The paper depicts central IT controlling terms and selected IT controlling concepts of the last decade. A performance oriented IT controlling concept describes central processes of the IT controlling concept by using a three step life cycle model in terms of a reference model. Finally some important results from a current survey concerning the development of IT controlling in German speaking countries are given. Based on these facts the paper describes the needs for action in academia and practice.

1 Introduction

IT controlling (information technology controlling) has for a long time had an established standing in business administration (von Dobschütz 2000, p. 5). It is essential as a core discipline of business and information systems engineering (Krcmar and Son 2004, p. 165). The term has been discussed for over 15 years in academia and practice (Hess 2007). Nevertheless there is no consensus about targets, tasks and responsibilities of IT controlling (Schauer 2006, p. 212–213). Often mentioned tasks are to secure the efficiency of using IT, project controlling (Kargl 2001), controlling of the IT strategy (Horváth and Rieg 2001) and the evaluation of outsourcing activities (Becker et al. 2006, p. 25).

This paper tries to compare the most important IT controlling concepts and to make a statement concerning the term, targets and processes of IT controlling. Its aim is to stimulate the discussion and the development of IT controlling concepts. Practitioners are invited to intensify the use of established methods.

2 Essentials and concepts

2.1 Evolution of the IT controlling term

IT controlling is an interdisciplinary task in the flash point between the areas of business information systems and general corporate controlling. Narrow interpretations emphasise the function of information, measurement and evaluation (Schauer 2006, p. 213). Broader proposals provide IT controlling with decision making power to ensure that companies can reach their targets. Examples are decisions about the planned IT project portfolio or about the size and structure of the IT budget.

The first papers with a focus on IT controlling were published in the 1970 s (Bottler et al. 1972; Horváth et al. 1975). In the 1990 s further publications were added (Britzelmaier 1999; von Dobschütz et al. 2000; Kargl 1993; Krcmar et al. 2000). After years of retention new suggestions were presented (Brun 2008; Gadatsch and Mayer 2006; Kargl and Kütz 2007; Kesten et al. 2007; Krcmar 2005; Kütz 2005 and Kütz 2007). A range of synonyms were proposed for the term IT Controlling (information technology controlling):

 

  • ADV controlling (automated data processing controlling)

  • DV controlling (data processing controlling),

  • EDV controlling (electronic data processing controlling),

  • INF controlling (Informatics controlling or information controlling),

  • IV controlling (information processing controlling),

  • IS controlling (information systems controlling).

 

The terms ADV controlling, DV controlling and EDV controlling are only used infrequently. The terms informatics controlling (Gysler 2005; Müller 1990) and information controlling (Herget and Schwuchow 1995 or Marzinzik 1998) occasionally still find use. Current terms are IV controlling (Krcmar 1990; Kargl and Kütz 2007) and mostly IT controlling (Kesten et al. 2007; Kütz 2005 and Kütz 2007).

In the English speaking world the term IT Performance Management is used, which is not comparable with IT controlling (for delimitation Strecker 2008). In some publications terms for partial tasks of IT controlling are used, e. g. IT sourcing controlling. This describes the controlling of the purchase of IT services (Schelp et al. 2006, p. 96). A further example is project controlling (Kargl 2001, 2008) which deals with the economic control and monitoring of IT projects. IT support for the IT controller is very seldom a focus of publications, e. g. with Hess (2006).

2.2 Tasks of IT controlling

The views on the volume of tasks diverge strongly. Questions of budgeting and cost accounting of IT operations (data centre, network and devices) and IT projects dominated the older sources (Schumann 1993; Britzelmaier 1999). Later the focus changed from cost accounting to profit centre accounting (Kargl 1998; Kargl and Kütz 2007). Current definitions are broader. They see IT controlling as a tool for decision support when using IT resources. IT controlling is interpreted as “... purchasing, preparation and analysis of data for preparation of target oriented decisions of purchasing, realising and running of hardware and software...” (Becker and Winkelmann 2004, p. 214). Or it is classified as an “elementary controlling and coordination tool” (Krcmar 2005, p. 420).

