COBIT & IT Governance Control Objectives for Information and Related Technology Includes material subject to: Copyright © 2004 and 2005 IT Governance Institute. This presentation is intended solely for academic use. Agenda COBIT: Control Objectives for Information and Related Technology • The quest for effective systems and the rise of internal control regulation emphasize the need for IT governance • Exercise: How can you do on your own? • COBIT: – Where does it come from? – How does it view IT organizations? – What does it include? • Try again: Does COBIT help? • Other IT management frameworks • Key takeaways COBIT – Controlling and Auditing IS 2 Why? Reason 1: The Quest for Effective Systems • Systematically controlled IT functions “We’ll delete that old user ID later” aim to assure that IS: “We’ll write the – Provides documentation later” “Pick the best solution value, for our department” – Pushes the envelope, and “It will be plenty fast” “We won’t get – Mitigates risk hacked, we’re too small to be on a hacker’s radar” Business Management As Usual Scale Inattention and cost SOX Compliance “There’s no real need Threat vulnerability for a log file” Increased IT dependence IT’s role in organizational change COBIT – Controlling and Auditing IS 3 History Reason 2: The Rise of Internal Control Regulation • Bank scandals in the 80’s brought us the 1992 Committee of Sponsoring Organizations of the Treadway Commission (COSO) Integrated Internal Control Framework for certifying financial data systems. • WorldCom, Enron, etc.. brought us the Sarbanes-Oxley Act of 2002 (SOX). – Management is responsible for internal control and financial reporting procedures – Annual reports must asses internal controls – Officers submitting inaccurate certifications are subject to a fine up to $1m + 10 yrs, If purposeful, up to $5m + 20 years. COBIT – Controlling and Auditing IS 4 History SOX and IS • From an IS function perspective, this means, that for financial reporting systems at least, SEC companies need: – An evaluation framework for IS operations – Useful IS metrics – A systematic way to apply the framework • This perspective applies to non SEC organizations as well: – Lenders may require IS audits – Financial services companies have their own somewhat similar regulations COBIT – Controlling and Auditing IS 5 IT Governance Meeting the Challenge: IT Governance Defined • IT Governance: the leadership and organizational structures and processes that ensure that the organization’s IT sustains and extends the organization’s strategies and objectives *. Improve Performance; Reduce Risk Performance vs. Goals and Best Practices Reliability of Financial Data Regulatory Compliance * (IT Governance Institute 2003, Board Briefing on IT Governance, 2nd Ed, page 18 ) COBIT – Controlling and Auditing IS 6 The IT Governance Framework: An Governance Model BeIT a Part of the Process Provide Direction Set Objectives • IT is aligned with the business • IT enables the business and maximises benefits • IT resources are used responsibly Be • IT-related risks are Good! appropriately managed Compare IT Activities • Increase automation (make the business effective) • Decrease cost (make the enterprise efficient) • Manage risks (security, reliability and compliance) Measure Performance www.itgovernance.org - Board Briefing on IT Governance Hunton et al. Pg. 3 COBIT – Controlling and Auditing IS 7 Lets Try it Without A Framework • You are the CEO of NASDAQ. You discover that the embarrassing error reported in the article happened when a new version of a software application was put into production. You know you need a better process. – Who should be involved in making sure this kind of thing doesn’t happen again? – What controls should be put into place? – How will you tell later if the controls are working? – Will your plan convince the angry board of directors? COBIT – Controlling and Auditing IS 8 Agenda How Are We Doing? • The quest for effective systems and the rise of internal control regulation emphasize the need for IT governance • Exercise: How can you do on your own? • COBIT: – Where does it come from? – How does it view IT organizations? – What does it include? • Try again: Does COBIT help? • Other IT management frameworks • Key takeaways COBIT – Controlling and Auditing IS 9 COBIT COBIT: Control Objectives for Information and related Technology • COBIT is a process-oriented, business-goal focused, systematic framework for evaluating the IT operations within an organization. It is designed for: – Managers who need IT, – IT Providers (internal and external), and – “Auditors” concerned with risk, security, privacy, compliance, and assurance. • Stakeholders may not know how to evaluate their organizations, COBIT can help guide the process. COBIT – Controlling and Auditing IS 10 COBIT Where did COBIT come from? • The COBIT steering committee includes international representatives from industry, academia, government, and the security and control profession. • Based in the IT Governance Institute. • The COBIT group has done extensive work mapping to other standards. http://www.isaca.org/Content/NavigationMenu/Members_and_Leaders/COBIT6/Project1/COBIT_Project.htm COBIT – Controlling and Auditing IS 11 Process Oriented