Landau (2023) defines IT governance as a collection of principles and practices that are put in place to ensure that all organisations’ IT activities are aimed towards meeting their business objectives. These IT activities include structuring IT teams, procuring IT assets and configuring IT infrastructure.

A study by Tian and Chen (2022) asserts that the primary goals of implementing IT governance in any given organisation are typically to ensure that IT generates business value, to oversee the performance of IT managers, to assess risks associated with the IT department and to establish an IT disaster recovery plan to provide transparency and accountability to IT operations.

Stone et al. (2015) define information and communication technology as the use of computers and telecommunications devices to gather, store, retrieve and distribute data for an organisation’s operations. To promote digital inclusion and close the digital divide, Information and Communication Technologies (ICTs) is essential. Ensuring fair access to technology is essential for advancing social justice and economic possibilities as economies depend more on digital platforms (Wu et al., 2023). Governments and organisations are putting policies and programmes in place to improve digital literacy and infrastructure because they understand how important ICT is to reach these objectives (Mello, 2020). According to Jere and Ngidi (2020), the idea of technology adoption itself is intrinsically linked to the importance of field research investigating how organisations embrace and incorporate new technologies into their daily operations. As a result, IT governance includes the incentives and difficulties related to technology adoption in addition to the formal processes. These elements can therefore have a significant impact on an organisation’s overall success as well as its competitive edge.

Since SOEs frequently must pursue modernisation efforts while also upholding public accountability and providing high-performance services, it is very important to understand how SOEs adopt technology. Sofyani et al. (2020) state that effective IT governance frameworks help firms maximise resources by facilitating accountability and decision-making. Several models, including ISO standards and the COBIT framework, offer recommendations for creating strong governance frameworks. Strong IT governance improves corporate performance, risk management and compliance, according to the literature (Malope et al., 2021).

For the above reason, good IT governance ensures that strategic plans and investments are in line with the overall goals of state-owned businesses (Dincă et al., 2019). In South Africa, where SOEs are key to providing basic services and promoting economic growth, this alignment is vital. State-owned entities can improve their operational effectiveness and service delivery by coordinating IT projects with strategic goals (Sutherland, 2020). State-owned entities are exposed to significant risks concerning cybersecurity, data privacy and regulatory compliance, according to a study by Zhen et al. (2021). Strong IT governance frameworks assist in addressing these issues by empowering SOEs to recognise, evaluate and reduce such risks, protecting private information and upholding public confidence.

State-owned entities are becoming more aware of the vital role that digital technologies play in improving their performance capabilities in the quickly changing technological world of today (Wilkin & Chenhall, 2020). Budgetary restrictions, public accountability and the requirement for efficiency and openness are some of the difficulties faced by SOEs as public sector entities entrusted with providing important services. These organisations have a revolutionary chance to overcome these obstacles and enhance their operational efficacy through the integration of digital technologies, including cloud computing, big data analytics, artificial intelligence (AI) and the Internet of Things (IoT) (Amedzro St-Hilaire, 2023). Additionally, Malope et al. (2021) state that SOEs can improve service delivery, optimise resource allocation and streamline procedures with the help of digital technologies, which eventually raises citizen satisfaction. Cloud computing, for example, provides scalable solutions that lower infrastructure costs, while big data analytics gives decision-makers access to insightful information gleaned from enormous databases. Similar to how IoT devices can enable real-time monitoring and control of public services, AI and machine learning can automate repetitive operations, freeing up human resources for more strategic endeavours. Information technology governance should concentrate on several important areas, such as performance measurement, risk management, stakeholder value drivers, IT value drivers and strategy alignment within IT, as shown in Figure 1.

Additionally, implementing technology supports larger government goals, including increasing accountability, encouraging transparency and spurring innovation in the provision of public services. In addition to enhancing internal operations, SOEs can increase citizen participation and meet citizens’ expectations in an increasingly digital world by utilising digital tools (Rakhmonov & Choriev, 2022). Moreover, Martínez-Caro et al. (2020) added that SOE’s have a great chance to improve their performance capabilities through the incorporation of digital technologies. Understanding the underlying reasons for adopting new technologies, the difficulties in putting them into practice and their potential uses will be crucial as SOEs negotiate the complexity of digital transformation. Notwithstanding that, to increase their operational effectiveness, SOEs can better meet the demands of the communities they serve by embracing innovation and utilising digital solutions, which will promote a more accountable and responsive public sector.

