Measuring ICT Governance Compliance in South Africa’s Public Service: A Systematic Multivocal Review and Conceptual Framework

Abstract

Digital transformation in the public sector has intensified the need to demonstrate not only adoption of ICT governance frameworks but sustained compliance with governance requirements. This systematic multivocal literature review developed a conceptual ICT Governance Compliance Measurement Framework for South Africa’s public service and was reported in accordance with PRISMA 2020. Peer-reviewed and authoritative grey literature published from January 2004 to May 2026 was searched across Scopus, Web of Science, IEEE Xplore, EBSCOhost, Google Scholar, and targeted institutional sources; the academic searches were updated through 31 May 2026. The protocol was registered on the Open Science Framework (DOI: 10.17605/OSF.IO/YZVB3). Of 1380 records identified, 130 full texts were assessed, 91 proceeded to source-appropriate quality appraisal, and 72 sources (52 academic and 20 grey/postgraduate) met the final quality threshold and informed an abductive thematic synthesis. Six interrelated compliance dimensions emerged: Strategic Alignment; Governance Structures and Accountability; Risk and Security Governance; ICT Investment and Procurement Governance; Regulatory and Policy Compliance; and Performance Monitoring and Continuous Improvement. These were integrated into a six-stage conceptual compliance-measurement workflow linking normative requirements, compliance dimensions, evidence triangulation, implementation rating, a six-dimensional compliance profile, and remediation/reassessment, bounded by organisational antecedents and public-value consequences. The framework offers a traceable basis for self-assessment and audit readiness, but requires empirical validation before formal scoring, benchmarking, or assurance use.

1. Introduction

Information and communication technology (ICT) has emerged as a strategic organisational ability that facilitates service provision, innovation, organisational performance and value creation. ICT governance thus involves strategic direction, oversight, accountability and decision rights that influence how technology is aligned to institutional goals, risks are managed, resources are allocated and performance is monitored [1,2]. There are principles and practices for these purposes already established in governance instruments but they do not necessarily mean that the governance requirement is being met in practice consistently across the organisations [3].

This difference poses a measurement problem. Typical existing research focuses on audit conformity, organisational capability, effectiveness, mechanisms, or ICT governance maturity. These constructs offer valuable partial views: maturity relates to the development of governance processes; capability relates to the capacity of an organisation to govern; audits test defined requirements/controls; and effectiveness relates to the impact of governance. None alone provides consistent coverage of all governance requirements applicable to an organisation [4,5].

This is especially relevant in the context of ICT governance in the South African public service, where a high level of governance policy, accountability, audit, and assurance is present. The Department of Public Service and Administration’s Corporate Governance of ICT Policy Framework (CGICTPF) specifies the roles of executive authorities and accounting officers and mandates alignment, appropriate structures, risk governance, performance monitoring, and accountability [6]. The requirements address public finance, information protection, corporate governance, audit, and sector-specific requirements, and the international instruments (COBIT and the ISO/IEC governance frameworks) offer complementary guidance for operations and assessment. South African studies nevertheless identify uneven implementation associated with executive commitment, fragmented structures, skills, communication, strategic alignment, and institutionalisation [7,8,9].

There are three related gaps that follow. ICT governance compliance is not clearly differentiated from maturity, capability, effectiveness, and regulatory conformity conceptually, all the time. Assessment typically focuses on individual processes, controls, maturity levels, or outcomes, and does not connect governance requirements to the evidence of implementation, monitoring, assurance, and improvement within a shared measurement architecture. In South Africa, the requirements for public-service governance and the expectations of the audit process have not been sufficiently aligned with other international audit frameworks to create a coherent audit compliance plan. The study, therefore, asks whether governance demands have become actualized in the form of demonstrable, monitored, and sustained organizational practice.

1.1. Scope, Aim, and Research Questions

The primary sphere of application is South African national and provincial public-service departments that work within the CGICTPF context. Evidence from the municipalities and public universities, state-owned entities, and other public sector organizations from Africa and international public institutions is used only if they provide transferable knowledge regarding the governance mechanisms, governance indicators, views of governance assessment, or measures of governance. The framework that emerged as a result is therefore not a blueprint for use across the entire public sector, but a conceptual framework that needs to be adapted for use in other public institutions, mapped, and empirically tested.

The goal is to create a conceptual ICT Governance Compliance Measurement Framework systematically using multi-voice synthesis of peer-reviewed and authoritative grey literature. The review is guided by four research questions (RQ):

• RQ1: How is ICT governance compliance conceptualised in academic and authoritative grey literature, and how is it distinguished from governance maturity, capability, and effectiveness?
• RQ2: What governance, policy, regulatory, and assurance requirements represented in the reviewed evidence shape ICT governance compliance within the South African public-service context?
• RQ3: What governance dimensions and candidate measurable indicators should be incorporated into an ICT Governance Compliance Measurement Framework for the South African public service?
• RQ4: How can the identified dimensions, indicators, evidence requirements, and assessment approaches be integrated into a conceptual framework for evaluating ICT governance compliance?

1.2. Contribution

The study is conceptually valuable by introducing a framework that is distinct from the concept of maturity, capability and effectiveness; methodologically valuable by demonstrating how independent pieces of evidence from various academic, policy, standards, audit and benchmarking sources can inform the design of a set of measurements; contextually valuable because it provides a framework that is grounded in the requirements of the South African public service with international guidance being selectively applied; and practically valuable because it gives a traceable basis for future self-assessment, audit readiness, remediation and benchmarking. The framework is a theoretical measurement structure and not a proven audit tool.

2. Literature Review and Theoretical Foundation

2.1. Public-Sector ICT Governance and Compliance

ICT governance emerged as a structure of decision rights, leadership direction, accountability, and oversight of technology. The field subsequently expanded to embrace a holistic perspective of structures, processes, and relational mechanisms that facilitate communication, shared responsibility, and strategic alignment [1,2]. Such mechanisms are implemented in public institutions in the context of other expectations of transparency, stewardship, service delivery, and accountability, and are thus not only dependent on technical capacity but also on institutional authority, inter-institutional coordination, and constraints in the public sector [3].