A typical catalogue with tasks was arranged by Schmid-Kleemann (2004, p. 30). The core tasks of the catalogue cover planning, control and supervision of IT activities and information of the management. The proposal covers central aspects of the tasks of an IT controller (Tab. 1).

Tab. 1 Central tasks of an IT controller (Schmid-Kleemann 2004, p. 30, modified)
Full size table

2.3 Organizational classification

The question of the organizational classification of IT controlling has been dealt with in several publications (Tab. 2). This topic is deemed not to be researched sufficiently (Hess 2006, p. 182). IT controlling is often seen as a part of information management (Krcmar 2005). Thus traditionally IT controlling is classified as belonging to information management or general corporate controlling (Hess 2006, p. 180 f). Top management often regards IT controlling as a part of information management (Santihanser 2004, p. 17). Very seldom is IT controlling independent from information management and corporate controlling, implemented as an independent organizational unit like at the Swiss Kantonalbank (Betschart 2005).

Krcmar (2005) connects the organizational anchoring of the IT controller to his role in the company. He differentiates between IT controlling as control of information management and IT controlling as a part of information management (Krcmar 2005, p. 295). In the first case a central area oriented IT controlling is proposed which is derived from general corporate controlling. In the second case IT controlling breaks away from the influence of general controlling determined by information management. Buresch (2000, p. 142) builds on these thoughts and develops an extensive role model accordingly. Jaspersen (2005, p. 120) as well as Kargl and Kütz (2007, p. 115) place IT controlling subordinate to IT management. Von Dobschütz et al. (2000, p. 16) discuss three varieties of central IT controlling: the integration of IT controlling into information management, or into corporate controlling, or the creation of mixed solutions. Central IT controlling is mainly responsible for strategic tasks like planning, standards and guidelines. Furthermore they describe decentralized forms of organization which can additionally be used by larger companies. For reasons of independence and technical specialization Gadatsch and Mayer (2006, p. 56) plead for a possible independent integration of the IT controller. Ideally IT controlling is situated on the same level of hierarchy as information management and controlling. Classifications into corporate controlling or information management units are considered as less efficient alternatives.

A classification of the IT controller as part of information management may lead to problematic conflicts like the refusal of an IT investment which is supported by the IT management (Hirnle and Hess 2004). Integration into the general corporate controlling results in an increased distance to the object of controlling, IT. This may lead to a situation where IT controlling is increasingly occupied with finance oriented issues like setting-up and control of the budget. Kütz (2005, p. 69) combines both central and decentralized solutions to avoid conflicts of interest. He explicitly differentiates between the creation of IT performance and the usage of IT performance. IT controlling concerned with the creation of IT performance is thus seen as belonging to IT management. IT controlling concerned with its usage on the other hand is integrated into the specific departments.

Tab. 2 Proposals for the organizational classification of IT controlling
Full size table

2.4 Selected IT controlling concepts

In this section selected IT controlling concepts which have been published in the past decade are presented. Contributions were selected which mainly have a holistic approach to objectives, tasks and tools for IT controlling. Contributions with an industry-related focus (e. g. Spitta and Schmidpeter 2002 with a focus on IT controlling in software industry) were not included due to lack of space. Textbooks, scientific papers and also several contributions by practitioners were considered to make allowance for the application-oriented character of business information systems and IT Controlling in particular. As to books, the first edition and the current one as well as – in case of multiple publications of one author – the masterwork were considered. They are presented in an order corresponding to the year of the first publication.

Kargl (1993) / Kargl and Kütz (2007)

The work of Kargl and Kütz (2007) presents an updated and expanded version of the original contribution by Kargl (1993) which belongs to the first fundamental and important IT controlling concepts. The textbook focuses the development and implementation of IT strategy, IT project portfolio management, IT project management and IT cost and performance accounting. IT controlling is derived from Horvath’s (2006) general controlling concept as an approach for coordination and coordination control (Kargl and Kütz 2007, p. 1). A special feature is the very detailed treatment of IT service management (customer service, IT asset management and others) as well as of IT performance indicators essential for planning and monitoring of activities. The updates concern among others the process models for information management ITIL (IT Infrastructure Library, Olbrich 2008) and COBIT (control objective for information and related technology, IT Governance Institute 2009) published in recent years as well as selected organizational issues of IT Controlling.

