Hitting a moving target: a process model of information systems control change

Abstract Controls are widely regarded as a key factor in driving high performing organisational processes. However, because of ongoing changes within information systems (IS) processes, control modifications are commonly required in order to maintain performance levels. Although past research recognises the ongoing benefits derived from successful control changes, there is a limited understanding of the actual steps taken by organisations, particularly with regard to avoiding negative performance implications such as process delays or employee resistance. This research draws on empirical data from six case studies to propose a new process model that depicts the interconnected steps involved in control changes. Our findings suggest that the sources of IS control change may be more diverse than most past research suggests and that control changes within non‐project‐oriented processes (e.g. enterprise architecture) present additional challenges in comparison to project‐oriented processes (e.g. systems development). Insights from this research can aid practitioners in streamlining control changes as a means to improve effectiveness, whilst also contributing to research by uncovering an enhanced understanding of why and how control changes are made in IS processes.