The slides from our IT governance conference on 20 November 2015 at Antwerp Management School. Presenters : Alison Holt and Steven De Haes.

1. @itSMFBelgium
@ISACA_BE
#itgovernance
Put here your
event image

2. @itSMFBelgium
@ISACA_BE
#itgovernance
Sponsored by
www.isaca.be
IT Governance Conference

3. @itSMFBelgium
@ISACA_BE
#itgovernance

4. @itSMFBelgium
@ISACA_BE
#itgovernance

5. @itSMFBelgium
@ISACA_BE
#itgovernance
•13.30 Dealing with the elephant in the boardroom
(Prof. Dr. Steven De Haes, AMS)
•14.30 Finding data werewolves on LinkedIn
(Mrs. Alison Holt, Longitude 174 Limited)
• 15.30 Break
•16.00 Expert Panel Discussion on IT Governance
(moderated by Mr. Jurgen Van de Sompel, inno.com)
• 17.00 Networking and walking dinner

6. Ethical Governance of Data:
Finding Data Werewolves on LinkedIn
ALISON HOLT, LONGITUDE 174 LIMITED

7. @itSMFBelgium
@ISACA_BE
#itgovernance
Dilbert and Data
DILBERT © 2012 Scott Adams. Used By permission of UNIVERSAL UCLICK. All rights reserved.

8. @itSMFBelgium
@ISACA_BE
#itgovernance
Agenda
vGovernance of Data Standard
vData Accountability Maps
vVoluntary Code for Data Sharing
vMaxims to Guide Ethical Data Sharing

9. @itSMFBelgium
@ISACA_BE
#itgovernance
Data - Problem Statement
The volume (big data, internet of things) and value (analysis, machine learning) of data has
increased enormously over the last few years. The use of this ‘new’ data will continue to
disrupt businesses (uber, Netflix, Airbnb) for many more years.
But associated with this new data comes risk (personal data, hacks).
For organizations to succeed, they need to:
1. Understand the importance and implications of data to their organization
2. Maximize the return on their investment in data
3. Operate within their acceptable level of risk, and
4. Ensure the appropriate level of accountability of the data and its use
Data has become strategically important for any organization – and therefore an important
topic for every governing body.

10. @itSMFBelgium
@ISACA_BE
#itgovernance
Data Driven
Name Product Own Start Revenue Custs Range staff notes
Uber Taxi, veh hire Prv 2009 ? ? World
Amazon E comm, Cloud Pub 1994 $88 bn ? World 183,100
Webjet Travel, Air, Accom Pub 1998 $98.6 m World
Expedia Travel, Air, Accom prv 1996 World Ex M’Soft
Airbnb Accom prv 2008 1.5m World
trivago Accom 2005 45m/
m
World 758 Expedia
61%
Hotels.com Accom prv 1991 37
count
Expedia
Alibaba E-com c2c, b2c,b2b pub 1999 CY76 bn world 34,985 Many affils
Trademe I’net auction pub 1999 3.7m NZ 357
eBay Ecom c2c,b2c pub 1995 $17.9 bn world 34,600
Youtube Video share sub 2005 world Google
Google I,net servs, cloud pub 1998 $66 bn world 57,148
PayPal Online payments pub 1998 $8bn 165m world Spun off
eBay 2015
Tinder “social discovery” prv 2012 12m/d world Uses
Facebook
Ashley
Madison
“Dating” prv 2001 37 m world
Facebook Social network pub 2004 $12.6 bn 1.44
bn/mt
h
world 10,082 subs
LinkedIn Bus social nw pub 2003 $2.21 bn 380 m world 7,600
Netflix On demand
streaming vid
pub 1997 $5.5 bn 30 m world 2,189
iTunes Multi media sub 2001 world Apple
From a business supported by IT
to
a data driven business

11. @itSMFBelgium
@ISACA_BE
#itgovernance
Data and Value
“Data creates opportunity. It's the oil of the 21st
century. Whoever has the right data will ultimately
win.”
Peter Sondergaard, senior vice president of Global Research at Gartner
https://www.nyse.com/network/article/Gartner-Whats-Next

12. @itSMFBelgium
@ISACA_BE
#itgovernance
Data and Risk
© |Dreamstime.com

13. @itSMFBelgium
@ISACA_BE
#itgovernance
Governance of Data Standards (38505)
Future Work
Building an
Assessment
and Maturity
Model for
38505-1
38505-4
Future Work
Application
of 38505-1 to
COBIT 5.0
38505-3
New Work
Item Proposal
Application
of 38505-1 to
data
management
38505-2
Draft
standard
Application
of 38500 to
the
Governance
of Data
38505-1
Published
standard
Governance
of IT for the
organization
38500

14. @itSMFBelgium
@ISACA_BE
#itgovernance
Foundation – Governance of IT (38500)
Responsibility
Strategy
Acquisition
Performance
Conformance
Human Behaviour
E
MD

