Transforming Enterprise IT Ref: www.isaca.org/cobit

IT Governance Is the Key Issue Enterprises are giving money, productivity and competitive advantage by not implementing effective IT governance A better way to: Direct IT for optimal advantage Measure the value provided by IT Manage IT-related risks IT governance goes a long way towards bridging the gap between corporate expectations and perceptions of the IT function. The need for top management direction and oversight regarding the value of IT and the management of IT-related risks are now understood as key elements of governance. Value, risk and control constitute the core of IT governance. IT governance consists of the leadership, organisational structures and processes that ensure that the enterprise’s IT sustains and extends the enterprise’s strategies and objectives. Governance is not the sole responsibility of the CIO; it is the responsibility of an enterprise’s top executives and board of directors. Successful enterprises understand the risks and exploit the benefits of IT and find ways to deal with: • Aligning IT strategy with the business strategy • Ensuring investors and stakeholders that a ‘standard of due care’ around mitigating IT risks is being met by the enterprise • Providing organisational structures that facilitate the implementation of strategy and goals • Measuring IT’s performance These are the benefits of sound IT governance.

IT Governance The purpose of IT governance is to direct IT endeavors, to ensure that IT’s performance meets the following objectives: • Alignment of IT with the enterprise and realisation of the promised benefits • Use of IT to enable the enterprise by exploiting opportunities and maximising benefits • Responsible use of IT resources • Appropriate management of IT-related risks

Focus Areas of IT Governance

Why do we need a Framework? Increasing dependence on information and the systems that deliver this information Increasing vulnerabilities and a wide spectrum of threats, such as cyberthreats and information warfare Scale and cost of the current and future investments in information and information systems The need to comply with regulations The potential for technologies to dramatically change organisations and business practices, create new opportunities and reduce costs Recognition by many organisations of the potential benefits that technology can yield

Who Needs a Framework? Board and Executive To ensure management follows and implements the strategic direction for IT Management To make IT investment decisions To balance risk and control investment To benchmark existing and future IT environment Users To obtain assurance on security and control of products and services they acquire internally or externally Auditors To substantiate opinions to management on internal controls To advise on what minimum controls are necessary

COBIT Control Objectives for Information and related Technology (COBIT) is a set of best practices (framework) for IT management created by the Information systems audit and control association (ISACA), Incorporates major international standards Has become the de facto standard for overall control over IT Starts from business requirements Is process-oriented

COBIT: Basics? Starts from the premise that IT needs to deliver the information that the enterprise needs to achieve its objectives Promotes process focus and process ownership Divides IT into 34 processes belonging to four domains and provides a high-level control objective for each Considers fiduciary, quality and security needs of enterprises, providing seven information criteria that can be used to generically define what the business requires from IT Is supported by a set of over 300 detailed control objectives Plan and Organise Acquire and Implement Deliver and Support Monitor and Evaluate Effectiveness Efficiency Availability Integrity Confidentiality Reliability Compliance

Overview of CobiT Then what is CobiT? It is the Control Objectives for Information and related Technology A methodology consisting of standards and controls created to assist IT professionals in the implementation, review, administration and monitoring of an IT environment. The CobiT Executive Summary and Framework were released in December 1995, Control Objectives in April 1996, and Audit Guidelines followed in September 1996. A tool that for IT professionals that has linked information technology and control practices CobiT consolidates and harmonizes standards from prominent global sources into a critical resource for management, control professionals and auditors.

Overview of CobiT CobiT represents A control framework, a set of generally accepted control objectives, and the CobiT Audit Guidelines. CobiT is based on the philosophy that IT resources need to be managed by a set of naturally grouped processes in order to provide the pertinent and reliable information an organization needs to achieve its objectives. CobiT is business process oriented provides the business process owners with a framework, which should enable them to control all the different activities underlying IT deployment.

Overview of CobiT What is the purpose of CobiT? To provide management and business process owners with an Information Technology (IT) governance model that helps in understanding and managing the risks associated with IT. CobiT helps bridge the gaps between business risks, control needs and technical issues by presenting the controls through one vehicle. It is a control model to meet the needs of IT governance and ensure the integrity of information and information systems.

