IT Governance in Banks, workshop organized by USAID Finance for Economic Development (FED) Program in Yerevan, Armenia in May, 2014

1. USAID Finance for Economic Development
(FED) Program
Workshop: “IT Governance in Banks”
May 27, 2014

2. IT Governance:
Why, How, When…
Komitas Stepanyan, PhD, CRISC, CMRM
CobIT Foundation Certificate
YEREVAN - 2014

3. Agenda
Introduction
 The problem
 Management Expectations of IT
 IT management challenges
 Key risk
Framework
Implementation Guidance

4. Is IT Works as needed??? Statistics…
Over 80% of IT project are delivered late and over budget. (Standish
Group – Oct 2006)
Nearly 60% of all IT projects are delivered with less functionality that
originally promised. (Standish Group – Mar 2007)
More than 25% of the IT projects usually fail (Gartner Group – May 2006)
Less than 5% of project fail due to technical reasons – Nearly all
obstacles are related to poorly defined requirements, poor
sponsorship, weak management controls or all of the above. (Gartner
Group – May 2006)
The IT aspects of CG are one of things that CEO’s think they don’t have to
understand-until it bites them! (Piter Morriss - KPMG)

5. Facts…
“ IT Governance is the responsibility of the Board of
Directors and executive management.
It is an integral part of enterprise governance and consists of the leadership and
organizational structures and processes that ensure that the organization’s IT
sustains and extends the organizations strategies and objectives.”
IT Governance Institute Board Briefing, Second Edition, 2003

6. Strategic
Alignment
Value
Creation
Risk
Management
Resource
Management
Performance
Measurement
Plan
&
Organize
Acquire
& Implement
Deliver
&
Support
Monitor

7. Management/Business Expectations of IT
- What does management expect from IT?
?
Information
Technologies
- What is an IT at all?
- How to use it?
- How to manage it?
- How to be sure everything works as needed?
- How to measure results?
It’s the time to recognize and manage complexity
It’s the time to open “Black Box” …

8. Information management challenges
How the organization will operate
How the information systems themselves will work.
Information systems are only successful if they are used.

9. Key risk
Misalignment between IT and Business
 Time and budget overruns
 Ineffective IT Investments
 Useless IT systems
 Anachronism IT systems
Apply good IT(and not only) risk management to ensure success

10. Agenda
Introduction
 The problem
 Management Expectations of IT
 Information management challenges
 Key risk
Framework
Implementation Guidance

11. The psychology/ sociology of Failed Systems
Inconsistent
materials
Work
overloads
Lack of
measures
& defined
processes
Cascading
rework
Soloed
functional
processes
Inconsistent
procedures for
identical tasks
Unintegrated
best practices

12. CobIT Framework
Management’s IT
Expectations
Management’s IT
Responsibilities

13. Management Needs COBIT
To Evaluate IT Investment Decisions
To Balance Risk and Control of Investment
To Benchmark Existing and Future IT Environment
76% of various CEOs and CIOs are aware of the
benefits offered by IT governance frameworks, yet
only 42% of them had any intention of implementing
such a framework” (Loggerenberg 2006)

14. Business Requirements
CobIT Cube
IT Processes
DS M PO AI Domains
Processes
Activities
People
Application
Information
Infrastructure

15. Who Benefits from More Effective and Sustainable IT Governance?
 What Executives Get
 – Business improvements that result from knowledgeable participation in IT decision-making from an enterprise
perspective
 – Ensures that key IT investments support the business and provide optimum returns to the business
 – Ensures compliance with laws regulations
 What Mid-Level Business Managers Get
 – Convinces senior business managers that their combined business -IT resources are being managed effectively
 – Helps to ensure that business services for which they are responsible will meet commitments
 What Senior IT Managers Get
 – Obtains sponsorship and support and a clear focus on important strategic and operational initiatives
 – Improves customer relationships by delivering results in a more predictable and consistent manner, with the
involvement of the customer
 What Program/Project and Operations Managers Get
 Helps in resolving issues, review progress and, enable faster decisions
 What Everyone Gets
 – Facilitates communications about how IT contributes to the business
 – Improves coordination, cooperation, communications and synergy across the organization
 – Less stress