15. @itSMFBelgium
@ISACA_BE
#itgovernance
Governance Model (38500)
“accountability for the effective, efficient and
acceptable use of IT by an organization remains with
the governing body and cannot be delegated”
Governing
Board
IT
Legal
Marketing
Production
HR
ISO/IEC 38500 Governance of IT for the organization

16. @itSMFBelgium
@ISACA_BE
#itgovernance
Applying the Model to Data
Governing
Board
IT
Legal
Marketing
Production
HR
Technology
&
Capabilities
Data
classification, risk
profile,
information
attitude
Reporting
&
Alerts
Evaluate
◦ Technology that can enable new information strategies (e.g.
IoT, Big Data, BI)
◦ Technology that can reduce the cost of data storage and
access (cloud computing, distributed processing)
Direct
◦ Data Feed strategy – currency, quality, retention, access etc.
◦ Data classification – allowing the lowest level of security and
access to data for decision makers at all levels
Monitor
◦ To improve the value of data (e.g. measure usage stats and
insights achieved, and evaluate decisions made)
◦ To build a ‘data culture’ (e.g. behaviours around decision
making, use of feeds, social etc.)

17. @itSMFBelgium
@ISACA_BE
#itgovernance
Applying the Principles from 38500 to Data
Responsibility
- Are you ensuring that everyone is responsible for data? (Not just IT)
- Would a documented Data Practice help guide the business (and the Board)?
Strategy
- Should you have a data strategy that covers all aspects and states of data?
- Does all data carry the same value and risk, or should Data Classification Schemes be used?
Acquisition
- Where does your data come from currently? Where will it come from in the future?
- How should Data Policy be applied across different data types?
Performance
- How well does the data use in the organization improve decision making?
- Are requirements for Data Management Frameworks and confidentiality, integrity, and risk being met?
Conformance
- Does Data Handling and Distribution conform to internal policies and external obligations?
- Do data practices meet legislative requirements including PII requirements?
Human Behaviour
- Is the Data Analysis being carried out with human needs in mind?
- Do the data policies reflect BYOD realities?

18. @itSMFBelgium
@ISACA_BE
#itgovernance
Introducing a Data Accountability Map
“A diagram or collection of data showing spatial
distribution of something or the relative positions of its
components” (OED)
“A representation in abridged form; a summary or
condensed account of a state of things; an epitome, a
summation.” (OED)

19. @itSMFBelgium
@ISACA_BE
#itgovernance
The Challenge of Maps
© |Dreamstime.com

20. @itSMFBelgium
@ISACA_BE
#itgovernance
Data Accountability
The accountability for data and its use rests with the
governing body of the organization.
Collect data acquisition and creation process, learning from previous
decisions made and other context extracted from other data sets
(internal or external)
Store locating the data where it can be physically or logically retrieved
Report manual or automated extraction and analysis of data for the
purpose of supporting decision making, distribution or disposal
Decide the data examination and analysis process to guide
organisational decision making and direction
Distribute extraction or copying of data via the Report activity for
circulation to external parties
Dispose extraction of data via the Report activity from the data store for
permanent removal. In the case of a data feed, this would be the
permanent disconnection to that feed

21. @itSMFBelgium
@ISACA_BE
#itgovernance
Guidance – Using Data Aspects to Apply
Governance Principles to Data
Accountability
Value Risk Constraints
Collect xx xx xx
Store xx xx xx
Report xx xx xx
Decide xx xx xx
Distribute xx xx xx
Dispose xx xx xx
Apply the principles
at each cell.

22. @itSMFBelgium
@ISACA_BE
#itgovernance
Example – Collecting Data
ASPECTS VALUE RISK CONSTRAINTS
Collect Governing bodies should ensure that
the data collected can be used for
current and future purposes.
How the data collection is performed
may dictate its current use, context
and quality.
The quality of the data collected
should be sufficient and appropriate
for further use and re-use of the
data to meet new requirements for
analysis as they arise.
If future use of the data is required
for general analysis, anonymisation
and pseudonymisation techniques
should be used to remove PII.
Governing bodies should ensure
their organization has the right to
use to the data that is collected and
that they trust the source of that
data.
They should also ensure that the
data being collected is fit for
purpose.
Data should be only be collected in
compliance with local rules and
regulations and with the relevant
consent of data owners.
Governing bodies should ensure
they understand the inherent
limitations of the data that is
being collected – and direct
policies accordingly.
Where personal consent is
associated with the data, it
should remain associated so that
future use can be appropriately
directed.

