COBIT IT Governance Control Objectives for Information and

COBIT & IT Governance Control Objectives for Information and Related Technology Includes material subject to: Copyright © 2004 and 2005 IT Governance Institute. This presentation is intended solely for academic use.

Agenda COBIT: Control Objectives for Information and Related Technology • The quest for effective systems and the rise of internal control regulation emphasize the need for IT governance • Exercise: How can you do on your own? • COBIT: – Where does it come from? – How does it view IT organizations? – What does it include? • Try again: Does COBIT help? • Other IT management frameworks • Key takeaways COBIT – Controlling and Auditing IS 2

Why? Reason 1: The Quest for Effective Systems • Systematically controlled IT functions “We’ll delete that old user ID later” aim to assure that IS: “We’ll write the – Provides documentation later” “Pick the best solution value, for our department” – Pushes the envelope, and “It will be plenty fast” “We won’t get – Mitigates risk hacked, we’re too small to be on a hacker’s radar” Business Management As Usual Scale Inattention and cost SOX Compliance “There’s no real need Threat vulnerability for a log file” Increased IT dependence IT’s role in organizational change COBIT – Controlling and Auditing IS 3

History Reason 2: The Rise of Internal Control Regulation • Bank scandals in the 80’s brought us the 1992 Committee of Sponsoring Organizations of the Treadway Commission (COSO) Integrated Internal Control Framework for certifying financial data systems. • World. Com, Enron, etc. . brought us the Sarbanes-Oxley Act of 2002 (SOX). – Management is responsible for internal control and financial reporting procedures – Annual reports must asses internal controls – Officers submitting inaccurate certifications are subject to a fine up to $1 m + 10 yrs, If purposeful, up to $5 m + 20 years. COBIT – Controlling and Auditing IS 4

History SOX and IS • From an IS function perspective, this means, that for financial reporting systems at least, SEC companies need: – An evaluation framework for IS operations – Useful IS metrics – A systematic way to apply the framework • This perspective applies to non SEC organizations as well: – Lenders may require IS audits – Financial services companies have their own somewhat similar regulations COBIT – Controlling and Auditing IS 5

IT Governance Meeting the Challenge: IT Governance Defined • IT Governance: the leadership and organizational structures and processes that ensure that the organization’s IT sustains and extends the organization’s strategies and objectives *. Improve Performance; Reduce Risk Performance vs. Goals and Best Practices Reliability of Financial Data Regulatory Compliance * (IT Governance Institute 2003, Board Briefing on IT Governance, 2 nd Ed, page 18 ) COBIT – Controlling and Auditing IS 6

The IT Governance Framework: An Governance Model Be. IT a Part of the Process Provide Direction Set Objectives • IT is aligned with the business • IT enables the business and maximises benefits • IT resources are used responsibly • IT-related Be risks are managed appropriately Compare Good! IT Activities • Increase automation (make the business effective) • Decrease cost (make the enterprise efficient) • Manage risks (security, reliability and compliance) Measure Performance www. itgovernance. org - Board Briefing on IT Governance Hunton et al. Pg. 3 COBIT – Controlling and Auditing IS 7

Lets Try it Without A Framework • You are the CEO of NASDAQ. You discover that the embarrassing error reported in the article happened when a new version of a software application was put into production. You know you need a better process. – Who should be involved in making sure this kind of thing doesn’t happen again? – What controls should be put into place? – How will you tell later if the controls are working? – Will your plan convince the angry board of directors? COBIT – Controlling and Auditing IS 8

Agenda How Are We Doing? • The quest for effective systems and the rise of internal control regulation emphasize the need for IT governance • Exercise: How can you do on your own? • COBIT: – Where does it come from? – How does it view IT organizations? – What does it include? • Try again: Does COBIT help? • Other IT management frameworks • Key takeaways COBIT – Controlling and Auditing IS 9

COBIT: Control Objectives for Information and related Technology • COBIT is a process-oriented, business-goal focused, systematic framework for evaluating the IT operations within an organization. It is designed for: – Managers who need IT, – IT Providers (internal and external), and – “Auditors” concerned with risk, security, privacy, compliance, and assurance. • Stakeholders may not know how to evaluate their organizations, COBIT can help guide the process. COBIT – Controlling and Auditing IS 10

COBIT Where did COBIT come from? • The COBIT steering committee includes international representatives from industry, academia, government, and the security and control profession. • Based in the IT Governance Institute. • The COBIT group has done extensive work mapping to other standards. http: //www. isaca. org/Content/Navigation. Menu/Members_and_Leaders/COBIT 6/Project 1/COBIT_Project. htm COBIT – Controlling and Auditing IS 11

