IT Governance behöver inte vara någon svår konst

Transcription

1 IT Governance behöver inte vara någon svår konst Cases & Projects 1

2 Agenda Cases: Master theses on ITG A comprehensive ITG definition ITG concerns in literature, of practitioners & in Cobit Case: Cobit implementation Current project: Cobit-based Modeling and assessment of IT organizations 2

3 ITG for Administrative Systems (AS) & Operation Support Systems (OSS) Master thesis at Vattenfall. Emma Hultgren, 2004 Findings AS IT processes better documented and formalized Lack of IT process monitoring to ensure compliance with standards and legislations OSS better at IT Governance of e.g. security, system continuity, performance and capacity issues OSS focus more on the business impact of changes to the system Possible Improvements: Documentation of procedures system level Monitoring, internal audit and metrics to support business objectives at group level Risk analysis group level 3

4 ITG at Föreningssparbanken (FSB) Master thesis by Fredrik Berg, 2005 Purpose: To benchmark existing IT management processes and review the use of performance metrics. Findings: FSB is a considerably mature organization regarding ITG Cobit simplifies legislatory compliance Monitoring and IT audits are performend in a satisfactory manner 4

5 ITG at Föreningssparbanken (FSB) 5

6 IT Direction Assessment at AcandoFrontec Master thesis by Jonas Kihlgren, 2005 Development of a framework for ITG-assessments for consultancy firms Assessment methodology verified by 31 ITG experts Result: Survey questions on ITG for different IT stakeholders ITG at SCA Master thesis by Erik Haglund, 2006 Findings: Differences in ITG maturity within different departments at SCA Ortviken. 6

7 IT Governance vs Corporate Governance Source: Weill, P., Ross, J.W. IT governance -How Top Performers Manage IT Decision Rights for Superior Results. Harvard Business School Press,

8 Generally agreed upon: IT should provide the business with correct information Using IT Resources Through IT Activities This requires governance Performance Information security Compliance Modifiability Availability Usability Data Quality Cost efficiency 8

9 Useful Support for IT Governance Implementation: Buzzword Bingo Balanced Scorecards ISO/IEC IT Infrastructure Library (ITIL) ITG is used & abused Which frameworks Internal Control provide BS7799/ISO17799 the best support, and where to start? IT Auditing Sarbanes & Oxley Act of 2002 (SOX) Risk Management Basel II Svensk Kod för Bolagsstyrning Control Objectives for IT and Related Technology A lot 9

10 Literature search on ITG Literature search ->102 academic articles Common view of IT governance (surprise): IT governance is the preparation for, making of and implementation of ITrelated decisions regarding goals, processes, people and technology on a tactical or strategic level. 10

11 Representation of IT governance as the making of IT decisions Domain Goal Technology People Scope Process Decision-making phase Tactics Strategy Monitor Decide Understand Based on analysis of 102 articles. Described in e.g. Assessment of IT Governance - A Prioritization of Cobit, Simonsson, M., Johnson, P., Proceedings of Conference of Systems Engineering Research (CSER), Los Angeles, April 7-8,

12 Domains Domain Policies IT Strategy Alignment with corporate strategy Control Objectives Infrastructure Applications Information storage, structure and use Roles Responsibilities Stakeholder groups Corporate structure Processes Activities Procedures 12

13 Phases of the Decision- Making Process Scope 13

14 Scope of IT Decision Litt prio 14

15 Literature s Prioritization ~60 sources were classified 100% IT Governance Prioritization according to Literature Priority according to literature 80% 60% 40% 20% 0% Process Goal Technology People Understand Decide Monitor Strategy Tactics Domain Decision-making Phase Scope 15

16 Practitioners Prioritization ~20 Swedish ITG experts 100% IT Governance Prioritization according to Practitioners Priority according to Practitioners 80% 60% 40% 20% 0% Process Goal Technology People Understand Decide Monitor Strategy Tactics Domain Decision-Making Phase Scope Cobit 16

17 COBIT 4.0 Released in December 2005 Control framework for IT governance Process-based 17

18 Affärsmål Möjliggör affären, maximera nyttan Kostnadseffektivt IT används förnuftigt Hantera IT-risker, följ lagar & regler Cobit Overview STYR STYRMÅL FÖLJER UPP IT-aktiviteter Plan & Organize Acquire & Implement Deliver & Support Monitor & Evaluate 34 IT processer 18

