citation index in other works or were considered relevant by the team of researchers. The distribution of accepted and excluded articles by indexing tool is available in figure 1. In addition, figure 2 shows the history of publications in IT governance in the context of SMEs.

Figure 1
Selection of primary studies. Source: Research data

Figure 2
Distribution of primary studies per year. Source: Research data Analysis of Studies

The present topic analyzes the data extracted from the articles selected in the research. the selected articles are available in Table 3. Each of the questions will be analyzed to obtain a vision of how the state of art is in the research on IT governance in the context of SMEs.

Main research question: What are the mechanisms used to address IT governance in the context of SMEs?

Effective IT governance could be achieved through the use of structural, procedural and relationship (SPR) governance mechanisms (Peterson, 2004). Each of these mechanisms used formally or informally assists the organization in obtaining better results in the use of IT resources. However, as the organization becomes aware of such a mechanism, its use becomes more frequent, increasing the maturity level of IT governance and, consequently, making the organization more efficient in the use of IT resources (Lunardi, Becker, & Maçada, 2010).

Among the 17 articles selected, 3 of them presents a framework for IT governance in SME context. The approaches in the three articles are quite different, being the first one a framework directed to the human resource that manages and uses IT (Garbarino-Alberti, 2013), the another one from the Technology-Organization-Environment framework proposed by Tornatzky, Fleischer and Chakrabarti (1990) (Olutoyin & Flowerday, 2016), and, on the third article, the authors propose a framework based the Outsourced Information System Failure (Devos, Van Landeghem, & Deschoolmeestem, 2009). In addition, two of the articles selected (Bergeron et al, 2015; Bergeron et al., 2017) present the development of a framework for research on IT governance in SMEs and not, properly speaking, an IT governance framework.

Table 3
Selected studies

Selected studies	Type
Aguillar, D. A., Murakami, I., Junior, P. M., & Aquino, P. T. (2017, September). IT governance program and improvements in Brazilian small business: Viability and case study. In Computer Science and Information Systems (FedCSIS), 2017 Federated Conference on (pp. 961-964). IEEE.	Conference paper
Ayat, M., Masrom, M., Sahibuddin, S., & Sharifi, M. (2011, January). Issues in implementing it governance in small and medium enterprises. In Intelligent Systems, Modelling and Simulation (ISMS), 2011 Second International Conference on (pp. 197-201). IEEE.	Conference paper
Bergeron, F., Croteau, A. M., Uwizeyemungu, S., & Raymond, L. (2017). A framework for research on information technology governance in SMEs. In Strategic IT Governance and alignment in business settings (pp. 53-81). IGI Global.	Book paper
Bergeron, F., Croteau, A. M., Uwizeyemungu, S., & Raymond, L. (2015). IT governance framework applied to SMEs. International Journal of IT/Business Alignment and Governance (IJITBAG), 6(1), 33-49.	Article
Cai, M., & Yu, J. (2009, September). The Pattern of IT Governance in Small and Medium-Sized Garment Enterprise. In Management and Service Science, 2009. MASS'09. International Conference on (pp. 1-4). IEEE.	Conference paper
Devos, J., Van Landeghem, H., & Deschoolmeester, D. (2009). IT Governance in SMEs: A theoretical framework based on the outsourced information systems failure. In 3rd European Conference on Information Management and Evaluation (pp. 132-142). Academic Conferences ltd.	Conference paper
Garbarino-Alberti, H. (2013). IT governance and human resources management: A framework for SMEs. International Journal of Human Capital and Information Technology Professionals (IJHCITP), 4(3), 40-57.	Article
Guldentops, E. (2014). Governance of IT in small and medium sized enterprises. In Information Systems for Small and Medium-sized Enterprises (pp. 3-24). Springer, Berlin, Heidelberg.	Book paper
Huang, R., Zmud, R. W., & Price, R. L. (2009). IT governance practices in small and medium-sized enterprises: recommendations from an empirical study. In Information Systems-Creativity and Innovation in Small and Medium-Sized Enterprises (pp. 158-179). Springer, Berlin, Heidelberg.	Article
Huygh, T., & De Haes, S. (2016). Exploring the Research Domain of IT Governance in the SME Context. International Journal of IT/Business Alignment and Governance (IJITBAG), 7(1), 20-35.	Article
Lee, M. C. (2013). IT governance implementation framework in small and medium enterprise. International Journal of Management and Enterprise Development, 12(4-6), 425-441.	Article
Lin, F., Chou, S., & Wang, W. K. (2011). IS practitioners’ views on core factors of effective IT governance for Taiwan SMEs. International Journal of Technology Management, 54(2/3), 252-269.	Article
Olutoyin, O., & Flowerday, S. (2016). Successful IT governance in SMES: an application of the Technology-Organisation-Environment theory. South African Journal of Information Management, 18(1), 1-8.	Article
Put, D. (2012). Awareness of IT governance and ITSM in small and medium enterprises in Western and Central Europe. Information Systems in Management, 1(2), 136-147.	Article
Rozehnal, Petr, & Novák, Vítězslav. (2016). The Approach to the Integration of the IT Governance Frameworks for SME. In IDIMT 2016: Information Technology, Society and Economy Strategic Cross-Influences - 24th Interdisciplinary Information Management Talks. p. 367-374. 2017.	Conference paper
Vogt, M., Küller, P., Hertweck, D., & Hales, K. (2011). Adapting IT Governance Frameworks using Domain Specific Requirements Methods: Examples from Small & Medium Enterprises and Emergency Management. In AMCIS.	Conference paper
Wilkin, C. (2012). The role of IT governance practices in creating business value in SMEs. Journal of Organizational and End User Computing (JOEUC), 24(2), 1-17.	Article

