-In recent years the world has been experiencing a series of environmental changes that have led to the emergence of a strong conviction in society to do with the need to protect the environment. Information Technologies (IT), especially software technologies, can contribute to environmental sustainability in two ways: “Green by IT”, in the sense that IT can provide tools to perform tasks in a way that is suitable for the environment, and “Green in IT”, when ITs themselves have an impact on the environment, due to their energy consumption. However, the techniques of Green in IT are relatively young, and there is no standard or framework to control their correct implementation and/or operation. The objective of this systematic mapping study is therefore to collect the current knowledge about Green in IT audits, in order to determine what are the most important characteristics in the development of an audit framework for Green in IT and especially the indicators used for this auditing. The results obtained demonstrate the novelty of this area, as well as the almost complete absence of studies related to the topic. All of this points to the need to develop a framework for Green in IT auditing.
INTRODUCTION
We have witnessed vertiginous changes, far beyond those brought about by the climate change which the planet has been suffering in the last 30 years. These new features have made society, and in particular organizations, reconsider many aspects of the efficiency, effectiveness and consumption of their activities, in order to reduce the impact these have on the environment.
When it comes to increasing sustainability, the impact of
technology is important from two different points of view [
In this sense, Erdélyi [
The focus of this study lies within the field of Green in IT, specifically in the identifying of standards or frameworks to control the correct implementation and/or operation of Green in IT, and especially as regards its auditing.
Within Green in IT, the reduction of energy consumption has
been addressed in different projects in cloud computing, in
hardware, in data centers, etc., but not in its audits [
From the point of view of the audit, there already exists an
IT framework for auditors, developed by ISACA (Information
Systems Audit and Control Association), called COBIT 5
(Control Objectives for Information and related Technology)
[
COBIT 5 has a series of guides and professional frameworks for the governance and management of different areas of IT (as shown in Fig. 1).
While it is true that this framework provides a fairly broad overview of everything related to IT, and there are versions adapted to specific areas such as security, COBIT does not yet have any version or any control mechanism related to Green IT or to sustainability. There is even less provision as regards Green in IT.
Fig. 1. COBIT 5 product family.
We thus believe that a systematic mapping study that gives the latest knowledge about this research area could be very useful, in order to establish the pillars for developing techniques and/or frameworks of Green in IT audits.
The rest of this study is organized as follows: in Section II the research protocol carried out to perform the systematic mapping study is described. Section III contains the results of the mapping study. In Section IV the main observations of the results, as well as the limitations and implications of this field are discussed. And finally, in Section V, the conclusions and the future work to be done in the field of Green in IT audits are presented.
II.
RESEARCH PROTOCOL
A systematic mapping study is a method for collecting and
categorizing the existing information about a research topic.
This systematic mapping has been carried out following the
lines/guidelines provided in work such as that of Genero et al.
[
The systematic mapping study has been conducted in three stages: planning, executing and documentation. Activities relating to the first two stages are described in the following subsections, and documentation stage corresponds to Section III.
At this stage, the following activities have been carried out: 1. 2. 3. 4. 5. 6.
Define the search strategy.
Establish the selection criteria of the primary studies. Establish the quality assessment criteria.
Define the data extraction strategy.
Select the synthesis methods.
The main objective of this study to examine the current state of Green in IT audits. To do this, the research questions that can be seen in Table I have been set.
By means of these questions, the existing information about Green in IT audit may be collected and categorized. The aim is to know the state of the art in the area and identify existing gaps, so as to be able to propose new research areas.
To carry out the automated search for information, the Scopus database will be used, in which a search string divided into two parts, representing, on one hand, the field of the audit, and, on the other hand, the Green in IT, will be introduced. In Table II this search string is shown, in which the Boolean OR has been used to link the terms and synonyms for each part, and the Boolean AND to join the two parts to each other.
The search will be performed by applying the search string to the title, abstract and keywords of each article.
