Environmental Sustainability in Information Technologies Governance

Abstract

In the present day, many risk factors affect the continuity of a business. However, this situation produces a conducive atmosphere to approach alternatives that relieve this situation for organizations. Within these alternatives, environmental sustainability (ES) and information technologies governance (IT governance or ITG) stand out. Both alternatives allow organizations to address intrinsically common issues such as strategic alignment, generation of value, mechanisms for performance improvement, risk management and resource management. This article focuses on the fusion of both alternatives, determining to what extent current ITG models consider ES issues. With this purpose, the strategy followed was firstly to identify the relevant factors of ES present in the main approaches of the domain (ISO14001, GRI G4, EMAS, SGE21 and ISO26000). As a result, we identified 27 activities and 103 sub-activities of ES. Next, as the second main objective, we determined which of those factors are present in the main current ITG approaches (COBIT5, ISO38500 and WEILL & ROSS). Finally, we concluded through a quantitative study that COBIT5 is the most sustainable (i.e., the one that incorporates more ES issues) ITG approach.

1. Introduction

In the present day, companies are facing a high risk environment [1] characterized by global recession, uncertain competitive environments, need to reduce costs, etc. This has led organizations to incorporate alternatives that help to maintain their benefits [2,3].

At this moment, two main concepts arise in the search for these alternatives. On the one hand, environmental sustainability (hereafter, ES) is considered to be one of the three dimensions of sustainability, whose most widely recognized definition belongs to Gro Harlem Brundtland: “meets the needs of the present without compromising the ability of future generations to meet their own needs” [4]. This definition applied to ES implies achieving business development results without threatening the environment and defending the interests of future generations. Thus, ES is a tool that allows organizations to: (i) generate business value, (ii) generate capacity to support, recover and prevail, and (iii) design strategies with greater economic and ecological responsibility [2,5].

On the other hand, information technologies governance (hereafter, IT governance or ITG) can be defined as “an integral part of enterprise governance that consists of the leadership and organizational structures and processes that ensure that the organization’s IT sustains and extends the organization’s strategies and objectives and that it is the responsibility of the board of directors and executive management” [6]. Thus, ITG is a tool that allows organizations to: (i) improve their effectiveness and efficiency, (ii) have a competitive advantage, and (iii) maximize profitability [7].

There are many approaches today concerning ES, among which we can mention the following:

• ISO14001: A standard developed by the ISO (International Organization for Standardization) whose objective is to reduce the amount of environmental impacts. It was first published in 1996 and had several versions, the last being the revision in September 2015 [8,9,10].
• GRI G4: The fourth version of the GRI (Global Reporting Initiative) guide, which offers the appropriate tools for the preparation of sustainability reports and provides the principles and indicators to measure and demonstrate the performance of an organization with respect to economic, ecological and social issues [11,12].
• EMAS: The European EMAS (Eco-Management and Audit Scheme) Regulation represents a voluntary approach that aims to increase corporate environmental performance [13,14]. Originally designed for the industrial sector, EMAS can be applied in all organizations following its revision of 2001 (Regulation (EC) No. 761/2001) in order to increase environmental performance [15,16,17] and even innovation [18].
• SGE21: An auditable and certifiable standard by FORÉTICA used to establish an ethical management system. It focuses mainly on compliance with legislation and regulations, ethical management, and social responsibility policy, and provides a code of conduct and means of review by management to achieve continuous improvement [19,20].
• ISO26000: An international standard of the ISO family, which provides guidance to organizations on the methods to implement the principles of social responsibility in the daily activities of an organization [20,21].
• ESF: The Environmental and Social Framework (ESF) enables the World Bank and borrowers to better manage environmental and social risks of projects and to improve development outcomes. The ESF offers broad and systematic coverage of environmental and social risks [22].
• SR10: Establishes the requirements of a social responsibility management system for organizations committed to the principles and recommendations on social responsibility and, in particular, those contained in the International Standard ISO26000 [23].

Similarly, there are many approaches today concerning ITG, among which we can mention the following:

• COBIT5 (Control OBjectives for Information and related Technology): A reference framework for governance and IT management whose objective is to help organizations create value from IT, maintaining a balance between obtaining benefits, optimizing the level of risk and their resources [24,25,26].
• ISO38500: Constitutes a guide or tool for ITG by establishing ITG activities, such as evaluation, management and monitoring of the use of information and communication technologies [27,28].
• CALDER-MOIR: An ITG framework that provides a structural guide to implement ITG. In fact, it is a simple tool to help implement the ISO38500 standard [29].
• WEILL & ROSS: Peter Weill and Jean Ross propose an ITG framework where senior management will position the company in the desired profile through the articulation of desirable strategies and behaviors [30].
• FORRESTER: The publication of Forrester Research establishes that the implementation of good IT governance requires a framework based on three main elements: structure, process and communication [31].
• GTI4U: This model has been proposed by a group of Spanish researchers. It is based on the ISO38500 standard and has been developed to be implemented in a university environment, being also used to evaluate the overall level of maturity of the Spanish university system [32].
• SMEsITGF: An ITG framework oriented on small and medium-sized enterprises and focused on the analysis of human resource management issues [33].

Both trends (ES and ITG) have followed independent paths until now. However, several studies have recently emerged with the intent to integrate them. Thus, because of the synergy between both, the concept of sustainable IT governance (hereafter, sIT Governance) arises. That is to say, the two trends merge with the intention of contributing to the evaluation, management and monitoring of IT practices in organizational processes and activities from a ES viewpoint [34]. The aim is to reduce or minimize the environmental impact by seeking optimization of resources, strategic alignment, generation of value and risk management [35,36].

SIT Governance is a recent concept that is still in progress. It is true that the number of investigations in this field is increasing (to a lower degree in the topic itself and to a greater degree in related topics), however, there are still no specific models/standards to help organizations to implement sIT Governance. In this sense, the work of Bengtsson and Ågerfalk [37] is a well-known study showing relevant papers relating IT and the environment. Most deal with more energy efficient computers [38,39], server virtualization [39] and other technical aspects that focus on the components (e.g., [40,41,42]); without taking into account the ES from an integral and strategic point of view.