• Source: Research data.

The framework proposed by Peterson (2004) appeared explicitly in only one article, but using as reference the work done by De Haes and Van Gremberger (2006). Additionally, 5 of the 17 papers make some citations regarding structural, procedural and relational mechanisms. Only one (Wilkin, 2012) article addresses directly the use of relational and structural mechanisms in IT governance. The other articles focus on frameworks that address the procedural dimension of IT governance without citing explicitly any of the dimensions proposed by Peterson (2004).

Despite the constant statements in the literature that effective IT governance can only be achieved through the use of a mix of structural, procedural and relational governance mechanisms, the absence of relational mechanisms in the studies, especially in the context of SMEs that, according to Wilkin (2012), would have greater facility in the implantation of these mechanisms, is a fact that calls attention.

A common point in selected articles was the use, or attempted adaptation, of internationally used frameworks for IT governance. The most cited framework in the articles was COBIT, both in version 4 and version 5. All but one of the articles (Devos, Van Landeghem, & Deschoolmeestem, 2009) used COBIT as an example of good practices for IT governance in SMEs. However, several articles affirm that the framework, at least, requires adaptations to be applicable to the context (Ayat et al., 2011; Lin, Chou, and Wang, 2011; Vogt et al., 2011; Garbarino-Alberti, 2013; Bergeron et al., 2015; Aguillar et al., 2017).

Another framework mentioned is ISO/IEC 38500. Because it is a more generic framework, it could be better adaptable to the reality of PME. However, this is also a criticism of the framework, its great generality, leaving large areas without procedures more specific to the context (Olutoyin & Flowerday, 2016). This framework is less cited, appearing in 5 of the 17 final selection articles.

Furthermore, other frameworks are cited as ITIL and TOGAF. In both cases the authors propose the fusion and the reduction of the frameworks, so that they are applied to the context. This is a procedure adopted in all articles that have used frameworks such as COBIT, ITIL or TOGAF in the context of PME, reduce to apply.

Finally, 3 of the articles (Bergeron et al., 2015; Huygh; De Haes, 2016; Bergeron et al., 2017) directly mention that there is no framework that was specifically built for the context of SMEs, despite the clear need for more studies on this theme. The main findings of this stage are presented in table 4.

Table 4
IT governance mechanisms

Reference	ITG mechanism for SME context	Uses SPR mechanisms	Uses COBIT	Other procedural frameworks	Adaptation and reduction of traditional frameworks	There is no ITG framework for SME
Aguillar et al. (2017)			X		X
Ayat et al. (2011)			X	X	X
Bergeron et al. (2017)		X	X			X
Bergeron et al. (2015)		X	X	X	X	X
Cai and Yu (2009)			X
Devos et al. (2009)	X
Garbarino-Alberti (2013);	X	X	X	X	X
Guldentops (2014)			X	X
Huang et al. (2009)			X
Huygh and De Haes (2016)			X			X
Lee (2013)		X	X	X
Lin et al. (2011)			X		X
Olutoyin and Flowerday (2016)	X		X	X
Put (2012)			X
Rozehnal and Vítězslav (2016			X
Vogt et al. (2011)		X	X	X	X
Wilkin (2012)		X	X

• Source: Research data.

