Conferences & Events
Events for all Levels and InterestsStay
Jump Start Your Career GrowthStay
Get on the Higher Ed IT MapStay
Uncommon Thinking for the Common Good™Stay
EDUCAUSE IT Governance, Risk, and Compliance Program
Governance, risk, and compliance (GRC) issues increasingly pervade higher education information technology. As institutional investment in IT and reliance on information systems have grown, so has the need for reliable structures and measures to ensure success and minimize failure.
IT GRC programs develop a framework for the leadership, organization, and operation of an institution's IT programs. This framework can be used by IT staff to ensure that their programs support and enable the institution's strategic objectives. The EDUCAUSE IT GRC program provides resources that help you define and implement IT GRC activities on your own campus.
A member advisory board, member working groups, and representatives from complementary organizations advise EDUCAUSE in the development of best practices, toolkits, and case studies. EDUCAUSE-conducted research will benchmark how higher education institutions are currently approaching IT GRC practices. New resources will be added to this page as they are developed.
To learn more or to contribute to the higher education IT GRC body of knowledge, contact us at GRC@educause.edu
- Governance, Risk, and Compliance: Why Now? EDUCAUSE Review, December 6, 2013. Governance, risk, and compliance (GRC) programs intend to develop a framework for the leadership, organization, and operation of the institution's IT areas to ensure that those areas support and enable the institution's strategic objectives.
- Speaking the Same Language: Building a Data Governance Program for Institutional Impact, EDUCAUSE Review, December 6, 2013.
- Starting the Conversation: University-wide Research Data Management Policy, EDUCAUSE Review, December 6, 2013.
- Boston University Information Services and Technology Governance Model, October 10, 2013,
- Making the Case for the Information Strategy, ECAR Bulletin. September 6, 2011.
- Leading the Higher Education IT Organization: Six Building Blocks of Success, EDUCAUSE Review, May 31, 2011.
- Making IT Governance Work, ECAR Bulletin, October 5, 2010.
- Decentralized IT Governance and Policy in Higher Education, ECAR Research Bulletin, March 10, 2009.
- Process and Politics: IT Governance in Higher Education, ECAR Research Report, July 21, 2008.
- Queensland University of Technology: Three Generations of IT Governance (and Counting), ECAR Case Study, July 25, 2008.
- Reforming IT Governance at Berkeley: Introducing an Enterprise Perspective to a Decentralized Organization, ECAR Case Study, July 25, 2008
- From 2004-2012 IT governance was in various positions of the EDUCAUSE top ten issues, http://www.educause.edu/educause/visualizations/vis1/index.html
- Leveraging Enterprise Risk Management: Opportunity for Greater Relevance, EDUCAUSE Review, December 6, 2013. Even though enterprise risk management (ERM) engages the entire higher education institution, IT organizations have an opportunity to use ERM to move beyond a services function toward providing strategic value to the institution.
- Learning While Doing: Two Institutions’ Practical IT Risk Management Experiences, ECAR Research Bulletin, July 29, 2013.
- Top-10 IT Issues, Policy Implications, and Managing Risk, EDUCAUSE Blog, June 24, 2013.
- IT Risk Management: Try This Exercise at Your Institution, EDUCAUSE Review Online, June 30, 2013.
- IT Risk Management Poll Results, April 2013.
- Managing IT Risk in Higher Education: A Methodology, ECAR Research Bulletin, March 18, 2008.
For additional resources see the library Items tab on the "Risk Management" page
- Higher Education IT Compliance through the Prism of Risk Controls,EDUCAUSE Review, December 6, 2013. Only through collaborative compliance and risk discussions can appropriate decisions be made about both the everyday activities and the transformative new technologies that are or will be available to the higher education institution of 2020.
- Higher Education Information Security Council, Information Security Guide, Compliance Chapter, EDUCAUSE/Internet2
- Privacy, Security, and Compliance: Strange Bedfellows, or a Marriage Made in Heaven?, EDUCAUSE Review, January 28, 2013.
- The Policy Process Life Cycle, EDUCAUSE Review, March 20, 2009.
- Higher Education Compliance Alliance, was created by the National Association of College and University Attorneys (NACUA), in partnership with thirty other higher education associations, to provide the higher education community with a centralized repository of information and resources for compliance with federal laws and regulations.
For additional resources see the library Items tab on the "Compliance" page
Library Items on this Topic
EDUCAUSE Library Items for IT Governance
- Session: Internet Governance – Federal Regulatory Agency, or a Nightmare Par Excellence?
March 12, 2010
A myriad of federal agencies currently try to address governance issues related to the Internet, for example, the Copyright Office, the FCC, the FTC, the Judiciary, the Department of Commerce, t…
- Demystifying Cloud Computing for Higher Education
September 22, 2009
This ECAR research bulletin is the first in a series of bulletins devoted to cloud computing in higher education. It summarizes insights and a framework for thinking about cloud computing, and i…
- Dispersed Web Content Management in Higher Education
July 30, 2009
Key Takeaways Colleges and universities can choose a centralized or a dispersed management model for handling content on their websites. Utah Valley University chose a dispersed web con…
- Strategic Outsourcing and Cloud Computing: Reality Is a Sober Adversary
June 16, 2009
This research bulletin examines outsourcing and cloud computing through the lens of strategic decision making for higher education. Strategic decisions have long-term impact, create institutional…
- Implementing an ERP on Time and on Budget: An Innovative, Inclusive Approach
May 19, 2009
This ECAR research bulletin provides an innovative and practical approach to implementing an institution-wide enterprise resource planning (ERP) both on time and on budget. It describes the princ…
- IT Services Advisory Committees - Miami University
May 5, 2009
This web site details the University of Miami's IT governance structure. This web site details the University of Miami's IT governance …
- Decentralized IT Governance and Policy in Higher Education
March 10, 2009
This ECAR research bulletin focuses on the challenges and strategies related to integrating IT governance and policy across multiple university entities (schools, colleges, departments, and campu…
- Revisiting and Upgrading IT Governance: An Interview with Michael Hites from the University of Illinois Central Administration
October 1, 2009
This podcast features an interview with Michael Hites , Associate Vice President of Administrative Information Technology Services (AITS) at the University of Illinois Central Administ…
- University of Louisville: Fulfilling the Promise of VoIP
March 2, 2009
This ECAR case study complements the 2009 ECAR study by Mark C. Sheehan with Judith A. Pirani, Spreading the Word: Messaging and Communications in Higher Education. The study examines curren…
- Website Redevelopment: A Big Job with a Big Payoff
November 11, 2008
This ECAR research bulletin focuses on what it takes to reposition, reengineer, rebuild, and redevelop an existing university-wide website and structure it for ongoing manageability. It covers we…