The two more relevant attempts today in merging ES and ITG into an integral and strategic sIT Governance synergy are the following:

• The study carried out by Machado et al. [43] that includes a mapping between activities from COBIT (versions 5 and 4.1), as a representative of ITG, and activities from GRI G4, as a representative of ES. However, this work: (i) puts aside relevant ITG approximations (such as ISO38500, CALDER-MOIR, WEILL & ROSS and FORRESTER) as well as relevant ES approaches (such as ISO14001, EMAS, SGE21 and ISO26000) and (ii) performs a “grosso modo” mapping.
• The study carried out by Merhout and O’Toole [44], where they review COBIT5, one of the most relevant ITG frameworks, to determine the degree to which it supports the ES dimension (especially in relation to the acquisition, use and disposition of IT assets). They concluded that COBIT5 clearly presents a sustainability deficit, although they do not quantify it.

From these studies, we conclude two main deficiencies:

• The identification of the relevant ES factors using a single approximation to such a domain without complementing it with the other points of view of the main approaches (ISO14001, GRI G4, EMAS, SGE21 and ISO26000). This situation does not allow considering all the information that could be relevant.
• The high-level of detail (granularity) used in the studies of ES/ITG activities. This situation does not allow specifying, for example, the detailed assignment of factors from ES to (sub) activities of ITG.

These two deficiencies are addressed in this work. The purpose is to contribute to: (i) first, identifying the specific (i.e., not general) factors of ES contained in the main ES approaches (ISO14001, GRI G4, EMAS, SGE21 and ISO26000); and (ii) second, determining to what extent these factors are already present in the main ITG approaches (COBIT, ISO38500 and WEILL & ROSS), concluding with quantitative measurements regarding the ES deficit in current ITG frameworks as a consequence. The first objective is essential since it allows considering all the information that could be relevant coming from the main current ES approaches (not only one) and with an adequate and practical level of detail (instead of a high-level of detail/granularity). The second objective, derived from the first, is equally important in order to evaluate to what extent the current ITG frameworks have an ES deficit. In fact, the study presented here will be the starting point to address the ES deficiencies detected in the ITG frameworks and/or to propose a new comprehensive sIT Governance model.

The rest of the article is organized as follows. Section 2 presents the methodology we applied to fulfill the two above-mentioned objectives, whereas Section 3 presents the results obtained for such objectives. Finally, Section 4 includes the discussion and the main conclusions according to the results obtained.

2. Materials and Methods

Figure 1 summarizes the two main activities that we considered in order to achieve the above-mentioned objectives. The first activity consists of comparing the main ES approaches in order to identify the set of relevant ES factors (first objective). This is because current ES approaches do not address the same aspects. Thus, there are ES factors that are considered by some approach but not by all of them and, on the other hand, the same ES factor may have different names in different approaches. Only when this information has been obtained from Activity 1, can the second activity be undertaken: to compare the main ITG approaches against the set of identified relevant ES factors in order to determine their degree of compliance (second objective).

We used an analytical strategy of a comparative study between models and standards [45] to address the activities shown in Figure 1. This decision was based on the absence of specialized publications regarding comparative studies of mapping activities among the models/standards related to ES and ITG. Specifically, we chose the Method of Study of Similarity between Models and Standards (MSSMS) [46] as the working method for both activities. It proposes seven phases to formalize and organize a study to find the similarities and differences between several approaches (e.g., frames, models or standards). This method has been applied in different and diverse domains: comparative analysis of maturity models in business intelligence [47], study on software outsourcing based on CMMI-ACQ [48], comparison of models and standards for implementing IT service capacity management [49] and similarity study of risk management process in software outsourcing projects [50]. Figure 2 presents the seven phases of the MSSMS method.

The deployment of these phases requires the identification of the elements that make up each approach/model/standard. We applied the deductive analytical method [51] for this and a documentary analysis as data collection technique to investigate the published documents. Below is a general description of the seven MSSMS phases:

Phase 1: Select the possible standards and models to be analyzed

The purpose of this phase is to choose the set of models and standards to be included in the study, setting up the criteria that support the selection (e.g., the contribution to the scope of study and the number of user organizations). Once the criteria are defined, the documentary analysis will let us identify the bibliographic references that validate our approach selection.

Phase 2: Define the reference model

The reference model represents the selected approach providing the broadest coverage in the field of study. Considering that the comparative analysis proposed in this work is based on the structure (elements) that make up each approach, the reference model should be the one that contributes most to the field of study through its structure. It will act as the pivot for the comparative analysis, and the correspondences with the other approaches are established around it in an iterative and individual way. This phase synthesizes the approaches selected in Phase 1 through the deductive and documentary analysis, and one is selected as the reference model for the comparative analysis.

Phase 3: Select the process(es) to be analyzed

The purpose of this phase is to determine the scope of the comparison to be carried out. Thus, the comparison of the approaches selected in Phase 1 may cover all or some of their constituent processes.

Phase 4: Set the level of detail

Once the standards/models to be considered, the reference model, and the process(es) to be analyzed have been selected, what remains to be defined is what element of the structure for each approach will be used to compare; that is to say, what is going to be mapped and to what level of the structure the mapping will reach. To select the level of detail, we applied the criteria of homogeneity and granularity. The first criterion tries to avoid mapping specific elements of an approach with general elements of another, because that would produce invalid results. The second criterion defines the level of specificity of the mapping taking into account that the highest granularity in a hierarchy would be at the top of it, and the minimum granularity would be at the bottom. The level of detail should be selected considering that granularity and homogeneity are consequently related; that is, homogeneity must be met to apply the minimum granularity.

Phase 5: Create a correspondence template

This phase defines the template to be used in the next phase. This template will be based on the process(es) to be analyzed (Phase 3) and on the level of detail established in Phase 4.

Phase 6: Identify the similarities among the models

The purpose of this phase is to identify the similarities among the selected models through the elements that they have in common. Thus, this phase performs the actual comparison among the selected approaches by mapping the considered element. We used an iterative strategy for the mapping: each model/standard is mapped individually regarding the considered element of the selected reference model. Once mapped, the result is reviewed in its entirety and the following is approached in the same way.

Phase 7: Present the results

The purpose of this phase is to present the results obtained in a structured manner.

3. Results

We present in this section the deployment of the seven MSSMS phases (Figure 2) to address the two activities proposed in Figure 1.

3.1. Activity 1: Identify the Relevant Factors of ES

3.1.1. Phase 1: Select the Possible Standards and Models to be Analyzed

The criteria for the selection of the standards and models to be incorporated into the comparative study were the following: (a) those related to ES, (b) those with a relevant proponent institution, (c) those most used by organizations, and (d) those with updated information and whose documentation is available.