Complementary research question: What are the consequences of these IT governance mechanisms in the context of SMEs?

In terms of the consequences of IT governance, the selected articles are unanimous in the position that IT governance has impacts on organizational performance, even though they do not perform this measurement or explicitly have this purpose in the conduct of scientific work.

More explicitly 3 of the selected articles present IT business value as a consequence of good IT governance (Wilkin, 2012; Bergeron et al., 2015; Bergeron et al., 2017). The value of the IT business is defined as the impact on the organizational performance of information technology at the procedural and organizational levels, including impacts on the company's efficiency and competitiveness (Bergeron et al., 2017).

A fact that attracted attention was the research of Lin et al. (2011). For the authors, IT governance could be achieved through a reduction or adjustment of the COBIT framework, so that the original dimensions of Planning and Organization, Acquisition and Implementation and Delivery and Support would lead to the fourth dimension, Monitoring and Control. Thus, IT governance would be this fourth dimension, achieved from the other dimensions, which would be antecedents to it. The summarization of the findings of the first complementary question is available in table 5.

Table 5
Consequences of IT governance

Consequences	Organizational performance	IT business value
Bergeron et al. (2017)	X	X
Bergeron et al. (2015)	X	X
Wilkin, C. (2012)	X	X
All other articles.	X

• Source: Research data.

Complementary research question: What are the theoretical approaches used in IT governance articles in the context of SMEs?

Among the articles selected in the research, only 5 of the 17 articles provide some theoretical basis for their research. It is true that some of these articles are presented at conferences, and limitations on article size are often restraining factors. But even in conference articles, citations to the theories underlying the work are important and possible.

Three of the articles selected in the study deal explicitly with the theoretical bases for conducting research on IT governance in the context of SMEs (Bergeron et al.,2015; Bergeron et al., 2017; Huygh and De Haes, 2016). Theoretical alternatives include: Theory of the Agency, Stakeholder Theory, Power Perspective Theory, Stress Theory, Resource Dependency Theory, Network Governance Theory, Institutional Theory, Higher Class Theory and Institutional Trust Theory.

Moreover, Devos et al. (2009) present a framework based mainly on agency theory. The authors also use other theoretical perspectives to formulate their final proposition such as Market for the “Lemons” theory (LMT), Prospect Theory (PT), Incomplete Contract Theory (ICT) and Organizational Trust Theory (OTT).

Finally, Olutoyin and Flowerday (2016) present the Technology-Organization-Environment (TOE) theory proposed by Tornatzky, Fleischer and Chakrabarti (1990) as an alternative to IT governance in SMEs. In general, the TOE framework proposes that the implementation and use of information technology or information systems are influenced by the technological, organizational and environmental contexts (Olutoyin & Flowerday, 2016). After the discussion, table 6 presents the summarization of the theoretical approaches present in the selected articles.

Table 6
Theoretical approaches used in IT governance

Reference	Articles dealing with the theoretical alternatives	Technology-Organization-Environment Theory	Agency Theory	LMT	PT	ICT	OTT
Bergeron et al. (2017)	X
Bergeron et al. (2015)	X
Devos et al. (2009)			X	X	X	X	X
Huygh and De Haes (2016)	X
Olutoyin and Flowerday (2016).		X

• Source: Research data.

CONCLUSION

To conduct this research, we adopted a systematic mapping. This type of review provides to professionals from diverse fields a quick access to relevant research findings that support decision making, providing critical knowledge (Nascimento and Silveira, 2017; Bombonatti, Goulão, & Moreira, 2016). The systematic mapping allows to systematize the scientific knowledge of a particular area of knowledge (Kitchenham, Budgen, & Brereton, 2011). To the extent that it presents an overview of the literature related to a given subject, systematic mapping brings to the forefront of researchers the possibility of further research.

Therefore, it was through this mapping that we can show that studies on IT governance in the context of SMEs still require greater efforts. For example, in all articles selected during systematic mapping, a unanimous point was the complexity of the context and the limitations of SMEs.

However, it is of fundamental importance to carry out studies with a more theoretical basis. Only three studies explicitly present theories that can explain or describe the phenomenon of IT governance in SMEs, and two present a theory of support for what is being studied. The theoretical support cannot be abandoned because of the search for a solution that "fits in the context".

