IT GovernanceHow to integrate IT into a mid-sized Enterpriseand ena e s perior a e rea on The control of IT Processes IT Processes which satisfy Business Business Requirements Requirements is enabled by Control Control Statements Statements considering Best Best Practices Practices ¦Ä > Why IT Governance is a powerful business tool. > valua n the poten al for value crea on – the Governance Scorecard. > sin the Scorecard to i prove IT inte ra on. The Infology Group, Inc.
IT Governance PAGE 2 owerful usiness Tool In a u er onsor u survey of co pany failin to deliver beneﬁts.e ecu ves s ll re arded Infor a on Technolo y IT as anecessary evil the IT depart ent purely as a cost center or IT G o v e r n a n c e. . .worse. Provides the structure that links IT processes, IT resources, and information to enterprise strategies and To the other IT is already a source of beneﬁts such objectives.as enhanced reputa on trust product leadership e-to- ar et reduced costs and ul ately sta eholder value. Integrates optimal ways of planning and organizing, acquiring and implementing, delivering andThese co panies re ard IT as an i portant value creator that supporting, and monitoring IT performance.drives e ec veness increases e ciencies and elevates Enables the enterprise to take full advantage of itsco pe veness. information, thereby maximizing benefits capitalizing on opportunities, and gaining competitive advantage. This new state of a airs presents a fresh set of business IT Governance Institute ana e ent challen es. The IT depart ent has tradi onally been so ewhat The challen e is to inte rate the IT co unity and theseparated fro the rest of the business o en repor n to control of IT in eneral into the fabric of the whole businessthe inancial func on. re uently the business and IT not just isolated areas and to e tend corporate overnanceco uni es e perience basic di culty in co unica n to IT processes and ac vi es.and in aintainin produc ve dialo s. Thus IT beco es What has been lac in so far is a co prehensivedisconnected fro the ainstrea of corporate overnance. perspec ve on the control of IT that would The price paid for this lac of inte ra on can be heavy > rovide an a enda for evalua on prescrip on and > Wea ened co pe ve posi on dissa sﬁed custo ers applica on of i proved ana e ent processes. or business losses. > stablish co on round between the various > Lowered uality hi her costs and issed deadlines. co uni es in the enterprise en a ed in the use and > ciency and processes ne a vely i pacted by poor delivery of IT. uality of deliverables. > Yield ilestones and oals for the advance ent of IT > usiness ini a ves inade uately supported by IT and inte ra on into the whole business. > e a pla or for i proved IT overnance. IT: Often Absent G v c P vid F c Corporate executives asked:Which subjects are included in your formal business strategy? IT Governance focuses ana e ent’s pursuit of cohesive oals across the IT and business func ons of the or ani a on. Good overnance endeavors to create har ony Product Strategy 51% between IT and the business ul ately leadin to a E-Business strategy 49% rela onship where IT and other business func ons adapt and Sales / marketing 43% collaborate in support of enterprise strate ies. Customer service 43% The ability to achieve and sustain this syner is c Competitive position 38% rela onship between the IT and other business func ons is ITs role 35% anythin but easy. Source: Cutter Consortium, Arlington, Massachusetts We ﬁnd in id-si ed or ani a ons that achievin ood February 2002: Based on 75 Large Organizations overnance is evolu onary and dyna ic. It re uires stron The Infology Group, Inc.
