Maturity Models and Sustainable Indicators—A New Relationship

Abstract

This study aims to investigate the relationship between maturity models adopted by information technology companies and the sustainability indicators that are currently considered decision-making factors for investors and customers. The research is based on previous studies, Control Objectives for Information and Related Technology (COBIT), and Global Reporting Initiative (GRI) standards, and indicators of the Sustainable Development Goals (SDG) defined in 2015 by the United Nations. As a result of the intersection between the GRI and SDG indicators with COBIT requirements, a set of 50 indicators covering four dimensions of sustainability was identified. In the environmental dimension, 11 indicators were identified, in the economic dimension six indicators, in social dimension 14 indicators, and, at last, in the governance dimension, there were 19 convergent indicators between COBIT and GRI. This set of 50 proposed indicators was validated by analyzing the content of the sustainability reports available on the websites of information technology companies, making it possible to relate the sustainable practices and strategies adopted by such companies with the indicators suggested in this study. Furthermore, we identified that the SDGs are incorporated into the strategic objectives of seven of the nine companies analyzed.

1. Introduction

In a competitive and highly connected world, technology companies play a key role as providers of solutions and services [1]. As a result of the restrictions imposed by the pandemic, these companies have seen their economic value increase, almost in proportion to the pressure from stakeholders and society for greater transparency in data management, ethics, and socioenvironmental responsibility [2].

To face these pressures, the adoption of strategic and operational management models aligned with sustainability, and the establishment of measurable goals through indicators that show the materiality of the operations, have become indispensable tools [3].

Indicators are generally implemented as a measure to assess a company in relation to the quality of its services and/or products, operational or financial performance, customer, employee, or stakeholder satisfaction, and are also used to assess the level of sustainability of a company, city, or country [4]. In the field of sustainability, several indicators have been proposed, but, according to [5], the set of variables used to compose these indicators, such as the Environmental Sustainability Index (ESI), Environmental Performance Index (EPI), Adjusted Net Economy (ANS), and the Ecological Footprint, present conflicting or contradictory results.

In view of this scenario, Agenda 21 was proposed, which reinforced the need to establish indicators that allow the sustainable development of the millennium to be assessed, giving rise to the Sustainable Development Goals (SDGs) which are presented as relevant, measurable, easily communicated, accessible indicators, and with a focus on results [6]. However, the metrics proposed in Agenda 21 do not always meet corporate objectives, generating the need for a new set of indicators that assess sustainability in companies.

In the software engineering environment, the steps to determine the metrics can be oriented towards product evaluation—product inspection and quality control; process—evolution of the life cycle and management of activities at the operational level and system management—guarantee of product quality and technical information [7,8,9]. Another mechanism adopted is the maturity model that supports the development and control of processes, the optimization of established procedures, and also an improvement in product quality and the management of related activities, promoting the best use of available resources [10].

The optimization of resources can also be measured through annual or biennial sustainability and/or social responsibility reports, in which companies inform the results of their performance indicators and describe voluntary or mandatory actions to improve environmental, economic, and social performance operations [11]. This information, which started with the Corporate Social Responsibility (CSR) approach, has gained new outlines and has recently come to be known as Environmental Social and Governance (ESG) criteria, making social and environmental issues an indispensable part of companies’ strategy [2,12].

One of the most adopted models to develop the Sustainability Report in companies is the Global Reporting Initiative (GRI), which uses inventory processes as a basis for data collection. This standardized model provides an overview of an organization’s sustainable practices for investors, customers, employees, and stakeholders [11,13].

In software and information and communication technology (ICT) companies, the preparation and dissemination of sustainability reports has become a practice adopted by large companies or global organizations; however, among Brazilian micro and small software companies, which represent 95.5% of a total of 5924 companies in the sector, the dissemination of sustainable actions and practices has not yet occurred due to difficulties in implementing and measuring sustainability indicators [14,15].

Thus, this study has a main objective to develop a set of sustainable indicators that can be adopted by micro and small software companies, based on the connection between the sustainability indicators proposed by SGD and GRI, and the requirements of the COBIT maturity model. This set of indicators can help micro and small companies to assess their level of adherence to sustainability and identify points that need improvement.

After this introduction, Section 2 presents the theoretical framework that supports this study, which includes sustainable indicators, GRI, SDG, COBIT, and IT governance. Section 3 describes the research method carried out in this study. In Section 4, the analysis of sustainability indicators related to the requirements of the maturity model is presented, and the results obtained with this relationship are presented, which were based on the description of the application, of each item, of the analyzed requirements and indicators. Finally, Section 5 brings the final discussions and conclusions.

2. Materials and Methods

This study uses exploratory research as a method. For this purpose, research was carried out in the academic databases of Web of Science, IEEE, Scopus, and Google Scholar, in order to identify related works that address the theme of sustainability, COBIT maturity models, sustainable indicators in ICT, and IT governance, to compose a reliable theoretical basis, eliminating the subjectivity of researchers and providing subsidies for the elaboration of the proposed theoretical model. The updated versions of COBIT 2019, GRI-GSSB, and the SDGs and their targets were also analyzed [16,17].

Data collection performed for this study relied on electronic searches on the websites of the largest information technology companies that publish sustainability reports and adopt maturity models as one of the management and assessment tools for their operations. To analyze this dataset, the summative content analysis method was applied, which involves counting and comparisons, using the content, followed by the interpretation of the context related to the reporting patterns used [18].

3. Theorical Framework

This section aims to present the literature reviews and research that will support the proposed study, the structures used in the dissemination of sustainable practices, the goals to achieve the objectives of sustainable development, and the models of corporate maturity.

3.1. Indicators

The need to establish sustainable indicators emerged when Agenda 21 was drawn up, as it became imperative to investigate and outline the measures adopted by several countries to achieve sustainability and the well-being of the population; therefore, the use of relevant and globally applicable indicators proved to be fundamental for a global sustainability assessment [19].

An indicator can be understood as a “parameter that points out, provides information about, or describes the state of a phenomenon with relevance and importance for performance objectives”. Metrics means “a measurable amount to track one or more indicators”. In order to assess sustainability in the production process to verify material consumption, energy use, waste generation, and related manufacturing processes, indicators are created, and sustainable targets are established [20].

The sustainability indicators originally proposed by [21] were implemented in the life cycle analysis and were organized into three criteria: usability, relevance, and robustness of the related method. These indicators were grouped into hierarchical levels, starting with level 1 (sustainability footprint), level 2 (best practices), and level 3 (comprehensive assessment); building a set of indicators for assessing the sustainability of the product’s life cycle [22] proposed 16 indicators to assess the sustainability of manufacturing companies considering four dimensions—environmental, economic, social, and governance.