The spectrum of tasks for IT controlling includes ensuring the effective use of the potential of information technology and the efficient use of resources to implement strategic objectives and the resulting areas of IT strategy, IT projects, running of IT applications and IT infrastructure (Kargl and Kütz 2007, pp. 1–2).

Krcmar (1997 and 2005), Krcmar et al. (2000)

The concept of information management developed by Krcmar (1997 and Krcmar et al. 2000) comprises among others a complete IT controlling concept. Central aspects of IT controlling have been discussed in more specialized publications (esp. Krcmar et al. 2000 and Krcmar 2005). The development of the concept was also continued by other authors (e. g. Hess 2006, p. 112). For example, the anthology (Krcmar et al. 2000) discusses a multitude of single aspects of IT controlling (tasks, organization, portfolio management, international IT controlling, benchmarking and more) in detail from a practical and theoretical view, based on Krcmar’s framework. IT controlling is understood as a task embedded in information management and focusing the object IT, i. e. the controlling of the resource IT. Except for assuring the formal targets efficiency and effectiveness by using the monitoring function of IT controlling, the coordination function of IT controlling is given special emphasis (Krcmar 2005, p. 420). The tasks are geared towards the life cycle of information systems and classed into portfolio controlling, project controlling and product controlling (Krcmar et al. 2000, p. 5 or Krcmar 2005, p. 421).

Britzelmaier (1999)

The concept of Britzelmaier (1999) is counted to the early publications dealing with IT controlling from an academic point of view. He proposes the construction of a basic calculation for data processing, specified as entity relationship model. His focus is on cost and performance accounting, understood as a special mode of accounting for the data processing area. IT controlling is responsible for the transparency of data processing with the following tasks: support of information management by identifying targets, planning and control, supply with information, coordination, and control of targets (Britzelmaier 1999, p. 26). The concept already emphasizes the significance of IT performance indicators (Britzelmaier 1999, p. 194) which was only evolved years later (Kütz 2006).

von Dobschütz et al. (2000)

The anthology by von Dobschütz et al. (2000) contains a description of IT controlling written by authors from academia and practice belonging to the special study group IT controlling (WI-ITC) of the German Informatics Society (Gesellschaft für Informatik e. V.). It is a comprehensive reference book for the daily work in companies. The book explores problems of the full range of IT controlling without loosing sight of details. It can be regarded as a standard book for the primary target group (practitioners and lecturers). The wide-ranging task area for an IT controller contains following aspects: organizational basics (organization and tools for IT controlling), controlling the information technology (IT strategy, software development), controlling the applications (application planning, portfolio planning, multi-project controlling and project controlling, and others), controlling the infrastructure services (software maintenance, quality control, service processes and others), special topics (economics of IT, total cost of ownership analysis, balanced scorecard, IT security and more) and IT controlling in specific areas (insurance, banks, small and medium-sized enterprises). Even concepts that were new at the time – like the balanced scorecard – were adapted for use in IT (Tewald 2000, p. 636).

Gadatsch and Mayer (2004 and 2006)

The text book by Gadatsch and Mayer (2006), first published in 2004, aims primarily at students and practitioners. In addition to an introduction to general corporate controlling and a comprehensive description of the IT controlling concept, it contains an introduction going further into IT cost and performance accounting. IT controlling is understood as a performance oriented leadership model which offers more than only cost and efficiency analysis. IT controlling is positioned as an independent adviser for information management attempting to increase the efficiency of tasks (strategic IT controlling) and the effectiveness of using IT (operational IT controlling).

Jaspersen (2005)

The practical text book by Jaspersen (2005) is aimed at staff of medium and small enterprises. It describes classic tools for IT controlling like accounting (e.g. cost accounting), operational (e. g. IT standards) and strategic tools (portfolio management, IT investment accounting) and IT outsourcing. The author differentiates between technical IT controlling (planning, control and supervising of processes) and economic IT controlling (monetary models of processes). The concept is one of the few attempts to discuss IT controlling for small and medium-sized enterprises. However, it becomes obvious that it is difficult to substantially address this company size. A lot of the presented methods fit larger companies and corporations better (see also Lehner 2006, p. 141).