Components of CobiT

PLANNING & ORGANIZATION (PO) ACQUISITION & IMPLEMENTATION (AI) Components of CobiT The 4 Domains of CobiT MONITORING (MO) PLANNING & ORGANIZATION (PO) ACQUISITION & IMPLEMENTATION (AI) DELIVERY & SUPPORT (DS)

MONITORING (MO) Components of CobiT All IT processes need to be regularly assessed over time for their quality and compliance with control and regulatory requirements Auditors need to perform procedures to ensure that the IT environment meets predefined standards with respect to controls. M1- Monitor the process M2- Obtain independent assurance

PLANNING & ORGANIZATION (PO) Components of CobiT PLANNING & ORGANIZATION (PO) Addresses strategy and tactics, and concerns the identification of the way information technology can best contribute to the achievement of business objectives. Is the IT strategy be effectively controlled and will it contribute to the business objectives? PO1- Define a strategic IT plan PO2- Define the Information architecture PO3- Determine technical direction PO4- Define IT Organization and relationships PO5- Manage the investment in IT PO6- Communicate management aims and directions PO7- Manage Human Resources PO8- Ensure compliance with external requirements PO9- Assess risks PO10- Manage projects PO11- Manage quality

ACQUISITION & IMPLEMENTATION (AI) Components of CobiT ACQUISITION & IMPLEMENTATION (AI) To realize the IT strategy, IT solutions need to be identified, developed and/or acquired as well as implemented and integrated into the business process. Is the process to choose and implement IT solutions a controlled process? Does this process meet control standards? AI1- Identify solutions AI2- Acquire and maintain application software AI3- Acquire and maintain technology architecture AI4- Develop and maintain IT procedures AI5- Install and accredit systems AI6- Managing changes

DELIVERY & SUPPORT (DS) Components of CobiT DELIVERY & SUPPORT (DS) Addresses the actual delivery of required information services. Are information related services delivered in a controlled manner? DS8- Assist and advise IT customers DS9- Manage the configuration of IT systems DS10- Manage problems and incidents DS11- Manage data DS12- Manage facilities DS13- Manage operations DS1- Define service levels DS2- Manage Third Party services DS3- Manage performance capacity DS4- Ensure continuous service DS5- Ensure systems security DS6- Identify and allocate costs DS7- Educate and train users

COBIT is a Road Map for an easy IT Governance Accepted globally as a set of tools that ensures IT is working effectively Functions as an overarching framework Provides common language to communicate goals, objectives and expected results to all stakeholders Based on, and integrates, industry standards and good practices in: Strategic alignment of IT with business goals Value delivery of services and new projects Risk management Resource management Performance measurement The COBIT mission is to research, continually update, publicise and promote an authoritative, internationally accepted IT governance control framework for adoption by enterprises and day-to-day use by business managers, IT professionals and assurance professionals. Now in its 4.1 release, the framework has been used successfully by IT organisations and business executives in many industries and of many sizes. COBIT provides a common language to communicate goals, objectives and expected results. A common language benefits all levels of IT, including management and stakeholders.

Business Benefits COBIT® provides guidance for executive management to govern IT within the enterprise More effective tools for IT to support business goals More transparent and predictable full life-cycle IT costs More timely and reliable information from IT Higher quality IT services and more successful projects More effective management of IT-related risks COBIT delivers significant benefits in areas that are fundamental to every enterprise: value, risk and control. Implementing COBIT also provides: Clearer security and privacy requirements, and more easily monitored implementation More efficient and successful audits IT compliance with regulatory requirements will become a normal management practice

Harmonizing the Elements of IT Governance Resource Management Strategic Alignment Value Delivery Performance Measurement Risk Management COBIT is based on the analysis and harmonisation of existing IT standards and good practices and conforms to generally accepted governance principles. It is positioned at a high level, driven by business requirements, covers the full range of IT activities, and concentrates on what should be achieved rather than how to achieve effective governance, management and control. Therefore, it appeals to executive management; business and IT management; governance, assurance and security professionals; and IT audit and control professionals. • Strategic alignment focuses on ensuring the linkage of business and IT plans; defining, maintaining and validating the IT value proposition; and aligning IT operations with enterprise operations. • Value delivery is about executing the value proposition throughout the delivery cycle, ensuring that IT delivers the promised benefits against the strategy, concentrating on optimising costs and proving the intrinsic value of IT. • Risk management requires risk awareness by senior corporate officers, a clear understanding of the enterprise’s appetite for risk, understanding of compliance requirements, transparency about the significant risks to the enterprise and embedding of risk management responsibilities into the enterprise. • Resource management is about the optimal investment in, and the proper management of, critical IT resources: applications, information, infrastructure and people. Key issues relate to the optimisation of knowledge and infrastructure. • Performance measurement tracks and monitors strategy implementation, project completion, resource usage, process performance and service delivery, using, for example, balanced scorecards that translate strategy into action to achieve goals measurable beyond conventional accounting.