The concept of ICT governance compliance is not as well-defined as governance. Compliance in this study is defined as a consistent, ongoing conformance to applicable governance requirements, substantiated by functional structures, processes, controls, relational practices, evidence, monitoring and corrective action. This definition is intentionally limited to effectiveness and broadened from legal or audit consistency. Capability enables governance; maturity describes its development; compliance establishes demonstrable and sustained conformity; and effectiveness concerns the results produced. Defensible measurement requires these constructs to be kept separate [4,5].

2.2. Framework Fragmentation and the Measurement Gap

There is no single governance instrument, identified in the reviewed evidence, that gives a comprehensive indicator of multidimensional ICT governance compliance. Authoritative governance expectations are defined in South African instruments; COBIT provides detailed governance objectives and system components; ISO/IEC standards provide high-level principles and assessment guidance; King IV reinforces governing-body responsibility; and NIST CSF 2.0 provides rich risk and cybersecurity governance outcomes. They are complementary strengths, but when applied separately, they can lead to a disjointed assessment or a lack of clarity between governance development, conformity, and outcomes. The main roles relevant to this review are summarised in Table 1.

Table 1. Principal governance instruments and their contribution to compliance measurement.

Instrument	Primary Focus	Key Contribution	Boundary for Compliance Measurement
CGICTPF/DPSA instruments	South African public-service ICT governance	Context-specific executive responsibility, structures, alignment, risk, performance, and reporting	Primary normative anchor; requires operationalisation into measurable evidence
COBIT 2019	Enterprise governance and management of information and technology	Governance objectives, practices, components, metrics, and design factors	Strong operationalisation and measurement support; not a substitute for domestic obligations
ISO/IEC 38500 [10,11]	Governing-body oversight and assessment	Principles for governance, assessment criteria/evidence, and IT-enabled investment guidance	Supports governance principles and assessment design rather than a complete local compliance model
King IV	Corporate governance of technology and information	Governing-body oversight, accountability, and strategic support	Broad corporate-governance principles rather than a detailed ICT compliance instrument
NIST CSF 2.0	Cybersecurity risk governance	Governance, roles, risk strategy, oversight and supplier-risk outcomes	Useful for the risk/security sub-domain, not the entire ICT governance construct

The review gap is thus an integrative one, meaning that the governance needs, organisational capability, implementation evidence, assurance and continuous improvement should be connected in one architecture and a professional framework, maturity level, audit result, or favourable outcome should not be considered compliance by itself.

2.3. Theoretical Sensitizing Framework

The study employs three theoretical lenses, not as preexisting measurement dimensions but as sensitising lenses to the study. A corporate-governance view is related to the question of accountability for ICT governance and how decision rights, stewardship, strategic direction and oversight are organised [2]. Institutional Theory explains why public organisations adopt recognised governance requirements and why formal adoption may diverge from substantive implementation under coercive, normative, and mimetic pressures [12,13]. Public Value Theory provides the answer to the question of why governance matters beyond conformity and situates accountability, stewardship, transparency, and service delivery within the broader aims of public administration [14].

The perspectives point to accountability, institutionalisation, conformance, organisational implementation and purpose of the public sector, while leaving the substantive compliance dimensions to emerge from the evidence. Theory cannot inform the six dimensions, but it can inform interpretation. The integration framework is given in Figure 1.

Figure 1. Integrated theoretical sensitising framework for ICT governance compliance.

3. Materials and Methods

3.1. Design and Protocol

For the purpose of this study, the method used was Systematic Multivocal Literature Review (SMLR) due to the fact that the phenomenon is partly empirical and partly normative: peer-reviewed studies present evidence in terms of theories, diagnosis, maturity, capability, and measurement evidence, whereas policies, audit reports, public-service governance frameworks, standards, and institutional guidance define and operationalise many of the requirements by which public-service ICT governance can be assessed. The multivocal-review guidance [15] was used to guide the review, and identification and selection followed PRISMA 2020 reporting guidelines [16].

A protocol was developed before the formal search and registered on the Open Science Framework (DOI: 10.17605/OSF.IO/YZVB3). The original registration remains the prospective record of the review. Post-registration operational clarifications to the eligibility boundary, implemented information-source list, and totals-based hybrid quality-appraisal procedure were documented transparently in an amended protocol (Version 2; 19 September 2026) and the supplementary audit trail. Literature published from January 2004 to May 2026 was eligible, capturing the development of contemporary ICT governance and subsequent assessment approaches.

3.2. Search Strategy

Two parallel search streams were used. The academic stream searched Scopus, Web of Science, IEEE Xplore, EBSCOhost, and Google Scholar using combinations of ICT-governance terms; compliance, assessment, measurement, maturity, capability, audit, and implementation terms; and public-sector terms. The academic database searches were updated through 31 May 2026. Google Scholar was used as a supplementary source, with the first 200 returned results screened. The grey-literature stream targeted authoritative organisations responsible for public-service governance, audit, standards, and digital-government assessment, including DPSA, AGSA, IoDSA, ISO/IEC, ISACA, NIST, OECD, UN DESA, and the World Bank. Full database strings, source-specific search dates, and the grey-literature search log are reproduced in Supplementary Tables S1 and S2.

The academic stream yielded 1346 records and the targeted grey-literature search yielded 34, giving 1380 records overall. After screening and retrieval, 130 full texts were assessed against the final eligibility criteria; 39 were excluded and 91 proceeded to source-appropriate quality appraisal. The final appraisal pool comprised 71 academic-rubric sources and 20 grey/postgraduate sources. The complete numerical progression through identification, screening, retrieval, full-text eligibility, quality appraisal, and final synthesis is presented in the PRISMA flow diagram (Figure 2).

Figure 2. PRISMA 2020 study-selection flow.