Kütz (2005)

The proposal of Kütz (2005) is aimed at IT managers and IT controllers in practice. It is one of the rare concepts which explicitly mentions an IT controlling concept. Starting from the general controlling concept of Horváth (2003), Kütz understands IT controlling as a subsystem of a higher leadership model for the IT area (Kütz 2005, p. 4). IT controlling is viewed from different angles as a system, as a process and as a hierarchical instance. The process view is very interesting because it presents one of the few process models for IT controlling. The targets of IT controlling comprise the increase of efficiency of IT, initiating impulses for the restructuring of IT usage, and IT innovation (Kütz 2005, p. 34). IT controlling is responsible for IT cost and performance accounting, IT efficiency analysis and analysis of IT performance indicators, procedures for planning, analysis, forecast and decision support. Compared with other IT controlling concepts the book distinguishes itself through practical orientation and high formalization at the same time.

Kesten et al. (2007)

The practice oriented IT controlling concept by Kesten et al. (2007) is one of the complete descriptions of IT controlling with a clear focus on IT project management and transfer into practice. Their target is to create an integrated framework from IT strategy to the running of IT. The framework includes development and supervision of the IT strategy, project planning including IT efficiency analysis, and IT operations (Kesten et al. 2007, p. 3). At the strategy level the task list for the IT controller includes the subtasks scouting and evaluation of new technologies, analysis of chances and risks, calculation of the added value of IT and the definition of strategic projects. On the project level the focus is on multi project management and the control and analysis of the efficiency of single projects. The area IT operations covers the tasks of economic control, e. g. relationship management to external business partners, IT product definition and calculation, cost accounting as well as evaluation and supervision of outsourcing projects (Kesten et al. 2007, p. 4). In addition to its methodical content the book includes numerous case studies.

Brun (2008)

The paper of Brun (2008) presents an advisory approach of a process oriented IT controlling concept. The proposal distinguishes the tasks of IT governance (Johannsen and Goeken 2007) and IT controlling. Thus IT governance harmonizes business strategy and IT strategy while IT controlling controls the planning process for IT specific products, IT cost accounting, and reporting (Brun 2008, p. 60). The task list of IT controlling focuses on cost and resource oriented activities like portfolio management (compiling of the IT project portfolio), project controlling (planning, control and supervising of activities and projects), product and infrastructure controlling (product creation, resource planning and cost and performance accounting), risk management (handling of IT specific risks) and use of the balanced scorecard (Kaplan and Norton 1992) as a tool for control of information management (control of IT strategy).

Comparison of concepts

The comparison of the IT controlling concepts in Tab. 3 (in the order of first publication) shows that the discussion about targets and tasks has already reached an advanced stage, but is not finished yet. Focus points can be identified. The target of IT controlling often addresses the area of efficiency and effectiveness of the IT performance creation. There is agreement concerning the central tasks of creating transparency (IT cost and performance accounting, IT performance indicators and reporting, IT portfolio and project management). IT controlling is primarily considered having an advisory purpose for information management. However, there is disagreement about the independence of IT controlling from information management. The central question is open if IT controlling can possess an independent decision making function or if its place is rather that of an advisory role for information management. All publications are written for academia and practitioners likewise, so they can be used in practice as well as for lectures in business information systems. Only a few concepts discuss both information management (e. g. IT strategy, IT standardization) and accounting (planning, clearing and analysis von IT costs and performance) equally. Often the focus is on a particular aspect like accounting (e. g. Britzelmaier 1999), information management (e. g. Krcmar 2005) or specific types of enterprises (Jaspersen 2005).

Tab. 3 Overview of selected IT controlling concepts (1999–2009)
Full size table

3 Performance oriented IT controlling concept

3.1 Cost versus performance orientation

The strong penetration of most business processes has lead to an increasing quota of IT costs relative to the total costs of companies. This results in the risk of IT controlling being identified with IT cost management. Cost oriented approaches (e. g. Marzinzik 1998) reinforce this impression. A lack of transparency here may lead top management to the impression that IT costs are too high. In this case the value of IT for the company may not be recognized. A performance oriented IT controlling approach enhances performance and efficiency of the use of IT. The employment of IT serves as a lever to increase the competitiveness and viability of companies. Typical activities are the alignment and control of IT activities according to companies’ targets, improvement of processes inside and outside of IT, establishing the causation principle regarding IT use and costs and performance accounting, as well as a business strategy oriented selection of IT projects.