In the case of ICT infrastructure, energy consumption in data centers is one of the biggest costs of its operation [17]. For this reason, the establishment of goals for the management of consumption and acquisition of energy from renewable sources, the use of energy-efficient equipment, and the adoption of intelligent cooling systems led to the creation of the Silicon Valley Commission (CA-USA), which established goals for the control and management of these resources in data centers [23].

Likewise, ecological and sustainable software is designed, from the beginning, to improve the use of energy and other natural resources, whether at the stage of development, implementation, use and/or storage, promoting the analysis of the life cycle process of the software [24,25].

3.2. Sustainability Report (GRI)

The Global Sustainability Standards Board (GSSB) is the agent responsible for preparing the set of standards with which organizations provide information on environmental, economic, and social impacts, positive or negative, considering the goals of sustainable operation and sustainable development programs. Being a globally accepted and recognized model, sustainability reports generated using the Global Reporting Initiative (GRI) set of standards allow you to compare business results, highlight transparency, promote accountability for organizations, and allow external and internal stakeholders to make decisions about investments, relationships, or business partnerships [26].

In sustainability reports based on GRI standards, materiality (all “significant impacts” arising from the activities carried out by the company that might concern an expert’s community or that have been detected by causing any impact or life cycle assessments, requiring management and/or active involvement of the organization, should be reported) is the determining principle for defining which items are strategically relevant and, therefore, be part of them. It should also be noted that materiality assessments must meet the expectations expressed in the international standards and agreements established by the company [12]. In this sense, it is observed that the evolution of materiality for environmental, social, and governance (ESG) data appears as a response to investors’ expectations so that these data can be compiled, enabling financial risk assessments, in addition to materiality [27,28].

When preparing the report according to the GRI standards, companies must choose the main (core) version that contains the main elements, focusing on the process of identifying aspects (those that reflect economic, social, and environmental effects) or a comprehensive version, which, in addition to meeting the items in the essential version, adds information on strategy, analysis, governance, ethics, and integrity, in addition to reporting broadly the indicators regarding the material aspects identified [27].

3.3. Sustainable Development Goals (SDG)

The Sustainable Development Goals (SDGs) comprise the 2030 Agenda established by the United Nations Summit in September 2015, in New York (USA) with the eradication of poverty in all its forms, gender equity, aggregating them in the three dimensions of sustainability as the main focus [29]. The 2030 Agenda presents these guidelines through 17 objectives and 169 goals that address social, environmental, economic, and institutional issues, constituting a set of indicators that make it possible to monitor progress and ensure everyone’s engagement [30].

These objectives were designed to complete the Millennium Development Goals, proposed in Agenda 21, and seek to guide the actions of governments, organizations, and civil society in areas critical to humanity and the planet, involving people, the planet, prosperity, peace, and the global partnership for sustainable development [6].

The 17 objectives for sustainable development proposed by the UN Commission are as follows:

“1—End poverty in all its forms everywhere. 2—Zero Hunger. End hungers achieve food security and improved nutrition and promote sustainable agriculture. 3—Ensure a healthy life and promote well-being for all at all ages. 4—Ensure inclusive and equitable education and promote lifelong learning opportunities for all. 5—Achieve gender equality and empower all women and girls. 6—Ensure availability and sustainable management of water and sanitation for all. 7—Ensure access to affordable, reliable, sustainable, and modern energy for all. 8—Promote sustained, inclusive, and sustainable economic growth, full and productive employment, and decent work for all, 9—Build resilient infrastructure, promote sustainable and inclusive industrialization and foster innovation. 10—Reduce inequality within and among countries. 11—Make cities and human settlements inclusive, safe, resilient, and sustainable. 12—Ensure sustainable consumption and production patterns. 13—Take urgent action to combat climate change and its impacts. 14—Conserve and sustainably use the oceans, seas, and marine resources for sustainable development. 15—Protect, restore, and promote sustainable use of terrestrial ecosystems, sustainably manage forests, combat desertification, and halt and reverse land degradation and halt biodiversity loss. 16—Promote peaceful and inclusive societies for sustainable development, provide access to justice for all and build effective, accountable, and inclusive institutions at all levels. 17—Strengthen the means of implementation and revitalize the global partnership for sustainable development.”

(Obtained in 18 August 2021 from https://un.org/sustainabledevelopment/).

The adoption of the Sustainable Development Goals by the countries of South America is based on the most emerging needs, generally related to zero hunger, housing and sanitation, and emission control of greenhouse gases (GHG) arising mainly from deforestation. These countries face great difficulties in following all the objectives determined in Agenda 2030, since this Agenda considers that governments are the majority in decisions and must adapt their internal development goals to the main objectives proposed in Agenda 2030 [31].

On the other hand, Latin American companies have shown an interest in the management and disclosure of sustainability actions, especially as there is a strong tendency among investors to allocate resources to companies that disclose ESG reports [12]. It was also observed that companies with a diversified board of directors and with CEOs whose goal is sustainability, the disclosure of impact data related to ESG will be made public [12].

3.4. Maturity Models and Information Technology Governance

Among the maturity models adopted by software companies, Capability Maturity Model Integration (CMMI), Control Objectives for Information and Related Technology (COBIT), and Information Technology Infrastructure Library (ITIL) stand out [32]. They concentrate the largest adhesion of companies due to their practical application in management, control, and guidance of best practices in the software and information technology sector [33]. In publicly traded companies, since the establishment of the Sarbanes–Oxley (SOX) law, the disclosure of internal controls over activities developed internally or externally in the information technology area and the security processes involving company data have become part of the corporate governance, with COBIT as the most used model [34].

• COBIT Structure

COBIT is a model for the governance and management of a company’s information technology. It is implemented in organizations as a tool to measure the achievement of the objectives of improving the quality of the process, as well as standardizing the activities carried out and improving governance initiatives.

The structure of COBIT 2019 has two dimensions, one for governance and another for management, and 40 management objectives distributed in five domains, integrating design factors and focus areas as indicated in the COBIT guidelines, created by the Association of Control and Audit Systems Information—ISACA. In the most recent version, it also aligns the maturity levels from 0 to 5 with the CMMI, enabling the ability to execute all processes successfully and promoting the ongoing progress of IT management and governance [35].

COBIT is considered one of the most used models to manage, control, and guarantee the best practices of information technology (IT), and incorporates the standards of ISO/IEC20000, ISO/IEC 27000, and ISO/IEC 38500 and alignment with models such as ITIL and CMMI, in addition to being an important determining factor for the disclosure of information on IT governance in annual reports [36].

• IT Governance

IT governance is a set of mechanisms that control the balance of activities and the appropriate use of resources, by which leaders perform the functions of representation, regulation, service provision, and formulation of public policies, integrating the various IT actors [37,38].

