Step 1The first step in performing an IT audit that is tied to b.docx

Step 1
The first step in performing an IT audit that is tied to business
strategy is understanding the short-term and long-term goals
and objectives of the business. While we expect IT strategies to
be aligned to an organization's business strategies, in practice,
this is not easy to achieve. The organization typically has made
large investments in legacy systems that have been supporting
the current business. The organization must balance the
maintenance of current business requirements with the need to
support longer term strategies, using emerging technologies to
improve the competitiveness of the organization.
Completing this business audit will ensure that you learn a lot
about the business of the organization.
To prepare for the audit, read Audits, Internal and Core
Competencies. The templates provided for Step 1 will give you
a framework for collecting this information. Be sure to ask the
following questions:
· What are the strategic goals of the organization?
· What are the business operational goals?
· How do you see your organization in one year, in five years,
and beyond?
Download and open
the Templates_for_Project2_with_Instructions.xlsx file. You
will be using this file throughout this project. For optional
feedback in Steps 1 and 3, use the following naming protocols:
· Step 1 -> Lastname_first name_Project 2_Appx_A1_A2_B_C
· Steps 2 and 3 -> Lastname_first name_Project
2_Appx_A1_A2_B_C_D_E_F
For the final submission in this project, please use the following
naming protocol:
· Step 5 -> Lastname_first name_Project
2_Appx_A1_A2_B_C_D_E_F_G_H_I
The templates for business objectives in Appendices A1 and A2
will guide your discovery. You should list a minimum of three

business objectives that exist for your organization, which will
likely vary from these templates. Existing entries in templates
A1 and A2 are for illustration purposes only. You should fill in
and submit to the assignment folder two tables: Appendix A1 is
for short-term goals (one year) and Appendix A2 is for longer
term goals (five or more years). See Goal Setting for more
information.
After you understand your organization's business objectives,
you will need to evaluate how well your organization is meeting
those objectives. The template in Appendix B will guide you
through a quick analysis of overall organizational effectiveness.
You may want to ask those in leadership positions how well the
organization is performing, but you can also get this
information by examining how well the organization is
performing according to current operational objectives. Choose
a minimum of three organizational effectiveness criteria.
Provide a one-sentence description of each measure, along with
an overall score on a five-point scale and an explanation of the
score you provided. See Effectiveness and Efficiency.
Now that you've looked at how well the overall organization is
performing, you should evaluate the organization at a lower
level. Using the Appendix C template to guide you, assess the
general well-being of any two departments in your organization
(for example, finance and marketing). Again, provide
explanation for any key issues for areas where there are less
effective or very effective departments. This information may
help you to see areas where opportunities exist to improve your
business with technology.
To summarize what you have found during your assessment of
the business, prepare a two-page summary of the business
objectives and the level of effectiveness in your organization.
This business objectives and effectiveness summary should
address the following questions:
· What are some short-term and long-term business objectives
of your organization?
· What is your evaluation of overall organizational

effectiveness? Departmental level effectiveness?
Post your business assessment worksheets (Appendices A1, A2,
B, and C) along with your two-page summary of business
objectives and effectiveness to your assignment folder. Your
instructor will review your work and inform you of any major
weaknesses in your deliverable.
In the next step, you will evaluate the ability of IT to meet the
business objectives identified in Step 1.
Step 2
In Step 1, you looked at the state of business. Now in Step 2,
you will evaluate the ability of IT to meet business objectives.
You should review Technology in Businessand Technology
Resources before moving on to Appendix D and E.
Conduct an inventory of the technology being used in your
organization. The technology inventory, Appendix D, provides a
structured format for identifying various technologies and their
business functions. In this step, you are merely identifying the
various types of technology that exist in your organization and
their purpose in the organization as they relate to business
functions.
Next, you will evaluate the technology for its ability to meet
current and future business needs. Does your organization use
software for customer relationship management (CRM)? For
inventory management? For employee training? What have you
learned from this assessment? Review Capabilities of IT
Systems and Measuring IT Effectiveness before you continue.
Many of the technologies found in organizations are
implemented to meet the needs of specific business functions.
Often, they are not evaluated for their impact on the
organization’s overall strategic business objectives. Use the
information technology assessment worksheet, Appendix E, to
document the overall state of technology in your organization.
Some of the cells in the worksheet are filled in as examples.

