Governing Information Technology through COBIT

Abstract

Board oversight of information technology has not kept pace with the rapid growth of IT as a critical driver of business success. However, this is shortsighted, since effective governance over IT Governance protects shareholder value; makes clear that IT risks are quantified and understood; directs and controls IT investment, opportunity, benefits and risks; aligns IT with the business while accepting IT as a critical input to and component of the strategic plan; sustains current operations and prepares for the future; and is an integral part of a global governance structure. Like most other governance activities, IT Governance engages both board and executive management. Among the board’s responsibilities are reviewing and guiding corporate strategy, setting and monitoring achievement of management’s performance objectives, and ensuring the integrity of the organisation’s systems. Management’s focus is generally on cost-efficiency, revenue enhancement and building capabilities, all of which are enabled by information, knowledge and the IT infrastructure. The four main focus areas for IT Governance are driven by stakeholder value. Two are outcomes: value delivery and risk mitigation. Two are drivers: strategic alignment and performance measurement. Action plans for implementing effective IT Governance, from both a board and an executive management point of view, consist of activities, outcome measures, best practices, critical success factors and performance drivers. In addition, organisations must assess how well they are currently performing and be able to identify where and how improvements can be made. The use of maturity models simplifies this task and provides a pragmatic, structured approach for measurement. Control Objectives for Information and related Technology (COBIT), a third edition of which was issued by the IT Governance Institute in 2000, incorporates material on IT Governance and a Management Guidelines component. COBIT presents an international and generally accepted IT control framework enabling organisations to implement an IT Governance structure throughout the enterprise. The Management Guidelines consist of maturity models, critical success factors, key goal indicators and key performance indicators. This structure delivers a significantly improved framework responding to management’s need for control and measurability of IT by providing tools to assess and measure the organisation’s IT environment against COBIT’s 34 IT processes.

Strategies and Models for IT Governance

“…In this way, IT governance enables the enterprise to take full advantage of its information, and can be seen as a driver for corporate governance. IT governance and corporate governance can therefore not be considered as pure distinct disciplines and IT governance needs to be integrated into the overall governance structure, as denoted by several authors (Duffy, 2002b;Guldentops, 2003;ITGI, 2003;Peterson, 2003).…”

“…The definitions in Figure 3 underline that the ultimate outcome of IT governance is the alignment of information technology with the business, often referred to as strategic alignment. Strategic alignment is an important driving force to achieve business value through investments in IT (Guldentops, 2003;ITGI, 2005). This section will discuss the strategic alignment concept in more detail.…”

“…IT of course not only has the potential to support existing business strategies, but also to shape new strategies (Guldentops, 2003;Henderson, Venkatraman, & Oldach, 1993;. In this mindset, IT becomes not only a success factor for survival and prosperity, but also an opportunity to differentiate and to achieve competitive advantage.…”

“…Information technology also offers a means for increasing productivity. Leveraging IT successfully to transform the enterprise and to create products and services with added value has become a universal business competency (Guldentops, 2003). In this viewpoint, the IT department moves from a commodity service provider to a strategic partner as illustrated by Venkatraman (1999) (Figure 2).…”

Methodology for IT Governance Assessment and Design

“…COBIT considers IT Governance as being a structure of relationships and processes to direct and control the enterprise, achieving the enterprise's goals by adding value while balancing risk versus return over IT and its processes [1] [5].…”