There are a ton of things that could be said on this topic. But one basic issue is that most IT departments are built from the ground up on diametrically oppos

There are a ton of things that could be said on this topic. But one basic issue is that most IT departments are built from the ground up on diametrically opposed goals. The first being to equip the company with the tools it needs to function. And the second being to avoid any change with undue risk or opportunity for abuse. Typically IT managers' self-interest calls for a focus on the second goal. So upper management must create incentives that reward a focus on the first goal and diminish the consequences to IT when something goes amok. For situations where risk management is more critical, a separate department that can share its message and enforce policies across all departments can help reduce conflicts and allay suspicions of IT having unhelpful motives.