The document discusses why corporate governance and compliance are important. It notes that there are over 200 international regulatory and legal compliance requirements that must be met. Compliance is required in many areas like Sarbanes-Oxley, HIPAA, privacy laws, and more. Strong IT governance is needed to support corporate governance objectives and compliance requirements as technology is so embedded in business operations. IT should support business goals and requirements, not drive them. Various frameworks for compliance and governance are discussed like COBIT, which provides principles and guidelines.

3. Why We Are Here
What compliance and governance is and why you
should care
Distinguishing Myth from Reality
Going Beyond “Just Good Enough” Approaches
Introduction to Compliance Frameworks
Balancing Competing Frameworks: Apples & Oranges?
Implementing Compliance Frameworks
E-Mail Management Issues to Be Addressed
On-Line resources
What do you need to take home?

5. Why Are We Here?

6. We don’t want to be…

7. We want to know how far it is to the hole…

8. Disclaimers

10. Compliance is Everywhere
At last count, there are at
least 200 international
regulatory & legal drivers
that must be complied with
as tracked by IBM Business
Consulting Services

11. Compliance is Everywhere
Sarbanes-Oxley FTC
SEC rule 17a-4 Patriot Act
European Union Privacy Laws
California Security Breach Notice Law
FDA
BASEL II FMFIA HIPAA
Financial Services Modernization FISMAV)
Act of 1999 (GLBA, Gramm-Leach-Bliley Act, Title

12. Compliance is Everywhere
And it makes C-Level executives and and their
employees want to just…

13. Compliance is Everywhere
Corporate Governance is not an option…
Resistance is not only futile…

14. Compliance is Everywhere
…but can take you from this…

15. Compliance is Everywhere
…to this

16. Terms and Definitions

17. Elements of Governance

18. Elements of Governance

25. Information technology is so
embedded in the operations of an
enterprise that strong IT
Governance is needed to support
corporate governance objectives
and compliance requirements.

26. Business Goals, objectives and
specific requirements drive IT, not
the other way around

29. COBIT Copyright The Information Technology Governance Institute, All rights reserved. Used with permission

31. (IT Strategy and Policy)
Requirements
Direction
Control
Goals Responsibilities
Objectives
Business Governance
Business Needs to Information (IT
Achieve Its Objectives Control, Risk and
Assurance)
IT Governance
COBIT Copyright The Information Technology Governance Institute, All rights reserved. Used with permission

33. IT Resources Information
• Data • Effectiveness
• Application Systems • Efficiency
• Technology • Confidentiality
• Facilities • Integrity
• People • Availability
• Compliance
• Reliability
Plan and Organise
Monitor And
Evaluate
Acquire and Implement
Deliver and
Support
COBIT Copyright The Information Technology Governance Institute, All rights reserved. Used with permission

34. PO7 manage human resources
PO8 ensure compliance with external requirements
PO9 assess risks
IT Resources Information PO10 manage projects
PO11 manage quality
• Data • Effectiveness
• Application Systems • Efficiency
• Technology • Confidentiality
• Facilities • Integrity
• People • Availability
• Compliance
• Reliability
Plan and Organise
Monitor And
Evaluate
Acquire and Implement
M1 monitor the processes
M2 assess internal control adequacy
M3 obtain independent assurance
M4 provide for independent audit Deliver and
Support
DS4 Ensure continuous service
DS5 Ensure systems security AI1 identify automated solutions
DS7 Educate and train users AI2 acquire and maintain application software
DS8 Assist and advise IT customers AI3 acquire and maintain technology infrastructure
DS9 Manage the configuration AI4 develop and maintain procedures
DS10 Manage problems and incidents AI5 install and accredit systems
DS11 Manage data AI6 manage changes
COBIT Copyright The Information Technology Governance Institute, All rights reserved. Used with permission

35. Control Process P06 –
Control over the IT process of
communicating management aims and direction
that satisfies the business requirement of to provide automated process
that satisfies the business requirement
to ensure user awareness and understanding of those aims
is enabled by
policies established and communicated to the user community; furthermore, standards
need to be established to translate the strategic options into practical and usable user rules
and takes into consideration
• clearly articulated mission
• technology directives linked to business aims
• code of conduct/ethics
• quality commitment
• security and internal control policies
• security and internal control practices
• lead-by-example
• continuous communications programme
• providing guidance and checking compliance

56. Questions, Comments,
and Discussion
How to Contact Me:
Christopher Byrne
iscontrolscaddy@gmail.com
Techies Cartoon Copyright 2000 Jeff Larson, All Rights Reserved, Permission Pending