3.3. Eligibility and Study Selection

Eligibility required substantive relevance to ICT/IT governance and extractable evidence capable of informing governance compliance or assessment. Multidimensional coverage within a single source was not required. Domain-specific evidence was eligible where it (i) addressed governance rather than technical or operational implementation alone; (ii) contained extractable evidence on governance requirements, structures, decision rights, controls, assessment, assurance, monitoring, implementation, or measurable indicators; (iii) could reasonably inform organisation-level ICT-governance assessment rather than only the performance of a specific technology, application, or system; and (iv) had direct public-sector relevance or defensible transferability to public-sector governance. Academic sources comprised peer-reviewed journal articles, proceedings papers, scholarly book chapters, and relevant review studies; grey/postgraduate sources comprised government policies and directives, audit reports, standards, implementation guidance, authoritative institutional reports, professional governance frameworks, and relevant postgraduate research. Only English-language sources published from January 2004 to May 2026 were included. The final inclusion and exclusion criteria are given in Table 2.

Table 2. Inclusion and exclusion criteria.

Criterion	Inclusion	Exclusion
Phenomenon	ICT/IT governance, information-systems governance, corporate governance of ICT, and governance-related compliance, assessment, capability, maturity, effectiveness, implementation, audit, or performance evidence.	Purely operational or technical IT topics without a substantive governance dimension.
Measurement relevance	Models, indicators, controls, evidence requirements, maturity/capability assessment, audit/conformance evidence, compliance assessment, governance diagnostics, implementation evidence, or domain-specific governance evidence transferable to organisation-level compliance assessment.	No extractable governance/assessment/measurement evidence, or domain-specific content that remains primarily technical/operational and cannot inform organisation-level governance assessment.
Context/transferability	South African public-service evidence; other public-sector evidence; or international evidence with demonstrable transferability to public-sector governance mechanisms, evidence, indicators, or assessment logic.	Exclusively private-sector evidence without demonstrable public-sector governance transferability.
Academic sources	Peer-reviewed journal articles, conference/proceedings papers, scholarly book chapters, and relevant review studies.	Editorials or non-scholarly commentary without substantive evidence
Grey/postgraduate sources	Government policies/directives, audit reports, standards, implementation guidance, authoritative institutional reports, professional governance frameworks, and relevant postgraduate research.	Blogs, promotional material, newsletters, unsupported opinion, or documents of unclear provenance.
Language and period	English; January 2004–May 2026	Other languages or outside the review period

Title and abstract screening was conducted independently by two reviewers. At this initial screening stage, sensitivity was prioritised: a record progressed to full-text assessment if either reviewer considered it potentially eligible, whereas exclusion required agreement by both reviewers. No automated screening or machine-learning tools were used. Following screening, 126 academic reports and 23 grey literature reports were sought for retrieval (149 overall). Nineteen academic reports could not be obtained, leaving 107 academic and 23 grey-literature reports (130 overall) for full-text eligibility assessment. Initial full-text agreement was 56.1% (60/107; Cohen’s κ = 0.08) for the academic reports. For the 23 grey-literature reports, initial agreement was 82.6%, while κ was 0.00 because one reviewer initially classified all grey-literature reports as eligible. These statistics are reported as measures of the reviewers’ independent pre-consensus decisions. Where full-text decisions differed, the reviewers returned to the source, reconsidered the applicable eligibility criteria, and resolved the disagreement through documented discussion. The final eligibility assessment excluded 35 academic-search reports and 4 grey-literature reports (39 overall). Of the 72 eligible academic-search reports, one doctoral dissertation [17] was classified as grey/postgraduate evidence for source-appropriate appraisal; the final appraisal pool therefore comprised 71 academic-rubric sources and 20 grey/postgraduate sources (91 overall).

3.4. Quality Appraisal

Academic sources were evaluated against six criteria scored from 1 to 5: clarity of research objective (QA1), methodological rigour (QA2), conceptual contribution (QA3), validity/credibility of findings (QA4), relevance to ICT-governance compliance (QA5), and reporting quality (QA6). Grey/postgraduate evidence used six source-appropriate criteria: institutional authority (GA1), publisher credibility (GA2), methodological transparency (GA3), evidence quality (GA4), policy relevance (GA5), and governance relevance (GA6). For both rubrics, 1 = poor/not evidenced, 2 = weak, 3 = adequate, 4 = good, and 5 = excellent/fully evidenced; the maximum score was 30.

Quality appraisal was conducted independently by two reviewers. Each reviewer’s six criterion ratings were summed to an independent total out of 30. Where reviewer totals differed by three points or less, fell within the same quality band, and were on the same side of the 18/30 retention threshold, the two totals were averaged and conventionally rounded to the nearest whole number (0.5 rounded upward). Criterion-level discussion was triggered where totals differed by four or more points, fell in different quality bands, or crossed the 18/30 threshold; triggered cases were re-examined against the criterion-level evidence and assigned a final reconciled score. Final hybrid scores were classified as high quality (25–30), moderate quality (18–24), or low quality (<18), and only sources scoring at least 18/30 were retained for synthesis. Because the review integrated heterogeneous empirical, conceptual, policy, audit, standards, and normative evidence rather than intervention-effect estimates, source-appropriate methodological quality and credibility appraisal was used instead of an effect-estimate-specific risk-of-bias tool. Summary of quality appraisal outcomes is shown in Table 3, and source-level criterion scores and reconciliation outcomes are reported in Supplementary Tables S5 and S6C.

Table 3. Summary of quality-appraisal outcomes.

Source Type	Appraised	Mean/30	High	Moderate	Low	Included	Excluded
Academic	71	24.03	45 (63.4%)	7 (9.9%)	19 (26.8%)	52 (73.2%)	19 (26.8%)
Grey/postgraduate	20	26.50	18 (90.0%)	2 (10.0%)	0	20 (100%)	0
Overall	91	24.57	63 (69.2%)	9 (9.9%)	19 (20.9%)	72 (79.1%)	19 (20.9%)

Across the 91 sources appraised, the mean final hybrid score was 24.57/30. Academic evidence (n = 71) had a mean score of 24.03/30; 45 sources were High, 7 Moderate, and 19 Low, with 52 retained for synthesis. Grey/postgraduate evidence (n = 20) had a mean score of 26.50/30; 18 sources were High and 2 Moderate, and all 20 were retained. Overall, 63 sources were High quality, 9 Moderate, and 19 Low, yielding a final synthesis set of 72 sources. Grey/postgraduate evidence was interpreted according to evidentiary role: South African policy and audit sources anchored context-specific requirements and assurance expectations, while international standards, professional frameworks, and benchmarking sources informed operationalisation, risk governance, indicator design, and benchmarking.

