IT Governance, Risk, and Compliance » ITGI

Achieving Not-for-profit Organizational Objectives through IT Governance Deployment – Part VI

Robert Davis — Mon, 26 Apr 2010 17:51:28 +0000

Governing an entity mandates management accurately conceptualize information criticality and communication paths. Reflective of the Australian/New Zealand Standard on Risk Management (AS/NZS ISO 31000:2009), risk management is an iterative process consisting of steps, which when taken in sequence, enable continual improvement in decision-making. It is also the logical and systematic method of identifying, analyzing, evaluating, treating, monitoring and conveying risks associated with any system, process, activity, or task in a way that will enable an entity to minimize losses and maximize opportunities. Consequently, management of risk represents the means by which an entity elects to administrate cataloged possibilities. As alternative responses, risks may be addressed by reducing, avoiding, transferring, or accepting potential threats. Specific to not-for-profit entities, these risks typically encompass: objective achievement, organizational credibility, equitable provision of services, and appropriate behavior of officials.

“View Part I of the Achieving Not-for-profit Organizational Objectives through IT Governance Deployment series here“

Achieving Not-for-profit Organizational Objectives through IT Governance Deployment – Part V

Robert Davis — Thu, 22 Apr 2010 18:34:47 +0000

Regarding supplemental value delivery design and development assistance, the Davis’ ‘Governance Tree’ offers a conceptual frame of reference for defining IT governance practices from an information and communication perspective; therefore enabling comprehensive process integration for value realization. Through the Davis’ Governance Tree, details demonstrating governance sub-domain influences can be documented utilizing specific processes and applicable controls. In addition, governance development discussions are enabled to convey evolutionary baselines necessary for measuring managerial progress. Once abstraction elements are understood, management’s role in providing strategic alignment impacting not-for-profit service delivery can be defined and enabled to address control objective deployment subscribing to IT governance mandates. Lastly, the Governance Tree can provide a comparative assessment of best practices for monitoring and evaluating IT governance strategic alignment.

“View Part I of the Achieving Not-for-profit Organizational Objectives through IT Governance Deployment series here“

Achieving Not-for-profit Organizational Objectives through IT Governance Deployment – Part IV

Robert Davis — Mon, 19 Apr 2010 19:14:44 +0000

Through misinterpretation of framework applicability, there is a widespread belief that effective IT governance can only be deployed within for-profit entities. Furthermore, when discussing not-for-profit institutions, IT governance is often used interchangeably with terms with narrower meanings; such as e-government, Information and Communication Technology (ICT), systems governance, and even digitized enterprise — that generally do not meet the necessity for a holistic managerial approach. Nonetheless, several governance frameworks and internationally recognized standards such as Control Objectives for Information and related Technology (COBIT), IT Infrastructure Library (ITIL), Val-IT and ISO 20000 have methodologies for assisting in the implementation of IT Service Management (ITSM) — an IT governance sub-layer enabling effective processes — that can create a value delivery system for most not-for-profit entities.

“View Part I of the Achieving Not-for-profit Organizational Objectives through IT Governance Deployment series here“

Achieving Not-for-profit Organizational Objectives through IT Governance Deployment – Part III

Robert Davis — Thu, 15 Apr 2010 17:31:51 +0000

Commonly, results-oriented IT services having significant value can be achieved when IT initiatives are successfully aligned with organizational strategies. However, IT alignments in not-for-profit entities are problematic because, unlike financially driven for-profit entities, they operate in more complex sociopolitical contexts, with different mandates and non-financial goals. For example, although no two countries are alike, the underlying IT objectives for governments and their agencies are commonly summarized as: value realization, service delivery, efficiency and political return. Yet, value realization and service delivery that sustains IT strategic alignment with a government’s mission remains elusive; especially where ““IT” is understood to encompass the infrastructure as well as the capabilities and organisation that establish and support it.”