We should highlight that only any information that has been published in the last decade (from 2005 to 2015, inclusive) will be considered. This is because the idea of Green in IT is relatively young; development and progress in this field has begun to take place only over the last decade. Moreover, in a field like Green in IT, which is in constant growth and renewal, choosing a longer period of time may be a disadvantage, since outdated information would be found in this context. Moreover, the time period used has been validated during the execution of the systematic mapping study, by observing that almost all the publications in the area are located in those years.
The information collected in the automated search will be evaluated, considering the title, abstract and keywords of each article, in order to determine whether that article is to be included or not. To do this, on the one hand, those articles that meet at least one of the following inclusion criteria will be included: I1: articles in English referring to Green in IT audits. I2: complete articles published between 2005 and 2015 in journals, conferences or workshops, with peer review.
On the other hand, articles that meet one of the following exclusion criteria will not be taken into account:
E1: types of articles of discussion or opinion, or those available only as abstracts or presentations.
E2: duplicate works (always considering the most complete and recent article).
The references of each of the articles to be included will be evaluated, i.e., the snowball effect will be taken into account.
To measure the quality of the studies selected, a questionnaire with a scoring system of three values (-1, 0, +1) has been developed. The questionnaire is composed of the following issues to consider: extraction for all the selected studies is ensured, facilitating their classification. The research questions and their possible answers can be seen in Table III. a. The study presents a detailed description of the characteristics and the application of Green in IT audits. The possible answers are: “Yes (+1)”, “Partially (0)”, and “No (-1)”. b. The study contains detailed guidelines about how to perform Green in IT audits.
The possible answers are: “Yes (+1)”, “Partially (0)”, and “No (-1)”. c. The study validates the idea of Green in IT audit, which it defends.
The possible answers are: “Empirically validated using a case study, survey or experiment (+1)”, “Applied at least through a “proof of concept” (0)”, and “Proposal not verified (-1)”. d. The study shows clearly and in detail the results obtained after applying the idea of Green in IT audit, which it defends.
The possible answers are: “Yes (+1)”, “Partially (0)” and “No/ not at all (-1)”.
Note that the score for the studies that have not carried out the application of the idea (i.e. that are only a proposal) will be considered as “Partially (0)”, so that they are not penalized. e. The study has been published in an important journal, conference or congress.
The possible answers are: “Very relevant (+1)”, “Relevant (0)”, and “Not very relevant or not relevant at all (-1)”.
This question will be evaluated considering the order of relevance, following the JCR index of the publications. f. The study has been cited by other authors.
The possible answers are: “Yes (+1)” if the study has been cited by more than five authors, “Partially (0)” if the study has been cited by between one and five authors, and “No (-1)” if the study has not been cited.
This question will be evaluated considering the citation index of Google Scholar. Note that the score for the studies recently published (2015) will be considered as “Partially (0)”, so that these are not penalized.
The sum of the score for each question makes up the final quality score about the study in question (obtaining a value between -6 and +6). These scores will not be used to exclude a specific study from the systematic mapping study if it gets a bad grade, but they will be used to find the most representative and relevant studies, i.e., those which have more weight in future research.
The data extraction strategy is based on a series of possible answers for each of the research questions defined. Thanks to this strategy, the application of the same criteria of data
Firstly, a quantitative synthesis of the data will be performed, based on:
Establishment and representation, through tables and/or graphics, the number and/or percentage of selected studies, classified according to their possible responses in each of the research questions and year of publication. Definition of bubble diagrams to show the frequency with which the possible responses to each of the research questions are related.
And, secondly, a qualitative synthesis of the data will be carried out, based on:
Representation through tables and/or graphs of the studies selected, classified according to the results of quality assessments conducted.
The systematic mapping study was started in January 2016, and was completed in April 2016.
The executing stage, in which the review protocol established in the previous stage has been implemented, has been guided by three main phases:
In the first phase, after applying the search string of the Table II over the Scopus database, a total of 627 documents was obtained. As a result of this, and after applying the selection criteria on the abstract of each, a total of 55 potential studies was obtained.
During the second phase, the selection criteria were applied to the 55 potential studies, but, in this case, to the entire study on each occasion. After this filter, a total of 13 primary studies was obtained.