The framework proposed by Peterson (2004) for IT governance presents a set of three dimensions, structural, procedural and relational. However, even in a context where the relational dimension could help to reach higher levels of governance, this dimension is mentioned only once and a clear preference for the procedural dimension can be perceived in the articles.

Frameworks such as COBIT, cited more in the selected studies, can serve as a basis for building a more context-relevant way. Interestingly, COBIT is cited as both good and bad example of IT governance. It is not being said here that the framework is bad in itself, but that its application to the context needs adaptations and reductions.

The IT business value has been used several times as a consequence of IT governance in SMEs. This fact may have been generated by the ease, or less difficulty, in measuring this construct. Other consequences of traditional IT governance such as strategic alignment would have greater difficulty in measuring in a context as complex and changeable as SMEs.

In general, tools to enable IT governance in SMEs have not yet been presented, and further theoretical and empirical studies should be carried out in order to achieve an initial framework, in the first stage, then a functional framework that can be applied to SMEs.

Lastly, from an initial set of 63 papers, a total of 17 research papers were selected for the mapping study, and the results obtained have allowed us to extract conclusions regarding the state-of-the-art in the field, to identify several research gaps, and to extract some guidelines for novice IT Governance practitioners. Moreover, the application of a well-defined review protocol will also allow us to efficiently update and extend the systematic mapping study in future years.

