Audit analytics (AA) enables the improvement of the effectiveness and efficiency of the internal audit function (IAF). In this research, we follow Lambrecht et al.’s (2011, p.3) and define AA as “the process of identifying, gathering, validating, analyzing, and interpreting data using information and communication technology to further the purpose and mission of internal auditing”. AA is an umbrella term encompassing various forms of technology-based audit approaches, from continuous auditing to advanced machine learning. Due to the increased effectiveness and efficiency, AA enables the IAF to provide proactive and ongoing assurance services instead of periodic assessment, expand the (internal) audit service areas with the same resources, enable larger samples or even the whole population for analysis, and can provide insight and foresight for its stakeholders, in addition to the hindsight of the (possibly) already occurred risks...

Despite the recent expansion of digital lending platforms in developing countries, marginalized segments still face challenges in accessing credit. Many borrowers are excluded due to the absence of formal financial histories or insufficient profiles. Existing research primarily focuses on improving model accuracy and ensuring profitability rather than addressing inclusion. Hence, more inclusive digital lending systems are needed. Inclusion in this study refers to “the equitable access, distribution, and utilization of financial resources, ensuring that all societal segments, particularly underserved populations, can participate meaningfully in lending systems.” This definition emphasizes removing systemic challenges and fostering empowerment by enabling individuals to make informed decisions....

In the Dutch energy market, the facilitation of digital communication and information exchange is essential. From monitoring real-time data of energy supply to ensuring secure energy distribution, varying applications operate together to communicate information in the energy sector. With the advancement of quantum computing technology, security threats to cryptographic algorithms may no longer be safe. While there is a need to shift towards quantum-safe solutions, there is little knowledge about quantum-safe technology and the trajectories of the Dutch energy market in the quantum era. This research aims to explore potential trajectories in the energy sector to allow better preparation for the quantum era. The results provide insights into the stakeholder and institutional layers that may require interventions to develop quantum-safe applications in the Dutch energy market. Viewing the system as a complex system and determining target areas using a Technological Innovation System (TIS) framework, data is abstracted from an extensive literature study and interviews with experts. The functions of the TIS are used as codes to analyse the interviews. The results of the desk research, literature review and expert interviews are triangulated. These results show potential for three scenarios of the Future Energy System (FES), varying in interconnectedness and decentralisation. Scenario 1 presents a simultaneous transition across the target system, scenario 2 shows a top-to-bottom approach with priority at the highest level of Internet of Energy (IoE) and scenario 3 focuses on the security of localised energy communities with a bottom-to-top approach.

This thesis investigates the socio-technical factors influencing the use of Agile methods within project teams in local government organizations in the Netherlands, aiming to develop a practical framework to enhance Agile practices. The primary research question is: How can project teams in local governments stimulate the use of Agile methods? To answer this, the study addresses three sub-questions: (1) What team archetypes represent the typical use of Agile methods in local governments? (2) WWhat barriers and drivers towards the use of Agile methods are experienced by the teams? (3) How do different types of (Agile) team management impact the perceived performance by team members? Data was collected through qualitative methods, including interviews with team representatives of 15 teams across three local government organizations, and surveys with team members from one of these government organizations. The study categorizes teams into archetypes based on their Agile methodologies, reason to change, experience levels, and management support. Key barriers include lack of management support, lack of focus, lack of knowledge, unclear
roles, lack of alignment and organizational resistance to change. Important drivers for Agile adoption include Agile mindset, Agile coaching, dedicated key roles, dedicated management and freedom to experiment and structure. No significant difference in perceived performance was observed between team archetypes, indicating that perceived performance may be influenced by a broader range of factors beyond the scope of this study. The theoretical contribution extends the understanding of Agile adoption in public sector contexts, while the practical framework provides actionable steps for local government teams to navigate barriers and leverage drivers. Future research should broaden the scope to include diverse local government contexts, integrate quantitative data, and explore the long-term impacts of Agile practices and the application of the framework in a government, providing valuable data to inform ongoing Agile transformations in government settings.

Background: A shift in the organisation of oncology care towards collaboration between hospitals in oncology networks (CCNs) is observed to allow high-quality, accessible, and affordable care in the future. The collaborating hospitals align their care processes and design a joined regional care pathway (RCP) to standardise and structure their care. Within an RCP the patient is transferred between hospitals in the CCN, often for specialised and complex care like surgery.