3.5. Data Extraction and Management

Data were extracted using a predefined structured extraction form developed from the review questions and eligibility criteria. For each included source, the extraction captured bibliographic information, evidence stream, country or institutional context, study or document focus, governance framework or instrument, relevant ICT-governance concepts, compliance or assessment evidence, measurement approaches, key findings, analytical contribution, and mapping to the relevant research question and emerging compliance dimension. The resulting source-level extraction is summarised in Supplementary Table S4.

The data sought from each source were defined in relation to the four research questions and included: (i) conceptualisations and definitions of ICT governance compliance and its distinction from maturity, capability and effectiveness; (ii) governance, policy, regulatory and assurance requirements relevant to the South African public-service context; (iii) governance dimensions, practices, indicators and forms of evidence that could support compliance measurement; (iv) measurement, assessment, audit, maturity and capability approaches used in the source; and (v) the source’s analytical contribution and relevance to the development of the proposed compliance framework. All relevant findings within these domains that were extracted were reported.

Two reviewers independently extracted and coded the included sources. Extracted information was compared across reviewers, and disagreements were resolved through discussion and re-examination of the original source until consensus was reached. No information was inferred where a source did not report it clearly; such information was recorded as not reported or not applicable. No automated data-extraction, text-mining, or machine-learning tools were used. Following extraction, recurring concepts were coded and progressively organised into subthemes and higher-order compliance dimensions through the abductive thematic-analysis process. The code-to-theme development and supporting evidence are documented in Supplementary Table S7.

3.6. Analysis and Framework Development

Thematic analysis was performed following Braun and Clarke [18] using an abductive approach. All sources that satisfied the final eligibility criteria and achieved a final hybrid quality-appraisal score of at least 18/30 were included in the thematic synthesis and mapped to one or more research questions and emerging compliance dimensions according to their extracted content and analytical contribution. Existing ICT-governance concepts were used to sensitise coding, together with theoretical considerations of accountability, institutionalisation and public value, but these were not imposed as predetermined categories. Recurring concepts were compared, refined, synthesised and grouped into higher-order categories, with a dimension retained only where it was conceptually relevant to compliance measurement and supported by multiple forms of evidence. The code-to-theme development, representative evidence and candidate indicators are documented in Supplementary Table S7.

Synthesis results were presented through structured tables and conceptual figures that mapped included sources to research questions, analytical contributions, higher-order dimensions, and candidate indicators, while Supplementary Tables S4–S7 provide the corresponding source characteristics, quality-appraisal records, and coding audit trail. Framework development followed the thematic synthesis. Conceptual coverage, contextual relevance, and measurability were evaluated by comparing the higher-order dimensions with South African governance requirements and internationally recognised governance instruments. This process resulted in an evidence-based integration rather than direct replication of any single theory, standard or governance framework.

Formal statistical assessment of reporting bias was not undertaken because the review synthesised heterogeneous qualitative, conceptual, policy, audit, standards and other normative evidence rather than comparable quantitative effect estimates. Potential publication and availability bias were instead considered qualitatively when interpreting the evidence base, particularly given the English-language restriction, the supplementary use of the first 200 Google Scholar results, and the targeted nature of the grey-literature search.

A formal certainty-of-evidence grading approach, such as GRADE, was not applied because the review integrated heterogeneous empirical studies with policy documents, audit reports, standards, professional frameworks and other normative sources rather than a homogeneous body of intervention-effect evidence. Instead, confidence in the synthesis was supported through source-appropriate quality appraisal, independent reviewer assessment, triangulation across academic and grey-literature evidence, and maintenance of an analytical audit trail.

3.7. Trustworthiness and Ethics

The use of a registered protocol with documented operational amendments, transparent eligibility procedures, source-appropriate independent appraisal, criterion-level reconciliation, an analytical audit trail, and triangulation of empirical, normative, and institutional evidence helped to enhance credibility and dependability. Ethical approval to conduct this study was obtained from the College of Science, Engineering and Technology, School of Computing ERC (Ref. No. 11483). No human subjects, confidential information of organisations, or personal information were used in the review.

4. Results

4.1. Evidence Base

The final synthesis consisted of 72 sources: 52 academic sources and 20 grey/postgraduate sources. The grey/postgraduate stream comprised 3 postgraduate theses/dissertations, 7 South African policy/governance/audit documents, and 10 international standards, professional frameworks, or benchmarking reports. Among 71 academic sources appraised, 52 met the final quality threshold; the mean final hybrid score across academic appraisals was 24.03/30. All 20 grey/postgraduate sources met the threshold, with a mean final hybrid score of 26.50/30. The combined evidence base, summarized in Table 4, enabled triangulation between empirical and conceptual research, locally authoritative governance and audit requirements, and international assessment and measurement guidance.

Table 4. Composition and analytical role of the final evidence base.

Evidence Category	n	Primary Analytical Role
Academic literature retained after quality appraisal	52	Empirical, conceptual, diagnostic, maturity/capability, compliance, governance-mechanism, audit, and design evidence.
Postgraduate research	3	Detailed public-sector governance, framework adaptation, policy, risk, and institutional evidence.
South African policy/audit/governance documents	7	Context-specific requirements, executive accountability, oversight, audit evidence, reporting, and implementation guidance.
International standards/frameworks/benchmarks	10	Normative principles, assessment methods, governance practices, metrics, risk-governance guidance, and comparative measurement architecture.
Total	72	Integrated multivocal evidence base retained after final hybrid quality appraisal.