Please delete the examples before starting your work so that you
begin with a blank template. Assess two or three of the most
critical business functions as you identify and list the
capabilities and problems or gaps that exist, being precise in
your description of how each business information system
contributes to the overall efficiency or performance of the
business function. You will use the following five questions to
guide your assessment:
· What technologies are responsible for the operation and
success of the organization?
· What is the organizational structure and where does IT reside
in this structure?
· Are there obvious areas where existing technology is not
meeting the current business needs of your organization?
· Are there inefficiencies or redundant systems?
· Are there potential vulnerabilities in the existing systems that
could impact operations in the short term? What about in the
long term?
See Identifying Applications of Current and Potential
Technologies before continuing.
Next, write a detailed assessment of the ability of technology to
support key business functions in the organization. Your two-to-
three-page technology assessment write-up will consist of one
or two paragraphs to address each of the five questions above at
the end of Week 2. Post this along with your technology
assessment worksheets (Appendices D and E) to your
assignment folder. Your instructor will review your work and
inform you of any major weaknesses in your deliverable.
In the next step, you will complete a business process risk
assessment for your organization.
Step 3
In Step 2, you looked at your organization's business processes
and the technology that supports them. Some opportunities for
improvement should now be apparent. Every organization has

limited resources to invest, and so it is important to prioritize
the problem areas that you identified. One way to prioritize
issues is by their potential impact to key organizational
business processes. You will do this by conducting a risk
assessment. A risk assessment can be used as a tool for
identifying and quantifying the factors that have the potential to
impact critical business goals. See Business Process Risk
Assessment.
A risk assessment exercise typically requires several steps:
identification of the business risks, assessment of the likelihood
and impact of the risk, and the identification of mitigation
strategies to control the risks. See Business Risk Mitigation to
get more details.
Use the risk assessment worksheet, Appendix F, to list and rate
the business risks as to the relative consequences and the
likelihood of not meeting business objectives. If there is an
existing work-around or mitigation strategy that reduces the
seriousness of the risk, please make a note. A mitigation
strategy may involve a process work-around, realignment of
resources or an investment in IT infrastructure. You might also
want to review the risk matrix in Appendix G, for additional
information on performing your risk assessment.
You will now use the risk assessment and level of risk you
determined through your risk analysis to prioritize the
organization's business risks. The risks that pose realistic and
severe threats to the business will typically have the highest
priority. However, mitigation efforts should be considered as
you make your list of priorities. The organization may not view
a risk as a high priority if they have an acceptable mitigation
strategy in place. Post the risk assessment (Appendix F) in your
assignment folder by the end of Week 2.
In the next step, you will familiarize yourself with emerging
technologies in preparation for making recommendations to the
CEO.
Step 4

Now that you have assessed your organization's current
technology inventory and assessed your organization's risk
factors, you are ready to review emerging technologies that may
benefit your organization.
In almost every aspect of business, technologies have been
transforming the way that we do business, improving the
productivity and efficiency of organizations across all sectors.
Point-of-sale systems are now used by most major retailers and
computers are used to manage sales, inventory, employees, and
communication. Technology is evolving and new technologies
are being introduced all that time that have the potential to
improve the competitiveness of organizations. The following are
some of the emerging technologies that you should become
familiar with before you make your report to the CEO:
· mobile devices
· social media
· cloud computing
· data analytics (big data)
· digital tools (3D printing, wearables, internet of things, etc.)
· virtual and augmented reality
· machine learning and artificial intelligence
You are not limited to the emerging technologies in this list; be
sure to consider other technologies you have learned about in
your research or from other sources. When you have completed
your review of emerging technologies, you are ready continue to
the next step, in which you will evaluate these technologies and
determine if they might be useful for your organization.
Step 5
Every organization is unique when it comes to assessing how
beneficial the implementation of one technology is over
another. Many technologies have failed to live up to the
potential benefits that were expected from their implementation,
so you will want to look at several factors as you proceed
through your analysis. Below are some specific questions to
consider when identifying emerging technologies that have the