Problem statement: The various disciplines and institutions involved in care delivery ask for coordination of care, clear agreements, and proper handovers of tasks. Inter-organisational collaborations within a CCN introduce new challenges (e.g. in information exchange) regarding coordination compared to multidisciplinary intra-hospital collaboration, because organisational and geographic boundaries are crossed. Unfortunately, little is known about how coordination between collaborating hospitals in a regional oncology care pathway can or should be achieved. Therefore, this thesis aims to contribute by developing a framework guiding improvements in coordination for RCPs.

Methods: A mixed-method approach was used which included a literature search and semi-structured interviews with healthcare professionals in oncology networks, policymakers, and patients. A selected conceptual framework of care coordination was adapted based on literature and each aspect within the framework was defined. Additionally, evaluation measures and improvement actions for each aspect were identified. The interviews were used to elaborate the findings from literature and incorporate the right context for RCPs. Moreover, the interviews gave insights into the experienced challenges and best practices. Lastly, the developed framework was applied in a case study.

Results: The framework for Care Coordination in Chronic and Complex Disease Management was opted as an initial conceptual framework and was extended by three additional aspects identified by other studies. The framework categorises the aspects of care coordination in domains creating an overview of the relation of each aspect in the coordination processes. The interviews resulted in two extensions of the original framework: 1) Alignment of resources and processes besides cultural alignment; and 2) leadership/coordination at the network level besides the boundary-spanning role of the case manager at the patient level. All aspects of the framework fit the RCP context, although some overlap between the aspects was identified.

Conclusion: The framework supports hospitals in improving coordination between hospitals within the RCP by offering an overview of aspects, evaluation measures and improvement possibilities. Information exchange, communication, and clear RCP protocols with defined roles and responsibilities turn out to be important aspects that facilitate coordination. These should be supported by boundary spanning actions and emergent conditions, like personal relationships and trust. Especially organising digital exchange of patient information is important for CCNs, but is still challenging to establish. A well-designed monitoring system including reminders and alerts will support coordination. However, regional dashboard development is challenged by non-structured data and differences in data structures between the hospitals. To further scale up initiatives for larger challenges and more resourceful improvement initiatives (e.g. digital exchange of EMR data), close collaboration within and between CCNs, and exchange of knowledge, tools, and best practices should be established.

Decentralized Autonomous Organizations (DAOs) are a fast-growing group of blockchain and smart contract-based applications. DAOs aim to serve new decentralized governance and organizational needs for various business purposes, ranging from decentralized exchanges such as UniSwap and theDAO, to R&D like VitADAO, managing infrastructures like Arbitrum, to charity funds like PactDAO. DAO projects have experienced an exponential growth over the past years. Although strongly rising in number, there is no clear consensus on what a DAO exactly entails. Additionally, despite this exponential growth, various DAO projects tend to pivot away from this form of governance or organization. They either experience a mismatch in the governance setup or the business objective, threatening their viability in the long-term. Also, as DAOs are built on blockchain infrastructure, this poses new governance challenges.
The goal of this thesis is to analyze how governance elements, business objectives and infrastructural choices can influence the long-term viability of DAOs. The main research objective of this PhD thesis is to:

“Develop a theory to explain how governance and infrastructure elements influence the long-term viability of decentralized autonomous organizations on public permissionless blockchains.”

In the Netherlands, there has been a growing exposure of discriminatory practices across various domains. Notable instances such as the child benefit allowance scandal (referred to as the "toeslagen affaire") and concerns surrounding student allowance (DUO) have captured public attention. These problems are not confined to public domains; instances of discrimination are also being found within the financial lending markets.

While existing research offers critical discussions, practical analyses, and technical solutions regarding discrimination, there is a lack of well-defined design principles specifically addressing discrimination challenges in financial lending in the Netherlands. This study aims to bridge the gap by providing a concrete set of design principles that architects can utilize to effectively design non-discriminatory financial lending systems, while also recognizing the potential for policymakers to draw inspiration from these principles and develop universal guidelines or other policies to address this issue more broadly.

This study combined the Design Science Research approach and Principle Based Design to derive design principles for a socio-technical topic like non-discrimination. The study started with identifying the factors contributing to financial discrimination in the lending system through desk research and 13 semi-structured interviews with a wide range of scientific experts and industry professionals. To make the concept of discrimination more applicable in the context of financial lending, the study defined specific dimensions which are differential treatment, differential outcome, unequal access, and lack of transparency. This study then identified and categorized various factors that can contribute to one or more dimensions of discrimination into six domains: regulatory, human interaction, user experience, business, data, and technical. These domains help identify the specific areas in which discrimination can arise within the lending context and how different factors may overlap across multiple domains. This also highlighted the complexity of discrimination, demonstrating that discrimination is not limited to one domain, and addressing a single factor can have cascading effects, either reducing or exacerbating discrimination across other domains.