Across the evidence base, the literature shifts from decision structures, strategic alignment, communication, and COBIT-oriented maturity towards diagnostic assessment, regulatory verification, institutional capability, behavioural governance, risk, resilience, and transparent benchmarking [19,20,21,22,23,24]. This evolution supports moving beyond maturity alone toward evidence-based compliance. The full characteristics and analytical contributions of all 72 included sources are provided in Supplementary Table S4 for audit-trail purposes.

4.2. RQ1: Conceptualising ICT Governance Compliance

Three overlapping but analytically distinct perspectives informed the construct. Regulatory and audit-oriented evidence treats compliance as demonstrable conformity with identifiable prescriptions and artefacts, with non-conformities linked to action and monitored remediation [20,25]. Capability and institutionalisation studies show that formally adopted governance frameworks can coexist with weak structures, skills, communication, and implementation, making documentary adoption necessary but insufficient [8,9,26,27]. Outcome-oriented evidence connects effective governance with service quality, accountability, transparency, innovation, and resilience, but those outcomes cannot substitute for evidence that specific requirements have been implemented [21,24,28].

Drawing on these views, ICT-governance compliance is the ability of a public-service organisation to show that its ICT-governance principles, responsibilities, structures, processes, controls and relational practices are formally established, applied consistently, monitored to credible evidence, and enhanced based on identified deficiencies, and in accordance with organisation goals and to relevant governance obligations. Capability relates to the capacity to govern, maturity relates to the institutionalisation and development of governance processes, compliance relates to evidence of adherence and on-going implementation, and effectiveness relates to the outcomes of governance.

4.3. RQ2: Governance Requirements in the South African Public-Service Context

The evidence shows a multi-layered governance system and not a single controlling system as depicted in Table 5. DPSA instruments provide the most direct public-service governance layer by specifying executive responsibility, governance structures, alignment, risk, value, conformance, performance, reporting, and formal assessment expectations [6,29,30]. King IV reinforces the responsibility of the governing body over technology and information [31] and AGSA brings independent assurance over control environments, compliance, credible performance information, procurement and contract management, remediation, and leadership accountability [32,33,34].

Table 5. Role of governance instruments in the proposed measurement architecture.

Instrument/Source Group	Principal Contribution	Role in Framework
DPSA CGICTPF and Implementation Guideline	Executive accountability, structures, alignment, risk, value, conformance, performance, reporting	Primary South African public-service governance layer
DPSA Determination and Directive	Formal implementation, assessment, and reporting expectations	Primary compliance/assessment layer
AGSA consolidated reports	Independent findings, controls, procurement, performance information, remediation, accountability	External assurance and evidence-validation layer
King IV	Governing-body oversight of technology and information	Corporate-governance principle layer
COBIT 2019	Objectives, components, practices, metrics, design factors	Operationalisation and indicator-design layer
ISO/IEC 38503:2022	Assessment approaches, criteria, evidence, governance maturity	Assessment-method layer
ISO/IEC 38506:2020	IT-enabled investment, value, acquisition, risk, conformance	Investment-governance layer
NIST CSF 2.0	Cybersecurity governance, risk, oversight, supply-chain governance	Risk/security sub-domain layer
OECD/UN DESA/World Bank	Public-sector dimensions, maturity/index architectures, comparative indicators	Benchmarking and measurement-design layer

The International instruments contribute measurement methods and operational constructs rather than replacing South African requirements. COBIT 2019 provides governance objectives, system components, practices, and example metrics and emphasises contextual tailoring [35,36,37]. ISO/IEC 38503 supplies assessment approaches, criteria, evidence, and maturity guidance, while ISO/IEC 38506 addresses IT-enabled investment and acquisition governance [10,11]. NIST CSF 2.0 strengthens cybersecurity governance and supplier-risk oversight [38], and OECD, UN DESA, and World Bank frameworks contribute indicator and benchmarking architectures [39,40,41,42].

The review does not constitute a stand-alone legal audit of every statute or sector-specific directive. Statutory obligations mentioned within the included governance and audit instruments are treated as contextual requirements rather than independently synthesised legislation. A future operational instrument therefore requires a dedicated legal traceability exercise before deployment.

4.4. RQ3: Six Compliance Dimensions and Candidate Indicators

The thematic synthesis consolidated recurring governance concepts into six higher-order dimensions, as shown in Table 6. They are cross-source analytical categories rather than a direct copy of COBIT, ISO/IEC, the CGICTPF, or any other single framework. Concepts were consolidated where they shared governance function and measurement relevance, reducing overlap while preserving the underlying concepts as potential sub-elements and indicators.

Table 6. Synthesised compliance dimensions, candidate indicators, and representative evidence.

Dimension	Candidate Indicators	Representative Evidence
Strategic Alignment	Strategy-to-ICT mapping; executive prioritisation; portfolio/budget alignment; architecture alignment; strategic review	Ali & Green [19]; Luna-Reyes et al. [21]; Ngqondi & Mauwa [8]; DPSA [6,29]
Governance Structures and Accountability	Functional committees; terms of reference; decision rights; role clarity; executive reporting; stakeholder participation; communication	Al Qassimi & Rusu [26]; Ali & Green [19]; Ngqondi & Mauwa [8]; Phahlane [9]
Risk and Security Governance	Risk register; risk appetite linkage; security governance; continuity/DR; incident escalation; supplier risk; treatment tracking	Al Hilali & Vijaya [43]; Plevnik [24]; Zainuddin et al. [44]; NIST [38]
ICT Investment and Procurement Governance	Business cases; portfolio prioritisation; sourcing/procurement controls; vendor governance; SLAs; benefits realisation; post-implementation review	Dias Canedo et al. [25]; AGSA [33,34]; ISO/IEC [11]; ISACA [36]
Regulatory and Policy Compliance	Obligation register; policy mapping; current approvals; self-assessment; exceptions; audit findings; remediation and closure evidence	Clara et al. [20]; Dias Canedo et al. [25]; DPSA [6,29,30]; AGSA [33,34]
Performance Monitoring and Continuous Improvement	Governance KPIs; dashboards; conformance/performance reports; assurance; trend analysis; action tracking; lessons learned; reassessment	Ali & Green [19]; Clara et al. [20]; Simonsson et al. [4]; Muniz dos Santos et al. [45]

4.4.1. Strategic Alignment

Strategic Alignment assesses whether ICT priorities, investments, architecture, projects, budgets, and performance measures are explicitly connected to the institutional mandate and strategic objectives. Evidence across public-sector studies and DPSA instruments supports executive prioritisation, portfolio alignment, and periodic strategic review as observable manifestations of this dimension [6,8,19,21,29].