REFERENCES

• Andrade, M. A. R., almeida, P., & freitas, L. (2014). Internacionalização como estratégia competitiva para pequenas e médias empresas do Brasil: uma revisão bibliográfica. Simpósio de Excelência em Gestão e Tecnologia, 11
• Ayat, M., Masrom, M., Sahibuddin, S., & Sharifi, M. (2011, January). Issues in implementing it governance in small and medium enterprises. In Intelligent Systems, Modelling and Simulation (ISMS), 2011 SecondInternational Conference on (pp. 197-201). IEEE. https://doi.org/10.1109/ISMS.2011.40
  » https://doi.org/10.1109/ISMS.2011.40
• Balestrin, A., & Vargas, L. M. (2003). Redes horizontais de cooperação como estrutura favorável ao desenvolvimento das PMEs. XXVII Encontro da Associação Nacional de Pós-Graduação e Pesquisa em Administração. Anais, Atibaia: ANPAD.
• Becherer, R. C., Haynes, P. J., & Helms, M. M. (2008). An exploratory investigation of entrepreneurial marketing in SMEs: The influence of the owner/operator. Journal of Business and Entrepreneurship, 20(2), 44.
• Bergeron, F., Croteau, A. M., Uwizeyemungu, S., & Raymond, L. (2017). A framework for research on information technology governance in SMEs. In Strategic IT Governance and alignment in business settings (pp. 53-81). IGI Global. http://doi.org/10.4018/978-1-5225-0861-8.ch003
  » http://doi.org/10.4018/978-1-5225-0861-8.ch003
• Bergeron, F., Croteau, A. M., Uwizeyemungu, S., & Raymond, L. (2015). IT governance framework applied to SMEs. International Journal of IT/Business Alignment and Governance (IJITBAG), 6(1), 33-49. http://doi.org/10.4018/IJITBAG.2015010103
  » http://doi.org/10.4018/IJITBAG.2015010103
• Blili, S., & Raymond, L. (1993). Information technology: Threats and opportunities for small and medium-sized enterprises. International journal of information management, 13(6), 439-448. http://doi.org/10.1016/0268-4012(93)90060-H
  » https://doi.org/10.1016/0268-4012(93)90060-H
• Bombonatti, D., Goulão, M., & Moreira, A. (2017). Synergies and tradeoffs in software reuse-a systematic mapping study. Software: practice and experience, 47(7), 943-957. http://doi.org/10.1002/spe.2416
  » https://doi.org/10.1002/spe.2416
• Bradley, R. V., Byrd, T. A., Pridmore, J. L., Thrasher, E., Pratt, R. M., & Mbarika, V. W. (2012). An empirical examination of antecedents and consequences of IT governance in US hospitals. Journal of Information Technology, 27(2), 156-177. http://doi.org/10.1057/jit.2012.3
  » https://doi.org/10.1057/jit.2012.3
• Budgen, D., & Brereton, P. (2006, May). Performing systematic literature reviews in software engineering. In Proceedings of the 28th international conference on Software engineering (pp. 1051-1052). ACM. http://doi.org/10.1145/1134285.1134500
  » http://doi.org/10.1145/1134285.1134500
• Budgen, D., Turner, M., Brereton, P., & Kitchenham, B. A. (2008, September). Using Mapping Studies in Software Engineering. In PPIG (Vol. 8, pp. 195-204).
• De Haes, S., & Van Grembergen, W. (2006, January). Information technology governance best practices in Belgian organisations. In System Sciences, 2006. HICSS'06. Proceedings of the 39th Annual Hawaii International Conference on (Vol. 8, pp. 195b-195b). IEEE .
• De Haes, S., & Van Grembergen, W. (2008). Practices in IT governance and business/IT alignment. Information Systems Control Journal, 2, 1-6.
• De Haes, S., Haest, R., & Van Grembergen, W. (2010). IT governance and business-IT alignment in SMEs. ISACA Journal: the source for IT governance professionals/ISACA (= Information Sytems Audit and Control Association)-Place of publication unknown, 6, 38-44.
• Devos, J., Van Landeghem, H., & Deschoolmeester, D. (2009). IT Governance in SMEs: A theoretical framework based on the outsourced information systems failure. In 3rd European Conference on Information Management and Evaluation (pp. 132-142). Academic Conferences ltd. http://hdl.handle.net/1854/LU-752136
  » http://hdl.handle.net/1854/LU-752136
• Devos, J., Van Landeghem, H., & Deschoolmeester, D. (2012). Rethinking IT governance for SMEs. Industrial Management & Data Systems, 112(2), 206-223. http://doi.org/10.1108/02635571211204263
  » https://doi.org/10.1108/02635571211204263
• Huygh, T., & De Haes, S. (2016). Exploring the Research Domain of IT Governance in the SME Context. International Journal of IT/Business Alignment and Governance (IJITBAG), 7(1), 20-35. http://doi.org/10.4018/IJITBAG.2016010102
  » https://doi.org/10.4018/IJITBAG.2016010102
• Jewer, J., & McKay, K. N. (2012). Antecedents and consequences of board IT governance: Institutional and strategic choice perspectives. Journal of the Association for Information Systems, 13(7), 581.
• Junior, I. P. G., Reis, A. L. D. S. B., & Santos, A. V. A. V. (2016). O uso da tecnologia de informação nas micro e pequenas empresas familiares de cachoeira-ba. REAVI-Revista Eletrônica do Alto Vale do Itajaí, 4(5), 77-89.
• Kitchenham, B., & Charters, S. (2007). Guidelines for performing systematic literature reviews in software engineering. Version 2.3, EBSE Technical Report, Keele University, UK.
• Kitchenham, B. A., Budgen, D., & Brereton, O. P. (2011). Using mapping studies as the basis for further research-a participant-observer case study. Information and Software Technology, 53(6), 638-651. https://doi.org/10.1016/j.infsof.2010.12.011