19 IT Process According to Cobit Styrmål CSF: Kritiska framgångsfaktorer Mål IT-process Möjliggörare KGI: Resultatmått CMM Processmognad KPI: Processmått 19

20 Alignment between standards Balanced Scorecards BS7799/ISO ITIL Enterprise Architecture Compliance requirements (e.g. SOX) Supported in COBIT 20

21 COBIT 4.0 s prioritization 100% IT Governance Prioritization according to Cobit 4.0 Priority according to Cobit % 60% 40% 20% 0% Process Goal Technology People Understand Decide Monitor Strategy Tactics Domain Decision-Making Phase Scope 21

22 Comparison Focus of Literature 100% 80% 60% 40% 20% Priorities according to Literature, Practitioners, and Cobit 4.0 Literature Practitioners Cobit 4.0 0% Process Goal Technology People Understand Decide Monitor Strategy Domain Decision-making Process Scope Tactics 22

23 Conclusions Domain Goal Technology People Process Decision-making phase Tactics Strategy Monitor Decide Understand Scope IT governance is prioritized differently in literature, by practitioners, and in COBIT. Practitioners: Fire extinguishing rather than monitoring and working proactively Cobit: Process based. Lacks hands-on support for establishment of decision-making structures 23

24 Case: Cobit Implementation Small company with outsourced IT operation and support organization Low end user satisfaction with provided services Unclear SLAs Unclear what was agreed upon IT operation personnel misfocus A few, but serious incidents indicated lack of control over IT processes 24

25 15 IT Processes to Monitor PO 1: Define a strategic IT plan PO 4: Define the IT processes, organization, and relationships PO 5: Manage the IT investment AI 2: Acquire and maintain application software AI 3: Acquire and maintain technology infrastructure AI 7: Install and accredit solutions and changes DS 1: Define and manage service levels DS 3: Manage performance and capacity DS 4: Ensure continuous service DS 5: Ensure systems security DS 7: Educate and train users DS 8: Manage service desk and incidents DS 9: Manage the configuration DS 11: Manage data ME 1: Monitor and evaluate IT performance 25

26 Change initiation Define Roles & Responsibilities Maturity level goals per process 2-4 performance indicators per process Action plan: Write SLAs Introduce weekly status mail, quarterly audit, regular meetings, etc 26

27 Documentation Weekly status Checklist for User Account Removal Date Revision Responsible This document was created. M. Simonsson Added list removal procedure to list M. Simonsson Activity scope Att ta bort alla behörigheter för en användare så snart hon eller han lämnat avdelningen. Input for activity Mail från Judy med information om att en exjobbare/doktor/doktorand är färdig med sin uppgift/har slutat. Följande steg ska då vidtagas. Checklist Ta bort serverkonto Ta bort mapp på servern Ta bort kort ur passersyste Om personen vars konto läggs till eller tas bort är anställd skall även EE-epost listan på webben uppdateras Quality of Service SLA Specifies the availability of the service, including maximum downtown per time unit, minimum time to repair, required performance of the service, etc. K: Kritisk tjänst IK: Icke-kritisk tjänst Tillgänglighet Oplanerade avbrott K: Maximalt fyra (4) timmar avbrott per kalendermånad IK: Maximalt åtta (8) timmar avbrott per kalendermånad Planerade avbrott K: Maximalt fyra (4) timmar per kalendermånad IK: Maximalt åtta (8) timmar per kalendermånad Antal avbrott K: Maximalt ett (1) avbrott per månad IK: Maximalt två (2) avbrott per månad Avbrottens längd K: Maximalt fyra (4) timmar per avbrott. IK: Maximalt åtta (8) timmar per avbrott. 27

28 Company X IT Governance Maturity ME 1: Monitor and evaluate IT performance DS 11: Manage data DS 9: Manage the configuration DS 8: Manage service desk and incidents DS 7: Educate and train users DS 5: Ensure systems security DS 4: Ensure continuos service DS 3: Manage performance and capacity DS 1: Define and manage service levels AI 7: Install and accredit solutions and changes AI 3: Acquire and maintain technology infrastructure AI 2: Acquire and manitain application softw are PO 5: Manage the IT investment PO 4: Define the IT processes, organisation, and relationships PO 1: Define a strategic IT plan

29 Result Better communication and understanding of costs Clearly visible goals Better support Lower cost IT service provider & consumer Improved user satisfaction with IT 29

30 Current project: IT Organization Modeling & Assessment 30

31 Questions? Working papers and publications on IT Governance and Enterprise Architecture availible at 31