Corporate governance can be described as a set of activities that include authority, control, accountability, definition of functions, and responsibilities aiming at the transparency of operations, and it requires top management to transparently disclose information and results of operations to the board, shareholders, stakeholders, and employees [39,40,41].

IT governance (ITG) can be defined as the organizational capacity exercised by the board of directors, senior managers, and IT managers in the elaboration of strategies and controls for information technology activities, so that they remain aligned with the business strategy [37,42].

The mechanisms that make up IT governance can contribute to increased organizational performance and efficiency, as they help to reduce infrastructure costs through the appropriate use of resources [39]. When the organization includes people management resources for managing IT resources (automate, computerize, transform, and infrastructure), it reveals the possibility of developing these resources with a sustainable bias [43,44].

4. Results

In this section, we present the results of the comparative analyses between the SDG indicators and GRI-GSSB items with the requirements of COBIT 2019, considering that the objective of this study is to develop a set of indicators that enable the sustainability data records of micro and small software companies. The analyses of the sustainability and/or social responsibility reports prepared and made available by nine global technology companies are presented, aiming to validate the adherence of the proposed set of indicators with the indicators used by these companies. This validation was carried out because micro and small companies do not yet practice the dissemination of their sustainable actions.

4.1. Convergence among Sustainability Indicator Standards (GRI, SDG, COBIT)

Taking, as a guideline, the 17 SDGs and the 169 related goals, a comparative content analysis was carried out to outline similarities between the SDG and the GRI-GSSB 141 report items, prioritizing the indicators used in the software industry. After the end of this comparison, the 232 requirements of COBIT 2019 were analyzed to identify the adherence of these objectives to the ODS indicators and the GRI-GSSB items, generating a set of 50 indicators and/or items.

These 50 identified indicators (see

Table 1. Convergence among GRI and SDG and COBIT2019 indicators.