16. Agenda
Introduction
 The problem
 Management Expectations of IT
 Information management challenges
 Key risk
Framework
Implementation Guidance

17. How To Implement CobIT in an Organization
Top Down Approach
Audit Committee Approach
Audit and IT Management Consensus Approach
Regulation/Legislation

18. Getting Started – Board and Executive Questions for IT
Does the IT strategy align with the business strategy?
Is the IT investment justified based on its contributions to the business?
How likely will IT meet or exceed its plans, objectives and initiatives?
Is IT being managed prudent, effectively? How is that measured?
How is IT delivering value?
Is IT developing and maintaining constructive relationships with customers, vendors and
others?
Is IT delivering projects and services on time, within scope, within budget and with high
quality?
Is IT staffed adequately, wit the right skills and competencies?
How does IT management and operations compare to other best practice organizations
How is IT managing and planning for contingencies, disasters, security, and back- up?
How is IT measuring its performance? What key performance measures?
Does the Board review and possibly approve the IT strategy?
Is a risk management policy, assessment and mitigation practice followed for IT?

19. To Adopt CobIT, Who Needs To Be Influenced?
 Chief Executive (e.g., CEO)
 Senior IT Executive (CIO or VP of IT)
 IT Steering Committee
 IT Management
 Business managers

20. CobIT Maturity Model
How do you know where you are?
Nonexistent Initial Repeatable Defined Managed Optimised
0 1 2 3 4 5

21. CB RA Case
Before CobIT Implementation

22. CB RA Case
After CobIT Implementation

23. CB RA Case
After CobIT Implementation - 2011
Process Maturity By CobIT
IT Processes
Maturity level
AVRG IT
AVRG IT &
IT Audit
IT Audit
Benchmark

24. Summary
• IT governance is a broad and complex topic with many parts
• Clearly defined roles, ownership and accountability
• IT governance is integral part of corporate governance
• IT governance is a journey and not only destination

25. To be or NOT to be?
D I s c u s s I o n
IT Governance or NOT IT Governance?

27. Business and IT’s Perpetual Disconnect
AT Kearney, from a survey conducted in December 2001, report
that only 17% of businesses had IT strategies that were "fully
aligned and developed simultaneously" with corporate strategy.
Furthermore, 45% of participants did not feel that their IT
strategies were developed to support or align with their
corporate strategy.
Fact: The Corporate Alignment Profile most often shows IT as the most unaligned group.

28. CEOs Seeking a Solution
The IT Governance Global Status Report (2004) found that 80%+
of CEOs recognised that “IT Governance or some form thereof is
required” to resolve “IT issues”.
The Report also found that 57% of CEOs looked to IT Governance
to align IT strategy (and 53% to manage IT risks).
However the Report concluded that “solutions in this domain are
not yet available”.

29. What CIOs Want ?
The top benefits CIOs were hoping to achieve:
Increased IT credibility with the business (81%);
Closer alignment between IT and business objectives (69%);
Improved teamwork between IT and internal business partners (68%);
Improved ability for CIO to influence the business (46%).
#CIO Research Reports. June 1, 2005. Turning IT Doubters into True Believers
http://www2.cio.com/research/index.cfm

30. The Pieces of CobIT
Executive Summary - Senior Executives (CEO, CIO)
Framework - Senior Operational Management (Directors of IT)
Control Objectives - Middle Management (Mid-Level IT Management)
Audit Guidelines - Line Management (Applications or Operations
Management)
Management Guidelines - Operational Management, Director of IS, Mid-
Level IT Management
Implementation Tool Set - Director of IS, Mid-Level IS Management
For additional information:
www.isaca.org; www.itgi.org
komitas.stepanyan@cba.am