Infrastructure Information IT Resources Systems Assetsbrings Complexity used to achieve Organizational Goals People Information Applications special problems Because Information systems are much more complex than lunch boxes: Processes! Information systems’ acquisition, operation, and maintenance can be usefully understood as a set of IT processes. We figure out what to control in IT by looking at what we do in IT. COBIT – Controlling and Auditing IS 12 Which of These Are IT Processes In the IT Governance Sense? • • • • • NO! Just a decision Buying a new server IT Purchasing Procedures Hiring the Right People NO! Bunch of Decisions Screening Potential IT Employees Processing an invoice sent in by EDI NO! this is an IT-enabled process from a supplier • Change Management System Good Governance Creates Good Processes that LEAD TO Good Decisions and IT Systems COBIT – Controlling and Auditing IS 13 Good Processes COBIT – Controlling and Auditing IS 14 COBIT Business Goal Focused Generic Business Goals are Matched with IT Goals To offer competitive products and services, create IT agility Goals are Matched with 34 IT Processes – Define Success Achieve IT agility by adjusting HR, information architecture, and infrastructure Defined Control Objectives Support Assurance. Good data architecture keeps data to support decisions, organizes data for sharing, and verifies data reliability Process Measures Support Systematic Evaluation to Manage IT Processes Measure data architecture success in % of redundant data elements, % of applications in the plan, and frequency of validation activities. COBIT – Controlling and Auditing IS 15 COBIT’s Systematic Framework COBIT ME1 ME2 ME3 ME4 Monitor the processes Monitor and evaluate internal control Ensure Regulatory Compliance Provide IT Governance INFORMATION PO1 Define a strategic IT plan PO2 Define the information architecture PO3 Determine the technological direction PO4 Define the IT processes, organisation and relationships PO5 Manage the IT investment PO6 Communicate management aims and direction PO7 Manage human resources PO8 Manage quality PO9 Assess and manage IT risks PO10 Manage projects Does the organization • Effectiveness • Efficiency • Confidenciality plan and organize • Integrity • Availability the organization Compliance to ••Does meet MONITORadequately AND Reliability EVALUATE effectively Does theinformation organizationneeds? have and deliver and IT support IT services? PLAN AND use sound processes for RESOURCES ORGANISE acquiring and implementing IT? DELIVER AND • Data SUPPORT systems Does the organization •• Application Technology • Facilities • People monitor andservice evaluate DS1 Define and manage levels DS2 Manage third-party services DS3 Manage peformance and capacity its IT activites? ACQUIRE AND DS4 Ensure continuous service DS5 Ensure systems security DS6 Identify and attribute costs DS7 Educate and train users DS8 Manage service desk and incidents DS9 Manage the configuration DS10 Manage problems DS11 Manage data DS12 Manage the physical environment DS13 Manage operations IMPLEMENT AI1 AI2 AI3 AI4 AI5 AI6 AI7 Identify automated solutions Acquire and mantain application software Acquire and maintain technology infrastructure Enable operation and use Procure IT resources Manage Manage changes changes Install and accredit solutions and changes Page 1 AI6 – Acquire and Implement Manage Changes Control over the IT process of process name that satisfies the business requirement for IT of summary of most important IT goals is achieved by key controls and is measured by key metrics COBIT – Controlling and Auditing IS 17 Page 2 AI6 Page 2 Detailed Control Objectives Detailed Control Objectives AI6.1 Change Standards and Procedures Set up formal change management procedures to handle in a standardised manner all requests.. AI6.2 Impact Assessment, Prioritisation and Authorisation Ensure that all requests for change are assessed in a structured way for impacts on the operational system… AI6.3 Emergency Changes Establish a process for defining, raising, assessing and authorising emergency changes… AI6.4 Change Status Tracking and Reporting Establish a tracking and reporting system for keeping change requestors and relevant stakeholders up to date… AI6.5 Change Closure and Documentation Whenever system changes are implemented, update the associated system and user documentation… COBIT – Controlling and Auditing IS 18 Page 3 AI6 Management Guidelines Process Inputs and Outputs Layered Goals and Metrics RACI Chart COBIT – Controlling and Auditing IS 19 Page 4 Maturity Model Management of the process of Manage changes that satisfies the business requirement for IT of responding to business requirements in alignment with the business strategy, whilst reducing solution and service delivery defects and rework is: 0 Non-existent: No defined change management process… 1 Initial/Ad Hoc: It is recognised that changes should be managed… 2 Repeatable but Intuitive: Informal change management process… 3 Defined Process: Defined formal change management process… 4 Managed and Measurable: Change management well developed… 5 Optimised: Change management process is regularly reviewed… COBIT – Controlling and Auditing IS 20 Like Dagwood’s Boss, We Want