Dimension Indicator	Global Reporting Initiative (GSSB)	Sustainable Development Goals (Targets Associated)	COBIT 2019 (Governance and Management Objectives)
GVN1	102-11 => Precautionary Principle or approach		EDM02.01 Establish the target investment mix; MEA02.02 Review effectiveness of business process controls.
GVN2	102-15 => Key impacts, risks, and opportunities		EDM03.01 Evaluate risk management; EDM03.02 Direct risk management.
GVN3	102-16 => Values, principles, standards, and norms of behavior	16.3 Promote the rule of law at the national and international levels and ensure equal access to justice for all.	MEA04.01 Ensure that assurance providers are independent and qualified.
GVN4	102-17 => Mechanisms for advice and concerns about ethics	16.3	MEA04.01 Ensure that assurance providers are independent and qualified.
GVN5	102-18 => Governance structure		APO01.01 Design the management system for enterprise I&T; APO01.04 Define and implement the organizational structures; EDM01.02 Direct the governance system.
GVN6	102-19 => Delegating authority		APO01.01 Design the management system for enterprise I&T; APO01.05 Establish roles and responsibilities; EDM01.01 Evaluate the governance system.
GVN7	102-21 => Consulting stakeholders on economic, environmental, and social topics	16.7 Ensure responsive, inclusive, participatory, and representative decision-making at all levels	APO02.05 Define the strategic plan and road map; APO02.06 Communicate the I&T strategy and direction; BAI01.03 Manage stakeholder engagement; EDM01.01 Evaluate the governance system.
GVN8	102-26 => Role of highest governance body in setting purpose, values, and strategy		APO01.09 Define and communicate policies and procedures.
GVN9	102-28 => Evaluating the highest governance body’s performance		EDM01.03 Monitor the governance system.
GVN10	102-29 => Identifying and managing economic, environmental, and social impacts	16.7	EDM02.01 Establish the target investment mix.
GVN11	102-30 => Effectiveness of risk management processes		APO01.11 Manage continual improvement of the I&T management system; APO12.02 Analyze risk; EDM01.03 Monitor the governance system; EDM03.02 Direct risk management.
GVN12	102-31 => Review of economic, environmental, and social topics		EDM02.03 Direct value optimization; EDM03.03 Monitor risk management; MEA03.01 Identify external compliance requirements.
GVN13	102-40 => List of stakeholder groups		MEA01.01 Establish a monitoring approach.
GVN14	102-42 => Identifying and selecting stakeholders		MEA01.01 Establish a monitoring approach.
GVN15	102-43 => Approach to stakeholder engagement		BAI11.03 Manage stakeholder engagement; MEA01.02 Set performance and conformance targets; MEA03.01 Identify external compliance requirements; EDM05.01 Evaluate stakeholder engagement and reporting requirements.
GVN16	102-44 => Key topics and concerns raised		EDM05.03 Monitor stakeholder engagement.
GVN17	103-1 => Explanation of the material topic and its Boundary		APO01.02 Communicate management objectives, direction and decisions made; EDM04.02 Direct resource management.
GVN18	103-2 => The management approach and its components		EDM04.03 Monitor resource management.
GVN19	103-3 => Evaluation of the management approach		APO01.03 Implement management processes (to support the achievement of governance and management objectives); EDM02.02 Evaluate value optimization; EDM04.01 Evaluate resource management.
ECN1	201-1 => Direct economic value generated and distributed	1.2 By 2030, reduce at least by half the proportion of men, women, and children of all ages living in poverty in all its dimensions according to national definitions. 8.1 Sustain per capita economic growth in accordance with national circumstances and, in particular, at least 7 per cent gross domestic product growth per annum in the least-developed countries. 8.2 Achieve higher levels of economic productivity through diversification, technological upgrading, and innovation, including through a focus on high-value added and labor-intensive sectors. 9.1 Develop quality, reliable, sustainable, and resilient infrastructure, including regional and transborder infrastructure, to support economic development and human well-being, with a focus on affordable and equitable access for all. 9.4 By 2030, upgrade infrastructure and retrofit industries to make them sustainable, with increased resource-use efficiency and greater adoption of clean and environmentally sound technologies and industrial processes, with all countries taking action in accordance with their respective capabilities. 9.5 Enhance scientific research, upgrade the technological capabilities of industrial sectors in all countries, in particular developing countries, including, by 2030, encouraging innovation and substantially increasing the number of research and development workers per 1 million people and public and private research and development spending.	APO06.01 Manage finance and accounting.
ECN2	201-2 => Financial implications and other risks and opportunities due to climate change	13.1 Strengthen resilience and adaptive capacity to climate-related hazards and natural disasters in all countries.	DSS01.04 Manage the environment; EDM03.01 Evaluate risk management.
ECN3	203-1 => Infrastructure investments and services supported	5.4 Recognize and value unpaid care and domestic work through the provision of public services, infrastructure. and social protection policies and the promotion of shared responsibility within the household and the family as nationally appropriate. 9.1; 9.4; 11.2 By 2030, provide access to safe, affordable, accessible, and sustainable transport systems for all, improving road safety, notably by expanding public transport, with special attention paid to the needs of those in vulnerable situations, women, children, persons with disabilities, and older persons.	APO04.02 Maintain an understanding of the enterprise environment. EDM02.02 Evaluate value optimization. EDM02.04 Monitor value optimization.
ECN4	203-2 => Significant indirect economic impacts	1.2; 1.4 By 2030, ensure that all men and women, in particular the poor and the vulnerable, have equal rights to economic resources, as well as access to basic services, ownership, and control over land and other forms of property, inheritance, natural resources, appropriate new technology, and financial services, including microfinance. 3.8 Achieve universal health coverage, including financial risk protection, access to quality essential health-care services and access to safe, effective, quality, and affordable essential medicines and vaccines for all. 8.2; 8.3 Promote development-oriented policies that support productive activities, decent job creation, entrepreneurship, creativity, and innovation, and encourage the formalization and growth of micro-, small-, and medium-sized enterprises, including through access to financial services. 8.5 By 2030, achieve full and productive employment and decent work for all women and men, including for young people and persons with disabilities, and equal pay for work of equal value.	APO04.03 Monitor and scan the technology environment; APO04.06 Monitor the implementation and use of innovation; APO12.05 Define a risk management action portfolio; DSS04.02 Maintain business resilience.
ECN5	204-1 => Proportion of spending on local suppliers	8.3	APO05.02 Evaluate and select programs to fund; APO07.06 Manage contract staff.
ECN6	207-3 => Stakeholder engagement and management of concerns related to tax	1.1 By 2030, eradicate extreme poverty for all people everywhere, currently measured as people living on less than USD 1.25 a day. 1.3 Implement nationally appropriate social protection systems and measures for all, including floors, and by 2030 achieve substantial coverage of the poor and the vulnerable. 10.4 Adopt policies, especially fiscal, wage, and social protection policies, and progressively achieve greater equality. 17.1 Strengthen domestic resource mobilization, including through international support to developing countries, to improve domestic capacity for tax and other revenue collection. 17.3 Mobilize additional financial resources for developing countries from multiple sources.	EDM05.02 Direct stakeholder engagement, communication and reporting.
EVR1	301-3 => Reclaimed products and their packaging materials	8.4 Improve, progressively, through 2030, global resource efficiency in consumption and production and endeavor to decouple economic growth from environmental degradation, in accordance with the 10-year framework of programs on sustainable consumption and production, with developed countries taking the lead. 12.2 By 2030, achieve the sustainable management and efficient use of natural resources. 12.5 By 2030, substantially reduce waste generation through prevention, reduction, recycling, and reuse.	BAI09.03 Manage the asset life cycle.
EVR2	302-1 => Energy consumption within the organization	7.2 By 2030, increase substantially the share of renewable energy in the global energy mix. 7.3 By 2030, double the global rate of improvement in energy efficiency. 8.4; 12.2; 12.5; 13.1	BAI04.01 Assess current availability, performance and capacity and create a baseline.
EVR3	302-3 => Energy intensity	7.3; 8.4; 12.2; 13.1	BAI04.02 Assess business impact; DSS01.05 Manage facilities.
EVR4	302-4 => Reduction of energy consumption	7.3; 8.4; 12.2; 13.1	BAI04.04 Monitor and review availability and capacity.
EVR5	302-5 => Reductions in energy requirements of products and services	7.3; 8.4; 12.2; 13.1	BAI04.05 Investigate and address availability, performance and capacity issues.
EVR6	303-1 => Water withdrawal by source	6.3 By 2030, improve water quality by reducing pollution, eliminating dumping, and minimizing release of hazardous chemicals and materials, halving the proportion of untreated wastewater and substantially increasing recycling and safe reuse globally. 6.4 By 2030, substantially increase water-use efficiency across all sectors and ensure sustainable withdrawals and supply of freshwater to address water scarcity and substantially reduce the number of people suffering from water scarcity. 6.A By 2030, expand international cooperation and capacity-building support to developing countries in water- and sanitation-related activities and programs, including water harvesting, desalination, water efficiency, wastewater treatment, recycling, and reuse technologies. 6.B Support and strengthen the participation of local communities in improving water and sanitation management. 12.4 By 2020, achieve the environmentally sound management of chemicals and all wastes throughout their life cycle, in accordance with agreed international frameworks, and significantly reduce their release to air, water, and soil in order to minimize their adverse impacts on human health and the environment.	BAI04.04 Monitor and review availability and capacity.
EVR7	305-2 => Energy indirect (Scope 2) GHG emissions	3.9 By 2030, substantially reduce the number of deaths and illnesses from hazardous chemicals and air, water, and soil pollution and contamination. 12.4; 13.1 14.3 Minimize and address the impacts of ocean acidification, including through enhanced scientific cooperation at all levels. 15.2 By 2020, promote the implementation of sustainable management of all types of forests, halt deforestation, restore degraded forests, and substantially increase afforestation and reforestation globally.	DSS01.05 Manage facilities.
EVR8	305-5 => Reduction of GHG emissions	13.1; 14.3; 15.2	DSS01.05 Manage facilities.
EVR9	306-1 => Waste generation and significant waste-related impacts	3.9; 6.3; 6.4; 6.6 By 2020, protect and restore water-related ecosystems, including mountains, forests, wetlands, rivers, aquifers, and lakes; 12.4; 14.1;	BAI09.03 Manage the asset life cycle.
EVR10	306-5 => Waste directed to disposal	6.6; 14.2 By 2020, sustainably manage and protect marine and coastal ecosystems to avoid significant adverse impacts, including by strengthening their resilience, and take action for their restoration in order to achieve healthy and productive oceans. 15.1 By 2020, ensure the conservation, restoration, and sustainable use of terrestrial and inland freshwater ecosystems and their services, in particular forests, wetlands, mountains, and drylands, in line with obligations under international agreements. 15.5 Take urgent and significant action to reduce the degradation of natural habitats, halt the loss of biodiversity, and, by 2020, protect and prevent the extinction of threatened species.	BAI09.03 Manage the asset life cycle.
EVR11	308-1 => New suppliers that were screened using environmental criteria		APO10.03 Manage vendor relationships and contracts.
SCL1	401-1 => New employee hires and employee turnover	5.1 End all forms of discrimination against all women and girls everywhere. 8.5; 10.3 Ensure equal opportunity and reduce inequalities of outcome, including by eliminating discriminatory laws, policies, and practices and promoting appropriate legislation, policies, and action in this regard.	APO07.01 Acquire and maintain adequate and appropriate staffing.
SCL2	402-1 => Minimum notice periods regarding operational changes	8.8 Protect labor rights and promote safe and secure working environments for all workers, including migrant workers, in particular women migrants, and those in precarious employment.	APO07.02 Identify key IT personnel; BAI05.06 Embed new approaches; BAI06.01 Evaluate, prioritize and authorize change requests.
SCL3	403-5 => Worker training on occupational health and safety	8.8	DSS01.05 Manage facilities.
SCL4	404-1 => Average hours of training per year per employee	4.3 By 2030, ensure equal access for all women and men to affordable and quality technical, vocational, and tertiary education, including university. 4.4 By 2030, substantially increase the number of youth and adults who have relevant skills, including technical and vocational skills, for employment, decent jobs, and entrepreneurship. 4.5 By 2030, eliminate gender disparities in education and ensure equal access to all levels of education and vocational training for the vulnerable, including persons with disabilities, indigenous peoples, and children in vulnerable situations. 5.1; 8.2 Achieve higher levels of economic productivity through diversification, technological upgrading, and innovation, including through a focus on high-value added and labor-intensive sectors. 8.5 By 2030, achieve full and productive employment and decent work for all women and men, including for young people and persons with disabilities, and equal pay for work of equal value. 10.3	APO01.08 Define target skills and competencies; APO07.03 Maintain the skills and competencies of personnel; DSS04.06 Conduct continuity plan training.
SCL5	404-2 => Programs for upgrading employee skills and transition assistance programs	8.2; 8.5	APO07.03 Maintain the skills and competencies of personnel.
SCL6	404-3 => Percentage of employees receiving regular performance and career development reviews	5.1; 8.5; 10.3	APO07.04 Assess and recognize/reward employee job performance.
SCL7	408-1 => Operations and suppliers at significant risk for incidents of child labor	8.7 Take immediate and effective measures to eradicate forced labor, end modern slavery and human trafficking, and secure the prohibition and elimination of the worst forms of child labor, including recruitment and use of child soldiers, and by 2025, end child labor in all its forms. 16.2 End abuse, exploitation, trafficking, and all forms of violence against and torture of children.	APO10.04 Manage vendor risk.
SCL8	409-1 => Operations and suppliers at significant risk for incidents of forced or compulsory labor	8.7	APO10.04 Manage vendor risk.
SCL9	414-1 => New suppliers that were screened using social criteria	5.2 Eliminate all forms of violence against all women and girls in the public and private spheres, including trafficking and sexual and other types of exploitation. 8.8; 16.1 Significantly reduce all forms of violence and related death rates everywhere.	APO10.03 Manage vendor relationships and contracts.
SCL10	416-2 => Incidents of noncompliance concerning the health and safety impacts of products and services	16.3	APO13.03 Monitor and review the information security management system (ISMS).
SCL11	417-1 => Requirements for product and service information and labeling	12.8	APO14.02 Define and maintain a consistent business glossary.
			DSS01.02 Manage outsourced I&T services.
SCL12	417-2 => Incidents of noncompliance concerning product and service information and labeling	16.3	DSS01.01 Perform operational procedures.
SCL13	418-1 => Substantiated complaints concerning breaches of customer privacy and losses of customer data	16.3; 16.10	APO13.01 Establish and maintain an information security management system (ISMS).
SCL14	419-1 => Noncompliance with laws and regulations in the social and economic area	16.3	MEA03.03 Confirm external compliance.