potential to impact critical business functions in your
organization.
· Can it lower the cost of maintaining your legacy systems?
· Will it enable your organization to improve business
processes?
· Will it improve interoperability of systems?
· Will it simplify or standardize IT interfaces?
· Does it define new computing or communication standards?
· Can this technology be used to reengineer a mission critical
business process?
· Will employees see it as a solution to their problem?
· Is the organization prepared to deliver any required training
on the new system?
Be sure to read Technology
Solution
Implementation before you continue with this step.
Indicate which two emerging technologies you would
recommend that your organization implement. As you evaluate
the new technologies, you will choose two that you believe have
great opportunity to add value to your organization and
organizational business processes. Replacing or integrating
critical legacy information systems can be costly to the
organization and may put the organization at risk, therefore you
should evaluate these suggestions carefully. Fill out the
emerging technology templates (Appendix H and I). These
templates will help you capture the pertinent factors regarding
implementation of new technologies in your organization. For

assistance for estimating costs of new technology see Cost
Estimating.
When you have finished evaluating emerging technologies,
continue to the next step, in which you will present your
complete technology audit report.
Step 6
Now that you have a full understanding of the gaps and
opportunities presented by current and future technologies,
prepare an executive-level brief (or technology audit report) of
no more than 2800 - 3000 words, which communicates the
current state of information technology in your organization.
Discuss whether or not existing technologies help your
organization meet business objectives as well as the impact that
these technologies may have on your organization's business
model. Ultimately, if accepted, your recommendations would be
documented in a technology plan or technology roadmap.
See Technology Roadmap for help on this step.
Description
Week Due
· Appendices A1, A2, B, and C
· Two-page summary of business in your organization
End of Week 1
· Appendices D, E, and F
· Two-to-three page Technology Assessment Write-up

End of Week 2
· Appendices H and I
· Technology Audit Report (2800 – 3000 words; use the
following naming protocol: Lastname_first name_Project 2)
Week 3
Appendix A1Business ObjectivesObjectiveTimeframe: one year
goalsProfitexample: Increase profit by 8%Products and
Servicesexample: Post comparable products list on
websiteProductionexample: Begin label making in-
houseCustomer SatisfactionEmployee RetentionGrowthChange
ManagementMarketingNew ClientsQualityService
LevelDonation LevelCommunity RelationsResearch and
DevelopmentInnovationGlobalizationBrand
RecognitionCorporate ImageSupply ChainFundingInformation
TechnologyTrainingexample: Offer Label making training
Instructions for Appendix A (A1 A2): Business Objectives
Each organization will have its own business objectives,
although many look similar. However, for-profit organizations
will likely differ in their objectives than educational entities or
non-profits. Business objectives may be written as a verb,
"Increase Profit" or "Increase Service Level", or may only
identify the business area, "Profit" or "Service Level" as the

goal statements typically define the direction and scope of the
activity, ie., "increase profit by 5% in next 12 months", or
"provide all new clients job training classes".
You must identify a minimum of three objectives and at least
one goal for each objective for each of the two timeframes
identified in Appendix A1 and A2. If your organization uses
different timeframes, then you may change the timeframes from
the templates to your actual planning phases, but please ensure
that you have near term and long term goals. The goals may
remain the same or be different in some of the timeframes.
Appendix A2Business ObjectivesObjectiveTimeframe: Five+
year goalsProfitProducts and ServicesProductionCustomer
SatisfactionEmployee RetentionGrowthChange
ManagementMarketingNew ClientsQualityService
LevelDonation LevelCommunity RelationsResearch and
DevelopmentInnovationGlobalizationexample: enter market of
one asian and three east african countriesBrand
RecognitionCorporate ImageSupply ChainFundingInformation
Technologyexample: upgrade unsupported legacy
systemsTraining
Instructions for Appendix A (A1 A2): Business Objectives
Use instructions in Appendix A1
Appendix BOrganizational EffectivenessTwelve Organizational
Effectiveness Criteria; adapt as neededSuggested Measures for