“View Part I of the Achieving Not-for-profit Organizational Objectives through IT Governance Deployment series here“

Achieving Not-for-profit Organizational Objectives through IT Governance Deployment – Part II

Robert Davis — Mon, 12 Apr 2010 18:05:46 +0000

Whether an organizational formation exists for-profit, or not-for-profit; to exercise effective governance throughout an entity, the top-level oversight committee and senior executives must have a clear understanding of what to expect from an IT governance program. Logically, as defined by ISACA, IT governance is a sub-domain of enterprise governance. Based on this premise, if properly designed and deployed, IT governance should provide a generally accepted means for ensuring: information and communication requirements are strategically aligned with the not-for-profit’s designated mission, investments are value driven, and risks are managed judiciously. Thus, not-for-profit information dissemination effectiveness is measurable by the degree strategic synchronization fulfills the entity’s mission.

“View Part I of the Achieving Not-for-profit Organizational Objectives through IT Governance Deployment series here“

Second-Tier Governance Deployment – Part V

Robert Davis — Thu, 19 Nov 2009 21:16:15 +0000

Governance usually occurs at different organizational strata, with procedures tailored for processes, with processes linking up to systems, and programs receiving objectives from the entity’s oversight committee through established reporting lines. Alternatively or simultaneously, designated technological resources may provide information directly to the entity’s oversight committee for critical programs, systems, or processes. Summarily, these connectivity approaches will not be effective unless approved plans as well as organized strategic objectives and goals have first been conveyed within the entity’s organizational structure. Therefore, management should govern safeguarding information assets through an ‘objectives-based’ security program or risk excessive incidents that may impact financial stability, customer loyalty and/or employee morale.

“View Part I of the Second-Tier Governance Development series here“

How Does Management Support Deploying IT Governance?

Robert Davis — Mon, 09 Feb 2009 20:02:07 +0000

Depending on your abstraction level, IT governance can be viewed as a framework, methodology, or technique. As a framework, IT governance enables a “system of controls” assisting in assuring organizational goals and objectives are achieved effectively and efficiently. As a methodology, IT governance furnishes a description of the role entity direction and controls play in achieving information systems objectives. Lastly, as a technique, IT governance provides processes and steps that can generate superior financial and/or reputational returns for stakeholders.

If you view IT governance as a framework for assisting in organizational governance, then structurally, IT governance should be implemented as an organizational program with objectives, goals, policies, procedures, standards, and rules designed to accomplish management’s intentions. To drive controls, IT governance should subsequently receive ‘significant program’ status because other program results are directly impacted by IT governance effectiveness results — such as control self-assessment (CSA) and quality control (QC) programs. Furthermore, efficiency of controls should be obtained through models available to assist in deploying IT governance; including The Institute of Internal Auditors’ Systems Auditability and Control (SAC) framework and the Information Systems Audit and Control Association’s Control Objectives for Information and related Technology (COBIT) framework.

Alternatively, if you perceive IT governance as a description for achieving information systems objectives, the adopted IT governance methodology should provide management with a series of assessments defining control usefulness and control deployment — with IT governance effectiveness and efficiency directly related to management’s responsibility, accountability, and authority structure demonstrated. Management usually is concerned with the cost of controls and the benefits that can be derived from controls deployment and utilization while achieving an entity’s strategic direction. Hence, understanding IT governance roles are considered key to managing information systems.

If, however, you assume IT governance provides financial and/or reputational benefits, potential stakeholders are presumed to rely upon governance elements prior to investing their time, talent, and/or money. Therefore, ascertaining IT objectives effectiveness and efficiency, through monitoring, is rudimentary to sound business practices for satisfying stakeholder expectations. In this regard, effectiveness and efficiency evaluation requires measurement against established standards. The performance measures should be established when standards are created or adopted. Techniques utilized for IT governance implementation include capability maturity modeling, budgeting, benchmarking, and gap analysis. Supporting the belief that IT governance is a financial enhancement technique, the Center for Information Systems Research (CISR) has suggested that organizations with exceptional IT governance have higher profits than organizations with inferior governance, given the same strategic objective. Based on financial opportunity, with an organization’s reputation enhanced through demonstrated profitability when employing IT governance, new stakeholders may be attracted to the organization as a corollary benefit.

Whatever your perspective may be, the importance of effective and efficient IT governance cannot be overlooked in the current global high technology environment. Considering what is at stake politically, economically and technically for most organizations; usually justifying IT governance deployment based on one viewpoint narrows suitability and expected benefits. In the final analysis, combining the discussed individual abstraction levels may be the most appropriate support for implementing IT governance.