IT Governance Strategy High Ground

IT Governance Vs. Compliance –
Taking Back
The Strategy High Ground
Presented by: Peter Hubbard
Pink Elephant EMEA Ltd
Think Differently. Think Pink

IT Governance Vs Compliance © Pink Elephant, 2016 All Rights Reserved.
ITIL® is a Registered Trade Mark of Axelos Ltd.
Introduction – Peter Hubbard
 Principal ITSM Consultant
 Worked in ITSM for over 20 years
 Regular speaker at industry events
 Worked in all sorts of organisations, large and small.
City of London

IT Governance
Governance is sometimes seen as ‘red tape’
Something to be worked about, or at best wished away.
IT Governance does not have to be this (and never
should be!) It helps focus the efforts of an IT department
and provides much needed clarity.
3

ITIL® is a Registered Trade Mark of Axelos Ltd. 4
What Is COBIT?
 Framework of good practices for overall IT governance
(management) and control (audit)
 Recognized worldwide
 Represents the consensus of experts
 Integrator for IT good practices
 Focus on control (what) and less on execution (how)
 Flexible – Implement COBIT according to your
organizational needs
 Public domain – ITGI (free PDF download)
 Evolves – COBIT edition 5 released 2012
According to the Institute of Internal Auditors (IIA) COBIT is one of the
most common Internal Control Frameworks and is often used to
comply with SOX requirements.

COBIT 5 Mapping Summary
Figure 25 – COBIT 5 Coverage of Other Standards and Frameworks. © 2012 ISACA. All rights reserved.
Evaluate, Direct and Monitor
Align, Plan and Organize
Build Acquire and Implement
Deliver, Service and Support
Monitor, Evaluate
and Assess
ISO/IEC 38500
ISO/IEC
27000
ISO/IEC
31000
PRINCE2/PMBOK
CMMI
ITIL V3 2011 & ISO/IEC 20000
TOGAF
5

COBIT 5 Process Reference Model
Figure 31 - COBIT 5 Process Reference Model. © 2012 ISACA. All rights reserved.
ProTip:Noonetriestodoallof
them!

IT Governance
ISO
9001:2000
ISO
27002
ISO
20000Best Practice Standards
PERFORMANCE:
Business Goals
CONFORMANCE
Basel II, Sarbanes-
Oxley Act, etc.
Drivers
Enterprise Governance COSO
Balanced
Scorecard
Where Does COBIT Fit?
QA
ProceduresProcesses and Procedures Security
Principles
ITIL
COBIT
© 2012 ISACA. All rights reserved.
7

Okay fine…COBIT is neat. Got you.
But…my strategy remember?

Figure 4 - COBIT 5 Goals Cascade Overview. © 2012 ISACA. All rights reserved.
The COBIT 5 Goals Cascade
Influences
Stakeholder Drivers
e.g. strategy changes, changing business and
regulatory environment, new technologies
Cascades to
Stakeholder Needs
Benefits
Realization
Risk
Optimization
Resource
Optimization
Enterprise Goals
IT Related Goals
Process Goals
Cascades to
Cascades to
 Translates stakeholder needs into
specific and actionable goals at every
level, and in every area, of
responsibility in the enterprise
 Allows the definition of priorities for:
 Implementation
 Improvement
 Assurance of governance of
enterprise IT
based on the strategic objectives of
the enterprise and the related risk
 Clearly identifies and communicates
how (sometimes very operational)
enablers are important to achieve
enterprise goals
9

Mapping Stakeholder Needs And
Enterprise Goals
Excerpt from Figure 24 - Mapping COBIT 5 Enterprise Goals to Governance and Management Questions. © 2012 ISACA. All rights reserved.

COBIT 5 Enterprise Goals
Figure 5 - COBIT 5 Enterprise Goals. © 2012 ISACA. All rights reserved.
11

COBIT 5 IT-Related Goals
Figure 6 - COBIT 5 IT-Related Goals. © 2012 ISACA. All rights reserved.
12

Mapping Enterprise To IT-Related Goals
Excerpt from Figure 24 - Mapping COBIT 5 Enterprise Goals to IT-related Goals. © 2012 ISACA. All rights reserved.

Mapping IT-Related Goals To IT-Related
Processes
Excerpt from Figure 23 - Mapping COBIT 5 IT-related Goals to Processes. © 2012 ISACA. All rights reserved.
14
Primary
Process:
BAI06 Manage
Change

BAI06: Description & Purpose

BAI06 : Goals & Metrics
16

BAI06: RACI
17

BAI06: Process Practices, Inputs/Outputs & Activities
Evaluate, Prioritise and authorise change requests (BAI06.01)
18

An Example: Linkage Of Goals
Business goal no. 04:
Compliance with External Laws and Regs
IT goal no. 02: IT compliance & support
For business compliance with ext….
COBIT IT processes:
EDM01 Ensure Governance Setting
BAI06 Manage Changes
KPIS:
Number of business
Disruptions due to IT
Incidents.