EvaluatingScoring of Criteria: 1 (less effective, poor) to 5 (very
effective, excellent)Issues/explanation of
scoreEfficiencyRevenue per employee-hour
Profit per employee-hour
Profit per square foot
Cost per client served
Cost per unit of output
Fixed asset utilization rate
Revenue multiplierProductivityUnit volume per employee-hour
Unit volume per machine-hour
Gross output per employee-hour
Gross output per machine-hour
No. of clients served per employee-hour
No. of billable hours per employee-hour
Gross payroll powerStabilityPlanning and goal setting
Extent of routinization
No. of layoffs during the period
Extent of job rotations
Safeguarding assets
Alignment of strategy, mission, vision
Compliance with established proceduresInnovationR&D
expenses as a percentage of net revenue
Training as a percentage of net revenue
New product development rate
No. of new markets entered

Willingness to innovate
Operational process change frequency
Administrative process change frequencyGrowthCompounded
annual growth rate (revenue)
Profit or fund crowd during the period
Relative market share change
New customer growth
New market growth
Change in manpower
Net change in assetsEvaluativeFeedback system utilization
Performance management system utilization
Task force utilization
No. of new initiatives launched
Percent of internally generated business ideas
Percent of externally generated business ideas
Change initiatives launched Fiscal HealthReturn on net
assets/equity /invested capital
Net debt position
Free cash flow
Liquidity ratios
Profitability ratios
Expense ratios
Fund equity balanceOutput QualityCustomer satisfaction /
loyalty
Customer retention rate

External review / accreditation
Internal quality measures
Warranty claims
Service errors
Response timeInformation ManagementRole ambiguity
Integrity of information
Timeliness of information
No. of staff meetings per month
No. of company-wide meetings per year
Perceived adequacy of information available
Access to procedures, rules, and regulationsConflict-
cohesionWork group cohesion
Employee turnover
Absenteeism
Workplace incivility
Commitment
Bases of power
Violence of conflictIntra-organizationalInstances of ethical
breach
Results of ethics audits
Evidence of workforce training
Evidence of monitoring systems
Components of organizational justice
No. of employee accidents
External / internal auditsExtra-organizationalRegulatory

compliance
Ecological footprint change
Environmental controls and monitoring
Emissions levels (pollutants, noise)
External audits
Contribution to the larger system
Philanthropic activities
Instructions for Appendix B: Organizational Effectiveness
There are several methods of evaluating organizational
effectiveness, and for this project we will be using a goal
focused method. This template uses 12 universal effectiveness
criteria as identified by Wesley A. Martz (Martz, Wesley A.,
"Evaluating Organizational Effectiveness" (2008).
Dissertations. 793.
http://scholarworks.wmich.edu/dissertations/793). You may
adapt these criteria for your own organization. The
effectiveness criteria you use should be clear, concise,
measurable, and tied to organizational performance. The
suggested measures offer some ideas as to how that criteria can
be measured. Organizations should define what makes the
criteria poor or excellent so that the measures are evaluated as
consistently as possible. As you fill out this checklist for your
organization, see if you can get help from executives in your
organization. Evaluate a minimum of three organizational

effectiveness criteria for your organization, providing your
description of how that criteria is being measured, your score,
and a one to two sentence explanation of your score.
Appendix CDepartment EffectivenessDepartmentEvaluation
Score: 1 (less effective) to 5 (very effective)Issues/explanation
of
scoreExecutiveFinanceProductionDistribution/TransportationAd
ministrationInformation TechnologySalesMarketingCustomer
ServiceHuman
ResourcesTrainingFacilitiesMaintenanceLogisticsQualityAccou
ntingDocumentationResearch &
DevelopmentLegalContracts/ProcurementOperationsPublic
Relations/Public AffairsTest and EvaluationRecruiting
Instructions for Appendix C: Department Effectiveness
Organizations have different departments that support their
business functions. Often business functions may be combined
within a single department that represents several functions,
such as Sales & Marketing, or Distribution & Logistics, or
Finance & Accounting. Select two departments from your
organization and perform your assessment of their
effectiveness. You should explain your evaluation with one or
two sentences that describe how the department is effective or
ineffective in meeting business goals or where potential
weaknesses have been uncovered.