The study proceeded to identify the challenges encountered in realizing a non-discriminatory financial lending system in the Netherlands. This was accomplished through a combination of semi-structured interviews and literature review, which led to the identification of 13
challenges. Design principles were then developed that could address those challenges in collaboration with seven business and IT architects. These principles were also evaluated in two workshops involving another group of architects. Based on the feedback received, efforts were made to improve the structure and consistency of the principles, resulting in a final set of 11 principles. To enhance clarity, the principles were rearranged and grouped into four categories: culture, governance, process, and models.

The study acknowledges that while the identified design principles can contribute to reducing discrimination in the financial lending system, they do not fully resolve the problem. This is because many discriminatory issues are deeply rooted in society. However, the principles are valuable additions to existing practices and tools, providing a framework for organizations to improve their lending practices. In addition, the involvement of regulatory authorities is essential to address discrimination in the lending system. Without regulatory incentives or oversight, organizations are not motivated to proactively implement such principles or other initiatives aimed at promoting non-discriminatory lending practices. Moreover, the design principles have the potential to be applied in other areas, such as governmental financial allowances, extending their impact beyond the financial lending system.

From smart phones to speakers and watches, Edge Al is deployed on billions of devices to process large volumes of personal data efficiently, privately and in real-time. While Edge Al applications are promising, many recent incidents of bias in Al systems caution that Edge Al too, may systematically discriminate against groups of people based on their gender, race, age, accent, nationality and other personal attributes. More so, as the physical restrictions of Edge Al, together with the complexity of its heterogeneous and decentralised operating environment pose trade-offs when deploying Al to the edge.

This thesis is motivated by the societal demand for trustworthy Al, by the propensity of Al systems to be biased, and consequently by the need to detect and mitigate bias in diverse Edge Al applications. To address this need, this thesis develops design patterns for detecting and mitigating bias in the development of Edge Al systems. The design patterns present a generalisable approach for capturing established practices to detect and mitigate bias in machine learning. They make this knowledge readily accessible to researchers and practitioners that develop Edge Al, but who have limited prior experience with detecting and mitigating bias.

Technological systems and infrastructures form the bedrock of modern society and it is system administrators (sysadmins) who configure, maintain and operate these infrastructures. More often than not, they do so behind the scenes. The work of system administration tends to be unseen and, consequently, not well known. After all, do you think of your IT help-desk when everything is working just fine? Usually, people reach out for help when something is not working as expected or when they need something. A lot of work and effort goes into ensuring that systems are working as expected most of the time and, paradoxically, this smooth functioning results in the invisibilization of the work and effort that went into it.
This PhD research focuses on system administration work and what that entails in day-to-day tasks. Instead of proposing technical and social solutions, we try to better understand the “problem” that these proposed solutions are meant to solve. Drawing from safety science research and feminist research approaches, we perform a qualitative exploration of sysadmins’ work. We center their experiences via an in-depth interview investigation and a focus group study. We identify and describe the coordination mechanisms and gender considerations embedded in their work. We shed light on care work as part of sysadmin work and the phenomenon of double invisibility that is experienced by sysadmins who are not cis men. The thesis wraps up with a set of recommendations for moving toward safe and equitable work environments for sysadmins.

This thesis applies design science to the monetary and financial system as a whole. The application of this novel methodology offers new possibilities to examine this complex system. The contribution of this thesis is threefold. First, different theories on money, banking and systemic financial crises have been researched through an extensive literature review and balance sheets. Second, those theories have been used to develop design requirements and guidelines. Finally, the consensus and pivotal dissensions about the systemic problem(s) of the current monetary and financial system, requirements and guidelines among experts have been identified through semi-structured interviews. This research process results in widely supported requirements that demarcate the design space and widely supported guidelines that aim to give direction within the design space, that is, to the future development of the monetary and financial system.

The main artifact of this research are these three guidelines:
GDG 1: Develop and gradually introduce public digital money.
GDG 2: Move the financial system towards funding based on securities offering market liquidity.
GDG 3: Move financial regulation towards transparency.