The COBIT® Framework Let’s take a closer look at the COBIT framework. COBIT defines IT activities in a generic process model within four domains along with a set of information criteria. The four domains are: Plan and Organise, Acquire and Implement, Deliver and Support, and Monitor and Evaluate. The domains map to IT’s traditional responsibility areas of plan, build, run and monitor. The COBIT framework provides a reference process model and common language for everyone in an enterprise to view and manage IT activities. Incorporating an operational model and a common language for all parts of the business involved in IT is one of the most important and initial steps towards good governance. It also provides a framework for measuring and monitoring IT performance, communicating with service providers and integrating best management practices. A process model encourages process ownership, enabling responsibilities and accountability to be defined. • Plan and Organise (PO)—Provides direction to solution delivery (AI) and service delivery (DS) (example controls: Define Strategic IT Plan, Manage Quality) • Acquire and Implement (AI)—Provides the solutions and passes them to be turned into services (example controls: Identify Automated Solutions, Manage Changes) • Deliver and Support (DS)—Receives the solutions and makes them usable for end users (example controls: Define and Manage Service Levels, Identify and Allocate Costs • Monitor and Evaluate (ME)—Monitors all processes to ensure that the direction provided is followed (example controls: Ensure Regulatory Compliance, Monitor and Evaluate IT Performance)

The high-level approach diagram of information system audits Approch Ref- http://www.isaca.org/Knowledge-Center/cobit/Pages/Government-of-Dubai.aspx

Operationalising CMMI: integrating CMMI and CoBIT perspective Ref- http://www.emeraldinsight.com/journals.htm?articleid=1954554&show=html

The COBIT model groups all information and IT activities into four domains, which are articulated into 34 processes Ref: http://www.isaca.org/Journal/Past-Issues/2008/Volume-4/Pages/Case-Study-Better-to-Prevent-Than-Cure-A-New-Way-to-Enhance-IT-and-Business-Governance-Collaboration.aspx

Ref:http://educore.info/tag/cobit/

COBIT® Defines Processes, Goals and Metrics Relationship Amongst Process, Goals and Metrics (DS5) The chart illustrates the relationship between the business, IT, process and activity goals, and the different metrics. From top left to top right, the goals cascade is illustrated. Below the goal is the outcome measure for the goal. The small arrow indicates that the same metric is a performance indicator for the higher-level goal. The example provided is from DS5 Ensure systems security. COBIT provides metrics only up to the IT goals outcome as delineated by the dotted line. While they are also performance indicators for the business goals for IT, COBIT does not provide business goal outcome measures. The metrics have been developed with the following characteristics in mind: • A high insight-to-effort ratio (i.e., insight into performance and the achievement of goals as compared to the effort to capture them) • Comparable internally (e.g., percent against a base or numbers over time) • Comparable externally irrespective of enterprise size or industry • Better to have a few good metrics (may even be one very good one that could be influenced by different means) than a longer list of lower-quality metrics • Easy to measure, not to be confused with targets

Defined Responsibilities for Each Process RACI Chart A RACI chart identifies who is Responsible, Accountable, Consulted and/or Informed. Functions Activities Link business goals to IT goals. C I A/R Identify critical dependencies and current performance. R Build an IT strategic plan. A Build IT tactical plans. Analyse programme portfolios and manage project and service portfolios. COBIT also provides information on what processes should be delegated and to whom they should be delegated. This helps to ensure that IT processes are being managed at the appropriate level within an enterprise. The ‘RACI’ Chart is defined for each process and indicates who is responsible, accountable, consulted or should be informed about specific tasks within a given process. The roles in the RACI chart are categorised for all processes as: • Chief executive officer (CEO) • Chief financial officer (CFO) • Business executives • Chief information officer (CIO) • Business process owner • Head operations • Chief architect • Head development • Head IT administration (for large enterprises, the head of functions such as human resources, budgeting and internal control) • The project management officer (PMO) or function • Compliance, audit, risk and security (groups with control responsibilities but not operational IT responsibilities)