4.4.2. Governance Structures and Accountability

Governance Structures and Accountability refer to the formal allocation and real implementation of governance authority. The functional committees, decision rights, role clarity, executive reporting, stakeholder participation, and governance communication are recurring throughout the evidence and are of significance; operational functionality must be demonstrated, not postulated on the basis of the presence of charters or committees [8,9,19,26].

4.4.3. Risk and Security Governance

Risk and Security Governance is the combination of ICT risk, cybersecurity, continuity, information protection, incident escalation, and third-party risk into enterprise governance. The dimension is not directly about the technical configuration, but about oversight, accountability, risk decisions, and assurance [24,38,43,44].

4.4.4. ICT Investment and Procurement Governance

ICT Investment and Procurement Governance addresses how public resources are prioritised, acquired, contracted, monitored, and evaluated for value. Business cases, portfolio prioritisation, sourcing decisions, supplier governance, service levels, benefits realisation, and post-implementation review are governance issues because they combine strategy, risk, accountability, decision rights, and stewardship [11,25,33,34,36].

4.4.5. Regulatory and Policy Compliance

Regulatory and Policy Compliance concerns the organisation’s ability to identify applicable obligations, translate them into internal policy and controls, retain evidence of implementation, and remediate non-conformities. The emphasis is traceability from requirement to operating practice, evidence, review, and closure rather than policy existence alone [6,20,25,29,30,33,34].

4.4.6. Performance Monitoring and Continuous Improvement

Performance Monitoring and Continuous Improvement assesses whether governance performance and conformance are measured, reported, assured, and used to improve governance. Dashboards, trend analysis, action tracking, lessons learned, reassessment, and closed corrective-action cycles convert governance from a once-off implementation exercise into a recurrent evaluate-direct-monitor-improve practice [4,19,20,45].

4.5. Measurement Approaches in the Included Evidence

Five broad measurement families were identified [46], as shown in Table 7: maturity/capability assessment [47,48,49,50,51], audit/conformance verification [52,53,54], diagnostic/design models [55,56,57,58,59,60,61,62,63,64,65,66], perception-based effectiveness models [67,68,69], and public-sector benchmarking/index models. None can achieve sustained multidimensional compliance alone, but all provide useful design features. Maturity offers developmental diagnosis; audit affords more evidence of conformity; diagnostic models offer evidence of contextual tailoring; perception studies provide evidence of testing mechanisms, but are inadequate for direct evidence of compliance; and benchmarks offer indicator architecture, but may or may not reflect legal obligations in that context. The suggested framework thus brings together their complementary strengths without destroying their complementary purposes.

Table 7. Measurement approaches and implications for framework design.

Approach	Typical Form	Strength	Limitation for Compliance	Examples
Maturity/capability	COBIT maturity, Process Assessment Models (PAM), staged models	Current-state diagnosis; improvement pathway	May conflate development with compliance; aggregation may be subjective	Nfuka & Rusu [22]; Simonsson et al. [4]; Zainuddin et al. [44]
Audit/conformance	Compliance elements, documentary verification, audit findings	Traceable requirements; independent assurance	Bounded by audit scope and point-in-time evidence	Clara et al. [20]; Dias Canedo et al. [25]; AGSA [33,34]
Diagnostic/design	Contextual models; mixed-method/documentary diagnosis	Public-sector tailoring; gap identification	Documents may not fully reflect operating practice	Muniz dos Santos et al. [45]; Olaitan et al. [23]
Perception/effectiveness	Surveys, regression, PLS-SEM	Tests mechanisms and relationships	Self-report insufficient for compliance on its own	Ali & Green [19]; Sofyani et al. [28]; Wiedenhöft & Luciano [67]
Benchmark/index	Composite indicators, stages, cross-government comparison	Comparability, dashboards, longitudinal tracking	Broader digital-government focus; weighting may not reflect local obligations	OECD [39,40]; UN DESA [41]; World Bank [42]

4.6. RQ4: Integrated Compliance Framework and Evidence Model

The four research questions are integrated in a six-stage conceptual compliance-measurement workflow bounded by antecedents/enablers and consequences/outcomes. Stage 1 identifies the applicable South African normative requirements. Stage 2 specifies the six ICT-governance compliance dimensions. Stage 3 triangulates documentary evidence, governance records, quantitative metrics, self-assessment, and assurance evidence. Stage 4 applies an evidence-based 0–4 implementation rating to each indicator, as represented in Table 8. Stage 5 produces a six-dimensional compliance profile that preserves material weaknesses rather than collapsing them into a compensatory total. Stage 6 links identified gaps to remediation, monitoring, and reassessment. Leadership, skills, structures, resources, communication, and governance culture are treated as antecedent conditions that influence implementation but are not themselves compliance scores; governance effectiveness and public-value outcomes are consequences and external validation rather than components of the compliance construct.

Table 8. Conceptual evidence-rating anchors for future instrument validation.

Proposed Rating	Conceptual Anchor
0—Not evidenced	No credible evidence that the required governance practice exists or operates.
1—Initiated/ad hoc	Policy, intention, or isolated activity exists, but implementation is informal, incomplete, or not routinely evidenced.
2—Partially implemented	Practice operates in some areas or periods; roles, evidence, or monitoring are inconsistent and material gaps remain.
3—Substantially implemented	Practice is routinely performed, documented, assigned, and monitored; only limited gaps remain.
4—Fully implemented and improving	Practice is consistently evidenced, independently reviewable, monitored against targets, and improved through a closed corrective-action cycle.