The following ES approaches were selected using the above-mentioned criteria: ISO14001:2015, GRI G4:2013, EMAS:2009, SGE21:2016 and ISO26000:2012.

Table 1. Bibliographic references supporting compliance with the criteria for the selection of ES standards and models. Criteria: (a) related to ES, (b) relevant proponent institution, (c) most used by organizations, and (d) updated information and whose documentation is available.

Criterion	ISO 14001	GRI G4	EMAS	SGE21	ISO26000
(a)	[8]	[11]	[52]	[19]	[21]
(b)	[8]	[53]	[52]	[19]	[21]
(c)	[54]	[55]	[54]	[56]	[57]
(d)	[8]	[11]	[52]	[19]	[21]

shows the bibliographic references that support the compliance with the criteria for each approach. It is worth mentioning that we have not selected other models because they do not meet any of the aforementioned criteria. For example, ESF [22] and SR10 [23] have not been selected because they do not meet the criterion defined in c) (i.e., they are not used by organizations despite their relative degree of dissemination).

3.1.2. Phase 2: Define the Reference Model

Once the ES approaches have been selected, one has to be defined as the reference model in this phase. The deductive and documentary analysis of the five selected approaches lets us gather the sufficient knowledge to select the reference approach.

Table 2. Descriptive synthesis of the selected ES approaches.

Model/Standard	Table	Structure
ISO14001	S1a	This standard is composed of six phases. Each phase is composed of several activities, which decompose in sub-activities. In total, there are 26 activities and 68 sub-activities.
GRI G4	S1b	This guide proposes two types of contents that must be included in a Sustainability Report: (i) General Basic Contents and (ii) Specific Basic Contents, whose information was excluded for not contributing to ES [53]. The General Basic Contents are composed of 59 activities, which are grouped in phases: Prepare, Connect, Supervise and Inform.
EMAS	S1c	This regulation is composed of five phases. Each phase is composed of several activities, which decompose in sub-activities. In total, there are 22 activities and 49 sub-activities.
SGE21	S1d	This standard is composed of nine phases. Each phase is composed of several activities, which decompose in sub-activities. In total, there are 37 activities and 47 sub-activities.
ISO26000	S1e	This standard is composed of seven phases and each phase is composed of several activities: 36 in total.

shows a descriptive synthesis of the five ES approaches studied, whereas a detailed description for each approach is provided in the supplementary material by means of five tables (Table S1a–e). Each table shows the name of the phase, the name of the activity and its coding.

ISO14001 was selected as the reference model after the analysis carried out because it provides the greatest coverage in ES issues. This decision is supported by [58], which states that this standard is the main reference for environmental management in all types of organizations in the world.

3.1.3. Phase 3: Select the Process(es) to be Analyzed

In this case, the processes to be considered are all those relating the dimension of ES. Therefore, all the processes included in the reference model will be analyzed.

3.1.4. Phase 4: Set the Level of Detail

We established the minimum level of granularity (as long as homogeneity was maintained) to ensure that the relevant ES factors were identified with a sufficient level of detail. This was to avoid the “grosso modo” issue stated in the Introduction.

It should be noted that all the ES approaches studied in this work have the same level of detail, although they use different nomenclatures. For example, where ISO 14001 talks about sub-activities, GRI G4 talks about activities.

Table 3. Structure and level of detail of each ES approach.

ES Approach	Original Structure	Unified Structure
ISO14001	Phase/activity/sub-activity	Phase/activity/sub-activity
GRI G4	Phase/content/activity	Phase/activity/sub-activity
EMAS	Phase/activity/sub-activity	Phase/activity/sub-activity
SGE21	Phase/activity/sub-activity	Phase/activity/sub-activity
ISO26000	Phase/activity	Activity/sub-activity

summarizes the relevant information until now: it shows, for each approach, the original and the unified structure based on the reference model (ISO14001). The nomenclature has been unified taking into account the level of detail provided for each approach, irrespective of the name used by each one. Thus, it can be concluded from Table 3 the minimum level of granularity that can be selected for all the approaches: sub-activity.

3.1.5. Phase 5: Create a Correspondence Template

We considered the following aspects presented before in order to define the correspondence template:

• Selected ES approaches: ISO14001:2015, GRI G4:2013, EMAS:2009, SGE21:2016 and ISO26000:2012.
• Reference model: ISO14001:2015.
• Level of detail that will be used for the comparisons: sub-activity (in the unified structure).

The elements that make up the template are: the names of the phases and the activities and sub-activities codes, for the reference model, and the sub-activities that are connected with the sub-activity of the reference model (using the unified structure), for each ES approach.

3.1.6. Phase 6: Identify Similarities among the Models

Table 4. Template filled with the results of the mapping process between the reference model and the other ES approaches.