Process Oriented Information IT Resources Systems Assetsbrings Complexity used to achieve Organizational Goals People Infrastructure Information Applications special problems Because Information systems are much more complex than lunch boxes: Processes! Information systems’ acquisition, operation, and maintenance can be usefully understood as a set of IT processes. We figure out what to control in IT by looking at what we do in IT. COBIT – Controlling and Auditing IS 12

Which of These Are IT Processes In the IT Governance Sense? • • • NO! Just a decision Buying a new server IT Purchasing Procedures Hiring the Right People NO! Bunch of Decisions Screening Potential IT Employees Processing an invoice sent in by EDI NO! this is an IT-enabled process from a supplier • Change Management System Good Governance Creates Good Processes that LEAD TO Good Decisions and IT Systems COBIT – Controlling and Auditing IS 13

Good Processes COBIT – Controlling and Auditing IS 14

COBIT Business Goal Focused Generic Business Goals are Matched with IT Goals To offer competitive products and services, create IT agility Goals are Matched with 34 IT Processes – Define Success Achieve IT agility by adjusting HR, information architecture, and infrastructure Defined Control Objectives Support Assurance. Good data architecture keeps data to support decisions, organizes data for sharing, and verifies data reliability Process Measures Support Systematic Evaluation to Manage IT Processes Measure data architecture success in % of redundant data elements, % of applications in the plan, and frequency of validation activities. COBIT – Controlling and Auditing IS 15

Business Objectives Governance Objectives COBIT’s Systematic Framework COBIT ME 1 ME 2 ME 3 ME 4 Monitor the processes Monitor and evaluate internal control Ensure Regulatory Compliance Provide IT Governance INFORMATION PO 1 Define a strategic IT plan PO 2 Define the information architecture PO 3 Determine the technological direction PO 4 Define the IT processes, organisation and relationships PO 5 Manage the IT investment PO 6 Communicate management aims and direction PO 7 Manage human resources PO 8 Manage quality PO 9 Assess and manage IT risks PO 10 Manage projects Does the organization • Effectiveness • Efficiency • Confidenciality plan and organize • Integrity Availability the organization Compliance to • • • Does meet MONITORadequately AND Reliability EVALUATE effectively Does theinformation organization have and deliver and needs? IT support IT services? PLAN AND use sound processes for RESOURCES ORGANISE acquiring and implementing IT? DELIVER AND • Data SUPPORT systems Does the organization • • Application Technology • Facilities • People monitor andservice evaluate DS 1 Define and manage levels DS 2 Manage third-party services DS 3 Manage peformance and capacity its IT activites? ACQUIRE AND DS 4 Ensure continuous service DS 5 Ensure systems security DS 6 Identify and attribute costs DS 7 Educate and train users DS 8 Manage service desk and incidents DS 9 Manage the configuration DS 10 Manage problems DS 11 Manage data DS 12 Manage the physical environment DS 13 Manage operations IMPLEMENT AI 1 Identify automated solutions AI 2 Acquire and mantain application software AI 3 Acquire and maintain technology infrastructure AI 4 Enable operation and use AI 5 Procure IT resources AI 6 Manage changes AI 7 Install and accredit solutions and changes

Page 1 AI 6 – Acquire and Implement Manage Changes Control over the IT process of process name that satisfies the business requirement for IT of summary of most important IT goals is achieved by key controls and is measured by key metrics COBIT – Controlling and Auditing IS 17

Page 2 AI 6 Page 2 Detailed Control Objectives AI 6. 1 Change Standards and Procedures Set up formal change management procedures to handle in a standardised manner all requests. . AI 6. 2 Impact Assessment, Prioritisation and Authorisation Ensure that all requests for change are assessed in a structured way for impacts on the operational system… AI 6. 3 Emergency Changes Establish a process for defining, raising, assessing and authorising emergency changes… AI 6. 4 Change Status Tracking and Reporting Establish a tracking and reporting system for keeping change requestors and relevant stakeholders up to date… AI 6. 5 Change Closure and Documentation Whenever system changes are implemented, update the associated system and user documentation… COBIT – Controlling and Auditing IS 18

Page 3 AI 6 Management Guidelines Process Inputs and Outputs Layered Goals and Metrics RACI Chart COBIT – Controlling and Auditing IS 19

Page 4 Maturity Model Management of the process of Manage changes that satisfies the business requirement for IT of responding to business requirements in alignment with the business strategy, whilst reducing solution and service delivery defects and rework is: 0 Non-existent: No defined change management process… 1 Initial/Ad Hoc: It is recognised that changes should be managed… 2 Repeatable but Intuitive: Informal change management process… 3 Defined Process: Defined formal change management process… 4 Managed and Measurable: Change management well developed… 5 Optimised: Change management process is regularly reviewed… COBIT – Controlling and Auditing IS 20

