IT Governance Infocom India Presentation December 6, 2006 Pathfinder Technology Solutions
Agenda Why have IT Governance? What is IT Governance? Various elements of IT Governance Frameworks for IT Governance How Frameworks interact How IT processes underpin IT Governance Example of Framework integration Metrics to measure IT process health
Why Bother About IT Governance? Lack of Effective Governance Can Lead to Catastrophic Failures!! IT Readiness Decline of Business Readiness Desired Level Major Effort for Recovery Catastrophic Failure!! Time
This is not a Rhetorical Conjecture! Some Examples: Largest Asian Stock Exchange suspended trading in November, 2005 due to incorrect software patch Payroll of millions of customers of a major North American bank was affected in June, 2004 due to incorrect system update Erroneous changes to Airline Ticketing system caused hundreds of international travel tickets being sold for less than $00
IT Governance The Definition IT Governance is a system that: Directs and controls to administer necessary IT services to its clients Specifies rights and responsibilities of parties* involved Defines the policies and procedures; Provides the structure to achieve the above The above closely follows corporate governance definition outlined by OECD (Organization for Economic Cooperation and Development) located in Paris, France. * Customers, Regulators and Stakeholders
IT Governance Differing Viewpoints Three Parties & Three Areas of Interest Regulators in Regulatory Compliance Regulators are Government Agencies Customers in Effectiveness of IT Services and somewhat in Regulatory Compliance Customers are recipients of IT Services Stakeholders in Efficiency and Effectiveness of IT Services and Regulatory Compliance Stakeholders are managers and employees of an IT organization
Interest Areas of the Three Parties Efficiency Effectiveness Compliance Regulators Customers Stakeholders Efficiency, Effectiveness and Compliance are only possible through Deployment and Management of a Process Environment of Best Practices
Ef f iciency EFFECTIVENESS COMPLIANCE Gover na nce
Elements of Governance Standard against which Governance can be assessed Proven Set of Practices for the processes of an organization Compliance for government regulations Continuous Improvement to address Efficiency Governance is NOT just compliance of Government Regulations for Financial Disclosure
Frameworks impacting IT Governance The Alphabet Soup Standards Frameworks ISO (Int. Org. for Standardization) for Quality Adoption for competitive reason and is optional SOXA (Sarbanes-Oxley Act) for Compliance Regulatory requirements make adoption mandatory Compliance Framework COBIT (Control Objectives for Information and Related Technology) for Controls
Frameworks impacting IT Governance The Alphabet Soup Best Practices Frameworks CMMI (Capability Maturity Modeling Integration) for IT Development ITIL (Information Technology Infrastructure Library) for IT Infrastructure Support Continuous Improvement Framework Six Sigma
Governance Elements - Also Underpinned by Best Practices Standards Sarbanes- Oxley Act Regulatory Standard Controls & Audit Quality Standard Best Practices ITIL Continuous Improvement
Processes Underpin Governance Elements ITIL processes are necessary for ISO 20000 certification ITIL helps to provide controls for COBIT ITIL processes underpin CMMI for support and maintenance Continuous Improvement & Six Sigma is only possible through deployment of ITIL best practices ITIL Best Practices allow addressing of Effectiveness, Efficiency and Compliance
Difficulties, Inquiries Service Requests ITIL (IT Infrastructure Library) Users Communication, Updates, Workarounds Service Desk Change Requests Incidents Releases Incident Management Problem Management Change Management Release Management Configuration Management Availability Management Capacity Management Financial Management for IT Services IT Service Continuity Management Queries, Inquiries Requirements, Targets, Achievements Service Level Management The Business, Customers Communication`
ITIL and ISO - Achieving ISO 20000 Certification Benchmarking Certification Requires ISO 20000- Specification Management Overview Process Definition Requires Requires ISO 20000-2 Code of Practice ITIL IT Infrastructure Library Deployed Solutions In-House Procedures
Necessary Tasks for SOXA*. Display the Business Process 2. Define Control Objectives 3. Identify Risks (or what-can-gowrong ) in the process Compliance 4. Define specific Controls that are in place to mitigate the above Risks, and, 5. Produce Evidence to prove that the above Controls are effective ITIL Best Practices ITIL Best Practices *Sarbanes-Oxley Act enacted by US Congress in 2002