ISO14001 (Reference Model Selected in Section 3.1.2)			GRI G4	EMAS	SGE21	ISO26000
Phase	Activity	Sub-activity	Sub-activity (Unified Structure)
CONTEXT OF THE ORGANIZATION	EMS1 Understanding the organization and its context	1.1	G4-1	1.1.1; 1.2.1; 1.3.1; 1.4.1; 1.5.1	6.1.1	1.1 to 1.3
	EMS2 Understanding the needs and expectations of interested parties	2.1	G4-24; G4-25		3.1.1	2.1
		2.2	G4-26; G4-27	2.3.2.1	3.1.2	2.2
					3.1.3; 3.2.1; 3.3.1
	EMS3 Determination of the scope of the Environmental Management System (hereafter, EMS)	3.1
	EMS4 EMS	4.1
LEADERSHIP	EMS5 Leadership and commitment	5.1
	EMS6 Environmental policy	6.1		2.1.1	4.1.1
	EMS7 Roles, responsibilities and authorities	7.1	G4-34 to G4-43; G4-45 to G4-G450; G4-52 to G4-55; G4-51a	2.3.1.1; 2.3.1.2; 2.3.1.3	4.5.1
PLANNING	EMS8 Actions to deal with risks and opportunities	8.1	G4-2		5.6.1 to 5.6.3	3.4
	EMS9 Significant environmental aspects	9.1	G4-19	2.2.1.1	5.3.1	3.1; 3.2
		9.2	G4-20	2.2.1.2
		9.3
		9.4		2.2.1.3
		9.5
		9.6
	EMS10 Legal requirements	10.1		2.2.2.1	2.2.1	2.3
		10.2		2.2.2.2		2.4; 3.3
		10.3		2.2.2.3
		10.4
		10.5
		10.6
	EMS11 Action planning	11.1				3.6
		11.2
		11.3
		11.4
	EMS12 Objectives, environmental goals and programs	12.1		2.2.3.1; 2.2.3.3	5.1.1
		12.2		2.2.3.2	5.1.2
		12.3
		12.4
		12.5
	EMS13 Planning of actions to achieve environmental objectives and goals	13.1
		13.2		2.2.4.1	5.9.1
		13.3
		13.4
IMPLEMENTATION AND OPERATION	EMS14 Resources	14.1
					2.5.1; 5.11.1	4.4; 4.5
	EMS15 Competence	15.1		2.3.3.1
		15.2		2.3.3.2
		15.3
	EMS16 Awareness	16.1	G4-56 to G4-58	2.3.3.3	4.4.1; 4.4.2
	EMS17 Communication	17.1		2.3.4.1	5.7.1; 9.3.1	3.7; 4.6
		17.2
		17.3
		17.4
		17.5
	EMS18 Documented information	18.1
		18.2	G4-28 to G4-33	2.3.5.1; 2.3.6.1		7.1
	EMS19 Planning and operational control	19.1		2.3.7.1
		19.2
		19.3
		19.4
		19.5
	EMS20 Preparation and response in case of emergency.	20.1		2.3.8.1		3.5
		20.2		2.3.8.2
		20.3		2.3.8.3
		20.4		2.3.8.4
VERIFICATION	EMS21 Monitoring, measurement, analysis and evaluation	21.1		2.4.1.1	5.8.1
		21.2		2.4.1.2
	EMS22 Assessment of legal compliance	22.1		2.4.2.1		2.4; 2.5
		22.2		2.4.2.2
	EMS23 Internal audit	23.1		2.4.5.1
		23.2			9.2.1
		23.3
	EMS24 Review by management	24.1		2.5.1	9.4.1
		24.2
		24.3
CONTINUOUS IMPROVEMENT	EMS25 Improvement of non-compliance, corrective action.	25.1		2.4.3.1
	EMS26 Continuous improvement	26.1
		26.2
			G4-44; G4-51b

shows the correspondence template filled with the results of the mapping process, in which three different scenarios can be found:

• First scenario: There is correspondence, without assessing its accuracy. It is enough that the sub-activity makes some reference, although slight. This scenario means that the correspondence template shown in Table 4 defines what sub-activity is the one that refers to the sub-activity of the reference model (ISO14001). This is evidenced by showing the code of the corresponding sub-activity by using the unified structure.
• Second scenario: The sub-activity does not contribute to ES. The reason for this scenario is that GRI G4, SGE21 and ISO26000 also cover economic and social sustainability domains. In addition, there are sub-activities typical of the context of each approach. Thus, for example, GRI G4, as a guide to help organizations in preparing sustainability reports, includes sub-activities referring to this specific information. In the same way, EMAS has sub-activities related to the certification process. Such kinds of sub-activities were not considered because they are not a relevant contribution to ES.
• Third scenario: The sub-activity contributes to ES but does not exist in the reference model (ISO14001). In this case, this sub-activity becomes a reference for the other approaches, providing a new ES factor to be considered. These sub-activities, which have no correspondence in the reference model, are included in Table 4 using the unified terminology as follows: 3.1.3, 3.2.1, 3.3.1, 2.5.1 and 5.11.1 for SGE21; G4-44 and G4-51b for GRI G4, and 4.4 and 4.5 for ISO26000.

Since the purpose of this work is to establish correspondences between ES approaches, we only considered scenarios 1 and 3. An empty cell in Table 4 denotes that there was no correspondence with the sub-activity of the reference model.

It is important to note that the relevant ES factors were identified from Table 4 by applying the deductive method. As a representative example, the sub-activity 1.1, from the activity “EMS1 Understanding the organization and its context” of the reference model (first row in Table 4), has correspondence with the sub-activity G4-1 (GRI G4), with the sub-activities 1.1.1, 1.2.1, 1.3.1, 1.4.1 and 1.5.1 (EMAS), with the sub-activity 6.1.1 (SGE21), and with the sub-activities 1.1 up to 1.3 (ISO26000). Since there is correspondence (scenario 1), although it is not exact, it means that each of these sub-activities can contribute to EMS1 activity. Therefore, the set of contributions (sub-activities) for the EMS1 reference activity is:

• Determine the internal and external problems of the organization, legal aspects and economic environment (from ISO14001).
• Strategic focus of the organization (mission, vision, strategies, purposes, scope) from GRI G4 and ISO26000.
• Description of the organization (from EMAS).
• Define a strategic plan for sustainability (from SGE21).

A similar strategy was used to identify the rest of relevant ES factors. The full description of the relevant ES factors can be found later in Section 3.2.6 (first three columns in Table 8).

3.1.7. Phase 7: Present the Results

In order to graphically organize the overlapping and most common sub-activities, the similarities between ES approaches (Table 4) are synthesized by means of a Venn diagram [59] in Figure 3. The five ES approaches are labeled in this figure as A (ISO14001), B (GRI G4), C (EMAS), D (SGE21), and E (ISO26000). With the exception of the cases mentioned in Phase 5 of Activity 1 (3.1.3, 3.2.1, 3.3.1, 2.5.1 and 5.11.1 for SGE21, and G4-44 and G4-51b for GRI G4), the sub-activities of the reference model overlap with the sub-activities of the other approaches (see Table 4). Therefore, the overlapped sub-activities are coded with the nomenclature of the reference model (i.e., A or ISO14001) in the Venn diagram.

We can determine from Figure 3 the similarities across the ES approaches through their common sub-activities:

• The sub-activities 1.1, 9.1 and 2.2 are common to the five approaches (section A∩B∩C∩D∩E in the Venn Diagram).
• Sub-activities proposed in four ES approaches: 2.1 and 8.1 (section A∩B∩D∩E); 7.1, 16.1 and 18.2 (section A∩B∩C∩D); 10.1 and 17.1 (section A∩C∩D∩E).
• Sub-activities proposed in three ES approaches: 6.1, 12.1, 12.2, 13.2, 21.1 and 24.1 (section A∩C∩D); 10.2, 20.1 and 22.1 (section A∩C∩E); 9.2 (section A∩B∩C).
• Sub-activities proposed in two ES approaches: 9.4, 10.3, 15.1, 15.2, 19.1, 20.2 to 20.4, 21.2, 22.2, 23.1 and 25.1 (section A∩C); 11.1 (section A∩E); 23.2 (section A∩D); 2.5.1, 5.11.1, 4.4 and 4.5 (section D∩E).
• Less common sub-activities (proposed by a single ES approach): 3.1, 4.1, 5.1, 9.3, 9.5, 9.6, 10.4 to 10.6, 11.2 to 11.4, 12.3 to 12.5, 13.1, 13.3, 13.4, 14.1, 15.3, 17.2 to 17.5, 18.1, 19.2 to 19.5, 24.2, 24.3, 26.1, 26.2 and 23.3 (section only A); 3.1.3, 3.2.1 and 3.3.1 (section only D); G4-44 and G4-51b (section only B).

