201306 CIO NET The Value of IT Frameworks
- 1. The Value of IT Frameworks Recent views from Chief Information Officers Results from the CIONET survey of European CIO’s on the business value of IT Frameworks What’s next.
- 2. Table of Contents _ Introduction ................................................................................. 3 1. IT Frameworks COBIT.......................................................................................4 ISO 27001 - Information Security......................................6 ISO20000 - ITIL.....................................................................7 2. The Survey Results IT Governance .......................................................................8 Information Security ............................................................12 Service Delivery......................................................................16 3. Comparison to other international surveys .................. 18 4. The Case Studies IT governance and management at Atos Worldline....................................................................20 IT Service Delivery at M-Team ...........................................21 Information Security at Dexia.............................................21 5. Major Findings .................................................................... 22 6. Conclusion .......................................................................... 23 2
- 3. In an environment where new business demands, stringent industry-specific regulations, and risks emerge every day, maximizing the value of intellectual property, managing information risk and security, and assuring compliance through effective enterprise govern- ance of IT, have all emerged as mission critical issues for all size and all industry enterprises worldwide. Several frame- works to support these enterprise chal- lenges emerged some 20 years ago and while they have evolved they increas- ingly maintained they would create value for the enterprise. But do they? CIONET is the biggest community of IT executives in Europe. Bringing together over 3500 CIOs, CTO’s and IT directors from wide ranging sectors, cultures, academic backgrounds and genera- tions, CIONET’s membership represents an impressive body of expertise in IT management. CIONET’s mission is to feed and develop that expertise by providing top-level IT executives with the resources they need to realise their full potential. The CIONET community maintains close ties with both corporate and aca- demic worlds, helping to foster the kind of creative thinking that fuels innova- tion in IT. Every year, CIONET actively supports a number of research projects and, e.g., trends surveys on a range of topics developed in consultation with our advisory boards. For the needs of this report, 56 enterpris- es of varying size and industry responded to the survey and provided detailed in- formation on usage, actual and expected benefits, and actual and expected costs of IT frameworks used for __ IT Governance __ Information Security __ Service Delivery In addition to the traditional ‘Major lessons learned’, the survey explored the reason and degree of adoption of frameworks, their expected cost and benefits and the actual costs and benefits. 3 Company Staff IT Users <500 501-1000 1001-5000 5001- 10000 10001- 50000 50000+ Services Consumer Goods & Retail Technology & Telecom Industrials & Manufacturing Utilities & Energy Financials Healthcare Government Other Belgium Other U.K. Italy Netherlands Spain Introduction Enterprise Size IndustryGeography 5 3 2 12 2 7 4 8 13
- 4. 4 IT Governance and Management An IT Governance Framework like COBIT helps enterprises navigate the complexities of managing information and its infrastructure and helps to un- derstand, utilise, implement and direct important information-related activities and make more informed decisions through simplified navigation and use. It is developed and maintained by ISACA who is about to publish version 5. COBIT helps IT professionals with tools and expertise to identify critical issues and customize company-specific prac- tices to support the management and governance of information and related technologies. COBIT defines responsibility do- mains and a process structure together with a suggested cascade of linked enterprise, IT and process goals to help identify critical is- sues relative to enterprise IT. It also provides a knowledge base follow- ing the process structure containing practices, metrics, maturity models and RACI charts. 1. IT Frameworks COBIT is being used by tens of thousands of companies and millions of professionals worldwide, is supported by many regulators and has become the de facto standard for enterprise governance of IT.