23. @itSMFBelgium
@ISACA_BE
#itgovernance
Governance of Data (38505) Summary
Responsibility
Strategy
Acquisition
Performance
Conformance
Human Behaviour
E
MD

24. @itSMFBelgium
@ISACA_BE
#itgovernance
Voluntary Code for Data Sharing

25. @itSMFBelgium
@ISACA_BE
#itgovernance
Voluntary Code Components
• Maxims – Guidance for all data handlers
• Considerations – Check list for the data owners
• References – Best practice guidance underpinning the
Considerations
• An Owner
• An Incentive for Compliance
• A Mechanism for Sharing

26. @itSMFBelgium
@ISACA_BE
#itgovernance
Considerations for Data Sharing
vLegal Requirements
vAssessment of Data and Value – Short Term - Long Term
vEthical Use and Re-Use (31000)
vSecurity (27000 series), Privacy (AWI 20889) and Confidentiality
vQuality (15289) and Suitability
vAvailability (20000) and Accessibility (W3C)
vSelection of Tools and Analysis Techniques (15288, 15265)
vCuration, Preservation and Ongoing Maintenance (30301)
vProvenance

27. @itSMFBelgium
@ISACA_BE
#itgovernance
Maxims for Data Sharing
vAssign a responsible owner for each data collection or sets of data collections, to be
responsible for assessing data for quality and for identifying risks and constraints, at
collection and at distribution. (Reduce Risk)
vCollect consent, curate and catalogue data at the point of collection. (Increase Value)
vStore the minimum data to serve your purposes. (Reduce Risk)
vDesign and locate your store for safety and security; apply privacy as appropriate and
encrypt data at rest. (Address Constraints)
vBalance being conservative in what you distribute, with your moral obligations and
a consideration of the social and commercial value of your data to others. (Balance Risk
and Value)
vBe transparent on the limitation and classification of your data, regarding completeness,
accuracy, quality, reliability. (Increase Value)

28. @itSMFBelgium
@ISACA_BE
#itgovernance
Questions?
DILBERT © 2012 Scott Adams. Used By permission of UNIVERSAL UCLICK. All rights reserved.

29. @itSMFBelgium
@ISACA_BE
#itgovernance
Problem statement
Emerging research calls for more board level
engagement in enterprise governance of IT and
identifies serious consequences for digitized
organizations in case the board is not involved (Turel
and Bart, 2014).

30. @itSMFBelgium
@ISACA_BE
#itgovernance
Problem statement
Yet, it appears that enterprise technology
governance remains the ‘elephant in the boardroom’
for more than 80% of boards of directors (Valentine,
2015).

31. @itSMFBelgium
@ISACA_BE
#itgovernance
Problem statement
Boards need to extend their governance accountability, from a mono-
focus on finance and legal as proxy to corporate governance, to
include technology and provide digital leadership and organizational
capabilities to ensure that the enterprise’s IT sustains and extends the
enterprise’s strategies and objectives.
Board
Executive committee
Key assets
Human
assets
Financial
assets
Physical
assets
IP
assets
Inform. &
IT assets
Relationsh
ip assets
IT governance
practices
Financial governance
practices
Board
Executive committee
Key assets
Human
assets
Financial
assets
Physical
assets
IP
assets
Inform. &
IT assets
Relationsh
ip assets
IT governance
practices
Financial governance
practices

32. @itSMFBelgium
@ISACA_BE
#itgovernance
Research project 2015-2018

33. @itSMFBelgium
@ISACA_BE
#itgovernance
Research questions
• What is Board level IT Governance?
• What are enablers / inhibitors for boards to take up this accountability?
• What are contemporary best practices that can help Boards in engaging
in IT governance?
• What competencies should board members have in digitized
organizations?
• How can boards ensure that the innovation potential coming out of
technology (big data, cloud, …) is realized?
• How can boards ensure that the risks coming out of technology are
under control (eg. Cybersecurity)?
• How should non-executive board report on IT governance towards
investors?
• …

34. @itSMFBelgium
@ISACA_BE
#itgovernance
How are non-executive boards reporting on IT Governance?
Risk
Mngt.
Value
Deliv.
Align
ment
Perf.
Mngt.
sample
IT Gov disclosure
framework (Joshi)

35. @itSMFBelgium
@ISACA_BE
#itgovernance

36. @itSMFBelgium
@ISACA_BE
#itgovernance
A glimpse of our research project
Balancing rigor and relevance
Build
tool-kit
Influence
corporate
governance
codes
Educate
board
members

37. @itSMFBelgium
@ISACA_BE
#itgovernance
What COBIT 5 proposes

38. @itSMFBelgium
@ISACA_BE
#itgovernance 38
Source: COBIT® 5, figure 16. © 2012 ISACA® All rights reserved.

39. @itSMFBelgium
@ISACA_BE
#itgovernance 39
Evaluate the design of
enterprise governance of
IT
Determine the significance of IT and its role with respect to the
business
One example à EDM1: Ensure Governance Framework Setting

40. @itSMFBelgium
@ISACA_BE
#itgovernance 40
Turnaround ModeSupport Mode
Strategic ModeFactory Mode
Turnaround ModeSupport Mode
Strategic ModeFactory Mode
Lowtohighneedforreliableinformationtechnology
Low to high need for new information technology
Nolan R., McFarlan F.W., 2005, Information Technology and Board of
Directors, Harvard Business Review
One example à EDM1: Ensure Governance Framework Setting

41. @itSMFBelgium
@ISACA_BE
#itgovernance 41
Establish governance structures and
processes accordingly…
Direct the design of
enterprise governance
of IT
One example à EDM1: Ensure Governance Framework Setting

42. DISCUSSION
QUESTIONS

43. @itSMFBelgium
@ISACA_BE
#itgovernance