The concept of corporate governance has changed dramatically throughout time. Stakeholder interests and accountability were not given much consideration in early corporate governance structures, which were frequently informal. However, to ensure organisational integrity, transparency and long-term sustainability, strong governance structures are becoming increasingly important. The significance of moral leadership, risk control and open financial reporting was highlighted by these incidents (Solomon, 2020). It was noted by Larcker and Tayan (2020) that the key components of corporate governance consist of:

Board of Directors: At the heart of corporate governance, the board oversees establishing the company’s strategic direction, supervising management and making sure the business acts in the shareholders’ best interests. The board’s independence, diversity and experience are frequently used to gauge its efficacy.

Management: The functions and duties of management are outlined in corporate governance frameworks. For management to be held accountable to the board and shareholders, they must act openly and in accordance with the goals of the business.

Shareholder rights: With the ability to vote on important issues like board member elections and big business deals, shareholders are essential to corporate governance. Upholding the rights of shareholders is essential to making sure businesses continue to answer to their owners.

Stakeholder engagement: Employees, clients, suppliers and the community are just a few of the stakeholders that modern corporate governance acknowledges as being important. Companies can better comprehend these groups’ interests and incorporate larger societal issues into their governance procedures by interacting with them.

Regulatory frameworks: Corporate governance processes are governed by several laws, rules and recommendations. These frameworks, which differ from one nation to the next, comprise guidelines established by international organisations, stock exchanges and regulatory authorities. They frequently concentrate on topics including executive salaries, financial disclosures and board duties.

King Reports were released by South Africa’s King Committee on Corporate Governance. They provide some values and approaches for effective governance. The actual code of practice that transforms these principles into practical suggestions is the accompanying King Code. They are well known for their progressive, principles-based (rather than rigorous, rules-based) strategy that prioritises ethical leadership, sustainability and stakeholder inclusion. They are recognised as the cornerstone of corporate governance in South Africa, particularly in public and SOEs (Rossouw, 2020).

Because of changing stakeholder expectations, regulatory frameworks and economic realities, the field of corporate governance has experienced significant change in recent decades. The several versions of the King Reports on corporate governance in South Africa are the best example of this progression. The King codes, which date back to the early post-apartheid era, have continuously addressed both domestic demands, such as redressing historical injustices and encouraging moral leadership, and global developments, such as the emergence of sustainability as a strategic priority and global financial crises. Van der Merwe (2020) and Rossouw (2020) discuss how codes and reports have evolved to accommodate changing local and international business settings.

Moudoubah et al. (2021) elucidate that support should be above the primary goal of COBIT to promote best practices through an organised, global IT standardisation process. Therefore, by identifying an organisation’s core IT competencies and coordinating IT with the business plan, COBIT maximises the advantages of IT. The following areas are the focus of COBIT: strategic alignment of the firm’s business plan, IT alignment with the company’s operations, resource management optimisation to increase return on investment and effective risk management to lower major risks to the organisation. Figure 2 presents a thorough process oriented governance and management model.

The COBIT framework’s significance arises from its ability to bridge the gap between broad corporate strategy and technical IT activities (Ikhsan et al., 2021). COBIT assists organisations in making better decisions, performing better and reducing risks associated with IT operations by providing a holistic approach to IT governance. Kesuma et al. (2022) add that COBIT provides a useful foundation for developing nations such as South Africa in the modern digital economy, where organisations rely on technology to drive innovation and maintain their competitiveness. Its methodical approach assists organisations in streamlining operations, establishing clear accountability and coordinating IT initiatives with more general business objectives. Mangalaraj et al. (2014) emphasise that, achieving operational excellence, adhering to industry standards and fostering stakeholder confidence, are all vital for sustained success in emerging economies.