- 5. 5 CobiT5 Concepts and Process Model Evaluate Governance Processes Management Processes Direct Monitor Plan Build Run Monitor Align, Plan & Organise ... Processes for Management of Enterprise IT Processes for Governance of Enterprise IT Monitor, Evaluate & Assess ... APO1 Define the Management Framework for IT DSS1 Manage Operations EDM1 Set and maintain the Governance Framework BAI1 Manage Programmes and Projects BAI6 Manage Changes DSS4 Manage Continuity DSS2 Manage Service Requests & Incidents EDM2 Ensure Value Optimisation BAI2 Manage Requirements Definition BAI7 Manage Change Acceptance & Transition DSS5 Manage Security DSS3 Manage Problems EDM3 Ensure Risk Optimisation BAI3 Manage Solutions Identification & Build BAI8 Manage Knowledge DSS6 Manage Business Process Controls EDM4 Ensure Resource Optimisation EDM5 Ensure Stakeholder Transparancy BAI4 Manage Availability & Capacity BAI9 Manage Assets BAI5 Manage Organisational Change Enablement BAI10 Manage Configuration APO7 Manage Human Resources APO2 Define Strategy APO9 Manage Service Agreements APO3 Enterprise Architecture APO10 Manage Supplier APO4 Manage Innovation APO11 Manage Quality APO5 Manage Portfolio APO12 Manage Risk APO6 Budget & Costs APO7 Manage Human Resources APO13 Manage Security Build, Acquire & Implement ... Deliver, Service & Support ... Evalute, Direct & Monitor Direct MonitorDirect Direct MEA1 Monitor & Evaluate Performance and Conformance MEA2 Monitor System of Internal Control MEA1 Monitor and Assess Compliance with External Requirements
- 6. 6 Information Security The widest used framework by far is the current ISO27001, which formally specifies a management system that is intended to bring information security under explicit management control. Being a formal specification means that it mandates specific requirements. Organizations that claim to have adopted ISO/IEC 27001 can therefore be formally audited and certified com- pliant with the standard. The standard evolved from ISO17799 which itself was based on the British Standard for Information Security BS7799. ISO/IEC 27001 requires that manage- ment: __ systematically examine the or- ganization’s information security risks, taking account of the threats, vulnerabilities and impacts; __ design and implement a coherent and comprehensive suite of infor- mation security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; __ adopt an overarching management process to ensure that the informa- tion security controls continue to meet the organization’s information security needs on an ongoing basis. It is constructed following a Plan-Do-Check-Act model and provides 39 control objectives and 123 controls for information security for 11 domains: IS27001 Domains Objectives Controls 1 Security Policy 1 2 2 Organisation and information Security 2 11 3 Asset Management 2 5 4 Human Recources Security 3 9 5 Physical and Evironmental Security 2 13 6 Communications and Operations Management 10 32 7 Access Control 7 25 8 Security Requirements of Information Systems 6 16 9 Information Security Incident Management 2 15 10 Business Continuity Management 1 5 11 Compliance 3 10 Associated standards have been developed for verifying compliance against 27001.
- 7. 7 Service Delivery ITIL (Information Technology Infrastruc- ture Library) is the most widely accept- ed approach to IT service management in the world. ITIL provides a cohesive set of best practice, drawn from the public and private sectors internation- ally. It was developed by the CCTA which is now incorporated in the Office of Government Commerce (OGC). ITIL describes activities and practices of the service lifecycle in detail, linked to customer/business requirements using business metrics and reinforcing continuous improvement. Based on a clear specification and a “Code of Practice”, it draws on many other standards and helps managers develop their own IT Service Manage- ment System. ITIL has become the “bible” of many IT operational managers. A new version became available in 2007 (ITIL version 3). It does not focus on processes like version 2 but rather on services. A service lifecycle forms the heart of version 3: __ Service Strategy __ Service Design __ Service Transition __ Service Operation __ Continual Service Improvement ISO/IEC 20000-1 ISO/IEC 20000-2 Supporting frameworks: ITIL, Cobit, MOF, ... Policies, processes, working procedures and instructions proper of IT organizations (in-house) Certification ISO/IEC 2000-1: 2005 ISO/IEC 2000 : 2005 Specification “Aims to fulfil” Code of practice “2000-1 explanatory guidance” Best practice preference models for IT Service Management IT Service Management System ITSMS Implementation and improvement ITIL Concepts and Structure
- 8. 8 2. The Survey Results IT Governance In almost all cases this framework is CobiT or CobiT-based. Not surprisingly, the CIO sponsors the adoption and use of an IT governance framework in more than 3 out of 4 cases. Hence it is also logical that IT management and IT pro- fessionals are leading its implementa- tion and are primary users. Other major users are the risk, security, compliance and audit functions. CIO COO CTO CFO none Users Leaders Seniormanagement ITmanagement ITprofessionals Riskmanagers Securitystaff Complianceofficers Auditors 5 4 3 25 18 22 6 10 1 11 2 7 10 Sponsors IT Governance Framework Users and Leaders IT Governance Framework
- 9. 9 Nearly all respondents use the frame- work in one form or another. But when asking how intensively the IT Governance Framework is used, it turns out that less than one third use it for more than just for guidance. The latter was confirmed when ask- ing for the reason why they adopted the framework, i.e. as guidance for IT governance implementations and IT improvements. Adoption of a governance framework is seen as a forward looking action and not done in reaction to a problem. High Medium Low Not used at all Just influenced by its concepts To obtain guidance in decision making In addition used regularly as reference material Basis for IT policy but not for practices Extensively used for practices but compliance not verified Extracted practices applied and compliance verified 5% 39% 18% 11% 7% 13% 7% Usage Maturity of the IT Governance Framework Major Drivers for using an IT Governance Framework Support regulatory compliance Guide IT Governance implementation Guide IT improvements Reference for Audit In response to a major incident Support IT operations