Compliance should be determined by triangulation—documentary evidence, governance activity records, quantitative metrics, self-assessment, and independent assurance. In addition to its role in supporting organisational learning, self-report can also be used to support higher-stakes judgements through committee records, approved artefacts, risk and portfolio records, audit evidence, KPI trends, and remediation closure [10,20,25]. The 5-level implementation scale is offered as a design hypothesis and is not a validated national-scale score.

It is preferred that the initial output be a 6-dimensional profile, not a composite score. This will help to keep material weaknesses visible and not allow good performance in one area to offset weaknesses in another. Before any use of benchmarking or assurance, the weighting or thresholds and the overall index need to be empirically validated. A conceptual framework for compliance measurement is shown in Figure 3.

Figure 3. Conceptual ICT Governance Compliance Measurement Framework for the South African public-service context.

5. Discussion

5.1. From Maturity and Formal Adoption to Evidence-Based Compliance

The first contribution of the synthesis is a change in the unit and purpose of ICT-governance measurement. While maturity is still valuable for diagnosing developmental progress, sophistication is not enough to ensure conformity to all obligations applicable. Advanced governance processes can be implemented without meeting minimum material accountability, risk, procurement and reporting obligations, and minimum requirements can be met with a modest maturity level. Therefore, treating maturity as compliance could lead to construct contamination and cloudy aggregation [4,22,44]. The proposed framework rather asks whether the required governance practices are in operation, applied consistently, documented, reviewed and corrected when a deficiency is detected.

The same relationship exists between formal and substantive compliance. Regulated organisations may demonstrate committees, charters, policies and assigned responsibilities but do not necessarily demonstrate that these arrangements have an impact on decisions, allocation of accountability, limitation of behaviour or an impact on corrective action. Existing evidence from the public sector indicates that formal governance artefacts can coexist with weak governance, poor skills and uneven institutionalisation [8,9,23]. Institutional Theory helps explain this adoption-implementation gap: external pressures can encourage formal conformity, but substantive compliance requires recurring organisational practice and credible evidence of enactment [12,13].

5.2. Compliance as a Governance System Rather than a Checklist

The six dimensions are analytically separable but operationally interconnected. Functioning decision rights and accountability are necessary for strategic alignment, investment governance is achieved through strategy, risk, and monitoring, and regulatory compliance is achieved through structures, decisions, controls, and feedback spread across the other dimensions. A lack in Governance Structures and Accountability can therefore have a negative impact on risk and procurement oversight, and weak Performance Monitoring can allow for weaknesses in other areas to remain. This systemic property implies that compliance should not first and foremost be seen as compensatory.

A single weak score could mask a material weakness when balanced by strength in other areas. The six-dimensional profile, therefore, preserves visibility of where compliance is strong or weak, while leaving weighting, materiality thresholds, and non-compensatory rules to empirical validation. The conceptual framework moves from control-completion logic to systems-governance logic: the substantive compliance is determined by whether the governance practices collectively constitute a coherent, functioning and self-correcting system, rather than by the number of discrete requirements that are checked as being met.

5.3. Local Normative Primacy and International Measurement Complementarity

A distinction between normative authority and measurement utility needs to be established in the context of the layered evidence base. The public-service duties of South African public servants are based on domestic governance, policy, audit and legal structures. International frameworks can provide more advanced practices, evidence expectations, metrics, and assessment methods, but these are not necessarily normatively equivalent. The framework thus starts with local requirement, moves to international operational mechanism—local requirement is what must be adhered to, and the international mechanism helps to specify how these requirements can be adhered to, evidenced, and assessed [6,10,11,29,30,35,36,37].

This design also makes transferability easier to understand. In another jurisdiction, the South African normative anchor would be swapped for its own legal and governance frameworks, but its guiding principles of requirement mapping, capability, evidence, multidimensional compliance, and feedback would remain intact [70]. Transfer, therefore, concerns measurement logic rather than export of South African obligations or creation of a universal compliance standard.

5.4. Compliance as a Dynamic Evidentiary State and Public Value as External Validation

The evidentiary requirement is also temporal. A point-in-time discovery will not provide proof of ongoing compliance if technology, risks, organizational priorities, and requirements evolve. Monitoring, deviation detection, remediation, and reassessment are thus elements of compliance, not maturity enhancements. Repeated findings and un-actioned actions are particularly critical as they indicate that the governance system is not working to ensure conformity. This means the nature of Performance Monitoring and Continuous Improvement is a part of the closed governance cycle. The compliance score should not include public-value outcomes. There are a number of ICT governance requirements that have been linked to evidence of positive outcomes in terms of service quality, accountability, transparency, resource use, and resilience [21,24,28]; however, positive outcomes do not necessarily mean that all ICT governance requirements were met. The external placement of outcomes prevents circularity and provides a clear function to the Public Value Theory: it offers a rationale as to why substantive compliance should matter, and offers a set of criteria to test the significance of stronger compliance profiles subsequently [14,71].

5.5. Integrated Explanatory Logic

The synthesis ties together the three theoretical perspectives in a recursive explanation, not parallel labels. Governance expectations are set by institutional pressures, and they can be a catalyst for adoption; corporate-governance arrangements give authority, decision rights, accountability, and oversight [72] to help make the expectations realisable; the capability of the organisation is a precondition to whether the expectations can be made real; and evidence is needed to determine whether a substantive compliance can be shown. Governance effectiveness and public-value outcomes subsequently offer external validation, and audit results, performance information, new risks and evolving requirements help to reinforce reassessment and adaptation.

Governance authority and organisational capability → governance requirement and pressures → substantive implementation across six dimensions → evidence-based compliance profile → governance effectiveness and public-value outcomes ↺ feedback and adaptation.