IT Governance PAGE 3support fro senior ana e ent ood wor in the aps between business ris s control needs andrela onships between func ons stron leadership technical issues. It provides ood prac ces across aappropriate priori a on trust and e ec veco "We believe by 2002-03, more than 30-40 percent unica on. ll based on a co prehensive understandin of Global 2000 companies deploying newof the underlyin business environ ent as well as deployedand e er in technolo y capabili es. technologies and entering new markets with e- products and services will have adopted a COBIT-A w like risk assessment and balanced risk/reward Despite the si e of invest ents and ris s associated reporting process,"with IT control and overnance of the do ain has not Al Passori, vice president, META Group. enerally received the level of a en on it deserves. erhapsthis is because it re uires ore technical insi ht; has its own do ain and process fra ewor and presents ac vi es inuni ue lan ua e; and is an inherently co ple subject a sound and lo ical structure. a in the co unica on ap between IT and other IT is desi ned to be the brea throu h ITco uni es di cult to brid e. overnance tool that helps in understandin and owever the scale of the challen es and the poten al ana in the ris s and beneﬁts associated withrewards of success in dealin with the are drivin a reat infor a on and related IT. - SACAdeal of new research into the uni ue challen es of IT as a In its full co ple ity IT addresses 34 hi h-level ana e ent discipline. rofessional bodies lar er process control objec ves robustly supported by anenterprises do ain e perts and even acade ic ins tu ons addi onal 3 detailed process control objec ves.con nually research how to be er ana e IT adop on andinvest ent. IT is ore than just a delinea on of control objec ves. It is a co plete fra ewor for the crea on and So e es this involves the re-tar e n of eneral aintenance of a syste of processes and controls ana e ent techni ues. en it involves a confusin appropriate to the business.prolifera on of theories tools and techni ues tar e n the any and varied ele ents of IT ac vity but rarely ta in a O App chholis c view of the proble . s a ﬁr Infolo y has always sou ht to provide id-O App ch S d O si ed co panies with the advanta es nor ally reserved for the lar est and ost sophis cated enterprises. We adapt and In a crowded ﬁeld the wor done by The Infor a on transfer the ﬁeld tested e periences of lar e early adopterSyste s udit and ontrol ssocia on IS stands out. or ani a ons to the id-si ed ar etplace.The IS is a reco ni ed leader in IT overnance controland assurance o erin ori inal resources to assist enterprise or Governance wor we use IT as the underpinninleaders in their responsibility to a e IT successful in of fast-paced pra a c ini a ves a uned to thesuppor n the enterprise s ission and oals. or ani a onal and resource capabili es of our clients. We scale the IT approach to the tas at hand usin its robustCOB T process base to ensure inte rity and best prac ce. We retain The ontrol bjec ves for Infor a on and related all core a ributes to per it bench ar in between ourTechnolo ies IT ra ewor is a se inal wor which we clients and other or ani a ons.believe is a sound basis for a uniﬁed approach to IT or e ec ve overnance to be i ple entedperfor ance enhance ent. The IT ra ewor is bein or ani a ons need to assess how well they are currentlyfor ally adopted by Global 2 co panies and is the perfor in and iden fy where and how i prove ents caninspira on of related e orts by ﬁr s such as Infolo y who be ade. This applies to both the overnance process itselfaddress the uni ue needs of id-si ed co panies. and to all the processes that need to be ana ed within IT. ontrol bjec ves for Infor a on and related Technolo y helps eet ana e ent needs by brid in The Infology Group, Inc.
IT Governance PAGE 4 The Governance ScorecardControl Process Maturity LevelsCategories 1. Without 2. Repeatable 3. Defined 4. Managed 5. Optimized Business/IT Lack Limited Business/IT Good understand- Bonding, unified Informal, pervasive1. Communication Understanding Understanding ing Some technical Functional cost effi- Some cost effective- Cost effective; Extended to exter-2. Metrics measurements ciency ness Some partner value nal partners No formal process; Tactical at function- Relevant process Managed across Integrated across3. Oversight reactive priorities al level across organization organization organization Conflict; IT a cost of IT emerging as as- IT seen as asset; IT enables / drives IT & business4. Partnership doing business set Process driver business strategy co-adaptive Traditional office Transaction Integrated across Integrated with Evolve with partners5. Technology support (e.g., ESS, DSS) the organization partners IT takes risk, little Differs across func- Emerging as value Shared risk & re- Education/careers/6. Human Resources reward; Technical tional organizations service provider; wards rewards across the training Balanced Hiring organization Figure 1. The use of a scorecard reatly si pliﬁes the tas of is chao c and there is only sporadic inconsistentassess ent and i ple enta on. It provides a pra a c and co unica on on issues and responses to issues. There aystructured approach for easurin how well developed your be so e ac nowled e ent of the need to capture theprocesses are a ainst a consistent and easy-to-understand contribu on of IT to enterprise perfor ance. IT onitorin isscale. sin a process aturity odel you can i ple ented reac vely to an incident that has caused so e loss or e barrass ent to the or ani a on. > uild a perspec ve of current prac ces that is shared across internal and e ternal co uni es. Level or ani a ons are hi hly li ely to e perience si niﬁcant IT under-perfor ance but have no way of > Set tar ets for future develop ents based on best addressin the subject. prac ces hi her up the scale. L v l2– p bl p c > lan projects to reach those tar ets by deﬁnin the speciﬁc chan es re uired to i prove ana e ent. There is awareness of IT overnance issues. IT overnance ac vi es and perfor ance indicators are under > riori e project wor by iden fyin where the reatest develop ent. Mana e ent has iden ﬁed basic IT i pact will be ade ost easily. overnance easure ents and assess ent ethods and i ure provides an overview of the adapted techni ues. owever the process has not been adopted overnance scorecard that we have adopted. across the or ani a on. There is no for al trainin andP c M i yL v l co unica on on overnance standards and responsibili es are le to the individual. IT overnance ac vi es are The rocess Maturity Levels reﬂect the followin included in the or ani a on’s chan e ana e ent process eneral states of IT overnance with ac ve senior ana e ent involve ent and oversi ht. L v l 1 – wi h p c Level 2 or ani a ons can be characteri ed as be innin rocesses are not applied at all or are ad hoc. The the overnance process. This ran in tends to reﬂector ani a on ay not even reco ni e that there is a a ributes reali ed at local units or func onal roups within overnance issue to be addressed. Mana e ent’s approach The Infology Group, Inc.
