During a governance audit, an IS auditor finds that the IT department launches new technology projects based primarily on the personal preferences of individual business unit managers. There is no formal mechanism to evaluate whether proposed investments support the enterprise's documented strategic goals, and completed projects are never reviewed against expected business benefits. Which of the following is the MOST significant concern the auditor should raise?