Appendix DTECHNOLOGY INVENTORYTechnology/ Business
System FunctionSupplier/ Inventory SystemFinancial/
Transactional SystemCompensationSales and Marketing
SystemOffice Administration SystemProduction
SystemResearch and Technology Management SystemQuality
and Auditing SystemTraining SystemKnowledge Management
SystemEmployee Communication SystemDocumentation
SystemManagement Decision MakingHardwareexample: Mobile
credit cardSoftware Programsexample: In-house accounting tool
developed in CobaltEnterprise Systemsexample: SAP for
timekeepingexample: SAP for transfer to corporate HQe-
businessDatabasesexample: Inventory databaseSecurityexample:
Common access cards (PKI enabled)example:
nonePeopleexample: Marketing has their own ITNetworks:Local
Area NetworkWide Area NetworkInternet Connectivity
Instructions for Appendix D: Technology Inventory
Provide an inventory of the technology and tools currently used
in your organization. Identify what business function they
provide. In some instances, you may find that one tool provides
capability to several business functions, such as enterprise
systems for financial bookkeeping, timekeeping, and inventory.
In other instances, you may find that a single business function
is managed by using multiple pieces of technology, including
software programs, databases, networks, and hand-held tools.

For example, inventory systems may depend on hand-held
scanners, supplier databases, transportation networks, and in-
house inventory optimization programs. Provide detail for those
business processes that you feel are most critical to your
organization's performance.
Appendix EINFORMATION TECHNOLOGY
ASSESSMENTBusiness Information SystemSpecific Functions
PerformedGap in capability to meet needsInefficiencies or
RedundanciesCustomer ComplaintsPotential Vulnerabilities
(now and future) IT effectiveness score - 1 (least) to 5
(most)Explanation/ Comment/ IssuesInventory SystemFinancial
SystemCompensation SystemSales and Marketing
Systemexample: Online ordering; Facebook; email marketing;
customer databaseexample: For last two years, we’ve missed
our sales target.example: New customers must be added
manually to customer databaseexample: Customers not able to
access online ordering during peak hrsexample: Access problem
will become worse if we make more products available
onlineexample: 2Office Administration SystemProduction
SystemResearch and Technology SystemQuality and Auditing
SystemTraining SystemEmployee Training SystemKnowledge
Management Systemexample: 3Employee Communication
SystemLocal Area NetworkWide Area NetworkInternet
ConnectivityDocumentation System
Instructions for Appendix E: Information Technology

Assessment
This Information Technology assessment template is significant
to the technology audit as it is the foundation of your IT needs
assessment. As you think about the business functions in your
organization identified in Appendix D, you will now evaluate
how well the existing IT infrastructure supports each business
function. The business functions listed in the template are fairly
standard and should capture most of the functions that IT
services in your organization. Again, provide your score along
with an explanation of how IT could be used more effectively in
support of that business function. After filling out the template,
you will write a detailed description (one to two paragraphs)
that address where existing technologies are not meeting the
business needs, where customer support is not being met, where
there are ineffiencies or redundancies, and where potential
vulnerabilities exist.
Appendix FRISK ASSESSMENTBusiness RisksLikelihood of
occurrence: 1 (less likely) to 5 (very likely)Consequence or
Severity of occurrence: 1 (less severe) to 5 (very severe)Risk
Rating: low, medium, or highCurrent mitigation in
placeCommentsexample: Supplier delaysexample: 4example:
4example: Highexample: Second source for batteries has been
found. Sales department is offering incentives for customers to
stay while we work the problems. Need automatic alerts and