3.2. Activity 2: Determine the Deficiencies of the ITG Approaches in ES Feature

3.2.1. Phase 1: Select the Possible Standards and Models to be Analyzed

We used the following criteria to select the ITG standards and models for the comparative study: (a) those related to ITG, (b) those with a relevant proponent institution, (c) those most used by organizations, and (d) those with updated information and whose documentation is available. However, in this case and as opposed to Activity 1, it was necessary to incorporate an additional criterion: (e) those with a level of detail equivalent to a sub-activity level, regardless of what it is called. This was necessary to take advantage of the level of detail (sub-activity) achieved in the identification of the relevant ES factors, which acts as the reference model for Activity 2 (see Figure 1). Otherwise, it would not be guaranteed that the comparison and the subsequent quantification would be completely objective.

Using these criteria, the following approaches were selected: COBIT5:2012, ISO38500:2015, and WEILL & ROSS:2005.

Table 5. Bibliographic references supporting the compliance with the criteria for the selection of ITG standards and models. Criteria: (a) related to ITG, (b) relevant proponent institution, (c) most used by organizations, (d) updated information and whose documentation is available, and (e) level of detail equivalent to a sub-activity level.

Criterion	COBIT5	ISO38500	WEILL & ROSS
(a)	[62]	[63]	[64]
(b)	[62]	[63]	[64]
(c)	[65]	[66]	[30]
(d)	[62]	[63]	[64]
(e)	[62]	[63]	[64]

shows the bibliographic references that support compliance with the criteria for each approach. It is worth mentioning that we have not selected other models for not meeting any of the aforementioned criteria. For example, the ITG Framework for SMEs (SMEsITGF) [33] and the ITG Model for Universities (MITGU) [32] have not been selected because they do not meet criteria b) and c), and the CALDER-MOIR [29,60] and FORRESTER [31,61] approaches have been excluded because they do not meet criterion e), since they are limited to the level of activity.

The relevance of the criterion e) can be illustrated by trying to compare COBIT5 using the activity instead of the sub-activity level (in the unified structure) with the relevant ES factors. Thus, going back to the example shown in Section 3.1.6, the activity “EMS1 Understanding the organization and its context” of the relevant ES factors is composed of four sub-activities. In this case, the activity “Evaluate” of the process “EDM01 Ensure Governance Framework Setting and Maintenance” from COBIT5 (Table S2a in the supplementary material) could be covered by the above-mentioned EMS1 activity. However, this would be a subjective comparison since it would be not guaranteed to have a connection with all its sub-activities. In fact, if we descend to the sub-activity level, we will see that only two of the four sub-activities of EMS1 are covered by COBIT5, as it will be explained later in Section 3.2.6.

3.2.2. Phase 2: Define the Reference Model

In this case, the reference model is the set of the relevant ES factors identified in Activity 1, which are composed of activities and sub-activities. This reference model will be compared with the three approaches selected in the previous phase.

Table 6. Descriptive synthesis of the ITG approaches.

Model/Standard	Table	Structure
COBIT5	S2a	This standard is composed of 37 processes, five of which are related to governance. Each process is composed of governance practices, which decompose in activities. In total, there are 79 governance activities.
ISO38500	S2b	This standard is composed of six principles. Each principle is composed of three tasks, which decompose in activities. In total, there are 58 activities.
WEILL & ROSS	S2c	This standard is composed by six components. Each component is composed of activities. In total, there are 25 activities.

shows a descriptive synthesis for these approaches, whereas a detailed description for each approach is provided in the supplementary material (Table S2a–c). Each table shows the name of the phase, the name of the activity and its coding.

3.2.3. Phase 3: Select the Process(es) to be Analyzed

In this case, the processes to be considered are all those relating the dimension of ES and ITG. Therefore, all the processes included in each ITG approach will be analyzed to see if they consider or not the ES factors identified in Activity 1.

3.2.4. Phase 4: Set the Level of Detail

The minimum granularity is the sub-activity level. This is because the ITG approaches will be mapped with the relevant ES factors, which are composed by activities and sub-activities. This was to avoid the “grosso modo” issue stated in the Introduction. Logically, homogeneity should be maintained between both levels of detail. When addressing the homogeneity criterion, we are faced with the same inconvenient detail in Phase 4 for Activity 1 (Section 3.1.4). In this regard, it should be noted that all the ITG approaches studied in this work have the same level of detail, although they use different nomenclatures. For example, where COBIT5 talks about activities, the relevant ES factors talk about sub-activities.

Table 7. Structure and level of detail of each ITG approach.

ITG Approach	Original Structure	Unified Structure
COBIT5	Process/government practice/activity	Phase/activity/sub-activity
ISO38500	Principle/task/activity	Phase/activity/sub-activity
WEILL & ROSS	Component/activity	Activity/sub-activity

summarizes the relevant information until now: it shows, for each approach, the original and the unified structure based on the relevant ES factors. The nomenclature has been unified taking into account the level of detail provided for each approach, irrespective of the name used by each one.

3.2.5. Phase 5: Create a Correspondence Template

We considered the following aspects presented before in order to define the correspondence template:

• Selected ITG approaches: COBIT5, ISO38500 and WEILL & ROSS.
• Reference model: relevant ES factors derived from Activity 1 (cf. Figure 1).
• Level of detail that will be used for the comparisons: sub-activity (in the unified structure).