Controls (employees?) that Work COBIT – Controlling and Auditing IS 21 COBIT Audit Guidelines An IT process is audited by: • Obtaining an understanding of business requirements-related risks, and relevant control measures • Evaluating the appropriateness of stated controls • Assessing compliance by testing whether the stated controls are working as prescribed, consistently and continuously • Substantiating the risk of the control objectives not being met by using analytical techniques and/or consulting alternative sources COBIT – Controlling and Auditing IS 22 COBIT Audit Guidelines AI6 Audit Guideline COBIT – Controlling and Auditing IS 23 COBIT Audit Guidelines AI6 Audit Guideline COBIT – Controlling and Auditing IS 24 COBIT Audit Guidelines AI6 Audit Guideline COBIT – Controlling and Auditing IS 25 Now that you have AI6… • You are the CEO of NASDAQ. You discover that the embarrassing error reported in the article happened when a new version of a software application was put into production. You know you need a better process. – Who should be involved in making sure this kind of thing doesn’t happen again? – What controls should be put into place? – How will you tell later if the controls are working? – Will your plan convince the angry board of directors? COBIT – Controlling and Auditing IS 26 Comparing Frameworks Different Frameworks: Different Emphasis • Control Objectives for Information & Related Technology (COBIT): Comprehensive checklists for IT, supports auditing, doesn’t directly address software development or give a roadmap for improvement • Capability Maturity Model Integration (CMMI): Geared for software development organizations • IT Infrastructure Library (ITIL): IT service delivery and management best practices • Six Sigma: Continuous improvement for repeatable activities (e.g., helpdesks) http://www.computerworld.com/managementtopics/management/story/0,10801,90797,00.html COBIT – Controlling and Auditing IS 27 Comparing Frameworks COBIT Asks All the Right Questions COBIT: 34 IT processes in 4 domains: COBIT defines issues, values, measurements, and responsibilities. It focuses on control over execution and strives to address all IT governance issues. COBIT – Controlling and Auditing IS 28 Comparing Frameworks CMM Helps Develop Mature Software Development Processes CMM (1993) and the later CMMI focus on improving the development, acquisition, and maintenance of systems. CMM addresses only some of the issues considered by COBIT. SEI CMM http://www.sei.cmu.edu/cmmi/general/general.html ITGI’s mapping of SEI’s CMM for Software with COBIT 4.0 COBIT – Controlling and Auditing IS 29 ITIL Presents Best Practices for IT Service Delivery ITIL, originally created by the British Government, “the only consistent and comprehensive best practice for IT service management.” ITIL provides more guidance on who should be responsible and how they should proceed. ITIL - Best practices COBIT – IT control ITGI’s mapping of ITIL With COBIT 4.0 COBIT – Controlling and Auditing IS 30 IT Governance Norms • • • • • Business Alignment A Risk/Control Perspective Accountability Continuous Improvement Systematic Measurement COBIT – Controlling and Auditing IS 31 Takeaways Key Takeaways • Forces are pushing organizations to adopt IT governance but its an uphill battle. • COBIT provides a systematic framework to evaluate IT operations. Plan, do, check, & correct. • A control perspective for IT processes is crucial to long term success. (It helps us talk nice to the CFO too!) • Thanks to the IT Governance Institute for material. COBIT – Controlling and Auditing IS 32 Back To AI6 Page 1 AI6 Manage Changes High-Level Control Objective • All changes, including emergency maintenance and patches, relating to infrastructure and applications within the production environment must be formally managed in a controlled manner. Changes (including procedures, processes, system and service parameters) must be logged, assessed and authorised prior to implementation and reviewed against planned outcomes following implementation. This assures mitigation of the risks of negatively impacting the stability or integrity of the production environment. COBIT – Controlling and Auditing IS 33 Back To AI6 Page 1 AI6 Waterfall Control over the IT process of Manage changes that satisfies the business requirement for IT of responding to business requirements in alignment with the business strategy, whilst reducing solution and service delivery defects and rework by focusing on controlling impact assessment, authorisation and implementation of all changes to the IT infrastructure, applications and technical solutions, minimising errors due to incomplete request specifications and halting implementation of unauthorised changes is achieved by • Defining and communicating change procedures, including emergency changes • Assessing, prioritising and authorising changes • Tracking status and reporting on changes and is measured by • Number of disruptions or data errors caused by inaccurate specifications or incomplete impact assessment • Application or infrastructure rework caused by inadequate change specifications • Percent of changes that follow formal change control processes COBIT – Controlling and Auditing IS 34
© Copyright 2024