1. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 Measuring the Unmeasurable: Governance & Management of Information Technology Mark Toomey Author: Waltzing with the Elephant Managing Director Infonomics Pty Ltd Member, Standards Australia Committee IT-030 Member, ISO/IEC JTC-1 WG6 Page 1 9:00/0

2. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 Today’s briefing The topic, and the problem: Governance of Information Technology; The ISO 38500 Framework for governance; The Infonomics approach to assessment; What we learn about governance effectiveness. Page 2 9:00/1

3. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 The topic and the problem: Page 3 … IT keeps going wrong! 2004 Five Day Fiasco 2005 Cargo Management 2006 ERP Consolidation 2007 Futures Market 2009 Amadeus 2010 Crippled 2010 Year 2010 2008 Terminal 5 Choked 9:01/3

4. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 The promise of Information Technology... Page 4 Photos: (1) http://velocityresource.com/RS6AvantPlus.aspx and Audi. (2) Public domain – widely circulated email 9:04/1... or a shattered dream.

5. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 We have tried to make IT better… …but we have missed the key issue! Page 5 9:05/2

6. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 ISO 38500: First Glance Australian guidance leads the world… 22 May, 2015 Page 6 9:10/2

7. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 Corporate Governance: The System by which entities are directed and controlled. (Cadbury) Corporate Governance: The System by which entities are directed and controlled. (Cadbury) The ISO 38500 Framework for governance : Part of Corporate Governance. Page 7 Adapted from “Corporate Governance – A Working Definition”, Teresa Barger, Director IFC/World Bank Corporate Governance Department Governance “Protect owners interests” Governance “Protect owners interests” Management “Develop business capabilities” “Run business operations” Management “Develop business capabilities” “Run business operations” Ownership “Appoint the Directors” Ownership “Appoint the Directors” Establish Strategy Establish Strategy Direct Monitor Definition from “Report of the Committee on the Financial Aspects of Corporate Governance” (Chair: Sir Adrian Cadbury), London, 1992 9:07/2

8. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 The System of Management Ongoing business operations Strategic Business Future Demand Supply Demand Supply Reliable IT Service Effective IT enabled change Information technology in context... Page 8 Business Domain: How IT is used to enable and operate the business IT Domain: How IT is managed and delivered. 9:09/2... management responsibilities.

9. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 The System of Management Ongoing business operations Strategic Business Future Demand Supply Demand Supply Reliable IT Service Effective IT enabled change Business Domain: How IT is used to enable and operate the business IT Domain: How IT is managed and delivered. Information technology in context... Page 9 9:11/1 The System of Management Ongoing business operations Strategic Business Future Supply Reliable IT Service Effective IT enabled change Business Domain: How IT is used to enable and operate the business IT Domain: How IT is managed and delivered. Demand

10. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 Governance Evaluate Information technology in context...... Governance oversees management. Page 10 Management Responsibility Top level oversight The System of Governance 9:12/1 The System of Management Ongoing business operations Strategic Business Future Supply Reliable IT Service Effective IT enabled change Business Domain: How IT is used to enable and operate the business IT Domain: How IT is managed and delivered. Demand Direct Monitor Current & proposed demand for & supply of IT

11. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 Governance Evaluate Governance and management of IT...... a symbiotic system... Page 11 Management Responsibility Top level oversight The System of Governance 9:13/1 The System of Management Business Domain: How IT is used to enable and operate the business IT Domain: How IT is managed and delivered. Ongoing business operations Supply Reliable IT Service Demand Strategic Business Future Supply Effective IT enabled change Demand Direct Monitor Current & proposed demand for & supply of IT Evaluate Plans, Policies Performance Conformance Direct Monitor Current and Future use of IT IT enabled business operations IT enabled business change projects Business Pressures Business Needs

12. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 Governance and management of IT...... a symbiotic system... Page 12 Governance The System of Management Evaluate Plans, Policies Performance Conformance Direct Monitor Current and Future use of IT IT enabled business operations IT enabled business change projects Business Pressures Business Needs Business Pressures Governance Management Evaluate Plans, Policies Performance Conformance Direct Monitor Current and Future use of IT IT enabled business change projects IT enabled business operations Business Needs 9:14/2

13. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 Governance and management of IT...... a symbiotic system based on principles. ISO 38500 principles Responsibility; Strategy; Acquisition; Performance; Conformance; Human Behaviour. Page 13 Business Pressures Governance Management Evaluate Plans, Policies Performance Conformance Direct Monitor Current and Future use of IT IT enabled business change projects IT enabled business operations Business Needs 9:16/2

14. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 The ISO 38500 Assessment Framework Are we governing and managing effectively? Page 14 What does each cell mean? How do you perform? What should you seek to improve? What consequences of improvement should you seek? 9:18/2

15. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015Page 15 The Infonomics Assessment System: The first 6 Indicators from a set of 84 points. 123456 Huh?NoVery littleSomewhat AssertionScore 1Your organisation has a formal system for Governance of (to direct and control) IT. 2All business and technology managers understand and comply with the system for Governance of IT. 3The system for Governance of IT protects you from IT failures in operations and projects. 4The system keeps management and directors properly informed of IT status. 5Ongoing business dependence on IT is well understood. 6IT is used effectively in day to day business operations and plans for IT use contribute to future business sustainability. 9:21/2 Very closeExactly

16. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015Page 16 The Infonomics Assessment System: The scoring model. Assertions reflect good practice and outcomes that would be observed in organisations that have good governance that is well aligned with ISO 38500. Consider each and score it using the 1 to 6 scale below. Score 1 if you think your organisation would not understand the point. Score 2 if your organisation would understand it, but clearly doesn’t do it. Score higher as you see the extent of alignment. 123456 Huh? NoVery littleSomewhatVery closeExactly 9:20/1

17. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 The Infonomics Assessment System: Interpretation framework. Page 17 12 3456 Unknown Gap Known Gap Weak Basic Good Exemplary Don’t know what a car is. Know what a car is: Can’t drive. Can get the car moving – crash at first corner. Can drive to many places. Crash if there’s oil on the road. Competently identifies and controls most road hazards including the bad driving of others. Never gets driving wrong, whether on public roads or race tracks. 9:23/2

18. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 The Infonomics Assessment System: Benchmarking and comparing performance Page 18 Human Communities: Who are they? How do they behave? What do they need? What motivates them? Principles Strategy Performance Human Behaviour RMIT and Infonomics research 2006-7. Published in “Achieving Business Sustainability” (Infonomics), and “Information Technology Entrepreneurship and Innovation”, edited by Fang Zhao, published by IGI Global, 2008. 9:23/1 Responsibility Acquisition Conformance

19. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 The Infonomics Assessment System: Behavior drives performance Page 19 Can improved conformance lead to better results? 9:24/1

20. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015 The Infonomics Assessment System: Cross referencing provides insight Page 20 9:25/1

21. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015Page 21 The Infonomics Assessment System: Detailed modeling exposes behaviour patterns. One executive (X1) has a much more positive view, consistently, across all assertions, including several “exemplary”. Technology managers tend to be broadly consistent in their views, and see things differently to the business managers in several areas. However most executives agree with technology managers. Broader engagement and some comfort in finance may be linked to closer engagement on SAP. The “black holes” reflect poor business engagement and participation in setting the IT agenda. Improvement in this area would almost certainly help performance in other areas. Alignment Index = 3 Overall View 9:26/1

22. ©2010 Infonomics Pty Ltd Governance & Management of IT 22 May, 2015Page 22 Questions More information: www.infonomics.com.au The Infonomics Letter Waltzing with the Elephant Today’s slides: www.infonomics.com.au/PresACOSM2010.htm 9:27/1