Fortunately, we moved on from those crazy days. Leading companies have progressed from restrictive and onerous controls over everything to focusing on the constraints that really matter. Controls are only audited where there is a real risk of a material misstatement of the company's filings with the Securities and Exchange Commission. A top-down and risk-based approach is used to identify those risks.
We have reduced the level of unnecessary bureaucracy from IT's SOX compliance activities, but can we do the same for all areas of governance? Before answering that question, we must address what is meant by the term "governance" and how it relates to IT governance.
Curiously, there is no single, comprehensive, universally accepted definition of organizational governance. The Organization for Economic Co-operation and Development (OECD) developed a commonly used definition stating that organizational governance is a set of relationships between a company's management, its board, its shareholders and other stakeholders. Corporate governance also provides the structure through which the objectives of the company are set and the means of attaining those objectives and monitoring performance are determined.
It is important to note that governance is not the same as compliance. While there has been a tremendous focus on compliance in the wake of SOX, governance is as much about achieving performance objectives (typically focused on strategy, value creation and resource creation) as it is about compliance objectives.
IT governance necessarily flows from enterprise governance. As the IT Governance Institute states:
An effective set of IT governance processes and systems will ensure achievement of the following objectives:
- Cost-effective, timely and high quality delivery of the services and facilities required for the organization to achieve its strategies and objectives. This area would include the continuous delivery of good technology infrastructure, applications and other services, as well as the ability to monitor enterprise performance against objectives.
- Appropriate and effective management of risks to organizational objectives. Risks addressed within IT governance include direct risks specific to IT technology (e.g., data privacy) as well as indirect risks, where the business's response to a risk (e.g., noncompliance with environmental regulations), is dependent on IT services. For purposes of this discussion, noncompliance with laws and regulations are considered risks that need to be managed similarly to the way operational risks are managed.
How can these objectives be achieved with a minimum level of cost and bureaucracy? The trend among leading-edge governance, risk and compliance functions is to follow a top-down and risk-based approach:
- Understand the enterprise strategies and objectives, and the extent of their reliance on IT.
- Determine where a failure within the IT function could negatively affect the achievement of the enterprise strategies and objectives.
- Assess the likelihood of these failures and the magnitude of the impact of a failure.
- Ensure that IT processes, systems and controls efficiently and effectively manage the risks.
- Take prompt action to correct any deficiency in IT processes, systems and controls.
- Question all activities that are not required to achieve enterprise strategies and objectives, including the management of related risks.
- Apply these steps both to management of the IT function as a whole and to management of individual projects and functions within IT.
- Continuously monitor and improve all of the above.
Step by Step
The CIO and his team are generally involved with the rest of the executive management team in establishing the projects and organizational priorities to achieve the objectives approved by the board. Many of these rely either directly or indirectly on IT. For example, there may be an initiative to expand to a new geography that would require new currencies being supported by the financial applications. Sometimes, the full extent of reliance on IT is not immediately clear, so the IT management team has to ensure they partner effectively with the business owner to understand all the issues. It is possible, for example, that the business expansion just mentioned also requires additional IT support for the cash management and hedging programs that will be initiated to support the new geography.
Be the first to comment on this post using the section below.