1.2: IT Governance

Prelim Topic

Corporate Governance

• Ethical corporate behavior by directors or others charged with governance in the creation and presentation of value for all stakeholders

• The distribution of rights and responsibilities among different participants in the corporation, such as board, managers, shareholders, and other stakeholders

• Establishment of rules to manage and report on business risks

IT Governance

• Essentially, provides a structure for aligning IT strategy with business strategy

• Comprises the body of issues addressed in considering how IT is applied within the enterprise.

Governance of Enterprise IT (GEIT)

• Is about the stewardship of IT resources on behalf of all stakeholders (internal and external) who expect their interests to be met. The board of directors responsible for this stewardship will look to management to implement the necessary systems and IT controls

• IT resources should be used responsibly, and IT-related risk should be managed appropriately

• Purpose = Ensure IT performance meets enterprise objectives and promised benefits.

IT Resource Management

• Focuses on maintaining an updated inventory of all IT resources and addresses the risk management process

Performance Management

• Focuses on ensuring that all IT resources perform as expected to deliver value to the business and also extends to identifying risk early on. This process is based on performance indicators that are optimized for value delivery and from which any deviation might lead to a materialization of risk

Compliance Management

• Focuses on implementing processes that address legal and regulatory policy and contractual compliance requirements

Strategic Alignment

(IT Governance Focus Areas)

• Focuses on ensuring the linkage of business and IT plans; defining, maintaining, and validating the IT value proposition; and aligning IT operations with enterprise operations

Value Delivery

(IT Governance Focus Areas)

• Is about executing the value proposition throughout the delivery cycle, ensuring that IT delivers the promised benefits against the strategy, concentrating on optimizing costs and proving the intrinsic value of IT

Resource Management

(IT Governance Focus Areas)

• Is about the optimal investment in, and the proper management of, critical IT resources: applications, infrastructure and people. Key issues relate to the optimization of knowledge and infrastructure

Risk Management

(IT Governance Focus Areas)

• Requires risk awareness by senior corporate officers, a clear understanding of the enterprise’s appetite for risk, understanding of compliance requirements, transparency about the significant risks to the enterprise and embedding of risk management responsibilities into the organization.

Performance Measurement

(IT Governance Focus Areas)

• Tracks and monitors strategy implementation, project completion, resource usage, process performance, and service delivery, using, for example, balanced scorecards that translate strategy into action to achieve goals measurable beyond conventional accounting.

Audit Role

• Reporting on IT governance involves auditing at the highest level in the organization and may cross division, functional or departmental boundaries

• Plays a significant role in the successful implementation of IT governance in an organization

IT Strategy Committee

• Committee should broaden its scope to include not only advice on strategy when assisting the board in its IT governance responsibilities, but also to focus on IT value, risks, and performance

• Is an industry best practice

Standard IT Balanced Scorecard

• A process management evaluation technique that can be applied to the IT governance process in assessing IT functions and processes

• Method goes beyond the traditional financial evaluation

• One of the most effective means to aid the IT strategy committee and management in achieving IT and business alignment

Information Security Governance

• Involves integrity of information, continuity of services, and protection of information asets

• Integral part of IT governance