better ordering system to prevent shortages.example: Inventory
system did not identify issue with batteries until it began
affecting the production line. Key customers have threatened to
switch vendors if we can't deliver product on time. Lack of
batteries is slowing production facilities.example: Loss of key
personnelexample: Quality assurance problemsexample:
External attack on information systemsexample: Denial of
service to customersexample: New competitors
Instructions for Appendix F: Risk Assessment
Use the information that you gathered in Appendix E and
identify where you have found BUSINESS RISKS while
reviewing the business functions and their IT capabilities.
Identify at least 10 business risks and then assess them in terms
of how likely they are to occur.
Using the risk definitions in Appendix G, first assign a
LIKELIHOOD score to the risk. Second, assess how great the
impact or consequence would be if the risk occurred and assign
a CONSEQUENCE score to the risk. Then use these two
numbers to identify the RISK RATING using the risk matrix in
Appendix G.
Enter the risk rating into the table along with any notes on
mitigation strategies that are in place that will help to decrease

the likelihood or consequence of the risk. Feel free to record
any notes that will help you communicate your evaluations.
Appendix GRISK DEFINITIONSRISK MATRIXConsequence of
OccurenceLikelihood of OccurrenceRating12345Risk
RatingNear Certain (90%)5Likelihood of
Occurance5LOWMEDIUMHIGHHIGHHIGHLikely
(70%)44LOWMEDIUMMEDIUMHIGHHIGHHIGHModerate
(50%)33LOWLOWMEDIUMHIGHHIGHMEDIUMUnlikely
(30%)22LOWLOWLOWMEDIUMMEDIUMLOWRare
(10%)11LOWLOWLOWMEDIUMMEDIUMConsequence of
OccurrenceRatingCatastrophic (Project extended or risk of
being cancelled)5Major (Delays of up to 50% of schedule or
increase of up to 50% of cost)4Moderate (reduction to
performance has moderate impact on performance
objectives)3Minor (reduction in performance can be tolerated
with little impact)2Insignificant (minimal to no impact to
performance or schedule)1
Instructions for Appendix G: Risk Matrix
The risk matrix above provides a way to assign a risk rating by
considering both likelihood and consequence .
Appendix HEmerging Technology Assessment
TemplateOpportunities / BenefitsEmerging Technology
1Emerging Technology 2Improves efficiencyHighLowImproves
competitivenessImproves customer satisfactionMediumIncreases
market segmentEmployee benefitsMediumEliminates obsolete

systemStandardizes processes across business
unitsMediumProvides shared information to
departments….othersConcerns/RisksEase of UseLowCost
(upfront)MediumCost
(ongoing)LowTrainingLowMaturityMediumSecurityHighInterop
erabilityLow….others
Instructions for Appendix H: Emerging Technology Assessment
Template
For the Emerging Technology template, assess the opportunities
and benefits you see for your organization based on the
information you found for two new technologies. Some
categories to consider when evaluating the benefits are provided
although you may add others to the list. If the technology you
are considering does not provide that opportunity you can write
in N/A for not applicable. Also note the concerns or risks of
implementing this technology in your organization. Think of
these concerns specific to your organization and what might
hold your organization back from seriously considering your
recommendations.
Appendix IImplementation Plan for Emergent Technology
1What's the plan? What needs to be done?Who is responsible
for managing this piece?What is length of overall task?Staffing
ChangesFacility ChangesTraining RequiredLife cycle support
strategyProcurement methodOverall Schedule/timeframeInitial

CostOperating CostImplementation Plan for Emergent
Technology 2What's the plan? What needs to be done?Who is
responsible for managing this piece?What is length of overall
task?Staffing ChangesFacility ChangesTraining RequiredLife
cycle support strategyProcurement methodOverall
Schedule/timeframeInitial CostOperating Cost
Instructions for Implementation Plan for Emerging
Technologies
Both implementation plans should capture the major
considerations and factors regarding implementation of the new
technology in your organization. This is where you present the
overall idea of the new technology and at a very high level, you
address how, when, how much, and by whom, in regards to the
implementation in your organization. You will need to fill out
the template for each of the two emerging technologies you
chose.

Step 1The first step in performing an IT audit that is tied to b.docx

Recommended

Recommended

More Related Content

Similar to Step 1The first step in performing an IT audit that is tied to b.docx

Similar to Step 1The first step in performing an IT audit that is tied to b.docx (11)

More from rjoseph5

More from rjoseph5 (20)

Recently uploaded

Recently uploaded (20)

Step 1The first step in performing an IT audit that is tied to b.docx