This sequence is not causal in the SMLR. It is an integrative theoretical proposition for empirical testing: future studies could investigate the relationship between institutional pressures, governance arrangements and capability with substantive compliance; the association between stronger compliance profiles and the effectiveness of governance and public value; and the effect of corrective feedback on the sustainability of compliance over time.

6. Contributions and Implications

6.1. Research Contributions

On the conceptual level, the study defines ICT governance compliance as a separate, multidimensional, evidence-based construct and provides a six-dimensional vocabulary to evaluate it without mixing the concepts of capability, maturity and outcomes. In theory, it combines institutional pressures, governance authority, organisational capability, substantive implementation, evidence, outcomes, and feedback in a recursive explanatory proposition. Methodologically, the SMLR shows role-sensitive synthesis, where empirical studies identify mechanisms and relationships, where policy and standards identify requirements and practices, where audit evidence identifies observable deficiencies and assurance expectations, and where benchmarking sources inform indicator architecture. It is therefore not about “invention” of a new governance standard, but about integration.

6.2. Practical and Policy Implications

The framework provides a structured approach for self-diagnosis, evidence management, annual governance planning and remediation prioritisation for departments, CIOs and Government Information Technology Officers in strategic, structural, risk, investment, regulatory and monitoring areas. It can coordinate evidence already collected as part of strategy, committees, risk management, procurement, internal audit, performance reporting and compliance assessment, and minimise the risk of building governance evidence just in time for an audit.

The architecture can link each future measurement item to an authoritative source, evidence requirement, responsible role, evidence assessment frequency, and remediation rule for DPSA and other policy owners. It can be used in addition to statutory audit criteria for AGSA and internal audit to deliver a more comprehensive governance picture and a pathway for continuous improvement from findings. The explicit Investment and Procurement dimension combines business-case quality, portfolio prioritisation, sourcing, contract governance, vendor risk, and benefits’ realisation as governance concerns, as opposed to as downstream administrative activities in the case of National Treasury and procurement.

6.3. Roadmap for Instrument Development

The conceptual architecture is designed for instrument-development research rather than national scoring. Authoritative requirements should be first mapped to candidate items, and then the content should be expertly validated by public sector ICT executives, GITOs/CIOs, internal auditors, risk and security practitioners, procurement specialists, policy officials and assurance stakeholders to validate the content and ensure it is relevant. This should then be followed by exploratory and confirmatory factor analysis, reliability assessment, convergent and discriminant validity, and criterion validation to ensure the validity of the factors against other independent data, such as recurring audit findings, remediation performance, control quality, risk incidents, procurement performance, and selected service outcomes. It is recommended that measurement invariance be demonstrated first and weighting or an overall composite index considered only after measurement invariance has been achieved, before direct comparison across institutional types.

7. Limitations and Future Research

7.1. Limitations

The framework has been qualified by six limitations. First, it is based on a secondary source and thus does not provide psychometric validity, a causal relationship or operational feasibility for each indicator. Second, the academic literature is not uniform in terms of the terminology used, the unit of analysis, the method, and the purpose, and thus some conceptual translation was inevitable. Third, international evidence can not be used by itself in national, provincial, municipal, higher education, or state-owned contexts. Fourth, authoritative grey literature is normative or mandate-based and should not be considered as causal evidence in its own right. Lastly, as ICT governance transforms in the era of cloud sourcing, AI, digital identity, data sharing, cybersecurity risks and other third parties, this framework will need to be periodically reviewed [38,40,41,42].

The review process also has limitations. First, restricting inclusion to English-language sources may have excluded relevant evidence published in other languages. Second, Google Scholar was used as a supplementary source, and screening was limited to the first 200 results generated by the predefined search strategy, which may have reduced the retrieval of lower-ranked relevant studies. Third, the grey-literature search was targeted to selected authoritative organisations rather than designed as an exhaustive search of all possible repositories, creating potential availability and indexing bias. Fourth, 19 reports sought for full-text assessment could not be retrieved and therefore could not be evaluated for eligibility. Fifth, the relatively low initial inter-reviewer agreement for academic full-text screening reflects the interpretive difficulty of determining relevance where ICT-governance compliance or measurement was only indirectly addressed, although all disagreements were subsequently resolved against the final eligibility criteria. Finally, the abductive thematic synthesis necessarily involved interpretive judgment in coding, grouping concepts, and developing higher-order dimensions; this risk was mitigated through independent review, consensus procedures, triangulation across evidence types, and maintenance of an analytical audit trail.

7.2. Empirical Validation Agenda

Further studies should focus on content validation, scale construction, construct and criterion validation, Measurement Invariance, longitudinal measurement and controlled extension to new governance areas. Comparative research should ensure that the core indicators are consistent across all public institutions, while the context-dependent indicators are customized. For cross-country African validation, the dimensions that do not vary between different resource, institutional and regulatory contexts could be particularly valuable [22,27]. New issues, like the governance of AI, cloud governance, data ethics, digital identity, and platform governance, should be incorporated only when their empirical validation indicates that they necessitate new dimensions, and not just new indicators within existing ones, to maintain parsimony and longitudinal comparability.

8. Conclusions

This study tackles an issue that has long plagued the public sector: the governance measurement problem. Governance frameworks, maturity models, audits, and performance measures are insufficient to confirm the existence of a sustained and demonstrative implementation of the needs of good governance. The multivocal synthesis conceptualises compliance with ICT governance as a separate, multidimensional, evidence-based construct that occurs when the demands of governance become part of the functioning, monitoring and sustaining of an organisation.

The principal contribution is integration rather than another governance standard. The proposed framework links locally authoritative requirements, organisational capability, six interrelated compliance dimensions, a multi-source evidence model, and governance/public-value outcomes while keeping compliance distinct from its antecedents and consequences. South African requirements remain the normative anchor and international frameworks provide complementary operational and measurement guidance. The framework should therefore be treated as a conceptual measurement architecture for the South African public service; adaptation to other settings requires legal mapping and contextual validation, and formal scoring, benchmarking, or assurance should follow only after empirical validation.