- 10. 10 Expected & Actual Benefits High Medium Low EFFICIENCY Improved enterprise processes Extended staff capabilities EFFECTIVENESS Better service delivery Faster solution delivery RISK Increased innovation Reduced risk The results of the expected and actual benefits paint a complex picture: __ The major driver is service delivery, a driver one would expect more for a service delivery framework such as ITIL __ Improved processes and reduced risk come in as a close second as expected benefits __ The actual benefits however look very different, indicating overall benefits (see the scores in the Medium column) but disappointing as to the high expectations. __ Interestingly, innovation was not an expected nor an actual benefit which indicates that the industry is maybe not ready yet for frame- works like ValIT Less data was provided on the actual cost of the framework’s implementa- tion, roll-out and usage. When asked how they measure costs, 60% was through metrics, the rest via actual cases and management perception. Only half of the respondents used external help on the project, on average 112 man-days, a quarter of which was used for training. Nevertheless and after deleting the extreme values, sufficient data was available to learn that the actual cost was generally less than the estimate. Larger companies tend to be better at estimating but the closeness of esti- mate and actual is intriguing. Smaller companies spend 20% less, especially in the roll-out phase of the project. Expected and Actual Benefits of using an IT Governance Framework Figure 3 - Measuring the cost of an IT Governance Framework Estimated and Actual Cost of an IT Governance Framework in Small and Large Enterprises Cases Perception Metrics COST in 1000€ Estimate Actual Implementation 340 290 SMALL Roll-out 250 150 Usage 200 190 Implementation 1450 1350 LARGE Roll-out 1000 1100 Usage 400 350
- 11. 11 The survey enterprises were also asked how benefits were demonstrated. The result is shown here as a heat chart. Two results jump to the front: benefit metrics appear to be very much used for service delivery, and increased in- novation is purely a case of perception. The respondents also provided infor- mation as to the actual metrics used. Overall the most quoted was number of issues raised, fixed and outstanding, and second most quoted was resolu- tion time. Framework adherence and maturity level achieved, only received low scores. Finally, the lessons learned were collected. Respondents confirmed a major argu- ment used by framework developers, i.e., that they significantly provide for a com- mon language between all stakeholders of IT. On the negative side, their implemen- tation is perceived to be complex with a high learning curve for managers. And as for most initiatives that look for improvement, the high level of senior management support was identified as a major requirement for success. As a general conclusion we can state that the cost of an IT governance framework is 20% less than expected but benefits - in the absence of strong metrics, are perceived to be less than hoped for. Notwithstanding, the lessons learned all talk about a better organisation, more useful management information and a higher maturity. Heat Map of How Benefits Are Demonstrated Proof Metrics Cases Perception Improved enterprise processes Extended staff capabilities Better service delivery Faster solution delivery Increased innovation Reduced risk
- 12. 12 Service Delivery Even more than for IT governance, the CIO sponsors the adoption and use of a Service Delivery framework. However, many more possible sponsors have been identified who push the issue onto the executive’s agenda. Usage patterns are not much different from the IT Governance framework. However, while security and audit staff are also significant users, in this case they appear to play no role in promot- ing adoption and helping implementa- tion. CEO CIO COO CTO Head of IT IT Manager IT Services Director Sponsors Service Delivery Framework Users and Leaders Service Delivery Framework Users Leaders Seniormanagement ITmanagement ITprofessionals Riskmanagers Securitystaff Complianceofficers Auditors 0 29 9 0 0 00 77 35 29 7 12 11
- 13. 13 When looking at intensity of usage, a totally different pattern emerges. Probably because frameworks like ITIL have been used for many years by op- erations managers as their ”roadbook”, and later on by CIO’s, a much higher degree of maturity is revealed with more than 60% of respondents using it at least as IT policy. A majority uses it for its practices and several even verify compliance. The reason for implementing a Service Delivery framework appears at first sight the same as for governance, i.e., governance implementation and IT improvements. Surprisingly though, respondents also identified regulatory compliance and audit requirements as secondary reasons. Not used at all Just influenced by its concepts To obtain guidance in decision making In addition used regularly as reference material Basis for IT policy but not for practices Extensively used for practices but compliance not verified Extracted practices applied and compliance verified 2% 16% 12% 10% 6% 35% 19% Usage Maturity of ITIL Drivers for implementing ITIL High Medium Low Support regulatory compliance Guide IT Governance implementation Guide IT improvements Reference for Audit In response to a major incident Support IT operations