The elements that make up the template are: the relevant ES factors (using the structure Activity, Sub-activity and the Approach which contributes) and the sub-activities that are connected to an ES factor (and how this connection is) for each ITG approach. Thus, during the mapping process, there were different situations determined by two dimensions: location and content. The “location” dimension refers to whether or not the ES sub-activity is located on the ITG approach. On the other hand, the “content” dimension refers to the matching of the points of view (ES and ITG) for the considered ES factor. There are the following four possible situations based on these two dimensions:

• Situation 0: The relevant ES factor (sub-activity) does not exist in ITG (i.e., neither of these dimensions are fulfilled).
• Situation 1: The relevant ES factor (sub-activity) partially corresponds to ITG, but it deals with ES in one model and deals with ITG in the other (i.e., location is partially fulfilled and content is not fulfilled).
• Situation 2: The relevant ES factor (sub-activity) is present in ITG, but it deals with ES in one model and deals with ITG in the other (i.e., location is fulfilled and content is not fulfilled).
• Situation 3: The relevant ES factor (sub-activity) is present and with the same meaning in ITG (i.e., both location and content are fulfilled).

3.2.6. Phase 6: Identify the Similarities among the Models

Table 8. Correspondence template: ITG approaches vs. ES factors.

RELEVANT ES FACTORS (Identified in Activity 1, Section 3.1)			COBIT5		ISO38500		WEILL & ROSS
Activity	Approach	Sub-activity
EMS1 Understanding the organization and its context	ISO14001	Determine the internal and external problems of the organization, legal aspects and economic environment	ITG1	2		0		0
	GRI G4 ISO26000	Strategic focus of the organization (mission, vision, strategies, purposes and scope)		0	ITG1; ITG8	2		0
	EMAS	Description of the organization	ITG1	2		0		0
	SGE21	Define a strategic plan for Sustainability		0	ITG1; ITG8	2	3.3	1
EMS2 Understanding the needs and expectations of interested parties	ISO14001	Identify the interested parties that are affected		0		0		0
	ISO14001	Identify the needs and expectations of interested parties	ITG21	2		0		0
	GRI G4	Establish and evaluate the participation of interested parties	ITG15; ITG4	2		0		0
	SGE21	Establish forms of communication with interested parties	ITG72; ITG73; ITG78; ITG79	2		0		0
	ISO26000	Identify the interests of the stakeholders that are affected	ITG44	1		0		0
EMS3 Determination of the scope of the EMS	ISO14001	Define and document the scope of your EMS		0		0		0
EMS4 Environmental management system	ISO14001	Establish, document, implement, maintain and continually improve an EMS and determine how to meet the requirements of the EMS		0		0		0
EMS5 Leadership and commitment	ISO14001	Assume the obligation to be accountable for the efficiency of the EMS and report the performance of EMS for review and recommendation of improvements		0		0		0
EMS6 Environmental policy	ISO14001	Define the environmental policy of the organization within the defined scope. This environmental policy must include: a commitment to continuous improvement and prevention of pollution, document, implement and maintain this environmental policy and communicate to all people who work for the organization	ITG9	1	ITG8	1	3.1	1
	SGE21	Include in environmental policy: the requirements of the legislation signed by the principal of the organization	ITG9	1		0		0
EMS7 Roles, responsibilities and authorities in the organization	ISO14001 EMAS	Define representatives to establish, implement and maintain, in addition to establish the functions and responsibilities	ITG11; ITG7; ITG9; ITG10	2	ITG1; ITG2; ITG4 to ITG7; ITG43	1	4.1	1
	ISO14001	Define, document and communicate the authorities	ITG16	1		0		0
EMS8 Overview of actions to address risks and opportunities	ISO14001	Establish a framework to evaluate risks, threats and opportunities	ITG41 to ITG56	1		0		0
	ISO14001	Establish procedures to deal with risks and opportunities	ITG41 to ITG56	1	ITG53	1		0
	GRI G4	Detail the most important effects, risks and opportunities	ITG41 to ITG56	1	ITG27; ITG18; ITG38	1		0
	SGE21	Evaluate, prevent and manage a plan for the environmental risks associated with its activity	ITG41 to ITG56	1		0		0
EMS9 Significant environmental aspects	ISO14001	Identify significant environmental aspects of activities, products and services that can control or influence within the scope of the EMS		0		0		0
	ISO14001	Determine the significant environmental aspects of the organization that may have large impacts on the environment		0		0		0
	ISO14001	Establish criteria to determine the importance of environmental aspects		0		0		0
	ISO14001	Document and keep updated the list of significant environmental aspects within the organization		0		0		0
	ISO14001	Consider the implications of the organization on its own environmental performance		0		0		0
	ISO14001	Identify and collect quantitative and / or qualitative data on the characteristics of their activities, products or services		0		0		0
	ISO26000	Identify significant environmental aspects that are prohibited by law		0		0		0
	GRI G4	Identify significant environmental aspects that may affect the exterior		0		0		0
EMS10 Legal requirements	ISO14001	Identify and have access to the applicable legal requirements and other requirements subscribed to the organization related to the environment		0		0		0
	ISO14001	Determine how these requirements apply to environmental aspects		0		0		0
	ISO14001	Ensure that the applicable legal requirements are taken into account in the establishment and maintenance of your EMS	ITG18; ITG20	1	ITG49	1		0
	ISO14001	Communicate to all people who work in the organization or to those who act on their behalf		0		0		0
	ISO14001	Establish procedures to anticipate and prepare for new or modified requirements		0		0		0
	ISO14001	Prepare an updated record of applicable legal requirements		0		0		0
EMS11 Action planning	ISO14001	Establish implement or maintain to deal with non-conformities and take preventive actions		0		0		0
	ISO14001	Identify non-conformities and take preventive measures to mitigate their impact		0		0		0
	ISO14001	Investigate and determine in order to take actions to prevent environmental impacts	ITG44	1		0		0
	ISO14001	Evaluate the need for actions to prevent non-conformities.		0		0		0
EMS12 Objectives, environmental goals and programs	ISO14001	Establish implement and maintain documented environmental goals and targets at different levels		0		0		0
	ISO14001	Establish rules to measure compliance with the objectives and goals of the EMS		0		0		0
	ISO14001	Documentation and communication of environmental objectives and goals		0		0		0
	ISO14001	Raise objectives coherent with the environmental policy, including the commitment with the prevention of pollution, compliance with legal requirements and continuous improvement		0		0		0
	ISO14001	Take into account the functions, responsibilities, process, resources, deadlines, priorities and actions necessary to achieve the objectives and goals		0		0		0
EMS13 Planning of actions to achieve environmental objectives and goals	ISO14001	Design plans to monitor the progress of objectives and goals		0		0	2.4	1
	ISO14001	Establish, implement and maintain one or several programs to achieve objectives and goals		0		0		0
	ISO14001	Assignment of responsibilities to achieve the objectives and goals in the relevant functions and levels of the organization		0		0		0
