Your IT Governance Coach

Starting the IT governance conversation in college

I am becoming more aware of the responsibility we have as IT professionals to help high school students and college students better understand the benefits of a career in IT. Recent statistics show a decline in enrollment in computer science and MIS degrees. I have already started mentoring existing college students and helping recruit. What I had not thought about is that we can start having the IT governance education and conversation with students in other disciplines now. I just read an article in ComputerWorld by Paul M. Ingevaldson, retired CIO at ACE Hardware. In his article entitled "IT, We Have a Problem -- Revisited" Paul talks about his attempt at lecturing about IT governance to a class of MBA students.

His first attempt failed as the students had the belief that IT should govern itself, just as they would govern their own projects. It was not until he went back and used case studies that the students "got" that IT governance begins at the top of the company and as future business leaders they will play a critical role. I got two ideas out of his article: to begin the IT governance discussion early and to use case studies to drive the point.

Technorati Tags: IT Governance

Friendster's Saga Exemplifies Importance of Basic Leadership and Governance

Lack of leadership and governance brought down Friendster.

June's issue of Inc. has a cover story by Max Chafkin on Jonathan Abrams, founder of Friendster and the issues that turned the first social network site from a promising great business into a relative failure. The story is called "How to Kill a Great Idea" As I read the story I realized that the issues that brought Friendster down are the same issues that as a management consultant I see in so many companies. They may not have the money or visibility as Friendster, but unchecked, they could lead to the same results. People believed Friendster was destined to great success because it was a "bold idea backed by experienced investors and the best managers money could buy." Why did it fail?

I believe that this great talent failed in the basics of leadership: collaboratively defining a direction, getting the entire team aligned to that direction, and creating the commitment to each other, to the team, and to the purpose of the company necessary to overpower all the individual agendas. From a governance perspective it failed in the basics of defining what the critical decisions were, who was accountable to make them, and agreeing on how they would be made.

From the article I read about a management team with as many directions and priorities as they had talented managers. Some were heavily investing in re-writting the code to ease some of the long load times, without getting the engineers aligned that it was the best course of action. "Engineers were not convinced that the big re-write was necessary. There was constant bickering and side projects that went nowhere." Management members were passionately establishing content partnerships without alignment among board members that it was the right number or kind of partnerships to establish. Apparently, there was a "lack of spending discipline" in correcting engineering problems. Supposedly, the board of directors realized the team was dysfunctional, but was "loath to micromanage." What was their accountability?

Great idea. Lots of Money. Fantastic Talent. However, basic leadership and governance principles were not applied, causing synergies, talent, and resources to be wasted. Also causing a disconnect with what their users really wanted or needed. This scenario repeats over and over in so many business from corporate officers to small departments. Consultant Ram Charan says one of his favorite phrases is "purpose before self." If more of us took that virtue as a corporate motto, more businesses would be exceedingly successful.

Technorati Tags: Leadership

ABC: An Introduction to IT Governance

Karen D. Schwartz from CIO magazine did a wonderful job pulling together many topics to provide an easy to understand introduction to the topic of IT governance in the article entitled "ABC: An Introduction to IT Governance." In this IT governance primer she covers the following topics:

• What is IT governance?
• Is it something every organization needs?
• What are the drivers that motivate organizations to implement IT governance infrastructures?
• What’s the business case? That is, how can I convince top management that we need to do this?
• What are the major focus areas that make up IT governance?
• This appears pretty complicated; how do you actually implement everything involved in IT governance?
• There are a lot of framework choices. How do I choose?
• Can we do this alone, or should we get some outside help?
• What can go wrong if it’s not implemented effectively?
• What are some tips for making sure it goes smoothly and delivers positive results?

Here's an excerpt from a frequent question: There are a lot of framework choices. How do I choose?

