Ambidextrous AI Governance for Driving SmartCo’s Digital Transformation Using COBIT 2019 Traditional and DevOps

Octamevia Inkaputri  Azzahra; Rahmat  Mulyana; Taufik Nur  Adi

doi:10.59395/ijadis.v6i3.1419

Authors

Octamevia Inkaputri Azzahra Telkom University
Rahmat Mulyana Stockholm University Sweden https://orcid.org/0000-0002-5074-3916
Taufik Nur Adi Telkom University

DOI:

https://doi.org/10.59395/ijadis.v6i3.1419

Keywords:

Ambidextrous AI Governance, Digital Transformation, COBIT 2019, Design Science Research , Case Study

Abstract

Artificial Intelligence (AI) plays a vital role in accelerating digital transformation within the technology sector. This study investigates SmartCo, a technology company seeking to enhance the security and governance of AI implementation using an ambidextrous COBIT 2019 framework that integrates people, processes, and technology. The research adopts a Design Science Research (DSR) methodology, utilizing interviews, questionnaires, and internal document analysis until data saturation was achieved. Governance and Management Objectives (GMOs) were prioritized using design factors, DevOps practices, relevant regulations (ICT Minister Regulation No. 5/2021 and SOE Minister Regulation No. PER-2/MBU/03/2023), and previous studies. DSS05 (Managed Security Services) was selected as the primary focus, reflecting the organization’s priority on data protection and secure AI operations. The capability maturity assessment revealed gaps in security leadership, documentation, and process automation, indicating the need for more adaptive and integrated governance. Targeted improvements were implemented, including formalizing governance structures, enhancing security training, and adopting supportive technologies, which increased the DSS05 maturity level from 3.00 to 3.86. A comprehensive roadmap guides further enhancements in security-focused governance. This study provides practical insights for organizations aiming for secure, AI-enabled digital transformation. In addition, it contributes to the theoretical foundation of ambidextrous COBIT 2019 governance frameworks by demonstrating their application in a regulated technology environment.

1464 706

Downloads

Download data is not yet available.

Author Biography

Rahmat Mulyana, Stockholm University Sweden

Rahmat Mulyana is a PhD researcher and lecturer at the Department of Computer and Systems Sciences (DSV), Stockholm University, Sweden. His research interests include IT governance, digital transformation, IT and digital risk management, audit and assurance, enterprise architecture, and information security and privacy management.

References

[1] V. Ratten, Artificial Intelligence, Digital Trends and Globalization: Future Research Trends, FIIB Business Review, vol. 13, no. 3, pp. 286293, 2024, doi: 10.1177/23197145231222774. DOI: https://doi.org/10.1177/23197145231222774

[2] M. Kavak and L. Rusu, Challenges and Opportunities of Artificial Intelligence in Digital Transformation: A Systematic Literature Review, Procedia Comput Sci, vol. 256, pp. 369377, 2025, doi: 10.1016/j.procs.2025.02.132. DOI: https://doi.org/10.1016/j.procs.2025.02.132

[3] E. G. Andrzejak, Ai-powered digital transformation: Tools, benefits and challenges for marketers-case study of lpp, Procedia Comput Sci, vol. 219, pp. 397404, 2023, doi: 10.1016/j.procs.2023.01.305. DOI: https://doi.org/10.1016/j.procs.2023.01.305

[4] N. Stogiannos et al., AI implementation in the UK landscape: Knowledge of AI governance, perceived challenges and opportunities, and ways forward for radiographers, Radiography, vol. 30, no. 2, pp. 612621, 2024, doi: 10.1016/j.radi.2024.01.019. DOI: https://doi.org/10.1016/j.radi.2024.01.019

[5] A. Ghosh, A. Saini, and H. Barad, Artificial intelligence in governance: recent trends, risks, challenges, innovative frameworks and future directions, AI Soc, no. 0123456789, 2025, doi: 10.1007/s00146-025-02312-y. DOI: https://doi.org/10.1007/s00146-025-02312-y

[6] P. G. R. de Almeida, C. D. dos Santos, and J. S. Farias, Artificial Intelligence Regulation: a framework for governance, Ethics Inf Technol, vol. 23, no. 3, pp. 505525, 2021, doi: 10.1007/s10676-021-09593-z.

[7] OJK, Tata Kelola Kecerdasan Artifisial Perbankan Indonesia. Otoritas Jasa Keuangan, 2025.

[8] R. Mulyana, L. Rusu, and E. Perjons, IT Governance Mechanisms that Influence Digital Transformation: A Delphi Study in Indonesian Banking and Insurance Industry, Pacific Asia Conference on Information Systems (PACIS), AI-IS-ASIA, pp. 116, 2022.