I Governan e PAGE 5the overall enterprise. However, overall enterprise pro ess etri s. All pro ess stakehol ers are aware of risks,i prove ents re ain i lt to a hieve. he poten al the i portan e of I an the opport ni es it an o er. A onopport nity is beginning to be re ognize . is taken in any, b t not all ases where pro esses appear Level 3—deﬁned process not to be working e e vely or e iently. Pro esses are p ate an best internal pra es are enfor e . Root a se he val e of I governan e is n erstoo an a epte . analysis is being stan ar ize . on n o s i prove ent isA baseline set of I governan e in i ators is se , where beginning to be a resse . here is involve ent of alllinkages between o t o e eas res an perfor an e re ire internal o ain e perts. I governan e evolves into rivers are eﬁne , o ente an integrate into strategi an enterprise-wi e pro ess an is be o ing integrate withan opera onal planning an onitoring pro esses. enterprise governan e pro esses.Pro e res are stan ar ize , o ente an i ple ente .Manage ent has o ni ate stan ar ize pro e res evel organiza ons a vely anage I Governan e, toan infor al training is establishe . Perfor an e in i ators reinfor e the on ept of I as a val e enter. evelfor all I governan e a vi es are being re or e an organiza ons leverage I assets on an enterprise-wi e basistra ke , lea ing to enterprise-wi e i prove ents. Altho gh an fo s appli a ons syste s on riving b siness pro ess eas rable, pro e res are not sophis ate . is ng enhan e ents to obtain s stainable o pe ve a vantage.pra es are for alize . ools are stan ar ize , sing A evel organiza on views I as an innova ve an rrently available te hni es. It is, however, le to the i agina ve strategi ontrib tor to s ess.in ivi al to get training, to follow the stan ar s an to apply Level 5 – op m ed processthe . Root a se analysis is o asionally applie . Most here is visionary n erstan ing of I governan e iss espro esses are onitore against so e baseline etri s, b t an sol ons. raining an o ni a on is s pporte byany evia on, while ostly being a te pon by in ivi al lea ing e ge on epts an te hni es. Pro esses have beenini a ve, wo l nlikely be ete te by anage ent. reﬁne to the level of e ternal best pra es, base onNevertheless, overall a o ntability of key pro ess res lts of on n o s i prove ent an ben h arking withperfor an e is lear an anage ent is rewar e base on other organiza ons. he i ple enta on of these prin ipleskey perfor an e eas res. has le to an organiza on, people an pro esses that are evel organiza ons an be hara terize as having i k to a apt an f lly s pport I governan e re ire ents.establishe goo fo s on I Governan e. his level All proble s an evia ons are root a se analyze . I is on entrates oversight, pro esses an o ni a ons on se in an e tensive, integrate an op ize anner tospe iﬁ b siness ob e ves. I is be o ing e be e in the a to ate workﬂow an provi e tools to i prove ality anb siness. evel leverages I assets on an enterprise-wi e e e veness. he risks an ret rns of the I pro esses arebasis an appli a ons syste s e onstrate planne , eﬁne , balan e an o ni ate a ross the enterprise. anage ire on away fro tra i onal transa on ternal e perts are leverage an ben h arks are se forpro essing to syste s that se infor a on to ake b siness g i an e. Monitoring, an o ni a on abo t I e isions. he inter-organiza onal te hnology infrastr t re Governan e e pe ta ons are pervasive an there is op alevolves in partnership fashion. se of te hnology to s pport eas re ent, analysis, Level 4 – managed process o ni a on an training. nterprise an I governan e are strategi ally linke , leveraging te hnology an h an an here is f ll n erstan ing of I governan e iss es at all ﬁnan ial reso r es.levels, s pporte by for al training. here is a lear n erstan ing of who the I sto er is . Responsibili es evel organiza ons en oy op al I Governan e.are eﬁne an onitore thro gh servi e level agree ents. S staine governan e pro esses integrate the I strategiI pro esses are aligne with the b siness an with the I planning pro ess with the strategi b siness pro ess. evelstrategy. I prove ent in I pro esses is base pri arily organiza ons leverage I assets on an enterprise-wi e basis pon a an ta ve n erstan ing an it is possible to to e ten the rea h of the available inter-organiza onal onitor an eas re o plian e with pro e res an infrastr t re into the s pply hains of sto ers an The Infology Group, Inc.