"Most companies go with CoBIT or ITIL, but others can also fit the bill. For operations, try ITIL. For application development and lifecycle issues, try CMMI. For risk, use CoBIT. CoBIT is also a great umbrella framework. But combining frameworks can also make sense, says Ron Saull, an IT Governance Institute trustee. You might want to use CoBIT as an overall framework; then use ITIL for your operations, CMMI for development and ISO 17799 for security. In fact, combining frameworks is fairly common; the PricewaterhouseCoopers study found that in 65 percent of cases, companies use CoBIT and ITIL together or with lesser-known frameworks. But most importantly, use a framework that fits your corporate culture and that your stakeholders are familiar with. If the company is using one of these frameworks and can leverage it to be its IT governance framework, all the better."

Go read the full article...

Technorati Tags: IT Governance

Resources for Risk Assessment

Please check a few new resources on risk assessment at Alan Calder's blog. One is "Risk Assessment For Asset Owners" and the other is the more detailed ‘Information Security Risk Management for ISO27001/ISO17799.’

Technorati Tags: IT Governance, IT Risk Management

What has Changed in CobiT 4.1?

This month the IT Governance Institute published the next version of Cobit, Cobit 4.1. According to information published by ISACA, "COBIT is an IT governance framework and supporting toolset that allows managers to bridge the gap between control requirements, technical issues and business risks. COBIT enables clear policy development and good practice for IT control throughout organizations. COBIT emphasizes regulatory compliance, helps organizations to increase the value attained from IT, enables alignment and simplifies implementation of the COBIT framework.

COBIT 4.1 can be used to enhance work already done based upon earlier versions; it does not invalidate that previous work. When major activities are planned for IT governance initiatives, or when an overhaul of the enterprise control framework is anticipated, it is recommended to start fresh with the most recent version of COBIT."

I have only started to look at the new version in detail this week, but it does not look like they made major changes emanating from changes in philosophy. Overall, they made changes that help to more clearly and succinctly convey concepts, and to consolidate material that was unnecessarily divided. For example, under AI5, "Procure IT Resources" they consolidated control objectives AI5.4 (Software Acquisition), AI5.5 (Acquisition of Development Resources), and AI5.6 (Acquisition of Infrastructure, Facilities, and Related Services) into one control objective, AI5.4 (IT Resources Acquisition: Protect and enforce the organization's interests in all acquisition contractual agreements, including the rights and obligations of all parties in the contractual terms for the acquisition of software, development resources, infrastructure and services.) They similarly changed I7.9, AI7.10 and AI7.11 by combining them with AI7.8. They also revised ME3 to include compliance with contractual requirements in addition to legal and regulatory requirements.

I have found valuable how they expanded the explanation and graphics associated with the use of IT goals and metrics within the Framework section and the rework and graphics associated with application controls such as completeness, accuracy, validity, authorization, and segregation of duties.

Technorati Tags: CobiT

IBM Increases Focus on IT Governance and Risk Management

"IBM Corp. has become the latest IT vendor to talk up its strategy around IT governance and risk management software and services, a key area that's grown in importance for users struggling to comply with a rising tide of mandated regulations and rapidly changing business environments.

IBM unveiled several new and enhanced products on Tuesday, some incorporating technologies the company has bought, notably the Netcool software from its purchase of network management specialist Micromuse in February 2006. Other acquisitions have also helped IBM beef up its governance and risk management (GRM) offerings such as the purchases of Internet Security Systems, compliance and auditing technology vendor Consul and enterprise content management company FileNet."

See the rest of the story at ITWorld.com, "IBM deepens focus on governance, risk management" article by China Martens

Technorati Tags: IT Governance Tools

HP Continues to Grow their Impact on enabling IT Governance

From Physorg,com:

"Together, HP's OpenView enterprise management software portfolio and Mercury product lines give HP "end-to-end management of the entire IT life cycle," HP President and CEO Mark Hurd said at the time of the acquisition. "This allows our customers to use IT as a business enabler, rather than serving as an obstacle." "

"The demand for IT governance capabilities comes at a time when companies are looking for ways to better link their IT infrastructures and business needs, according to industry observers. Companies are running 24/7 front-facing Web sites, focusing more on data center operations, and trying to find ways to reduce monthly power bills associated with power and cooling of all that hardware.

