Information Systems Governance and Risk Management Part I

Information Systems Governance and Risk Management Part I – 1 Intro to COBIT 5: Overview Yüe “Jeff” Zhang, Acct & IS Dept, CSUN 10/24/2020 1

Outline of Part I – 1. Overview • COBIT 5 Overview v. Evolution of COBIT v. Benefits of COBIT 5 v. COBIT 5 Scope; Architecture v. COBIT 5 five principles v. COBIT 5 seven enablers 2

Learning Objectives (LO) Part I - 1 • Understand the benefits of COBIT 5 • Be familiar with the structure of COBIT 5 framework • Understand the elements of COBIT 5 framework: 5 principles, 7 enablers • Understand the differences between governance and mgmt • Understand the intrinsic logic of the components of COBIT 5 framework 3

The IT Governance Focus Areas (“Pentagon”) Focus Area Logical Role Alignment premium requirement Value ultimate goal Risk optimized for value Resource ground and “means” Performance operational assurance Philosophical framework of IT governance 4

The COBIT Framework The Need for a Control Framework Over the past decade, the term ‘governance’ has moved to the forefront of business thinking – COBIT 5, Executive Summary “A control framework for IT Governance vdefines the reasons IT Governance is needed, vthe stakeholders and vwhat it needs to accomplish. ” • Now to the higher level of “enterprise governance of IT” (GEIT) – emphasizing v. Stakeholder needs – “High on top” v. End-to-end coverage – “Whole enterprise” 5

The COBIT Framework Definition and Mission - Definition • COBIT stands for “Control Objectives for Information and Related Technology. ” v. Now just COBIT • Developed by the IT Governance Institute (ITGI) • Promoted/advocated by ISACA va standard setting body in the areas of information governance, control, and security for professionals. – ISACA motto recap Successful enterprises have recognised that the board and executives need to embrace IT – COBIT 5, Exe Summary 6

ISACA Motto Risk management Assurance Strategic objective achievement Value delivery Resources and performance management Stakeholder interests Risk management on g a t n e P. Strategic Alignment Value delivery Resources and performance management 7 Strategic Alignment 10/24/2020

The COBIT Framework Definition and Mission - Mission • COBIT Mission: [Importance of mission] v. To research, develop, publicize and promote an authoritative, up‐to‐date, internationally accepted IT governance control framework (New: COBIT 2019) vfor adoption by enterprises and day‐to‐day use by business managers, IT professionals and assurance professionals • Reference: IT Governance Institute, COBIT 4. 1 8

The COBIT Framework Definition and Mission - Mission • COBIT's success as an increasingly internationally accepted set of guidance materials for IT governance has resulted in the creation of a growing family of publications and products designed to assist in the implementation of effective IT governance throughout an enterprise. • What it is; how to use it • PHILOSOPHY! ! ! METHODOLOGY! ! ! 咨� �、高端分析� “必��技 ” 9

Evolution of COBIT Enterprise Governance of I & T Understand analyze (3 trends) Tim Sco e Lev pe Me el tho d COBIT 2019 10

The COBIT 5 Framework Benefits • COBIT 5 helps enterprises create optimal value from IT vby maintaining a balance between realising benefits and optimising risk levels and resource use. • COBIT 5 enables information and related technology to be governed and managed in a holistic manner for the entire enterprise, taking in the full end-to-end business and functional areas of responsibility, considering the ITrelated interests of internal and external stakeholders. 11

The COBIT 5 Framework (cont) • The COBIT 5 principles and enablers are generic* and useful vfor enterprises of all sizes； vwhether commercial, not-for-profit or in the public sector； vmethodology can be adopted entirely or partially; vapplication can be on the whole org or a portion. v. COBIT 5 Case Studies § http: //www. isaca. org/COBIT/Pages/Recognition. aspx Generic: 通用的；功能本�（而非品牌决定的） 12

The COBIT Framework The IT Governance Framework • Internationally accepted good practices • Management-oriented • Supported by tools and training • Sharing knowledge and leveraging expert volunteers • Continually evolving • Maps strongly to all major related standards • Is a reference, set of best practices, not an “off-theshelf” cure 13

The COBIT Framework - Aligning with the Business • COBIT framework helps IT deliver the information that an enterprise requires by helping align IT with the business. Req Deliver 10/24/2020 14