Legend: ECN: economic; EVR: environmental; GVN: governance; SCL: social.

) have similarities and/or convergence with each other, and are grouped within the four dimensions of sustainability, as shown below.

Environmental dimension = 11 indicators

• The environmental indicators, comprising water consumption, CO₂ emissions, energy consumption, use of materials, and products and services, show convergence with seven items in the COBIT structure.
• The relationship with the following objectives was also observed: ODS3—good health and well-being, ODS6—clean water and sanitation, ODS7—affordable and clean energy, ODS8—decent work and economic growth, ODS12—responsible consumption and production, ODS13—climate action, ODS14—life below water, and ODS15—life on land.

Economic dimension = six indicators

• The economic indicators prepared by the subsets economic performance, indirect impacts, purchasing practices, and products highlight the similarity of content with 13 COBIT items.
• Regarding the SDGs, it was observed that the economic aspect found convergence in the SDG1—non-poverty, SDG3—health and well-being, SDG05—gender equality, SDG8—decent work and economic growth, SDG9—industry, innovation, and infrastructure, ODS10—reduce inequalities, ODS11—sustainable cities and communities, ODS13—climate action, and ODS17—partnerships for the goals.

Social dimension = 14 indicators

• The social indicators, represented by the subset labor practices, training, products, and society, are similar to 17 items of COBIT.
• In relation to the relationship with the SDGs, adherence to the objectives SDG4—quality education, SDG5—gender equity, SDG8—decent work and economic growth, SDG10—reduction of inequality within and between countries, SDG12—responsible consumption and production, and SDG16—peace, justice, and strong institutions.

Governance = 19 indicators

• The governance indicators represented by the strategy, ethics, and risk analysis subsets have similarities with 31 COBIT items.
• When observing the relationship of these indicators with the SDGs, their adherence to SDG16—peace, justice, and strong institutions was identified.

As a result of this analysis, among the 50 converging items identified in the comparative checks between COBIT, GRI, and SDGs, there were the governance indicators with 19 items, the social indicators with 14 similar items, followed by the environmental indicators with 11 similar items, and ending with the economic indicators with six items.

Referring to the above finding, there is greater adherence of environmental and social indicators to COBIT requirements, and, at the same time, this confirms the trends of the ESG approach recently adopted by companies, which is supported by the socioenvironmental and governance indicators developed and disclosed by some data analysis companies of risk/investments such as MSCI’s Domini Social Index (DSI) and KDL400 Social Index, Morningstar’s Sustainalytics, and Bloomberg’s ESG which, monthly, release ESG risk assessments from more than 400 companies, including AT&T (Dallas, TX, USA), Dell (Austin, TX, USA), Facebook (Menlo Park, CA, USA), Google (Mountain View, CA, USA), IBM (Armonk, NY, USA), Microsoft (Redmond, WA, USA), and SAP (Walldorf, Germany).

Considering the possibilities of linking GRI reporting items, SDGs, and COBIT requirements and adopting the premise that GRI standards are adopted by software and IT companies, we sought to analyze whether sustainability in companies can be encouraged by adopting COBIT maturity models aligned with SDGs. As a result of the checklist presented above, it was found that of the 231 COBIT items, 99 belong to the APO and EDM domains, and that items in these domains total 43 of the 64 GRI and SDG indicators listed for this study.