ITIL and COBIT While ITIL is about process best practice, COBIT is about control points Procedures are mapped by ITIL best practices Risks can be defined through Metrics Software tool for ITIL management provide Control Evidence and Audit Logs
Integration of Development and Support Best Practices Application Management Lifecycle Elegantly Integrates ITIL and CMMI Requirements Application Development Optimize CMMI Domain Design Operate ITIL Domain Build Service Management Deploy Source: ITIL: Application Management (2002, p.7)
ITIL and Six Sigma ITIL Best Practice allows rapid adoption No need to develop from scratch ITIL defines metrics used as Six Sigma CTQs ( y ) and also for causes ( x ) ITIL process management software tool provides data for necessary analyses Application of Six Sigma require mature environment CTQ Critical to Quality (as defined by customer)
Deployment of Frameworks Parts of Frameworks can be applied as needed and incrementally Even partial implementations of Frameworks can provide major benefits for superior Governance Business goals decide what to adopt Any Framework implementation is a major effort Strong and committed leadership is not just crucial, it is absolutely mandatory to achieve superior governance
Support Infrastructure is a Must for Deployed Frameworks Successful deployments require that the processes be: Aligned ensuring process objectives address business needs Streamlined through adoption of best practice Mapped through mapping of tasks for workflows and role assignments Verified by various organizational functions to meet their business requirements Owned by assigning formal roles for accountability Documented for consistency of implementation throughout the organization Measured to ensure that the process is effective and efficient while meeting compliance A support infrastructure essentially includes a number of formal roles such as the champions, process owners, process managers and others depending on the nature of the framework and the organization
Integration of Frameworks An Example in an ITIL Process Problem Management Process ITIL Design, Deploy & Document based on Best Practices 6s Apply Cause-and- Effect, FMEA, Stat Tools for Analyses to Determine Root Cause CMMI If Root Cause is a Design issue, Hand over to Application Development COBIT Develop What-can-Go- Wrong and Controls
Metrics Crucial to Manage Processes and Frameworks Metrics Determine Process Health or Framework Maturity 3M Principle Measure-to-Monitor-to- Manage To manage, one needs to monitor To monitor, one needs to measure ITIL Best Practices also provide relevant and well-defined Metrics for IT processes Continuous improvement is NOT possible without appropriate metrics
Outage Duration (Min.) Examples of Applying 6σ Based Traditional Chart for Outage Metrics 500 Boxplot of Monthly Outage Duration 400 300 200 00 0
Outage Duration (Min.) Examples of Applying 6σ Based Statistical Chart (Boxplot) for Outage Metrics 500 Boxplot of Monthly Outage Duration 400 300 200 00 0 05 Jan 05 Feb 05 Mar 05 Apr 05 May 05 Jun 05 Jul 05 Aug 05 Sep 05 Oct 05 Nov 05 Dec 06 Jan
Outage Time (Min.) Examples of Applying 6σ Based Traditional Outage Chart by Platform Metrics 500 Boxplot of Outage Time by Platform 400 300 200 00 0 External Internal-Mid Internal-MVS Internal-Server Internal-Other
Outage Time (Min.) Examples of Applying 6σ Based Outage Boxplot by Platform Metrics 500 Boxplot of Outage Time by Platform 400 300 200 00 0 External Internal-Mid Internal-MVS Internal-Server Internal-Other
Sample Range Sample Mean Examples of Applying 6σ Based Metrics Xbar-R Control Chart Internal Outages Xbar-R Chart of Outage Duration (Min) - All Outages Internal 300 200 00 U B=05.7 _ X=5.6 0 LB=2.5 Weeks 6 6 2 26 Sample 3 36 4 46 5 2000 500 000 500 U C L=72 _ R=360 0 LC L=0 6 6 2 26 Sample 3 36 4 46 5
Sample Range Sample Mean Examples of Applying 6σ Based Metrics Xbar-R Control Chart Int. & Ext. Outages Xbar-R Chart of Outage Duration (Min) - for Both Int & Ext 240 80 20 UB=05.7 60 _ X=5.6 0 LB=0 6 Weeks 6 2 26 Sample 3 36 4 46 5 2000 500 000 UCL=863 500 _ R=43 0 LCL=0 6 6 2 26 Sample 3 36 4 46 5
Agenda Why have IT Governance? What is IT Governance? Various elements of IT Governance Frameworks for IT Governance How Frameworks interact How IT processes underpin IT Governance Example of Framework integration Metrics to measure IT process health
Questions?