Drivers* for Developing a Framework • End-to-end business and IT responsibilities • Provide guidance in: v – Enterprise architecture v – Asset and service management v – Emerging sourcing and organization models v – Innovation and emerging technologies 5 1 . P : f Re • A need for the enterprise to: v – Achieve increased value creation v – Obtain business user satisfaction v – Achieve compliance with relevant laws, regulations and policies v – Improve the relation between business and IT v – Increase the return of governance over enterprise IT v – Connect and align with other major frameworks and standards 15 Driver: ��力，��因素

Understanding Drivers (Zhang) External - Environment Tech advancement & challenge Biz advancement and pressure Compliance mandate * Coupling Internal - Objective Drivers for Benefit realization development of COBIT 5, Risk optimization P. 15 Resource optimization (Cost) Mandate: 指令，（不可免除的）要求; （不可�的） “天命” 10/24/2020 16

Enterprise Architecture (EA) - Gartner • A discipline for proactively and holistically leading enterprise responses to disruptive forces vby identifying and analyzing the execution of change toward desired business vision and outcomes. • EA delivers value by presenting business and IT leaders with signature-ready recommendations for adjusting policies and projects to achieve target business outcomes that capitalize on relevant business disruptions. 17 10/24/2020

Enterprise Architecture – Tech Target Network • A conceptual blueprint that vdefines the structure and operation of an organization. • The intent of an enterprise architecture is to determine how an organization can most effectively achieve its current and future objectives. 18 10/24/2020

Enterprise Architecture - Microsoft's Michael Platt 1. Business perspective defines the processes and standards by which the business operates on a day-to-day basis. 2. Application perspective defines the interactions among the processes and standards. 3. Information perspective defines and classifies the raw data that the organization requires in order to efficiently operate. 4. Technology perspective defines the hardware, operating systems, programming, and networking solutions used by the organization. 19 10/24/2020

Enterprise Architecture (EA) - Wikipedia • Architecture is the fundamental organization (structure) of components, their relationships, and the principles governing their design and evolution. va formal description of a system, a detailed plan of the system at component level, to guide its implementation. • Enterprise Architecture is the organization logic for business processes and IT infrastructure • EA is a conceptual blueprint that defines vthe structure and operation of an organization. v. The intent of EA is to determine how an organization can most effectively achieve its current and future objectives. 20 10/24/2020

Benefits of Using COBIT 5 COBIT assists from an Enterprises perspective by: • Maintaining quality information to support business Benefit Risk Cost -- three Objectives of IT governance • • decisions. Generating business value from IT-enabled investments, i. e. , achieve strategic goals and realize business benefits through effective and innovative use of IT. Achieving operational excellence through reliable and efficient application of technology. Maintaining IT-related risk at an acceptable level. Optimising the cost of IT services and technology. 21

Benefits of Using COBIT 5 • helps enterprises create optimal value from IT vby maintaining a balance between realising benefits and optimising risk levels and resource use (cost). • enables IT to be governed and managed in a holistic manner for the entire enterprise, vtaking in the full end-to-end business and IT functional areas of responsibility, considering the IT-related interests of internal and external stakeholders. • is generic and useful for enterprises of all sizes, whether commercial, not-for-profit or in the public sector. Repr • - COBIT 5, Executive Summary oduc e d fro m Sli de #1 1 10/24/2020 22

Benefits of Using COBIT 5 COBIT drives Stakeholder Value: • Delivering enterprise stakeholder value requires good governance and management of information and technology (IT) assets. • Enterprise boards, executives and management have to embrace IT like any other significant part of the business. • External legal, regulatory and contractual compliance requirements related to enterprise use of info and tech are increasing, threatening value if breached. • COBIT 5 provides a comprehensive framework that assists enterprises to achieve their goals and deliver value through effective governance and management of enterprise IT. 23

Benefits of Using COBIT 5: 24

COBIT Case Studies by Industry • http: //www. isaca. org/Knowledge. Center/cobit/Pages/COBIT-Case. Studies. aspx • COBIT 5, although developed for the whole organization, can be used for any portion of a firm/org, or any biz process • The philosophy/methodology can even be applied beyond biz, beyond org Revisit slide #12 25

COBIT 5 Scope • Not simply IT: not only for big business! • COBIT 5 is about governing and managing information v. Whatever medium is used v. End to end throughout the enterprise • Information is equally important to: v. Global, multinational business v. National and local government v. Charities and not for profit enterprise v. Small to medium enterprises and v. Clubs and associations 26

The COBIT 5 Format & Product Architecture The COBIT 5 Product Family: 27

COBIT 5 Principles Source: COBIT® 5, figure 2. © 2012 ISACA® All rights reserved. 28