  » https://doi.org/10.1016/j.infsof.2010.12.011
• Lunardi, G. L. (2008). Um estudo empírico e analítico do impacto da governança de TI no desempenho organizacional.
• Lunardi, G. L., Becker, J. L., Maçada, A. C. G., & Dolci, P. C. (2014). The impact of adopting IT governance on financial performance: An empirical analysis among Brazilian firms. International Journal of Accounting Information Systems, 15(1), 66-81. http://doi.org/10.1016/j.accinf.2013.02.001
  » https://doi.org/http://doi.org/10.1016/j.accinf.2013.02.001
• Lunardi, G. L., Becker, J. L., & Maçada, A. C. G. (2010). Governança de TI e suas Implicações para a Gestão da TI: Um Estudo Acerca da Percepção dos Executivos. XXXIV Encontro da ANPAD-EnANPAD Rio de Janeiro, 6.
• Lin, F., Chou, S., & Wang, W. K. (2011). IS practitioners’ views on core factors of effective IT governance for Taiwan SMEs. International Journal of Technology Management, 54(2/3), 252-269. http://doi.org/10.1504/IJTM.2011.039314
  » https://doi.org/http://doi.org/10.1504/IJTM.2011.039314
• NASCIMENTO, Ademir Macedo; SILVEIRA, Denis Silva . A systematic mapping study on using social media for business process improvement. Computers in Human Behavior, v. 73, p. 670-675, 2017.
• Nogami, V. K. C., Medeiros, J., & Faia, V. S. (2014). Análise da evolução da atividade empreendedora no brasil de acordo com o Global Entrepreneurship Monitor (GEM) entre os anos de 2000 e 2013. REGEPE-Revista de Empreendedorismo e Gestão de Pequenas Empresas, 3(3), 31-76. http://doi.org/10.14211/regepe.v3i3.118
  » https://doi.org/http://doi.org/10.14211/regepe.v3i3.118
• Olutoyin, O., & Flowerday, S. (2016). Successful IT governance in SMES: an application of the Technology-Organisation-Environment theory. South African Journal of Information Management, 18(1), 1-8. http://dx.doi.org/10.4102/sajim.v18i1.696
  » https://doi.org/http://dx.doi.org/10.4102/sajim.v18i1.696
• Petersen, K., Feldt, R., Mujtaba, S., & Mattsson, M. (2008, June). Systematic Mapping Studies in Software Engineering. In EASE (Vol. 8, pp. 68-77).
• Peterson, R. R. (2004). Integration strategies and tactics for information technology governance. Strategies for information technology governance, 2, 37-80.
• Santini, S., de Vasconcellos Favarin, E., Nogueira, M. A., de Oliveira, M. L., & Ruppenthal, J. E. (2015). Fatores de mortalidade em micro e pequenas empresas: um estudo na região central do Rio Grande do Sul. Revista Eletrônica de Estratégia & Negócios, 8(1), 145-169. http://dx.doi.org/10.19177/reen.v8e12015145-169
  » https://doi.org/10.19177/reen.v8e12015145-169
• Sarfati, G. (2013). Estágios de desenvolvimento econômico e políticas públicas de empreendedorismo e de micro, pequenas e médias empresas (MPMEs) em perspectiva comparada: os casos do Brasil, do Canadá, do Chile, da Irlanda e da Itália. Revista de Administração Pública-RAP, 47(1).
• Silva, H. C., & Araújo, M. A. (2016). Emerging Strategies and Hypercompetitive Environments to Micro and Small Companies of Information Technology. American International Journal of Contemporary Research, 6(4), 83-89.
• Silva, H. C. C., Araújo, M. A. V., & Dornelas, J. S. (2018). Determinantes da não utilização de frameworks de gestão e/ou governança de TI. Revista Gestão & Tecnologia, 18(2), 271-296.
• Tornatzky, L. G., Fleischer, M., & Chakrabarti, A. K. (1990). Processes of technological innovation. Lexington books.
• Venkatraman, N. (1991). IT-Induced Business Reconfiguration. The Corporation of the 1990’s. Information Technology and Organizational Transformation. Fair Lawn, NJ: Oxford University Press.
• Weill, P., & Olson, M. H. (1989). Managing investment in information technology: mini case examples and implications. MIS quarterly, 3-17. http://doi.org/10.2307/248694
  » http://doi.org/10.2307/248694
• Weill, P., & Ross, J. W. (2004). IT governance: How top performers manage IT decision rights for superior results. Harvard Business Press.
• Wilkin, C. (2012). The role of IT governance practices in creating business value in SMEs. Journal of Organizational and End User Computing (JOEUC), 24(2), 1-17. http://doi.org/10.4018/joeuc.2012040101
  » https://doi.org/10.4018/joeuc.2012040101
• Wilkin, C., Couchman, P., Sohal, A., & Zutshi, A. (2015). Exploring Differences between Large and Medium Organizations’ Corporate Governance of Information Technology. In UWCISA 2016 - JEBcl.
• Wu, S. P. J., Straub, D. W., & Liang, T. P. (2015). How information technology governance mechanisms and strategic alignment influence organizational performance: Insights from a matched survey of business and IT managers. Mis Quarterly, 39(2), 497-518.
• Zarvić, N., Stolze, C., Boehm, M., & Thomas, O. (2012). Dependency-based IT Governance practices in inter-organisational collaborations: A graph-driven elaboration. International Journal of Information Management, 32(6), 541-549. http://doi.org/10.1016/j.ijinfomgt.2012.03.004
  » https://doi.org/http://doi.org/10.1016/j.ijinfomgt.2012.03.004

Publication Dates

• Publication in this collection
  02 Dec 2019
• Date of issue
  2020

History

• Received
  22 Nov 2018
• Accepted
  10 Aug 2019