COBIT® Products and Their Primary Audience COBIT products have been organised into three levels designed to support: • Executive management and boards • Business and IT management • Governance, assurance, control and security professionals This COBIT-based product diagram presents the generally applicable products and their primary audience. There are also derived products for specific purposes (IT Control Objectives for Sarbanes-Oxley, 2nd Edition), for domains such as security (COBIT® Security Baseline and Information Security Governance: Guidance for Boards of Directors and Executive Management), or for specific enterprises (COBIT® Quickstart for small and medium-sized enterprises or for large enterprises wishing to ramp up to a more extensive IT governance implementation). COBIT, Risk IT and Val IT frameworks Implementing and Continually Improving IT Governance COBIT User Guide for Service Managers COBIT and Application Controls

IT Governance Focus Areas Ref: http://www.isaca.org/Knowledge-Center/cobit/Documents/COBIT4.pdf

... IT Governance Focus Areas Strategic alignment focuses on ensuring the linkage of business and IT plans; defining, maintaining and validating the IT value proposition; and aligning IT operations with enterprise operations. • Value delivery is about executing the value proposition throughout the delivery cycle, ensuring that IT delivers the promised benefits against the strategy, concentrating on optimising costs and proving the intrinsic value of IT. • Resource management is about the optimal investment in, and the proper management of, critical IT resources: applications, information, infrastructure and people. Key issues relate to the optimisation of knowledge and infrastructure. • Risk management requires risk awareness by senior corporate officers, a clear understanding of the enterprise’s appetite for risk, understanding of compliance requirements, transparency about the significant risks to the enterprise and embedding of risk management responsibilities into the organisation. • Performance measurement tracks and monitors strategy implementation, project completion, resource usage, process performance and service delivery, using, for example, balanced scorecards that translate strategy into action to achieve goals measurable beyond conventional accounting.

Management statement on IT Governance “IT governance is the responsibility of Telco’s executives to install a system of management control that ensures that Telco’s business objectives are achieved through end-to-end processes, quality of information and the supportive IT. This consists in our opinion of directing Telco’s IT resources towards optimal performance aiming for: - IT to be aligned with the business and the business processes; - IT resources to be used in a controlled structure; - IT risks to be assessed and to be managed appropriately.”  “Further formalisation of goal setting and performance monitoring of the overall IT program could be enforced by regular internal audits.”

Forces influencing IT Governance IT Governance Institute Erik Guldentops Value (Brookings Institute) 85% of market value of enterprises is intangible (knowledge, information, capability…) Institutional investors willing to pay up to 20% premium for shares of enterprises that have governance framework IT Governance Trust (McKinsey) Assurance (Turnbull) Regulations establishing responsibility of enterprise officers for internal control and risk transparency. Trust can vanish overnight. A factory cannot. Survival (Alan Greenspan) www.itgi.org

IT Governance Lifecycle IT Governance Institute approach IT governance, like other governance subjects, is the responsibility of executives and shareholders (represented by the board of directors). It consists of the leadership and organisational structures and processes that ensure that the organisation’s IT sustains and extends the organisation’s strategies and objectives. Definition Provide Direction Compare Measure Performance IT Activities Increase automation (make the business effective) Decrease cost (make the enterprise efficient) Manage risks (security, reliability and compliance) IT is aligned with the business, enables the business and maximises benefits IT resources are used responsibly IT related risks are managed appropriately Set Objectives Framework IT Governance Lifecycle Environment Ethics & Culture Laws & Regulations Mission & Vision Role Models Industry Practices …... Alignment Delivery Value Management of Risk Monitoring & Reporting Evaluation Lifecycle

Ex-Organisatie Telco RvB Corporate staf Division Fixed Division Mobile IT Operators IT partners

IT Governance framework DIO focus CIO focus Business Information Systems Information Technology Strategy Structure product, process, organisation use of information and transport IT products, security IT management Implementation Business Alignment Demand Management

Expertise in IT Governance Information Systems Information Technology Business Compliance management Sourcing Information Economics Strategy Third Party Assurance Information architecture Management of change Structure User/Application controls Security/ Operations IT Service Management Implementation Business Alignment Demand Management