3.2 IT processes

Fig. 1 roughly depicts an IT process model by adding selected tasks of information management and the area of IT controlling. Strategic IT controlling gets its bearing from the company’s targets without time horizon. It is used to increase the efficiency of the company. IT is known as a competitively relevant contribution to supporting the company targets. There is no clear dividing line in the transition to the operational IT controlling concept. It increases the efficiency of set activities inside a defined time horizon. Its success is assessed according to the profitability of the activities, among other criteria.

Fig. 1
figure 1

Rough IT process model (in addition to Gadatsch and Mayer 2006, p. 43)

Full size image

During the first step an IT strategy will be designed which takes care of the transformation and supervision of activities to achieve the company targets. Contents of the IT strategy are e. g. principle decisions for the procurement of standard application software or development of individual software, type and extension of outsourcing or the structure of cost and performance accounting (Heinrich 2002, p. 113). Of central importance is the development of an IT master plan. The master plan specifies applied and planned information systems (Herold 2003). To avoid problems of integration and to decrease IT costs, standards for hardware, software and security have to be defined. The IT portpolio planning identifies concrete projects and prioritizes them by criteria derived from the IT strategy.

The process step IT development supports the development and maintenance of individual software as well as the introduction and implementation of standard application software for typical corporate applications like enterprise resource planning or office software.

Software implementation is followed by IT operations. Here the tasks exist in planning and constructing the IT infrastructure. The IT infrastructure (also called IT landscape) covers all information systems, hardware and other facilities of a company (e. g. Hess 2006, p. 112). Furthermore the information systems have to be operated and a strategy-conform IT service (answering enquiries, incident management and others) has to be ensured.

3.3 A reference process model for IT controlling

The planning, control and measurement of IT processes is a crucial part of IT controlling (Brun 2008, p. 60). To describe these tasks a life cycle model is necessary which comprises all phases (Kütz 2007, p. 7). So far only a few specific life cycle models in the sense of reference models have been published. As an example the model of Buresch (2000, pp. 145–147) can be mentioned which divides into the cycles planning, control and monitoring. Therefore in Fig. 2a life cycle model is recommended which refines the rough IT process model from Fig. 1 into three linked subcycles. It mainly serves as a didactic concept to back up the strategic relevance of IT controlling as well as the operative integration of the IT controller into software development and implementation processes and IT operations.

Fig. 2
figure 2

Refined IT process model (life cycle model)

Full size image

First subcycle: Development and adjustment of the IT strategy

Inside of the first subcycle IT controlling works together with information management and the business departments to adjust the IT strategy to the business strategy of the company. This ensures that the planning of activities only pursues targets which are compatible with the IT strategy. By using the balanced scorecard method developed by Kaplan and Norton targets, indicators and target values will be agreed on and supervised to reach the targets (Kaplan and Norton 1992). The method can be modified and used as an IT controlling tool to control the IT strategy (Tewald 2001). In addition to using the balanced scorecard for the whole information management, the control of specific IT projects by using a modified balanced scorecard is proposed (Jonen et al. 2004).

Second subcycle: Selection, development and introduction of information systems

After determining of the IT strategy and the IT portfolio, projects can be initialized. Topics of this subcycle are problem analysis, concept development, software development and provision as well as testing and optimization of information systems. IT project controlling supports the compliance of targets, results and budgets. IT investment accounting will carry out the efficiency analysis of projects. Concepts of outsourcing to relocate software development into cheaper countries should be evaluated by IT controlling. IT standards (e. g. for consistent devices, application software customary in the market, development projects, procurement processes for IT services) support the acceleration of the software development process and its implementation as well as the abolishment of inefficiencies of IT operations. IT controlling helps information management realize cost advantages caused by economics of scale by enforcing IT standards in companies.