4.2. Alignment between Corporate Sustainability Goals and SDG, COBIT, and GRI

Searches were conducted on the corporate websites of the largest global technology companies, such as Amazon (Seattle, WA, USA) [45], AT&T (Dallas, TX, USA) [46,47], Dell (Round Rock, TX, USA) [48], Equinix (Redwood City, CA, USA) [49], Facebook (Menlo Park, CA, USA) [50], Google (Mountain View, CA, USA) [51,52], IBM (Armonk, NY, USA) [53,54], Microsoft (Redmond, WA, USA) [55], Oracle (Austin, TX, USA) [56,57,58], PayPal (San Jose, CA, USA) [59], Salesforce (San Francisco, CA, USA) [60], SAP (Walldorf, Germany) [61], and Tata (Mumbai, India) [62] in order to obtain the sustainability data published by these organizations, in order to verify which indicators are used, to identify whether the sustainability indicators presented by these companies in their reports are adherent to the set of indicators developed by this study. The data obtained in the surveys and the comparison of indicators are presented in

Table 2. Alignment among corporate sustainability goals and SDG, COBIT, and GRI.

CIA	Goals and Objectives	SDGs Prioritized by Companies	Indicators Prioritized versus Proposed Indicators
AT&T	While we are focused on today’s critical issues, we are maintaining our commitments to help tackle the ongoing climate emergency. AT&T has signed agreements surpassing 1.5 gigawatts of renewable energy capacity, making us one of the largest corporate purchasers in the U.S. To enhance the resiliency of our operations, our Climate Change Analysis Tool currently helps visualize climate-related risks to network infrastructure and operations in the southeastern U.S. up to 30 years into the future, and we are making the data sets we use available to external organizations conducting their own research.	AT&T purpose, to create connection—with each other, with what people need to thrive in everyday lives, and with the stories and experiences that matter, is aligned with the UN SDGs. The SDGs chosen as the focus of AT&T are: SDG3 GOOD HEALTH and WELL-BEING and Target 3.6; SDG4 QUALITY EDUCATION and Target 4.4. SDG5 GENDER EQUALITY and Target 5.1, 5.2, and 5.5 and 5.B. SDG8 DECENT WORK and ECONOMIC GROWTH and Target 8.4, 8.5, 8.6, 8.8. SDG9 INDUSTRY, INNOVATION, and INFRASTRUCTURE with Target 9.1, 9.4. SDG11 SUSTAINABLE CITIES and COMMUNITIES with Target 11.3, 11.6. SDG13 CLIMATE ACTION with Target 13.1, 13.3. SDG16 PEACE, JUSTICE and STRONG INSTITUTIONS with Target 16.2, 16.10, 16B, and SDG17 PARTNERSHIP FOR THE GOALS with Target 17.16 and 17.17	25 items GRI not found. 30 COBIT requirements not found. 9 SDGs chosen at company.
DELL	Global Environmental Policy—At Dell Technologies, we believe that we can be most successful as a sustainability-focused company by putting technology and expertise to work where they can do the most good for people and the planet. By setting science-based targets we are ensuring our own sustainability, as well as supporting the needs of businesses in the future. Our customers need to know we have their back and can help them reduce energy use in the long term. It has been an extremely useful process to go through: to understand the challenges and the potential technical solutions, to invest in the capability to measure progress, and of course, there are cost savings: if we can reduce the energy our products use, we benefit from that.	Considering the content of the Dell company’s sustainability report, synergy with the following SDGs can be identified: SDG1-NO POVERETY; SDG3; SDG4; SDG5; SDG6-CLEAN WATER AND SANITATION (A,B); SDG7-AFFORDABLE AND CLEAN ENERGY; SDG8; SDG9; SDG10-REDUCE INEQUALITIES; SDG11; SDG12-RESPONSIBLE CONSUMPTION AND PRODUCTION; SDG13; SDG14-LIFE BELOW WATER; SDG15-LIFE ON LAND; SDG16; SDG17.	3 items GRI not found. 3 COBIT requirements not found. 16 SDGs identified.
EQUINX	To further our #InServiceTo mindset, we are committed to protecting, connecting, and powering a more sustainable digital world. We are advancing a bold sustainability agenda and have made meaningful progress across our environmental, social and governance commitments. As a digital leader, we have the opportunity to harness the power of technology in order to create a more sustainable future. At Equinix, we are committed to protecting the planet, connecting everyone to the benefits of the digital world and powering global trust and responsibility. Our corporate sustainability program is comprised of our environment, social and governance (ESG) initiatives that focus on material issues to positively impact our key stakeholders.	Equinix, along with other companies, countries, and nongovernmental organizations (NGOs), has chosen to align our objectives with the United Nations Sustainable Development Goals (UN SDGs) in order to accelerate our collective progress on the world’s most important social and environmental challenges. While all SDGs are important, we have prioritized our alignment with the six SDGs that we believe are the most material to our business. SDG5; SDG7; SDG8; SDG9; SDG10; and SDG13.	18 items GRI not found. 18 COBIT requirements not found. 6 SDGs prioritized.
IBM	IBM has a proud history of engagement with the communities where we operate, as well as societies globally. We share the priorities for social advancement that the 17 United Nations Sustainable Development Goals establish and endorse the strategy of partnership that the SDGs call for, because collaboration has long been IBM’s approach to engaging societal challenges. IBM’s efforts toward these goals can be seen in our environmental programs, supply chain practices, corporate social responsibility work, and our global focus on diversity and inclusion. We work with social organizations, governments, and commercial clients to develop many of these solutions—some of which you will find in this report, shown with the SDG that each initiative can help achieve.	Considering the content of the IBM company’s sustainability report, synergy with the following SDGs can be identified: SDG1; SDG3; SDG4; SDG5; SDG6 (a,b); SDG7; SDG8; SDG9; SDG10; SDG11; SDG12; SDG13; SDG14; SDG15; SDG16; SDG17.	all GRI items found. all COBIT requirements found. 16 SDGs identified.
MICROSOFT COMPANY	Over the past year, we built on this pledge by announcing a series of commitments to be water positive by 2030, zero waste by 2030, and to protect ecosystems by developing a Planetary Computer. We grounded our sustainability strategy and commitments in the belief that technology can help solve the world’s biggest challenges. Whenever Microsoft takes on a new and complex societal issue, we strive first to learn and then to define a principled approach to guide our efforts. In 2020, we did the same with environmental sustainability. Definition of focus areas: We focus on four areas—carbon, water, waste, and ecosystems—where we can scale, minimizing the negative impacts of our operations and maximizing the positive impacts of our technology.	We are actively engaged in supporting the UN Sustainable Development Goals (SDGs) and publicly report how Microsoft contributes to the global effort to achieve them. At Microsoft, we have also reflected on three key pillars that most of our contributions stand on: empowering people, strengthening communities, and protecting the planet. These pillars correspond most closely to the following four Global Goals: SDG4, SDG8, SDG13, and SDG16. For the Microsoft Devices segment, SGD 3, 5, 6, 7, 12, 14, and 15 are established, in addition to the SGD defined as priorities for the Microsoft Company.	11 items GRI not found. 10 COBIT requirement not found. 4 SDGs prioritized.
ORACLE	Oracle recognizes that sustainability is good business. That is why we are committed to developing practices and products that enable our customers around the world to put the planet first. Operations—Sustainability is at the heart of our business operations—from managing our use of natural resources to ensuring responsible supply chain practices and running sustainable events globally. Oracle leads the way in designing sustainable world-class events for customers, partners, developers, and employees. Oracle is also a founding signatory to the Principles for Sustainable Events. Oracle OpenWorld—our largest annual customer technology conference—follows a process based on ISO 20121:2012 event sustainability management systems. Oracle creates event sustainability action plans that prioritize the four event sustainability goals: WASTE NOT (promote zero waste); BE COOLER (Model carbon reduction and responsibility for corporate events); GIVE BACK (Catalyze legacies to benefit host destinations) and HAVE FUN (Inspire attendees through engaging sustainability experiences).	We all share one planet and are one humanity. It is a truth both simple and profound, and one that drives our sustainability efforts at Oracle. Sustainability is inherent in the way we think about and approach nearly every aspect of our business, from operational efficiency to product development to employee engagement. There is always more work to be completed, and Oracle remains committed to building a resilient future for our planet, for humanity, and for future generations. Together we are changing lives around the world, and with the growth in new disruptive technologies, including the cloud, I am more hopeful now than ever before that we can achieve the Sustainable Development Goals necessary to benefit our planet and the life it sustains—SDG2-ZERO HUNGRE; SDG3; SDG4; SDG8; SDG13; SDG17.	13 items GRI not found. 13 COBIT requirement not found.
PAYPAL	In 2019, we prioritized initiatives aligned with our mission and values and worked to integrate key ESG factors into the very fabric of our business. Throughout the year, we introduced new wellness and engagement programs for our employees, advanced our cross-sector social impact partnership strategy, expanded our capabilities to support charitable giving, advanced our thought leadership on financial health, and made further commitments to our communities and our planet. As part of our ESG materiality assessment, we also examined how our business activities and key priority areas align with the United Nations’ Sustainable Development Goals (SDGs).	Overall, PayPal makes a direct, positive contribution to 10 of the 17 SDGs, with the greatest influence on the five goals listed below. Meanwhile, we remain focused on responsibly managing our operations and supporting our communities consistent with all of the Global Goals. SDG1 (Target 1.4); SDG8 (Target 8.5); SDG9 (Target 9.3); SDG10 (Target 10.C); SDG17 (Target 17.17). SDG4; SDG5; SDG3; SDG16; SDG6; SDG7, the company makes the statement in the report, but does not set clear objectives.	35 items GRI not found. 45 COBIT requirement not found.
SAP	At SAP, our purpose is to “help the world run better and improve people’s lives” by empowering our customers to create a better economy, society, and environment for the world. In line with our purpose, we are committed to supporting the United Nations Sustainable Development Goals (UN SDGs). Technology-driven innovation underpins how SAP, together with our customers and our partner ecosystem, can execute initiatives across all 17 of the UN SDGs. Our goal is to lead the evolution of technology while also helping ensure that the focus remains on taking responsibility for its outcomes and societal effects. Examples of how we are carrying this out include the focus of social investments on building digital skills and our guiding principles for artificial intelligence and governance.	In assessing our impact on society through the SAP portfolio, our stakeholders identified seven SDGs as material: SDG9; SDG3; SDG8; SDG13; SDG17; SDG12; SDG4.	27 items GRI not found. 36 COBIT requirement not found. 6 SDG prioritized.
TATA	TCS publishes the Sustainability Report on an annual basis. The last report was published for FY 2018. The current report, for FY 2019 (year ending 31 March 2019), is the 13th such report published by TCS till date. This report has been prepared in accordance with the GRI Standards: Core option. Our responsible sourcing program motivates our suppliers to adhere to 100% regulatory compliances and strive for better sustainability performance. Our Sustainable Supply Chain policy and Green Procurement policy outline our commitment to make our supply chain more responsible and sustainable. TCS’ focus on resource use and waste reduction has led to the reduction of the consumption of the per capita paper consumption by 12.6% over the previous year and 87% over the baseline FY 2008. The success of this drive can be attributed to the awareness created among employees and the enforcement of printing discipline through automated and manual means.	Analyzing the sustainability report of TATA Consultancy Services (TCS), it was identified that the following SDGs are identified as the Company’s priority, namely: SDG1, SDG3; SDG4; SDG5; SDG6; SDG7; SDG8; SDG9; SDG11; SDG12; SDG13; SDG14.	31 items GRI not found. 39 COBIT requirement not found. 12 ODS prioritized.