IT Governance is ...... IT management Business orientatie Extern IT Governance IT Control IT Management Intern Tijds dimensie Heden Toekomst Ontleend aan IT Governance mechanismen: Wim van Grembergen en Steven de Haes, Kluwer 2004

Visit www.isaca.org/cobit to download the COBIT® framework Getting Started Visit www.isaca.org/cobit to download the COBIT® framework If you would like to learn more, or are interested in taking the first steps, you will find that our web site has a wealth of material. The site offers not only a PDF version of COBIT you can download free of charge, it also offers archived Webcasts, case studies, access to the online discussion forum, and information on COBIT training.

TOM detail: Spider Diagrams Customer Customer INPUTS OUTPUTS Customer Interface Man. Customer Interface Man. Notifications Trouble Reports, Status reports Trouble reports Order Handling Major Trouble Reports Problem Handling Sales QoS & SLA terms, Profiles - Receive trouble notif - Determine cause &resolve Request to re-configure Service Configuration - Track progress of resolution Service Configuration Completion notification - Initiate action to reconfigure - Generate TT to suppliers Other Provider(s) - Confirm trouble cleared Trouble report Other Provider(s) Trouble report, Trouble cleared - Notify cust. trouble cleared - Schedule with and notify customer of planned work Problem reports Service Problem Resolution Trouble report, Trouble cleared Customer QoS Man. Trouble report* SLA violations, Planned mtc. scheduling and notification Customer QoS Man. SLA/QoS violations, Trouble reports Service Problem Resolution QoS Violations Service Quality Man. Rating & Discounting

Governance - architectuur 1. Domains: 2. Governance structure : Company wide steering committee; chair RvB member Board responsibilities like wise (Fixed, Mobile, CFO) Clear domain accountability (domain manager) Linkage to business via sponsor, steer by domain management: 3. Roles /responsibilities in conformance with baseline document: Domain manager (reporting to DIO), DIO & CIO Program office per division chaired by DIO Architectural board chaired by CIO (with participation of division) fixed mobile corporate Sales Fulfillment Billing Sales Fulfillment Billing Sales Fulfillment Billing Enterprise mgmt. Enterprise mgmt. Enterprise mgmt. Service Backbone Service Backbone Service Backbone Marketing Operations Purchasing Marketing Operations Purchasing Marketing Operations Purchasing business sponsor (MT member) working mode domain mngr operational mngt

Different Levels of IT Control Strategic Core Possible Outsourcing Tactic Operational

Clear governance relationships Business view Technology view Business strategy Processes Domains/services Applications Technology Strategic aspiration Business plan Value proposition Going-to-market model Business processes Business rules Domain structure Functional architecture Data architecture Domain services Governance model Application programs and modules Databases Connectivity Hardware, opera-ting systems, net-works Middleware, data-base management systems Business IT Demand (CIO/DIO) IT Supply (IT Service organizations)

Demand Management Organization Supply IT Axioms Portfolio - Target architecture Purchasing Contract standards Preferred Suppliers - Legal guidelines Operations Software maintenance/ supply Infrastructure Business Functional requirements Usage Money Demand Mngt - “Broker” - Functional characteristics - Quality Assurance - Maintenance documentation Selection functionality Implementation/Control SLA

Business alignment demand supply Example:Telco adoption of CobiT Framework BUSINESS PROCESSES INFORMATION effectiveness efficiency confidenciality integrity availability compliance reliability Criteria COBIT IT RESOURCES data aplication systems technology facilities people PLANNING AND ORGANISATION AQUISITION AND IMPLEMENTATION DELIVERY AND SUPPORT MONITORING Business alignment In order to provide the information that the organization needs to achieve its objectives, IT resources need to be managed by a set of naturally grouped processes. demand supply

Gartner Advisory on CobiT and ITIL Activities BS7799 Security CobiT Control WHAT HOW Ref: itgi.org,

Ex-IT Control Framework CobiT Supply Demand Key Control Objectives Manage Changes Manage IT-configurations Manage IT incidents and problems Manage Security Manage Service levels Manage Business Continuity Manage IT Costs Manage Business Information Planning Manage Releases (Project Management) Manage IT Sourcing ITIL Processes Plus