Finally, in the last phase, a quality assessment of each of these primary studies was carried out, along with a characterization of the studies, placing each into one of three groups (as is explained in Section III).
III.
RESULTS
In this section, the results obtained in each of the research questions are shown, as well as the general results of the systematic mapping study.
First of all, however, it is important to note a limitation or snag encountered during the evaluation of the primary studies selected.
The low number of primary studies found gave a glimpse of how little progress there had been in the area of Green in IT audits. In fact, of these studies only two ([S01] and [S02]) are actually about Green in IT audits. This meant that in order to answer the research questions and give validity to the mapping study, we considered it was a good idea to take into account the other eleven studies included in the primary studies selected.
These facts led us to believe it advisable to categorize the 13 primary studies, placing them in three groups to improve understanding:
Studies closely related to Green in IT audits: this group contains studies [S01] and [S02]; of these, the [S01] is about an analysis of the state of the art of Green IT, and stresses the importance of carrying out audits in this field; and the [S02] shows the results of a survey conducted on internal auditors from different organizations as regards their experiences and opinions about Green IT.
Studies with auditing techniques of Green in IT: in this group, studies [S03] and [S04] are found.
Study [S03] is about a model for measuring and managing the level of maturity of Green IT in an organization.
For its part, [S04] offers a series of initiatives for assessing Green IT, from the perspective of the balanced scorecard. In both of these studies, the areas, the indicators and the other characteristics discussed bear a resemblance to, and a close relationship with, audit topics. 3.
Studies of Green in IT related to some other aspect of audit: this group was formed by the rest of the studies. They deal with various issues of Green IT, from which we can see important characteristics about this area; we may draw out features that help to answer the research questions.
On the one hand, in Appendix A all references to the selected primary studies are found. And, on the other hand, in Appendix B the results concerning the responses of each of the questions in relation to each of the selected primary studies are collected.
Around 40% of the studies selected are systematic mapping studies or literature reviews, or have carried out such a study, the latter type aiming to give the reader a basis on which to follow the rest of the study ([S06], [S09], and [S10]). Two papers have carried out a review simply to show the state of the art of the field in question ([S08] and [S11]).
We can also highlight that about 40% of the studies are proposals ([S03], [S04], [S09], [S10], and [S13]) with which the authors try to establish some guidelines. These guidelines are, for example, on how to assess the maturity of Green in IT in an organization [S03], or about a contingency model for the government of Green in IT [S09].
Moreover, 23% of the studies include some kind of survey ([S02], [S03], and [S06]), to validate their idea [S03] or to display the current status of the field in the organizations studied [S02].
Finally, only 15% of the studies ([S09] and [S10]) validate their idea through a case study.
Only 40% of the studies take into account a particular
methodology or technique for managing/controlling some
aspect of Green in IT. Of these, the majority (80%) emphasize
the importance of applying the existing ISO (International
Organization for Standardization) standards within Green in IT
([S01], [S05], [S06], and [S13]), especially the set of ISO 14000
[
Furthermore, study [S02] offers a risk-oriented methodology, while study [S06], in addition to highlighting the ISO standards, focuses on demonstrating the importance of the ITIL (Information Technology Infrastructure Library) as a guide for managing Green in IT. effectiveness as one of the main and important indicators of Green in IT.
Productivity, for its part, is cited only by study [S11].
Regarding which areas are the main ones within Green in IT and therefore which are those that should be audited, practically all the studies (85%) agree that the two most important areas are the IT infrastructure and software applications, because they contain the bulk of the good practices of Green in IT.
IT governance is also an important area on which more than half of the studies (54%) place special emphasis, especially in the field of aligning both corporate governance and IT with the Green in IT.
Finally, IT management, although mentioned least, at 38%, is also characterized as a relevant and necessary area for the control of Green in IT.
The 69% of studies support the assertion that the main indicator in the measurement of Green IT is power, i.e., the consumption in watts (W) of the IT.
Other studies, such as [S04], [S11], and [S13], also defend the efficiency of IT as being a primary indicator. On the other hand, studies [S04] and [S13] also point to the role of
Regarding the roles, the most outstanding ones are those of CIO and CTO, who are the main individuals responsible for Green in IT in the organizations; this assertion has the support of 54% of the studies.