In the current digitalised society keeping assets secure is one of the most prominent challenges organisations face. In the ongoing arms race between attackers and defenders, software security patching is a well-recognised and effective strategy to mitigate vulnerabilities in software products. However, organisations struggle with the best practice to “patch early and often”, resulting in vulnerabilities in software being exposed for much longer than desired. Prior research indicates the socio-technical nature of this practice forms the core of delays in software patch management. Developing a deeper understanding of the decision-making of IT practitioners and what socio-technical factors play a role in this process allows organisations to address the ineffectiveness of their security patch process. The main research question in this explorative research is: What socio-technical factors influence the effectiveness and timeliness of the security patching process in organisations? This Mixed Methods research combines qualitative data from interviews with IT practitioners, with a quantitative data exploration of the meaningfulness of organisational measurements. Findings show that IT practitioners go through a funnel of decision-making that influences the decision of what to patch, and when to patch. The presence and interplay of different socio-technical factors related to four main aspects of this decision (i.e., security, applicability, operability, and availability) result in tensions and trade-offs influencing the decision space of IT. Furthermore, this study indicates the interrelations between the significance of socio-technical factors, which is reduced by certain coping strategies applied by IT practitioners. This research reveals that having some measurement in place helps to understand the existence of challenges and the working of coping strategies, therefore contributing to an understanding of socio-technical challenges. However, it also reveals several limitations to the quality of existing data and difficulties in coming to measurements that provide meaningful information, due to socio-technical factors. The main contribution of this research is a better understanding of how socio-technical factors influence the decision-making process of IT practitioners. This research is limited in the way it uses quantitative data to understand patching activity. Future research is recommended to compare the potential discrepancy between what IT practitioners state influences the effectiveness of their security patch process and what the actual patching activity of IT practitioners reveals about the effectiveness of patching. This research furthermore hypothesises that not all socio-technical factors have the same level of significance. It is recommended to investigate the possibilities of quantification of the importance of each of the socio-technical challenges identified in this explorative study.

The modern world is under great pressure to fight climate change and limit global temperature rises to a sustainable level. As part of new mitigation strategies, the Voluntary Carbon Market (VCM) emerged after the compliance markets materialized. Via the voluntary carbon market companies can offset their carbon emissions. The captured carbon is transformed into ’carbon credits’ representing one tonne of Greenhouse gas (GHG) emissions captured or reduced. One of the leading quality and integrity concerns is the potential double counting of credits. In a nutshell, the voluntary carbon market is based on voluntary carbon offset projects, compliance schemes require governments to report their national mitigation activities in Nationally Determined Contributions (NDC)s, and the private sector needs to report on their environment, governance, and sustainability responsibilities. Double counting occurs among these three activities when captured carbon is allocated to more than one actor. This thesis consists of an exploratory, single case study based on the blockchain solution of Acorn Rabobank. Acorn is both a project developer of carbon credits and the enabler of its own digital marketplace. The data for the case study is comprised of in-house research provided by Acorn, interview transcripts, reports, and news articles. This data is used to answer the research question: “What framework can be developed to evaluate the benefits and limitations of blockchain-based platforms to prevent double counting in the voluntary carbon market?

To answer this research question several research activities were performed. The research activities consisted of selecting and defining the case, data collection, data interpretation, and theory building. Three forms of double counting were established. To further enrich the knowledge base the stakeholder dimension was mapped based on secondary sources and empirical knowledge gained through preliminary interviews. Several mapping techniques were employed to map the interrelations between the market mechanisms and double counting.

The MLGBE framework allows carbon market actors to evaluate and, if applicable, reason about the various available blockchain-based infrastructures as tokenizing carbon credits and the digitized trading of these credits. By doing so, they can identify the stakeholder dynamics with all policies, interrelated treaties, and community plans in place, to develop or evaluate sustainable blockchain-based platforms tailored to the market to prevent double counting.

Scientifically, new theory was built through the development of the MLGBE framework. By integrating multi-level governance theory and business & governance information to the particularities of asset tokenization in blockchain applications, a new approach to evaluate blockchain designs is presented. Secondly, the research delineates the issue of double counting in the voluntary carbon market, Lastly, the research corroborates earlier findings in the logistics domain of the importance of reliability of data elements of blockchain-based applications used for audit trails.

Concerning double counting further research is recommended on the potential of blockchain solutions to link schemes together to facilitate a global carbon market, how these link to the eventual implementation of Article 6, and the potential nesting within countries’ NDCs. For
the MLGBE framework, future research should look into the interaction between the standardization/fragmentation dependent on policy layers and the different rights in the governance
requirements.