In addition, new government regulations, both foreign and domestic - such as the Sarbanes-Oxley Act in the United States and Basel II in Europe - require enterprises to maintain control of all company data for years at a time for e-discovery and litigation purposes, analysts and vendors say."

Technorati Tags: IT Governance Tools

Improvements to CobiT and ITIL

From NetworkWorld article "Industry improves upon best practice frameworks" by Denise Dubie:

"The rate of change in today's enterprise companies demands even best-practice frameworks evolve to keep up with business needs.

That is the thinking behind updates to process guidelines within the IT Infrastructure Library (ITIL) and last week's update to the Control Objectives for Information and related Technology, or COBIT.

The creators of ITIL will later this month reveal updates to the set of best practices around IT service management and delivery. In fact, ITIL Version 3 is expected to provide more prescriptive advice based on real-world use scenarios of the best practice framework, yet remain vendor agnostic.

The IT Governance Institute (ITGI) last week published COBIT 4.1, an incremental update to the IT governance framework which "ensures that IT is aligned with business goals, its resources are used responsibly and its risks are managed appropriately."

Among the updates in this release are enhanced performance measurement, improved control objectives and better alignment of business and IT goals, ITGI officials say.

“COBIT is the only management framework that addresses the complete life cycle of IT investment. The framework supports IT’s achievement of business objectives, ensures business IT alignment, and improves IT efficiency and effectiveness,” said Roger Debreceny, chair of ITGI’s COBIT Steering Committee, in a press release. “COBIT 4.1 is built upon practical guidance from managers around the world who use the framework to improve IT governance in their organizations, so it has been road tested and validated.” "

Technorati Tags: CobiT, ITIL

Corporate Boards Not Devoting Enough Time to IT Topics

According to a Deloitte study, "The Board and Information Technology Strategies" only 11% of the boards discuss IT governance at every meeting. Shocking? Not to me. There are many other corporate assets such as intellectual property and human resources to govern, IT is only one of them. I'd rather have them have quality conversations and effective decision making when they do meet about IT. There's something else I found interesting about the study described in the "Boards Should Walk the IT Strategy Talk" article written by Margaret Locher yesterday in CIO Magazine.

The study found that "Twenty-two percent of the 455 respondents, all directors of companies with revenue of $1 billion or more, said that they blame IT strategy for the companies' inability to achieve its goals. But they don't plan to work toward improving the strategy: 52 percent said their board won't spend any more time on IT over the next three years than it does now."

22% believe their company did not achieve their goals because of IT? I find it interesting that the problem given was "IT's strategy," and not the corporation's strategy to exploit the use of technology. What is then shocking is that after stating that the main problem was a deficient IT strategy they said they were not going to increase the attention they gave to IT topics. Does that make sense? The definition for IT governance found in CobiT begins with "IT governance is the responsibility of executives and the board of directors, and..."

Governance is all about choosing what decisions matter most to an organization and then ensuring those decisions can be made effectively and efficiently to achieve corporate goals. The 22% of the board directors who singled out IT for adversely impacting their company had the accountability to ensure there was a good integration of business unit and IT strategies and to ensure adequate monitoring was in place to carry out those strategies. Does the CIO and others deserve some blame? More than likely, but accountability for IT governance begins with the board.

Technorati Tags: CobiT, IT Governance

YITGC CIO Time Wasters

What are common CIOs time wasters?  In the May 7, 2007 issue of ComputerWorld Sandra Rossi writes about a study Gartner conduted on "CIO Time Wasters" by interviewing 150 CIOs. In this podcast I cover the 6 time wasters mentioned by Gartner VP John Mahoney and discuss IT governance implications to them.

Do you want to learn more about this topic? Please listen to this PodCast now by clicking this link.  If you are reading this in the blog, you may also subscribe to it and automatically get future releases for free by clicking the iTunes or RSS orange buttons on the left column.