[9] R. Mulyana, L. Rusu, and E. Perjons, How Hybrid IT Governance Mechanisms Influence Digital Transformation and Organizational Performance in the Banking and Insurance Industry of Indonesia, Proceedings of the 31st International Conference on Information Systems Development, 2023, doi: 10.62036/isd.2023.33. DOI: https://doi.org/10.62036/ISD.2023.33

[10] J. Zhen, Z. Xie, and K. Dong, Impact of IT governance mechanisms on organizational agility and the role of top management support and IT ambidexterity, International Journal of Accounting Information Systems, vol. 40, p. 100501, 2021, doi: 10.1016/j.accinf.2021.100501. DOI: https://doi.org/10.1016/j.accinf.2021.100501

[11] R. Mulyana, L. Rusu, and E. Perjons, Key Ambidextrous IT Governance Mechanisms Influence on Digital Transformation and Organizational Performance in Indonesian Banking and Insurance, no. July, pp. 173197, 2024, doi: 10.1007/978-3-031-57189-3_9.

[12] 2025 ISACA, Leveraging COBIT for Effective AI System, 2025.

[13] F. Febrianti and D. N. Utama, Enhancing IT maturity in the DevOps focus area: a comprehensive assessment with COBIT 2019, Edelweiss Applied Science and Technology, vol. 8, no. 4, pp. 926934, 2024, doi: 10.55214/25768484.v8i4.1472. DOI: https://doi.org/10.55214/25768484.v8i4.1472

[14] L. H. Lin and Y. L. Ho, Ambidextrous governance and alliance performance under dynamic environments: An empirical investigation of Taiwanese technology alliances, Technovation, vol. 103, no. February, p. 102240, 2021, doi: 10.1016/j.technovation.2021.102240. DOI: https://doi.org/10.1016/j.technovation.2021.102240

[15] S. Zhang and S. Suntrayuth, The Synergy of Ambidextrous Leadership, Agility, and Entrepreneurial Orientation to Achieve Sustainable AI Product Innovation, Sustainability (Switzerland) , vol. 16, no. 10, 2024, doi: 10.3390/su16104248. DOI: https://doi.org/10.3390/su16104248

[16] R. Mulyana, L. Rusu, and E. Perjons, Key ambidextrous IT governance mechanisms for successful digital transformation: A case study of Bank Rakyat Indonesia (BRI), Digital Business, vol. 4, no. 2, p. 100083, 2024, doi: 10.1016/j.digbus.2024.100083. DOI: https://doi.org/10.1016/j.digbus.2024.100083

[17] ISACA, COBIT 2019 Framework - Introduction and Methodology. 2019.

[18] G. Morris, W. Tangka, and E. Lompoliu, Optimizing IT Governance in BTS . id: A COBIT 2019-Based Analysis of Design Factors, vol. 5, no. April, pp. 699710, 2025. DOI: https://doi.org/10.57152/malcom.v5i2.1997

[19] ISACA, COBIT Focus Area: DevOps. 2021.

[20] R. B. Carvalho, A. M. P. Reis, C. L. C. Larieira, and L. H. C. Pinochet, Digital Transformation: Construct Definition Challenges and Scenarios for a Research Agenda, Revista de Administracao Mackenzie, vol. 22, no. 6, 2021, doi: 10.1590/1678-6971/eRAMD210400. DOI: https://doi.org/10.1590/1678-6971/eramd210400

[21] M. Baslyman, Digital Transformation from the Industry Perspective: Definitions, Goals, Conceptual Model, and Processes, IEEE Access, vol. 10, pp. 4296142970, 2022, doi: 10.1109/ACCESS.2022.3166937. DOI: https://doi.org/10.1109/ACCESS.2022.3166937

[22] B. A. Khamees, Information Technology Governance and Bank Performance: A Situational Approach, International Journal of Financial Studies, vol. 11, no. 1, 2023, doi: 10.3390/ijfs11010044. DOI: https://doi.org/10.3390/ijfs11010044

[23] R. Mulyana, IT Governance Influence on Digital Transformation, no. 25. 2025.

[24] A. Sharma, A. Sharma, A. Agarwal, S. Parween, A. Shrivastava, and V. Hajra, Artificial Intelligence and Business Strategy Towards Digital Transformation: A Research Agenda, Nanotechnol Percept, vol. 20, no. S6, pp. 4658, 2024, doi: 10.62441/nano-ntp.v20iS6.5. DOI: https://doi.org/10.62441/nano-ntp.v20iS6.5

[25] M. Mntymki, M. Minkkinen, T. Birkstedt, and M. Viljanen, Defining organizational AI governance, AI and Ethics, vol. 2, no. 4, pp. 603609, 2022, doi: 10.1007/s43681-022-00143-x. DOI: https://doi.org/10.1007/s43681-022-00143-x

[26] INFORMATION SYSTEM AUDIT AND CONTROL ASSOCIATION ISACA, Governance and Management Objectives. 2018.

[27] European Commission, The Assessment list for trustworthy artificial intelligence (ALTAI) for self assessment. 2020. [Online]. Available: https://ec.europa.eu/digital-single-market/en/news/assessment-list-trustworthy-artificial-intelligence-altai-self-assessment

[28] IEEE, A Vision for Prioritizing Human Well-being with Autonomous and Intelligent Systems, First Edition, IEEE Global Initiative on Ethics of Autonomous and Intelligent Systems, p. 292, 2019.