1. Meeting Stakeholder Needs • Enterprises exist to create value for their stakeholders. v---Internal and external!! • Consequently, any enterprise— commercial or not—will have value creation as a governance objective. • Value creation means: v. Realising benefits at an voptimal resource cost while voptimising risk. 29

The COBIT Framework Mapping Goals and Processes Enabler Goals 30

Principle 1: Meeting Stakeholder Needs • Stakeholder needs have to be transformed into an enterprise’s actionable strategy. • The COBIT 5 goals cascade translates stakeholder needs into specific, actionable and customised goals within the context of vthe enterprise, v. IT-related goals and venabler goals. 31

Principle 2: Covering the Enterprise End-to-End • COBIT 5 addresses the governance and management of information and related technology from an enterprisewide, end-to-end perspective. l l A tio c n fu ns 32

Principle 3: Applying a Single Integrated Framework • COBIT 5: 1. ► Is complete in enterprise coverage 2. ► Provides a basis to integrate effectively with other frameworks, standards and practices used 3. ► Aligns with the latest relevant standards and frameworks (COSO, ITIL, ISO, PMBOK, NIST etc) 4. ► Integrates all knowledge previously dispersed over different ISACA frameworks (Risk IT, Val IT, BMIS) 33

Principle 4: Enabling a Holistic Approach *** COBIT 5 defines a set of enablers to support the implementation of a comprehensive governance & management system for enterprise IT. • COBIT 5 enablers are: • ► Factors that, individually and collectively, influence whether something will work • ► Driven by the goals cascade • ► Described by the COBIT 5 framework in seven categories *** Important & operationable 34

Principle 4: Enabling a Holistic Approach 35

4. Enabling a Holistic Approach (cont. ) 1. Principles, policies and frameworks—Are the vehicles to translate the desired behaviour into practical guidance for day-to-day management 2. Processes—Describe an organised set of practices and activities to achieve certain objectives and produce a set of outputs in support of achieving overall IT-related goals 5 domains, 37 processes 3. Organisational structures—Are the key decision-making entities in an organisation 4. Culture, ethics and behaviour—Of individuals and of the organisation; very often underestimated as a success factor in governance and management activities 5. Information—Is pervasive throughout any organisation, i. e. , deals with all information produced and used by the enterprise. 6. Services, infrastructure and applications—Include the infrastructure, technology and applications that provide the enterprise with information technology processing and services 7. People, skills and competencies—Are required for successful completion of all activities and for making correct decisions and taking corrective actions 36

Principle 5. Separating Governance From Management The COBIT 5 framework makes a clear distinction between governance and management. • Governance—In most enterprises, governance is the responsibility of the board of directors under the leadership of the chairperson. • Management—In most enterprises, management is the responsibility of the executive management under the leadership of the CEO. 37

Governance Domain and Management Domains Gov: EDM; Mgmt: PBRM (Fig 15, P. 32) 38

Governance & Management in COBIT 5 • Governance ensures that enterprise objectives are achieved by evaluating stakeholder needs, conditions and options; setting direction through prioritisation and decision making; and monitoring performance, compliance and progress against agreed direction and objectives (EDM). • Management plans, builds, runs and monitors activities in alignment with the direction set by the governance body to achieve the enterprise objectives (PBRM). • Exercising governance and management effectively in practice requires appropriately using all enablers. The COBIT process reference model allows us to focus easily on the relevant enterprise activities.

Recap: COBIT 5 Principles Source: COBIT® 5, figure 2. © 2012 ISACA® All rights reserved. 40

COBIT 5 Enablers 41

Incorporates Good Practices - 5 domains, 37 Processes [Enabler #2] 42

Zhang’s “Distillation” of COBIT Logic * * Reference: Ent. Strat. Goals it Mon ored Mo n ore it d IT Governance Institute, COBIT 5 Con tro lled tro Con lled IT Goals IT Enabler Goals R A C © Yue Zhang 2015 -2019 I 43

Structure of COBIT components • 5 Principles v. Princ. 1: Meeting stakeholder needs v… v. Princ. 4: Holistic approach § 7 enablers: • Enabler #2: Processes v. Princ. 5: Separating gov from Mgmt Process - (1) objectives; (2) Practices; (3) Activities; (4) Inputs/outputs; (5) 10/24/2020 RACI Capabili ty Model 44

Structure of COBIT components 45 10/24/2020