	ISO14001	Establish means and deadlines to achieve the objectives set in the program		0		0		0
EMS14 Resources	ISO14001	Management must ensure the availability of human, specialized, infrastructure, financial and technological resources to establish, implement, maintain and improve the EMS	ITG25; ITG28; ITG27; ITG34	1	ITG29	1		0
	ISO14001	The assignation of resources must be reviewed by the management to guarantee its availability	ITG58; ITG67	2		0		0
	SGE21	Define responsible purchasing criteria		0		0		0
	SGE21	Establish a research, development and innovation environment	ITG23; ITG31;ITG35	2	ITG25	1		0
EMS15 Competence	ISO14001	Ensure that personnel working in or on behalf of the organization are competent based on their training, education and appropriate experience		0	ITG6; ITG7	1		0
	ISO14001	Identify the training needs of the staff working within or on behalf of the organization		0		0		0
	ISO14001	Provide training or undertake other training actions for staff and keep track		0		0		0
EMS16 awareness	ISO14001	People who work in the organization or on behalf of it must comply with the environmental policy		0	ITG43	2		0
	ISO14001	The significant environmental aspects and impacts relating them to their jobs		0	ITG44	1		0
	ISO14001	The environmental benefits provided by your personal best performance		0		0		0
	ISO14001	The functions and responsibilities that it has in the EMS		0		0		0
	ISO14001	The potential consequences of deviating from environmental procedures		0		0		0
	GRI G4	Describe values, principles, standards and norms of the organization. Establish internal and external mechanisms to report unethical or illicit behavior and matters related to the integrity of the organization.	ITG13; ITG14	1	ITG44; ITG45	1		0
EMS17 Communication	ISO14001	Define generalities of how external and internal communication will take	ITG72; ITG73	1		0	4.3	1
	ISO14001	Establish procedures for internal communication between the levels and functions of the organization	ITG72; ITG73	1		0		0
	ISO14001	Document communication decision with its external stakeholders	ITG72; ITG73	1		0		0
	ISO14001	Set one or several methods to perform external communication	ITG72; ITG73	1		0		0
	ISO14001	Establish procedures to receive, document and respond to relevant communications from interested parties		0		0		0
	ISO26000	Establish the type of information subject to communication with interested parties	ITG78; ITG79	1		0		0
EMS18 Documented information	ISO14001	The documentation of the EMS must be made taking into account: policy, objectives, goals, scope	ITG70; ITG75; ITG76; ITG77	1		0		0
	ISO14001 ISO14001 ISO14001 ISO14001 ISO14001 ISO14001 ISO14001 ISO14001 ISO14001	The documentation must include the required records of this international standard Creation and update: Approve the documents regarding their adaptation before their issuance Review and update documents when necessary and approve them again Control of documented information Ensure the identification of changes and the current revision status of documents Ensure that versions of applicable documents are available at points of use Ensure readability and easy identification of documents Ensure the identification of external documents necessary for the EMS Prevent unintentional use of obsolete documents or apply proper identification in case of keeping them for some reason		0		0		0
	GRI G4, ISO26000	Obtain verification by the interested parties of the information given. Use a rigorous and responsible verification process, in which the data and information come from a reliable source that allows the verification of their accuracy	ITG79	1		0		0
EMS19 Operational planning and control	ISO14001	Identify and plan operations associated with significant environmental aspects		0		0		0
	ISO14001	Establish, implement and maintain documented procedures to control situations that deviate from the environmental policy, objectives and goals		0		0		0
	ISO14001	Establish operational criteria in work procedures		0		0		0
	ISO14001	Establish documented procedures for goods and services used by the organization		0		0		0
	ISO14001	Communicate procedures and requirements to suppliers and contractors		0		0		0
EMS20 Preparation and response in case of emergency	ISO14001	Establish, implement and maintain one or several procedures to identify potential situations of potential accidents and emergencies, as well as document how to respond to them		0		0		0
	ISO14001	Establish procedures to respond to emergency situations and prevent or mitigate environmental impacts		0		0		0
	ISO14001	Periodically review and modify, when necessary, their emergency preparedness and response procedures, particularly after accidents occur		0		0		0
	ISO14001	Periodic testing of established procedures, when feasible		0		0		0
EMS21 Monitoring, measurement, analysis and evaluation	ISO14001	Establish, implement, document and maintain one or several procedures to track and regularly measure the fundamental characteristics of its operations that can achieve significant impacts on the environment		0		0		0
	ISO14001	Ensure that monitoring and measuring equipment are used and maintained calibrated or verified and records kept		0		0		0
EMS22 Legal fulfillment evaluation	ISO14001	Establish, implement and maintain procedures to periodically evaluate compliance with applicable legal requirements	ITG18	2	ITG49	1		0
	ISO14001	Keep records of the results of periodic evaluations		0		0		0
EMS23 Internal Audit	ISO14001	Establish policies to ensure that audits are conducted at planned intervals		0	ITG46	1		0
	ISO14001	Establish, implement and maintain audit programs		0	ITG46	1		0
	ISO14001	Establish procedures that deal with the determination of audit criteria, frequency and methods		0	ITG46	1		0
EMS24 Review by the main principals	ISO14001	Establish procedures for senior management to review the EMS at planned intervals		0		0		0
	ISO14001	Establish policies to keep records of revisions by management		0		0		0
	ISO14001	Establish that the results of the reviews include the decisions and actions taken related to possible changes in the environmental policy		0	ITG41	1		0
EMS25 Improvement of non-conformity, corrective action.	ISO14001	Establish, implement and maintain procedures to deal with real and potential conformities and take corrective actions		0		0		0
	ISO14001	Take appropriate actions in relation to the magnitude of the problems and environmental impacts found		0		0		0
	ISO14001	Ensure that any necessary changes are incorporate into the documentation of the environmental management system		0		0		0
	ISO14001	Evaluate the need to take action to eliminate the causes of non-compliance		0		0		0
	ISO14001	Implement any necessary corrective action		0		0		0
	ISO14001	Review the effectiveness of the corrective measures adopted		0		0		0
	ISO14001	Identify and correct the non-conformities		0		0		0
	ISO14001	Investigate the non-conformities (determining causes and taking actions)		0		0		0
	ISO14001	Evaluation of the need for actions to prevent non-conformities		0		0		0
	ISO14001	Record of the results of the preventive and corrective actions taken		0		0		0
	ISO14001	Review of the effectiveness of the preventive and corrective actions taken		0		0		0
	ISO14001	Ensure that any necessary changes are incorporate into the EMS documentation		0		0		0
EMS26 Continuous improvement	ISO14001	Evaluate the environmental management system		0		0		0
	ISO14001	The organization must continuously improve the EMS		0		0		0
EMS27 Supervise the governance	GRI G4	Supervise the governance		0		0		0