Next in importance, 38% of the studies also highlight the significance of the CEO and the director/ person responsible for sustainability (CSO, a role which few companies have, as has been observed) within Green in IT.
The board of directors and the CFO are in other roles to be considered, according to 23% of the studies, especially on issues of financial management and business alignment.
Also relevant is the sustainability steering committee (SSC); although practically absent in the majority of organizations, 15% of the studies highlight how important it is for a committee of such characteristics to exist in this field.
Finally, study [S02] also emphasizes the role of the auditors, especially the internal auditors, in the field that concerns us. Note that this is the only study that gives a purely practical vision of the audit.
The most important processes in Green in IT, according to 85% of the studies, and which therefore must necessarily be controlled through audits, are those related to building, acquiring and implementing (BAI) techniques and/or good practices of Green in IT.
It is also very important to audit those processes that are related to Green in IT management, such as the ones related to EDM and MEA; this is corroborated by 77% of the studies. Any failure in these processes that are responsible for monitoring, assessing, evaluating, etc. may cause the malfunction of the Green in IT practices that have already been implemented; it is therefore vital to control those processes.
No less important are processes related to aligning, planning and organizing (APO); their relevance is supported by 69% of the studies. These processes, related in particular to governance, are extremely important to monitor, because if the head of an organization is not aligned with and committed to Green in IT, it is difficult for this idea and the good practices implemented to manage to settle successfully within that organization.
Finally, the processes related to delivery, service and support (DSS), i.e., the processes which are related most to the customers, are named only in studies [S04] and [S13] as being important within Green in IT.
After analyzing each of the questions, we can determine as general mapping study results:
Most of the current studies are proposals and/or general mapping studies or literature reviews about Green IT; a few include Green in IT. This establishes and demonstrates the novelty of the field in question.
The ISO standards (especially the 14000 series [
IT infrastructure and software applications are the main areas in which the good practices and/or techniques of Green in IT are carried out.
Green in IT translates mainly into a reduction of the consumption in watts (W) of the IT, so power is the main indicator to consider.
The CIO and the CTO are the main individuals chiefly responsible for Green in IT in organizations.
The processes related to building, acquiring and implementing (BAI) techniques and/or good practices of Green in IT are the most important ones, in which the greatest number of activities take place (followed closely by the processes of EDM and MEA).
Furthermore, due to the small number of studies found and because of the problems that we have had in answering the research questions (since they had a not-very-close relationship to the subject), it makes no sense to produce the charts that are characteristic of this type of mapping studies, such as bubble diagrams. They would not generate any relevant information.
Nevertheless, we considered that questions RQ4, related to the indicators in the measurements of Green in IT audits, and RQ6, related to the processes involved in Green in IT audits, are important to highlight.
On the one hand, in the results of the question RQ4, we can observe that the most important indicator to measure the different practices and/or techniques of Green in IT, is the power, i.e., the energy consumption of the different IT systems related to the Green in IT. For this reason, in Green in IT audits (and in daily operations of Green in IT) is vital to take into account this indicator in the different assessments and measurements. In Fig. 5, the importance of the power over others indicators can be observed graphically.
On the other hand, the responses to the question RQ6 are directly related to the processes of the COBIT audit framework, which can serve as a basis for the development of a framework for Green in IT auditing. This means that there is greater interest in knowing what the most important processes in the topic in question are. Thus, in Fig. 7, the results of this question can be observed graphically, where the relevance that especially the BAI, EDM, and MEA processes have can be observed.
The objective of this systematic mapping study is to know the current status of the field of Green in IT audits, in order to determine the most important characteristics for developing an audit framework for Green in IT. After analyzing the results, the following observations can be deduced:
There is practically no research related to Green in IT audits. The small number of existing studies shows that it is a new field and that it is vital to develop it (as highlighted in [S01]).