The Continual Service Improvement
Approach
What is the Vision?
Service & Process
Improvement
Measurable Targets
Baseline
Assessments
Where do we want to
be?
How do we get there?
Did we get there?
Measurements &
Metrics
Business Vision,
mission, goals and
objectives
Where are we now?
How do we keep
the momentum
going?
© Crown copyright 2007 Reproduced under license from OGC. Figure 3.2 Continual Service Improvement, page 30

An IT Service Management Initiative
 Establish IT Governance to align
with business strategy
 Determine IT processes to improve
that underpin business strategy
 Assess IT processes for current state
 Determine IT process future state
 Build process improvements
 Measure success
 Measure process integration points
 Build for improvements and maintenance
What is the Vision?
Where are we now?

 Measure success
Where do we want
to be?

 Measure success
How do we get
there?

 Measure success
Did we get there?

Let me see if I get this right…..

To recap
 You can use COBIT 5 to work out what your
stakeholders (Internal & External) are likely to want
your organisation to want to do.
 You can then map those needs to Business Goals.
 Those Business Goals map to IT Goals
 Those IT Goals map to IT Processes
 Those processes contain activities, outputs, roles, and
suggested KPIs.
 You can VERY quickly create a straw man to begin you
conversation with the business. NOTE: Using COBIT
enhances strategy alignment. It does NOT replace it!
26

But does it work in the real world?
 A mid size Financial Services Firm
 Had de-merged from its parent company recently and
was facing its first external compliance audit in the
Autumn. (Approx. 7 months away)
 Passing the audit was a major strategic objective for
the board
 IT had to demonstrate HOW they would prepare to
meet the audit.
 IT used COBIT 5 as an approach to prepare
themselves and ensure successful assessment took
place
27

Step 1 – Stakeholder Needs to Business Goals
Business Goal Number of times it supported a
stakeholder need identified to
be of primary importance
Outcome
Business Goal 4:- Compliance with External
Laws and Regulations
4 In Scope
Business Goal 7:- Business Service
Continuity and availability
4 In Scope
Business Goal 15:- Compliance with Internal
policies
6 In Scope
Business Goal 2: Portfolio of Competitive
products and services
3 Out of scope
Business Goal 9: Information based strategic
decision making
3 Out of scope
28
Primary: Needed to meet the requirements of the audit
Secondary: Of interest in structurally arranging the IT department after
the audit
Utilising this approach, and limiting themselves to only 3 possible goals to
be taken forwards the following business goals were selected.

Step 2 – Business Goals to IT Goals
 Utilising these 3
business goals a
mapping exercise
was undertaken
to establish the
top 3 IT goals
that would
support the
business goals
 Primary = 3
points
 Secondary = 1
point
29
IT Goal Number of
Points
Outcome
IT Goal 2: IT compliance and support for
business compliance with external laws and
regulations
6 In Scope
IT Goal 4:- Managing IT related business risk 5 In Scope
IT Goal 10: Security of Information,
processing infrastructure and applications
9 In Scope
IT Goal 15: Compliance with internal policies 4 Out of scope

Step 3- IT Goals to Processes
30
Elapsed Time: 2 day workshop

Step 4 – Focussed Maturity Assessment
31
Elapsed Time: 2 week assessment
spread over a month

Consequence Of Capability Gaps
Capability Level
Where Gap Occurs
Nature Of
Consequence
Seriousness
Of
Consequence
1 - Performed Process
Missing Work Products
Process Outcomes not achieved
2 - Managed Process
Cost or time overruns
Unpredictable quality
3 - Established Process
Inconsistent process performance
across organization
4 - Predictable Process
Inability to quantify performance or
detect problems early
5 - Optimizing Process
Inability to achieve or evaluate
process improvements
Lowest
Highest
32

Step 5 – Improvement Program
 Suppliers Engaged with. Requirements for maturity
mapped out
 Information Security Manager recruited and formal
process designed and implemented
 The focus of the IT department changed from relying
on individual experts to embedding the required
processes and skills within the organisation supported
by good corporate governance.
 The external audit was passed. Although
weaknesses remained the auditors were happy that
they were understood and proper actions were being
deployed to mitigate risks.
33
Elapsed Time: 5 months to address
the issues

Questions?
p.hubbard@pinkelephant.co.uk
info@pinkelephant.co.uk
www.pinkelephant.co.uk
34
Follow us:

IT Governance Strategy High Ground

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (7)

Similar to IT Governance Strategy High Ground

Similar to IT Governance Strategy High Ground (20)

Recently uploaded

Recently uploaded (16)

IT Governance Strategy High Ground