S7.10 - IS_governance_theory

S7.10 ? IS governance theory

flowchart LR
    A[Classical IS governance concerns
decision rights, control, accountability, coordination]
    B[Traditional limitation
policy-level governance is too broad for situated GenAI use]
    C[RAIDT
run-level evidence framework]
    D[[IS governance theory
organisational logic for governing configured GenAI use]]
    E[Governance move
evidence over assertion
reviewability, contestability, audit readiness]
    F[Run-level evidence pack]
    G[RAIDT five-pillar score profile]
    H[Reviewer reconstruction and organisational learning]
    I[Public services, healthcare, education, cybersecurity, enterprise productivity]

    A --> C
    B --> C
    C --> D
    D --> E
    D --> F
    D --> G
    F --> H
    G --> H
    I --> D

? Star S7 - Academic Theory and Design Logic

Star context: Positions RAIDT within Information Systems and organisational governance by showing how run-level evidence turns abstract governance principles into operational decision rights, controls, accountability, and reviewable digital work.

Academic picture

Definition / background

IS governance theory explains how organisations allocate decision rights, establish control arrangements, distribute accountability, and coordinate information-related activity so that digital systems support organisational objectives while remaining manageable and reviewable. In the Information Systems field, governance is not simply management, compliance, or technical administration. It concerns the formal and informal arrangements through which digital work is directed, monitored, justified, and corrected.

Within RAIDT, this theory matters because generative AI creates governance difficulty at the level of situated use. A policy may say that GenAI must be used responsibly, but that does not by itself show who authorised a given use, what configuration was applied, what evidence was retained, who reviewed the output, or how a questionable result can be challenged later. RAIDT extends IS governance theory by treating the run as the smallest meaningful unit at which these governance questions can be answered.

This distinguishes IS governance theory from adjacent ideas such as AI ethics principles, model risk management, or platform administration. Ethics principles state desirable values. Model governance often focuses on model development and deployment. Platform administration focuses on access and configuration. IS governance theory, as used in RAIDT, explains how organisational authority, accountability, and control are enacted around actual digital work. That is why it belongs inside RAIDT's conceptual architecture.

The relationship to RAIDT's outputs is direct. The run-level evidence pack records how governance operated in one use episode. The five-pillar score profile translates governance quality into structured assessment across Responsibility, Auditability, Interpretability, Dependability, and Traceability. Together, these outputs make IS governance visible in practice rather than leaving it at the level of policy aspiration.

Why this concept matters

IS governance theory gives RAIDT a publishable and defensible Information Systems grounding. It explains why the framework is not merely an AI checklist, an ethics overlay, or a documentation exercise. RAIDT addresses a governance gap: organisations increasingly rely on GenAI in everyday work, yet their governance mechanisms are usually specified at levels too broad to reconstruct what happened in a specific case.

Without this concept, organisations can confuse governance with generic principle statements, assume that technical access controls are enough, or treat GenAI use as too granular to govern meaningfully. The result is weak accountability, poor contestability, limited audit readiness, and little organisational learning when outputs are challenged. IS governance theory avoids that confusion by explaining why decision rights, review rights, evidence obligations, and accountability chains must be tied to the run.

For organisations using GenAI, this matters because governance failure often appears in the gap between approved policy and actual use. RAIDT closes that gap by operationalising governance at the point where work is performed. This moves organisations from principles to operational governance, where claims about responsible use can be examined against evidence.

Key idea: IS governance theory matters in RAIDT because it explains why responsible GenAI use must be governed through reviewable run-level evidence rather than through policy statements alone.

What this item explains

Why the run is a legitimate governance unit for GenAI-enabled organisational work.
How decision rights and accountability can be attached to specific configured uses rather than only to systems or teams in general.
Why governance evidence must be produced at the point of use if later review, challenge, or audit is expected.
How RAIDT connects organisational governance theory with practical outputs such as evidence packs and score profiles.
Why GenAI governance in IS should include coordination among human actors, tools, prompts, data sources, review steps, and escalation paths.
How governance quality can be assessed across the five RAIDT pillars without reducing governance to a purely technical control problem.

Practical example / likely audience question

Audience question

Why is RAIDT publishable in Information Systems rather than being just another AI governance framework or compliance checklist?

Answer

The concern behind the question is that many AI governance proposals sound normatively sensible but are not clearly anchored in an established disciplinary conversation. The direct answer is that RAIDT is publishable in Information Systems because it identifies a missing governance unit and a missing evidence object for digital work: the run and the run-level evidence pack. That contribution sits squarely within IS governance theory because it addresses decision rights, accountability, control, and coordination around actual system use.

A practical example makes this clearer. Suppose an organisation allows staff to use a GenAI assistant to draft client-facing reports. A generic AI governance approach may provide a policy, broad roles, and some platform restrictions. However, if a disputed report emerges, those controls may not reveal which prompt was used, whether sensitive material was included, who reviewed the output, or whether the model configuration matched policy. RAIDT handles that gap by treating each configured use as governable and evidentially reconstructable.

This is stronger than a generic governance approach because it does not stop at saying that oversight exists. It shows how oversight is instantiated in evidence. That is precisely why IS governance theory is the right lens: it allows RAIDT to explain not just what responsible use should look like, but how organisational governance becomes operational, reviewable, and contestable in practice.

Practical example in RAIDT terms

Consider a public-services setting in which a local authority uses a GenAI assistant to draft case summaries for housing-support applications. The use case appears routine, but the run-level issue is significant: each summary may shape staff interpretation of eligibility, urgency, and required follow-up. If a resident later challenges a decision, the authority must be able to reconstruct how the summary was produced and reviewed.

In RAIDT terms, the evidence needed for a single run would include the task definition, prompt or template used, model and version, source documents provided to the model, user identity or role, timing of the run, review steps, approval status, redaction handling, and any warnings or limitations attached to the output. The relevant pillars are especially Responsibility, Auditability, and Traceability, though Interpretability and Dependability also matter because staff must understand the basis of the summary and trust its stability.

IS governance theory improves governance readiness here by clarifying that the issue is not merely whether the authority has an AI policy. The issue is whether governance rights and controls can be shown in the specific case. RAIDT makes that possible by turning a single GenAI-assisted work episode into a reviewable governance object.

Detailed link to RAIDT

IS governance theory links to RAIDT in four ways.

First, it gives RAIDT a clear conceptual basis for treating governance as the allocation of rights, controls, accountability, and coordination around digital work.
Second, it justifies the run as the level at which those governance arrangements must be evidenced for GenAI use.
Third, it connects governance theory to RAIDT's practical outputs by showing why an evidence pack and score profile are necessary rather than optional documentation.
Fourth, it supports reviewability, contestability, audit readiness, and organisational learning by ensuring that governance claims can be tested against a specific use episode.

IS governance theory ? Run-level evidence ? Evidence pack ? RAIDT score profile ? Governance readiness

In this chain, the theory explains why evidence is required, the run provides the unit of observation, the evidence pack records what happened, the score profile assesses governance quality across the five pillars, and the resulting artefacts strengthen the organisation's ability to review, challenge, defend, and improve GenAI-enabled work.

Link to the five RAIDT pillars

Responsibility

IS governance theory strongly affects Responsibility because it asks who had the authority to initiate, configure, review, approve, and escalate a GenAI-supported task.