With the rise of the internet, mobile technologies, and, most crucially, e-commerce, the retail industry has changed dramatically in recent decades. Emerging digital technologies, such as information and automation, have recently made it feasible for even more types of retail business to exist. One of the key strategic themes for retail businesses in Europe, and indeed the entire world, is the digital transformation of the supply chain. However, many retail representatives have only a vague idea of the exact steps that need to be taken in the digital arena. The retail supply chain does not seem to know how to measure the actual level of its digitalisation, and it is not clear whether the current digital development of the supply chain is on a good track, thus lacking guidelines for further strategy development and investment. Previous studies have shown that Maturity Model (MM) helps enable retail companies assess their level of digitization. On the one hand, MM can help companies assess the gap between themselves and competitive benchmarks. On the other hand, it can help managers to have a more comprehensive and scientific understanding of the current digital performance of their companies. MM is a great tool for both comparison with competitors and internal optimization of companies. All in all, using MM not only helps to position an existing relationship on the maturity scale but also helps to identify areas where improvement is needed to achieve a higher maturity.

Recent advances in the field of ‘Zero Trust’ security strategies have revealed that there is still much novelty regarding the concept of Zero Trust architecture (ZTA). Zero Trust has recently gained attention as the traditional approach, based on network perimeter security, is being outplayed by sophisticated cyber attacks. This research contributes significantly to the scientific knowledge base, as ZTA is hardly investigated. Moreover, recent developments are causing the perimeter to disappear, such as increasing collaboration between companies, ecosystem connections, and working from home due to Covid-19. As a result, public and private organizations need to rethink how to protect their IT infrastructure, assets and data better.
Several organizations are willing to opt for a Zero Trust approach because of its benefits. These benefits include improved security, reduced complexity, and lower overhead and operational costs. Additionally, innovation in enterprise architecture security is urgently needed as it can reduce data breaches, decrease lateral movement, and avoid ransom payments and a company freeze.

Even though Zero Trust brings many advantages, it has not yet replaced existing perimeter-based security approaches. The complication is that many organizations struggle with the implementation of ZTA due to a lack of knowledge and clarity on how to implement the Zero Trust security strategy. Additionally, “Zero Trust” is one of the most frequently used buzzwords in cybersecurity, making it hard to distinguish an actual ZTA. Complexity and misunderstandings of Zero Trust lead to failed projects and implementations. Furthermore, ZTA implementations are complex, and a predefined one-size-fits-all approach does not exist.

Moreover, organizations willing to transform their traditional architecture to a more advanced ZTA lack guidance in their transformation. However, Zero Trust solutions are marketed by multiple vendors, including Zscalar, IBM, Microsoft, and Palo Alto. There is no clear guidance for Enterprise Architects to support organizations in the transformation to a ZTA. Thus, research is needed to investigate 1) what Zero Trust architectures are, 2) what the challenges are, and 3) what the design principles for a successful ZTA transformation are.

This research focuses on the effects of the socio-technical boundary conditions on the success of chatbot implementation in organizations. To do so, different actor perspectives on "successful implementation" are explored and 33 boundary conditions are proposed. The findings suggest that satisfying the boundary conditions has a positive effect on the success of the chatbot implementation. This indicates that the suggested boundary conditions can be used as a tool to guide future chatbot implementations. By doing so, the social and technical requirements can be ensured.

Banks have started adopting machine learning to reinvent their business functions and improve their decision-making capabilities. However, operationalizing machine learning. i.e. converting machine learning experiments into sustainable production-grade applications, remains a key challenge, which limits banks from realizing the true business value of machine learning. Despite its significance, the scholarly literature on machine learning operationalization is scant and predominantly technical. The main objective of this research is to develop a socio-technical framework, that supports the understanding and implementation of the machine learning operationalization process in the banking sector. This research combines an extensive literature study and 15 expert interviews to identify nine socio-technical factors that influence the operationalization of machine learning applications. The identified factors are then validated and applied to a real-world context through a case study analysis. The findings suggest that risk management is one of the most crucial yet challenging aspects of the process. To investigate this further, the research analyzes the socio-technical challenges of risk management and proposes four strategic guidelines to address the same. This leads to the development of a conceptual model which illustrates how factors such as shared knowledge and controls reduce the challenges of risk management and thereby support the machine learning operationalization process.

Due to the increasing amount of data processed within organizations, these organizations are increasingly experiencing shortcomings in their current monolithic data architectures and their capacity to facilitate these data operations. The particular limitations cause an increasing demand for a data architecture design that can address these limitations. A distributed and domain-oriented Data Mesh architecture promises to address the limitations of current monolithic architectures in terms of scalability, improved data accessibility, shortened lead times between operations and analytics and improved appointments of ownership and responsibility for data. These improvements are promised, based on the design of a Data Mesh architecture that is built upon the following four principles: (1) domain-oriented decentralized data ownership, (2) data as a product, (3) self-serve data platform, and (4) federated computational governance. This research focuses on the assessment of organization readiness for the migration to a Data Mesh architecture...