.

Among the sustainability reports of the companies above, it was observed that the reports of the companies Amazon (Bellevue, DC, USA), Facebook (Cambridge, MA, USA), and Google (Menlo Park, CA, USA) did not use the GRI standard, and the report of the company Salesforce does not provide the necessary indications to carry out the comparisons, which limited the analyses, making it impossible to include these companies in the process of verifying the use of the SDGs in the composition of sustainability reports and in the corporate strategy of the companies.

It was observed that the surveyed companies established sustainability goals related to climate change, the efficient use of energy and water, in the education of employees and the community, in sustainable innovation, in gender equity, and in good labor relations (See Table 2).

The objectives of sustainable development, defined by the UN in 2015, find in the corporate environment a strong ally, as can be seen in the sustainability reports analyzed in which the following SDGs are the strategic objectives of seven of the nine companies analyzed. The prioritized objectives are: SDG3 (good health and well-being), SDG4 (quality education), SDG5 (gender equality), SDG7 (affordable and clean energy), SDG8 (decent work and economic growth), SDG9 (industries, innovation, and infrastructure), SDG13 (climate action), and SDG17 (partnership for the goals). SDG12 (responsible consumption and production) is part of the strategy of companies that produce electronic devices.

4.3. Proposed Indicators

Based on the analysis performed on the previous sections, including the identification of the sustainability indicators proposed by the GRI, SDG, and COBIT and the mapping of the sustainability goals adopted by the main IT companies aligned with GRI, SDG, and COBIT, 50 sustainability indicators were identified to be adopted by micro and small software companies. These indicators comprise the three dimensions: environmental, social, and economic, in addition to governance.