shows the correspondence template filled with the results of the mapping process. It is worth mentioning that the situation labeled as “3” in the previous phase never happened. As a representative example of ES deficiencies in ITG, we found the other three possible situations considering the activity “EMS2 Understanding the needs and expectations of interested parties” and COBIT5 (see Table 8). The situation “0” appeared when the sub-activity “Identify the interested parties that are affected”, provided by ISO14001, was considered: it does not exist in COBIT5 (i.e., empty cell). The situation “1” appeared when the sub-activity “Identify the interests of the stakeholders that are affected”, provided by ISO26000, was considered: it is partially considered in COBIT5 by its sub-activity ITG44 (in the unified structure, see Table S2a in the supplementary material). However, while it refers to ES in ISO26000, it refers to IT in COBIT5. The situation “2” appeared, for example, when the sub-activity “Identify the needs and expectations of interested parties”, provided by ISO14001, was considered: it is located in COBIT5 through its sub-activity ITG21 (in the unified structure, see Table S2a in the supplementary material). However, as in the previous example, it refers to two different aspects (ES and ITG).

3.2.7. Phase 7: Present the Results

We can determine the similarities across the ITG approaches and the relevant ES factors from Table 8 by identifying their common sub-activities:

• Sub-activities with correspondence in the three ITG approaches considered: “Define the environmental policy of the organization within the defined scope”, and “Define representatives to establish, implement and maintain, in addition to establish the functions and responsibilities”.
• Sub-activities with correspondence in two of the three ITG approaches considered: “Define a strategic plan for Sustainability”, “Establish procedures to deal with risks and opportunities”, “Detail the most important effects, risks and opportunities”, “Ensure that the applicable legal requirements are taken into account in the establishment and maintenance of your EMS”, “Management must ensure the availability of human, specialized, infrastructure, financial and technological resources to establish, implement, maintain and improve the EMS”, “Establish a research, development and innovation environment”, “Describe values, principles, standards and norms of the organization”, ”Define generalities of how external and internal communication will take” and, finally, “Establish, implement and maintain procedures to periodically evaluate compliance with applicable legal requirements”.

Taking into account the previous points, we can determine to what extent the relevant ES factors are present in the ITG approaches in order to obtain quantitative measurements about their sustainability deficit. This quantitative study was categorized according to the types of situations already discussed in Section 3.2.5, since each represents a different type of deficiency.

Table 9. Synthesis of the quantitative study derived from Table 8.

Relevant ES Factors		ITG Approach	Situations
			“0”		“1”		“2”
Activities	Sub-Activities		Number Of Sub-Activities	%	Number of Sub-Activities	%	Number of Sub-Activities	%
27	103	COBIT5	75	72.82	19	18.45	9	8.74
		ISO38500	85	82.52	15	14.56	3	2.91
		WEILL & ROSS	98	95.15	5	4.85	0	0.00

summarizes the quantitative results. Thus, the first two columns show the number of activities and sub-activities of the relevant ES factors. The last six columns show, for each situation described in Section 3.2.5, the number of sub-activities (ES factors) that are connected to the ITG approach and the corresponding percentage.

4. Discussion

This work addressed two main objectives regarding sIT Governance: identifying the relevant ES factors derived from the main ES approaches, and determining to what extent these factors are already present in the main ITG approaches.

Regarding the first objective, we extracted the relevant ES factors, which are composed of 27 activities and 103 sub-activities (Table 4), from ISO14001, GRI G4, EMAS, SGE21, and ISO26000 (Figure 1, Activity 1). It should be noted that most of these belong to ISO14001, which was the reference model selected in Section 3.1.2.

To achieve the second objective (Figure 1, Activity 2), we developed a correspondence template considering the relevant ES factors and COBIT5, ISO38500 and WEILL & ROSS as representative of IT Governance approaches (Table 8). This template let us determine, in a quantitative manner, to what extent current ITG approaches refer to the relevant ES factors (Table 9). Analyzing this last table, we can conclude that the situation labeled as “0” (i.e., the relevant ES factor does not exist in ITG) has, by far, the highest percentages. This situation demonstrates that there is a clear ES deficit in the ITG approaches studied: 72.82% in COBIT5, 82.52% in ISO38500 and 95.15% in WEILL & ROSS. This conclusion quantitatively corroborates the studies performed by Machado et al. [43], and by Merhout and O’Toole [44], although they restricted their analysis only to COBIT. In addition, the quantitative study carried out in our work also reveals that COBIT5 is the proposal that best covers ES issues, as confirmed by the results for situations “1” and “2” in Table 9.

It should be noted that the work presented here addressed the two main deficiencies presented in the Introduction section, since:

• The five main ES approaches (ISO14001, GRI G4, EMAS, SGE21 and ISO26000) have been considered in order to extract the relevant ES factors. It is worth mentioning at this point that, although ISO14001 is the approach providing more ES factors, none of the current studies has considered it.
• The issue about “grosso modo” was considered by applying the criteria of homogeneity and granularity to select the level of detail.

Future work should focus on two immediate research lines. The first would address the specific deficiencies of each ITG approach to make it “more sustainable”. The second line, where we are currently working, would develop a new framework for sIT Governance, including ES in the ITG processes. Thus, we are identifying the relevant (i.e., not general) ITG factors from the main ITG approaches using the same criteria that were employed here to identify the relevant ES factors. The idea is to develop a correspondence template between the relevant ES and the relevant ITG factors with the purpose to identify the type of ES deficits of the relevant ITG factors. Once these deficiencies have been identified, we can propose a sIT Governance framework. In order to improve this proposal, it will also be important to perform case studies in different organizations. Finally, it is important to note that by using ISO14001 as the reference model we can take advantage of the synergies derived from its wide dissemination. ISO14001 certified organizations would find the new framework familiar.