I Governan e PAGE 6Control Categor es organiza ons, in l ing I s involve ent in eﬁning b siness strategies, the egree of tr st between the two here are si ontrol ategories, s pporte by thirty- organiza ons, an how ea h per eives the ontrib on ofeight riteria, that a ress I Governan e perfor an e. the other. Giving the I f n on the opport nity to have an Comm n ca on e al role in eﬁning b siness strategies is obvio sly he e hange of i eas, knowle ge an infor a on i portant. How ea h organiza on per eives the ontrib ona ong the I an b siness organiza ons, enabling both to of the other, the tr st that evelops a ong the par ipants,have a lear n erstan ing of the o panys strategies, ens ring appropriate b siness sponsors an ha pions of Ib siness an I environ ents, priori es an what st be en eavors, an the sharing of risks an rewar s are all a or one to a hieve the . e ve e hange of i eas an a lear ontrib tors to at re governan e. his partnership sho l n erstan ing of what it takes to ens re s essf l strategies evolve to a point where I both enables an rives hanges toare high on the list of enablers an inhibitors to align ent. both b siness pro esses an strategies. oo o en there is li le b siness awareness within I or li le 5 TechnologyI appre ia on by the b siness. Given the yna i he e tent to whi h I provi es appropriate anenviron ent in whi h ost organiza ons ﬁn the selves, a aptable syste s an servi es in s pport of the evolvingens ring ongoing knowle ge sharing a ross organiza ons is nee s of the b siness. his set of riteria ten s to assesspara o nt. Many ﬁr s hoose to raw on liaisons to infor a on te hnology at rity. he e tent to whi h I isfa ilitate this knowle ge sharing. able to: 2 Metr cs > Go beyon the ba k o e an the front o e of the he se of eas res that e onstrate the ontrib on organiza onof I reso r es to the b siness, in ter s that the b siness > Ass e a role s ppor ng a ﬂe ible infrastr t re that is n erstan s an a epts. oo any I organiza ons annot transparent to all b siness partners an sto ers e onstrate their val e to the b siness in fa iliar ter s. > val ate an apply e erging te hnologies e e velyFre ently b siness an I val e etri s i er. Servi e levels > nable or rive b siness pro esses an strategies as athat assess I s o it ents to the b siness have to be tr e stan ar ane presse in ter s that the b siness n erstan s an > Provi e sol ons sto izable to sto er an ven ora epts. he servi e levels sho l be e to riteria that nee s. learly eﬁne the rewar s an penal es for s rpassing or issing the ob e ves. Fre ently organiza ons evote 6 H man Reso rcessigniﬁ ant reso r es to eas ring perfor an e fa tors. his in l es pra es s h as training, perfor an eHowever, they spen h less of their reso r es on taking fee ba k, en o raging innova on an provi ing areera on base on these eas re ents. opport ni es, as well as the I organiza ons rea iness for 3 Overs ght hange, apability for learning an ability to leverage new i eas. Skills in l e all of the h an reso r e onsi era ons he egree to whi h the a thority for aking I for the organiza on. Going beyon the tra i onal e isions is eﬁne an share a ong anage ent, an the onsi era ons s h as training, salary, perfor an epro esses anagers, in both I an b siness organiza ons, fee ba k, an areer opport ni es, are fa tors that in l eapply in se ng I priori es an the allo a on of I reso r es. the organiza ons lt ral an so ial environ ent. Is the ns ring that the appropriate b siness an I par ipants organiza on rea y for hange in this yna i environ entfor ally is ss an review the priori es an allo a on of I Do in ivi als feel personally responsible for b sinessreso r es is a ong the ost i portant enablers/inhibitors of innova on an in ivi als an organiza ons learn i klyalign ent. his e ision- aking a thority nee s to be learly fro their e perien e Does the organiza on leverage eﬁne . innova ve i eas an the spirit of entreprene rship hese 4 Partnersh p are so e of the i portant on i ons of op ize he rela onship between the b siness an I organiza ons. The Infology Group, Inc.