4.4. Relationship between the Sustainable Indicators in the Reviewed Reports and the One Proposed This Study

In order to evaluate the set of indicators proposed by this study, the indications of the GRI reporting items were verified, as well as the SDG indications that the companies linked to their sustainable goals, aiming to identify whether the proposed indicators are supported in the sustainability reports published by the analyzed companies. These indications are noted in the report and in indexes referenced in the reports, whenever the document uses the standard established by the GRI.

It is noteworthy that the analyses of the sustainability reports suggest that the essential report model has an average of 19 indicators adhering to the proposed model. The comprehensive model, on the other hand, has 41 of the 50 proposed indicators adhered to.

Among the proposed indicators and those reported in the analyzed essential sustainability reports, it was observed that the items related to governance have the lowest adherence, given that of the 19 proposed indicators, nine were not reported by the companies that use these standards, especially for the indicators that address governance actions aimed at sustainability.

As for the indicators related to the environmental, economic, and social dimensions, it was observed that of the six economic indicators proposed, on average, 3.75 are not included in the analyzed essential model reports. In the environmental dimension of the 11 proposed indicators, on average, six were not reported in the analyzed reports, and in the social dimension of the 14 proposed indicators, on average, 10 are not included in the analyzed reports.

At the same time, the reports that use the comprehensive model showed greater adherence to the proposed indicators, highlighting the governance indicators with 84.21% and environmental indicators with 83.64% of adherence. The social and economic indicators showed 77.14% and 80% adherence, respectively, to the set of indicators proposed by this study.

When considering the three dimensions of sustainability—environmental, economic, and social, the analyzed reports suggest that companies focus their efforts on environmental and social indicators, confirming the findings of this research that found a greater relationship between these indicators and the requirements of the COBIT maturity model. These findings are also supported by the SDG’s prioritization related to social and environmental issues reported in the verified reports.

On the other hand, considering that the set of 50 indicators proposed aims to place micro and small companies in the context of sustainability, some indicators prioritized by large companies, if adopted by micro and small companies, can lead them along the paths of sustainability. Among the governance indicators, we highlight risk management and stakeholder engagement. As for the economic aspect, the indicators are of investments in infrastructure and economic impacts and value creation. With regard to the environmental dimension, indicators of efficient use of energy, rational use of water, packaging recycling, and waste disposal lead companies towards sustainability. In the same way, social indicators related to labor relations, engagement with the community, and adoption of inclusion and diversity policies will allow these companies to align themselves with the social and environmental demands required in the global corporate scenario.

5. Discussion

The use of indicators to manage the sustainability goals established by companies and to establish sustainable standards of device production in the development of applications/software, suggested by Sage (1997) and Debreceny and Gray (2013), were identified in the analyzed reports.

Considering the SDGs and GRI reporting items, an analysis was carried out to identify their relationship with the requirements of the COBIT model, with the aim of generating a set of indicators that aggregate the three lines of corporate sustainability: environmental, economic, and social.

The result of these analyses is that the environmental and social indicators (GRI and ODS) are more adherent to the COBIT model, reinforcing the current trend of social and environmental indicators [27,28]. It was also observed that the economic indicators were less mentioned in the sustainability reports prepared and made available by the companies.

On the other hand, IT corporate governance, which permeates the sustainability aspects considered in this study, presented 19 converging items, reinforcing compliance with international rules linked to Sarbanes–Oxley’s transparency and compliance practices, as well as the definitions of the management and strategic alignment established by the GTI and adoption of the COBIT model itself, which is an efficient tool for managing activities carried out in software and information and communication technology companies.

Regarding the set of 50 proposed indicators, it was observed that they are unevenly distributed between environmental, economic, and social aspects, as described below.

• Environmental aspect → this dimension linked to the GRI items related to energy presented four items for energy, one item for manager environmental, and three items for products and services, adding up to eight COBIT requirements.
• Economic aspect → this dimension has seven items related to the economic and product aspects. One item of policies, two items of corporate environment management, one item of financial management, two items of contract management, and one of data management were verified, totaling seven COBIT requirements.
• Social aspect → Five items of the GRI social—labor relations and one item of social—society are strongly similar to eight requirements of COBIT, as shown in Table 1 of this study.

It was also observed that 29 items of governance, strategy, and engagement of stakeholders established in the GRI are following 16 requirements of the EDM dimension of COBIT, and that these comprise the analysis of the ESG indicators of the rating companies. In view of the results, it was confirmed that the proposed indicators include the three aspects of sustainability—environmental, economic, and social.

Regarding the feasibility of using the proposed set of indicators, although limited, given the number of sustainability reports analyzed, these were adequate to the current concerns of technology companies with the use of renewable energy, and sustainable productive means, considering the entire product and/or service life cycle and greenhouse gas emissions from its operations and suppliers.

At the same time, it is observed that investors have been looking for companies that have their strategy focused on the sustainability of their operations, especially those that aim to preserve and optimize the use of natural resources, control greenhouse gas emissions, and manage waste generated, as well as adopting inclusive policies in the hiring of its employees, engaging partners, suppliers, and local communities in business, and within its area of operation, generating value for society.

In this new scenario of opportunities, micro and small companies can and should take ownership of sustainable practices aiming to improve their operational performance, due to the satisfaction and engagement of their employees and partners, at the same time obtaining investments to expand their business and expand the portfolio of customers, generating value for partners, employees, and the parties involved.

6. Conclusions

This study showed the relationship between the GRI report items and the SDG sustainability indicators and requirements of the COBIT maturity model and presented, as a result of these relationships, a set of 50 indicators of similar content. The result of this comparative analysis was the identification of 26 items from COBIT, 21 items from GRI reports, 16 objectives, and 48 goals from the SDG that make up the standard essential model. In the case of the comprehensive model reports analyzed, 55 COBIT items, 41 GRI indicators, 16 objectives, and 48 SDG targets were observed when compared with the proposed set of 50 indicators.

This set was put to the test when compared to sustainability reports published by nine multinational technology companies, in which it was identified that these companies focus their efforts on indicators related to governance practices, stakeholder engagement, risk analysis and financial opportunities, investments in infrastructure, targeting for value generation, efficient use of resources such as water and energy, reduction of greenhouse gas emissions, creation of a safe, collaborative, and inclusive work environment, training of workers, management of suppliers with regard to labor relations, and sustainability. It was also identified that these companies established in their corporate goals to meet some ODS, among which stand out the ODS8 (decent work and economic growth) indicated by all companies, the ODS13 (climate action) which is the focus of eight out of nine, and ODS3 (good health and well-being) and ODS9 (industries, innovation, and infrastructure) prioritized by seven of the nine companies analyzed.

Finally, due to the limitations presented in this study, we suggest an expansion of this research, covering a larger number of companies, in order to analyze the economic, social, and environmental aspects of operations in software companies. It is also suggested to conduct research, including micro and small companies, using other methods, such as the application of electronic questionnaires and/or online interviews.