Like Dagwood’s Boss, We Want Controls (employees? ) that Work COBIT – Controlling and Auditing IS 21

COBIT Audit Guidelines An IT process is audited by: • Obtaining an understanding of business requirements-related risks, and relevant control measures • Evaluating the appropriateness of stated controls • Assessing compliance by testing whether the stated controls are working as prescribed, consistently and continuously • Substantiating the risk of the control objectives not being met by using analytical techniques and/or consulting alternative sources COBIT – Controlling and Auditing IS 22

COBIT Audit Guidelines AI 6 Audit Guideline COBIT – Controlling and Auditing IS 23

COBIT Audit Guidelines AI 6 Audit Guideline COBIT – Controlling and Auditing IS 24

COBIT Audit Guidelines AI 6 Audit Guideline COBIT – Controlling and Auditing IS 25

Now that you have AI 6… • You are the CEO of NASDAQ. You discover that the embarrassing error reported in the article happened when a new version of a software application was put into production. You know you need a better process. – Who should be involved in making sure this kind of thing doesn’t happen again? – What controls should be put into place? – How will you tell later if the controls are working? – Will your plan convince the angry board of directors? COBIT – Controlling and Auditing IS 26

Comparing Frameworks Different Frameworks: Different Emphasis • Control Objectives for Information & Related Technology (COBIT): Comprehensive checklists for IT, supports auditing, doesn’t directly address software development or give a roadmap for improvement • Capability Maturity Model Integration (CMMI): Geared for software development organizations • IT Infrastructure Library (ITIL): IT service delivery and management best practices • Six Sigma: Continuous improvement for repeatable activities (e. g. , helpdesks) http: //www. computerworld. com/managementtopics/management/story/0, 10801, 90797, 00. html COBIT – Controlling and Auditing IS 27

Comparing Frameworks COBIT Asks All the Right Questions COBIT: 34 IT processes in 4 domains: COBIT defines issues, values, measurements, and responsibilities. It focuses on control over execution and strives to address all IT governance issues. COBIT – Controlling and Auditing IS 28

Comparing Frameworks CMM Helps Develop Mature Software Development Processes CMM (1993) and the later CMMI focus on improving the development, acquisition, and maintenance of systems. CMM addresses only some of the issues considered by COBIT. SEI CMM http: //www. sei. cmu. edu/cmmi/general. html ITGI’s mapping of SEI’s CMM for Software with COBIT 4. 0 COBIT – Controlling and Auditing IS 29

ITIL Presents Best Practices for IT Service Delivery ITIL, originally created by the British Government, “the only consistent and comprehensive best practice for IT service management. ” ITIL provides more guidance on who should be responsible and how they should proceed. ITIL - Best practices COBIT – IT control ITGI’s mapping of ITIL With COBIT 4. 0 COBIT – Controlling and Auditing IS 30

IT Governance Norms • • • Business Alignment A Risk/Control Perspective Accountability Continuous Improvement Systematic Measurement COBIT – Controlling and Auditing IS 31

Takeaways Key Takeaways • Forces are pushing organizations to adopt IT governance but its an uphill battle. • COBIT provides a systematic framework to evaluate IT operations. Plan, do, check, & correct. • A control perspective for IT processes is crucial to long term success. (It helps us talk nice to the CFO too!) • Thanks to the IT Governance Institute for material. COBIT – Controlling and Auditing IS 32

Back To AI 6 Page 1 AI 6 Manage Changes High-Level Control Objective • All changes, including emergency maintenance and patches, relating to infrastructure and applications within the production environment must be formally managed in a controlled manner. Changes (including procedures, processes, system and service parameters) must be logged, assessed and authorised prior to implementation and reviewed against planned outcomes following implementation. This assures mitigation of the risks of negatively impacting the stability or integrity of the production environment. COBIT – Controlling and Auditing IS 33

Back To AI 6 Page 1 AI 6 Waterfall Control over the IT process of Manage changes that satisfies the business requirement for IT of responding to business requirements in alignment with the business strategy, whilst reducing solution and service delivery defects and rework by focusing on controlling impact assessment, authorisation and implementation of all changes to the IT infrastructure, applications and technical solutions, minimising errors due to incomplete request specifications and halting implementation of unauthorised changes is achieved by • Defining and communicating change procedures, including emergency changes • Assessing, prioritising and authorising changes • Tracking status and reporting on changes and is measured by • Number of disruptions or data errors caused by inaccurate specifications or incomplete impact assessment • Application or infrastructure rework caused by inadequate change specifications • Percent of changes that follow formal change control processes COBIT – Controlling and Auditing IS 34