Third subcycle: Planning and operating IT

The third cycle supports the planning, supply and use of IT infrastructure (hardware, staff etc.). With the help of service level agreements (Jäger-Goy 2002) the compliance of contracts between IT service providers (e. g. data centers) and IT customers (e. g. end user) will be supervized. During the monitoring targets will be adjusted. For small deviations an optimization of the process can be included in the fixed IT portfolio. For larger digressions a modification of the IT portfolio or of the IT strategy is necessary.

4 Current situation in German speaking countries

4.1 Empirical research on IT controlling

During the last years only a few studies concerning the transfer of IT controlling concepts into practice were published (Becker et al. 2006; Bichler et al. 2008; Son and Gladyszewski 2005). To reduce this deficit, the special interest group IT Controlling of the German Informatics Society (Gesellschaft für Informatik e. V.) has conducted a study of its own concerning the status of IT controlling in German speaking countries (Gadatsch et al. 2007). The target was to analyse the usage of tools of IT controlling and to derive recommendations for real life situations.

4.2 Core results

IT controlling is increasingly penetrating companies. More than half of the companies have established an IT controller position (55 %). Reasons for this are the stronger IT penetration of business processes and the resulting increased sensitivity of top management regarding IT questions. The recommendation in literature to make IT controlling a part of information management (Krcmar 2005) is confirmed by practice. Approximately half of all IT controllers (48 %) report to the head of information management. A similar study by Becker et al. (2006, p. 19) assigns 54 % of the IT controllers to information management. The classification as belonging to corporate controlling is inconsistently pronounced (10 % at Becker et al. 2006, p. 19 and 26 % at Gadatsch et al. 2007, p. 34), but increasingly demanded by current publications (Hess 2007). Only in very rare exceptions does the IT controller report to the head of the company.

The questioned companies are increasingly applying economic methods. However, standard methods of IT controlling (e. g. indicator systems) have not consistently been established. An IT strategy as basis for an IT controlling concept is only available in about 80% of the questioned companies, mostly with a focus of 3 years (Gadatsch et al. 2007, p. 8).

However, only one third of these companies use the balanced scorecard as a tool to control their IT (Gadatsch et al. 2007, p. 14). One reason for this is that these methods cannot always be used economically. For project controlling only classical methods like Mile stone analysis and Efficiency calculation are generally used. Especially innovative IT projects can only use the methods of efficiency analysis conditionally (Oehler 2008). The earned value analysis which has been postulated again for some time compares planned costs with current costs (Linssen 2008; Stelzer and Bratfisch 2004; Stelzer et al. 2007). This method cannot yet be regarded as an established tool of IT controlling because of its insufficient circulation.

4.3 Need for action

A weak point is the insufficiently fixed terminology. The term IT governance for example has a lot of overlapping with broader versions of IT controlling. The proposal of Brun (2008) who defines the terms clearly is to be welcomed. Only few publications are available concerning reference models for IT controlling (Johannsen and Goeken 2007) although they would be helpful. This applies to the whole IT controlling process as well as to sub processes (portfolio management, planning and budgeting, project controlling and others). The determination of the value of IT is something which is often sought after by practitioners (e. g. Brugger 2005), but which is actually only dealt with in few publications (e. g. Kesten et al. 2007). Aspects of risk have to be included because of the nature of IT projects. Flexible concepts for an assessment of risky IT-investments like the rarely used real options could be of help. But these concepts have to be further adapted for use in practice.

5 Summary and outlook

In this paper different IT controlling concepts have been presented. They depict an advanced but not completed discussion of the terminology. The proposal of a performance oriented IT controlling concept shows how the whole IT life cycle can be supported, besides dealing with the classic tasks of an cost oriented view. Furthermore the current situation of IT controlling in German speaking countries was analyzed. As a main result we noted a weak acceptance of methods. To improve the situation recommendations for activities were given. With regard to possible research activities we recommend to intensify efforts concerning the following aspects because of their suspected high importance for practice: Development of the specific terminology as well as development of reference model concepts for the specific tasks of IT controlling, e. g. the planning and budgeting process.