I Governan e PAGE 7 Using he S ore ar We have a opte a seven-step approa h that fo ses on at rity level of the organiza ons governan e an how the n erstan ing eval a on riteria, a i izing pro ess organiza on an best pro ee .enablers, an ini izing inhibitors. 4 naly e and pr or e gaps Set the goals and establ sh a team he tea st re e ber that the p rpose of this step is ns re that there is an e e ve b siness sponsor an to i en fy a vi es that will i prove siness-I integra on. ha pion for the assess ent. Ne t, assign a tea of both On e it is n erstoo that the i erent opinions hel by theb siness an I lea ers. Obtaining appropriate par ipants reﬂe t the opport ni es for i prove ent, therepresenta ves fro the a or b siness f n onal gro p agrees on ranking. he gaps between where theorganiza ons: Marke ng, Finan e, R D, Man fa t ring an organiza on is to ay an where the tea believes it sho lDistrib on is ri al to the s ess of the assess ent. he be in the f t re are priori ze a er onsi era on of val e top rpose of the tea is to fairly s ore the I Governan e the b siness an ease of o ple on.ranking. On e the pro ess is n erstoo , the tea is 5 Spec y ac onse pe te to eﬁne opport ni es for enhan ing the he priori ze list of gaps will rive fo s on spe iﬁhar onio s rela onship of b siness an I . a ons. il a governan e roa ap with learly eﬁne 2 Understand the b s ness-IT l nkage eliverables, ownership, efra es, reso r es, risks, an he I Governan e S ore ar is an i portant tool in eas re ents for ea h of the priori ze gaps. n erstan ing the b siness-I linkage. he tea eval ates 6 Choose and eval ate s ccess cr ter aea h of the si riteria. A traine fa ilitator an be val able in his step ne essitates revisi ng the goals an reg larlyg i ing the i portant is ssions. is ssing the eas re ent riteria se to eval ate the 3 Complete the scorecard i ple enta on of the roa ap pro e ts. he review of the he e ort epen s on the n ber of par ipants, the eas re ents sho l serve as a learning vehi le topresen e of an e perien e fa ilitator, the egree of n erstan how an why the ob e ves are or are not being onsens s re ire , an the level of etail of the et.re o en a ons. a h of the riteria is assesse in ivi ally 7 S sta n mprovementby a tea of I an b siness nit e e ves to eter ine the So e proble s st wont go away. Why are so any ofranking. he s ore ar per its any riterion to be allo ate the inhibitors I relate his last step in the pro ess is o ento two or ore rankings if there is an overall re ogni on that the ost i lt. o s stain the beneﬁt fro I , a "S stainethe organiza on tr ly has an neven perfor an e. While the I prove ent ehavior" st be evelope an l vate .s ore ar an ipates ea h riterion, within a ontrol y a op ng s h behavior, o panies an in rease the ategory, will be e ally weighte , the tea an agree to poten al for a ore appropriate level of I Governan e an o ify the weigh ng. he overall ranking is al late sing reinfor e their ability to gain b siness val e fro Ithe ategory weigh ngs. hese have been preset sing invest ents. Hen e, on n o sly i proving I governan efee ba k fro any sers of the s ore ar , b t an be stan ar s to i prove I integra on is key. o iﬁe . Generally, it is the is ssions that ens e ringthe pro ess that pro ote n erstan ing of both the rrent The o om L ne Fo s on I Governan e an raise the val e of I to a higher level. We believe i -size o panies sho l strive to a ainan overall s ore ar ranking in the range of 2.8 to . with so e perfor an e riteria rea hing evel perfor an e. Infology oes not believe that i -size o panies an erive s ient beneﬁt fro an overall evel or ranking to s fy theinvest ent re ire to a hieve the res lt. O r prag a approa h provi es signiﬁ ant i prove ent with ely ret rn oninvest ent, while working in a fra ework g i ing the strategi ire on for f t re i prove ents. The Infology Group, Inc.