Green IT is growing in importance. Most studies highlight the significance of this field; interest in it is increasing every day, and the relevance that it is taking on in society means that this area is becoming as indispensable for the future of organizations as for mankind itself.
The main limitation of this systematic mapping study has to do with the establishment of a very specific search string on the topic of Green in IT auditing.
During the execution of the mapping study we have observed that, for example, in relation to the term “Green in IT” more generally terms could have been used (such as “sustainability”). But these terms would return a huge number of results, and many of them would have had little or no relation to Green IT, or to IT in general.
Therefore, and bearing in mind the primary objective of the study, we decided to not carry out such a broad search in this first contact with the topic.
The findings of this systematic mapping study have huge transcendence for researchers who are planning to investigate into Green IT, and more specifically for those aiming to carry out research on the topic of Green in IT audits.
Also, the study is, of course, highly relevant for auditors, computer managers, or other individuals responsible for Green in IT in their organizations.
First of all, it is a very interesting area for researchers because, as we have seen, this is a new field, in which practically nothing has been done so far.
Secondly, thanks to the development of this field, auditors may develop new audit models that allow them to expand their operating range to this new field of Green IT. It will thus be possible to achieve more specific and comprehensive audits, helping to consolidate the good practices of Green IT in the organization.
And finally, organizations will benefit significantly from the progress in this field. So far, some organizations have developed and implemented such measures or practices of Green IT that they have considered appropriate, (according to their own criteria), without carrying out any validated internal or external audit. More organizations will be able to take on these good practices, without having to invent their own techniques. They will instead be able to access the knowledge that exists about the area and adapt it to their situation very simply and easily.
V.
Over the last few years, Green IT has become one of the most
important and relevant areas; in the near future putting it into
practice will be indispensable [
The results obtained in the systematic mapping study presented in this article demonstrate the novelty of this field and the need to develop an audit framework for Green in IT. That would allow a monitoring of the practices adopted by organizations in this regard, also establishing empiricallyvalidated guidelines for good practices.
Also, we have observed that the measurements become a vital part to control and improve the different techniques and practices of Green in IT. That is why Green in IT audits should take into account the power or energy consumed by the related IT systems, as has been shown by the results.
All this means that it is very important to continue to develop this idea; with respect to future work, we are working on:
Development of a new systematic mapping study, in which a wider search string is applied and more search engines are included. This new mapping study is intended to mitigate the limitation explained in the previous section and expand the object of the study to Green IT in general.
Creation of a framework for Green in IT audits, one which will provide the basis for a subsequent audit framework of Green IT.
For now, we have developed an early version of this framework (based on COBIT 5), which we have entitled “Governance and Management Framework for Green IT”, through which organizations can establish a governance and a management of Green IT, as well as can audit this area.
Development of a software application to carry out audits of Green IT, on the basis of the “Governance and
Currently, we have developed the first version of this
application [
Propose and validate a set of indicators and metrics to carry out Green in IT audits and, also, to measure (by the organizations themselves) the correct performance of the Green in IT function for improve it.
Fig. 8. “Audit Questions” view in GreenITAudit.
ACKNOWLEDGMENTS
This work is part of the project GINSENG (TIN2015-70259C2-1-R) funded by the Spanish Ministerio de Economía y Competitividad and the FEDER fund (Fondo Europeo de Desarrollo Regional); and GLOBALIA (PEII-2014-038-P), Consejería de Educación y Ciencia, Junta de Comunidades de Castilla-La Mancha. Management,
[S01] C. Gabriel, “Why it's not naive to be green,” in Business Information
Review, vol. 25, pp. 230-237, 2008. e X X X X X X X 6RQ cd X X X X X X X X
X
X X X
X X X X b X X X X X X X X X a X X X X X X X X X X l X X X X X X k X j i X X X X X X h X X X X X X X X e d X ISEDU cb XX XX X X XX TYS a X X IRAM e X X X ERP X FTHO 4RQ cdb X X NG X X X IPPAM fa X X X X X X X X X . e IELV 3RQ cd X X X X X X X BA X X X X X T b X X X X X X X X X X X a X X X X X X X X X X X f X X X X X X X X e b X a e X