The ITIL is a dynamic and fundamental framework for efficient IT service management rather than merely a passive set of rules. Information Technology Infrastructure Library was first created by the Central Computer and Telecommunications Agency (CCTA) of Britain in the late 1980s, and it has now matured into a widely accepted collection of best practices. Nachrowi et al. (2020) contend that ITIL provides an organised framework that not only arranges these best practices but also actively assists companies in coordinating their IT services with business objectives.

To support the above assertion, Aguilar-Alonso and Vergara-Calderon (2020) postulate that ITIL management service encompasses internal and external supplier development activities, service control and the implementation of control procedures throughout their life cycle. These principles are quite useful for developing policies to monitor and manage the ITIL service lifecycle. This study notes that recommendations for the design and development of IT management services and procedures continue to be part of the project service process. According to Yamami et al. (2018), activities continue to be the process of translating previously established strategic goals in a service portfolio. Information Technology Infrastructure Library transition services collect the requirements of the service strategy, analyse the service project and apply this context to service operations to reduce the risk of failure and provide guidance on the service strategy requirements encoded in service design that are successfully implemented.

A study by Rusman et al. (2022) emphasises that to have effective practices that drive efficient IT governance, International Organization for Standardization and the International Electrotechnical Commission (ISO/IEC) 27002 frameworks should be in place to align the principles and guidelines aimed at enhancing an organisation’s information security management for organisational success. The principles underlying foundational elements of ISO/IEC 27002 are information security, asset management, safety of human resources, physical security and the environment, operations and communications management, access control, acquisition, development and maintenance of information systems, information security incidents management, business continuity management and compliance.

The ISO/IEC 27002 standard is critical for establishing effective IT governance procedures, and it provides a comprehensive collection of rules and concepts aimed at improving an organisation’s information security management system (ISMS). Information security is an essential component of IT governance for enterprises, particularly SOEs that routinely handle sensitive data and operate in highly regulated environments (Calder & Watkins, 2024). In addition, a study conducted by Herath et al. (2023) asserts that the ISO/IEC 27002 framework can help organisations ensure that their IT systems and procedures are secure, robust and compatible with worldwide best practices. Rusman et al. (2022) further add that ISO/IEC 27002 framework supports IT governance by providing an organised method for dealing with information security threats and describing safeguards that businesses can put in place to protect their information assets, such as data availability, confidentiality and integrity. These safeguards are critical for reducing risks such as cyberattacks, unauthorised access and data loss for SOEs, which commonly supervise critical infrastructure and public services.

According to Palmer et al. (2022), a good flow of information for organisations requires a well-designed, less time-consuming and easy-to-implement good governance system to be in place to ensure the right information is collected at the right time. In addition, organisations need to ensure that proper strategic planning is done, and staff is well trained and competent in the methods of performance reporting, while stakeholders are involved in strategic planning.

Figure 3 shows the link between dependent, moderating and independent elements, outlining the conceptual framework that reflects the idea from corporate governance and strategic information systems planning. The variables describe how planned activities are executed and how each variable impacts the organisation’s daily operations and performance. It also recognises the challenges the company has with the performance reporting tools and the IT governance architecture. The dependent variable primarily focuses on the organisation’s existing systems and the staff’s access to information. Conversely, the components of the IT governance framework charter, policies, accountable framework, IT reporting, IT risk framework, decision-making structures and the application of the logical framework are examined by the independent variables.

An initial search for information technology governance and performance in SOEs using the Sabinet Database and Google Scholar without any time or restriction parameters produced 123 documents. The following search string was used to narrow down the results for the years 2019 through 2025 ‘IT governance’, ‘digital technology’ and ‘performance of public entities’ are the title keys. The search procedure was then made more efficient by using other parameters, such as publication year (2014–2025) and document type (conference papers, journal articles and book series). A total of 40 documents were selected as the study’s foundation once these criteria were applied. Thematic analysis was then carried out to methodically find, examine and report recurrent patterns and themes across the 40 articles to determine the essential themes of the selected articles, such as pertinent journals and their individual contributions to the performance of SOEs.

Ethical clearance to conduct this study was obtained from the University of South Africa’s College of Science, Engineering and Technology, School of Computing (ERC) on 01 April 2025 (No. [6109]).