[29] R. Kremers, Artificial Intelligence, Level Design, pp. 341368, 2020, doi: 10.1201/b10933-22. DOI: https://doi.org/10.1201/b10933-22

[30] iTeh STANDARD, Governance Implications of the Use of Artificial Intelligence by Organizations, vol. 2022, 2022, [Online]. Available: www.iso.org

[31] INFORMATION SYSTEM AUDIT AND CONTROL ASSOCIATION ISACA, Governance and Management Objectives. 2018. [Online]. Available: https://www.isaca.org/resources/cobit

[32] Nist, Artificial Intelligence Risk Management NIST AI 100-1 Artificial Intelligence Risk Management, Artificial Intelligence Risk Management Framework (AI RMF 1.0), 2023. DOI: https://doi.org/10.6028/NIST.AI.100-1.jpn

[33] P. G. R. de Almeida, C. D. dos Santos, and J. S. Farias, Artificial Intelligence Regulation: a framework for governance, Ethics Inf Technol, vol. 23, no. 3, pp. 505525, 2021, doi: 10.1007/s10676-021-09593-z. DOI: https://doi.org/10.1007/s10676-021-09593-z

[34] T. Birkstedt, M. Minkkinen, A. Tandon, and M. Mntymki, AI governance: themes, knowledge gaps and future agendas, Internet Research, vol. 33, no. 7, pp. 133167, 2023, doi: 10.1108/INTR-01-2022-0042. DOI: https://doi.org/10.1108/INTR-01-2022-0042

[35] L. Schmitt, Mapping global AI governance: a nascent regime in a fragmented landscape, AI and Ethics, vol. 2, no. 2, pp. 303314, 2022, doi: 10.1007/s43681-021-00083-y. DOI: https://doi.org/10.1007/s43681-021-00083-y

[36] A. R. Hevner, S. T. March, J. Park, and S. Ram, Design science in information systems research, MIS Q, vol. 28, no. 1, pp. 75105, 2004, doi: 10.2307/25148625. DOI: https://doi.org/10.2307/25148625

[37] R. Yin, How to do Better Case Studies: (With Illustrations from 20 Exemplary Case Studies), The SAGE Handbook of Applied Social Research Methods, pp. 254282, 2014, doi: 10.4135/9781483348858.n8. DOI: https://doi.org/10.4135/9781483348858.n8

[38] V. O. Ajayi, A Review on Primary Sources of Data and Secondary Sources of Data, European Journal of Education and Pedagogy, vol. 2, no. 3, pp. 17, 2023.

[39] P. I. Fusch and L. R. Ness, Are we there yet? Data saturation in qualitative research, Qualitative Report, vol. 20, no. 9, pp. 14081416, 2015, doi: 10.46743/2160-3715/2015.2281. DOI: https://doi.org/10.46743/2160-3715/2015.2281

[40] S. Campbell et al., Purposive sampling: complex or simple? Research case examples, Journal of Research in Nursing, vol. 25, no. 8, pp. 652661, 2020, doi: 10.1177/1744987120927206. DOI: https://doi.org/10.1177/1744987120928156

[41] M. Dolczewski, Semi-structured interview for self-esteem regulation research, Acta Psychol (Amst), vol. 228, no. June, 2022, doi: 10.1016/j.actpsy.2022.103642. DOI: https://doi.org/10.1016/j.actpsy.2022.103642

[42] Peraturan Menteri BUMN RI, Peraturan Menteri Badan Usaha Milik Negara Pedoman Tata kelola dan Kegiatan Korporasi Signifikan Badan Usaha Milik Negara, Berita Negara RI, vol. No. 262, no. 262, p. 144, 2023.

[43] Kominfo, Peraturan Menteri KomIunikasi dan Informartikan Indonesia Nomor 5 Tahun 2021, Peraturan Menteri KomIunikasi dan Informartikan Indonesia Nomor 5 Tahun 2021, vol. 151, no. 2, p. 133, 2021.

[44] C. Wu, H. Zhang, and J. M. Carroll, AI Governance in Higher Education: Case Studies of Guidance at Big Ten Universities, Future Internet, vol. 16, no. 10, 2024, doi: 10.3390/fi16100354. DOI: https://doi.org/10.3390/fi16100354

[45] B. W. Wirtz, J. C. Weyerer, and B. J. Sturm, The Dark Sides of Artificial Intelligence: An Integrated AI Governance Framework for Public Administration, International Journal of Public Administration, vol. 43, no. 9, pp. 818829, 2020, doi: 10.1080/01900692.2020.1749851. DOI: https://doi.org/10.1080/01900692.2020.1749851

[46] A. Aldoseri, K. N. Al-Khalifa, and A. M. Hamouda, AI-Powered Innovation in Digital Transformation: Key Pillars and Industry Impact, Sustainability (Switzerland) , vol. 16, no. 5, 2024, doi: 10.3390/su16051790. DOI: https://doi.org/10.3390/su16051790