- 14. 14 Expected & Actual Benefits High Medium Low EFFICIENCY Improved enterprise processes Extended staff capabilities EFFECTIVENESS Better service delivery Faster solution delivery RISK Increased innovation Reduced risk CIO’s expected more benefits from a Service Delivery framework and while results are overall better than for gov- ernance, again actual results are less than expected. However, the strong re- sults in the ‘Medium’ column for actual benefits are encouraging. While the heat chart for how benefits are demonstrated is again similar with better service delivery being objec- tively measured and innovation being a matter of pure perception, there are indications that for process quality and speed of delivery, more metrics are being used. Metrics that show up here which were not being used for governance are: SLA metrics and customer satisfaction. Expected and Actual Benefits from Using ITIL Heat map of How Benefits Are Demonstrated Proof Metrics Cases Perception Improved enterprise processes Extended staff capabilities Better service delivery Faster solution delivery Increased innovation Reduced risk
- 15. 15 The cost for implementing and using a service delivery framework appears to be much more supported by hard metrics compared to the cost measure- ment of IT Governance Frameworks. Again estimates are fairly accurate but now both large and small companies are less accurate spending about 10% more than estimated. Especially day-to- day usage in small companies is under- estimated. 72% of respondents use external help to implement a service delivery framework with on average 125m/d for training and 225m/d of expertise. A better IT organisation and improved common ground were experiences similar to the lessons learned from implementing an IT governance framework. As more of the respondents have implemented ITIL or similar frameworks, the lessons learned were more extensive. Major improvements experienced were a better risk and con- figuration management, stronger focus on the support of the business processes and a standardised and measurable IT. As for IT governance the learning curve, management time and complexity of implementation were identified as negative experiences. Interesting to note was the lesson that driving change is hard but foremost that people need to understand the reasons why of the implementation and changes it requires. Estimate and Actual Costs of ITIL Cases Perception Metrics COST in 1000€ Estimate Actual Implementation 245 240 SMALL Roll-out 190 200 Usage 125 170 Implementation 2900 3100 LARGE Roll-out 3100 3500 Usage 900 900
- 16. 16 Information Security As for the other domains, the CIO is most often the sponsor of the adoption of the Information Security Framework. However, leadership in implementa- tion is shared between the CIO and the security staff. Usage of the Information The security framework and its prac- tices has the broadest adoption of all frameworks in the survey. According to the responses, maturity of applica- tion is in between the governance and service frameworks. This is somewhat in contradiction with the broad usage in the enterprises, possibly due to the fact that most enterprises will adapt the standard framework to their own needs and risk profile. CIO COO CTO CEO Not used at all Just influenced by its concepts To obtain guidance in decision making In addition used regularly as reference material Basis for IT policy but not for practices Extensively used for practices but compliance not verified Extracted practices applied and compliance verified Senior management IT management IT professionals Risk managers Security staff Compliance officers Auditors Usage Maturity of Information Security FrameworkUsers and Leaders Information Security Framework Sponsors Service Delivery Framework 15% 30% 13% 7% 9% 13% 15%
- 17. 17 Expected Benefits Actual Benefits High Medium Low Support regulatory compliance Guide IT Governance implementation Guide IT improvements Reference for Audit In response to a major incident The main drivers are - no surprise - regulatory compliance and audit. Nevertheless, enterprises feel that ap- plication of this framework will also improve IT and help with IT governance implementation. Risk reduction is the major benefit iden- tified by most enterprises and has also been fairly well achieved. Respondents did not provide much data as to cost but it is generally estimated as ½ of the IT Governance Framework implementation. Notwithstanding, 60% of enterprises have objective metrics. The major positive experiences identified were the increase in awareness and the reduction of risk. Interesting remarks in the lessons learned were that the frame- work was to the point, extensive and complete and that useful than expected. The survey recorded the same comments as for other frameworks on negative experiences: complexity, learning curve, hard to do, management time, senior management support. Drivers for an Information Security Framework Benefits an Information Security Framework High Medium Low
- 18. 18 3. Comparison to other Surveys The IT Governance Institute published the results of two international surveys on the adoption and use of the IT governance frameworks CobiT and ValIT in 2008 and 2010. The first covered responses from 750 companies. Europe, Asia and the Americas were about equally represented while the manufacturing industry and public sector were the major responders. Leadership for these frameworks was in the first place with the CIO but with a much larger role for other executives. What was also strik- ing was that the non-IT responders of this survey were much more positive about IT – in terms of general management attention and value creation - than the IT responders. The 2008 survey also noted in the two years prior to the survey, a strong reduction in adoption of quality and ‘home-made’ frameworks and the growth of ITIL, CobiT and ISO27000. Concerning maturity of use, the find- ings were similar to the CIONET survey: for 50% it is one of the enterprise’s references, for 25% it is the main source of reference, a little more than 10% are only influence by it, and at the other end of the spectrum, a little less than 10% apply it by the book. CIO CEO CFO Usage - % of enterprises Leadership IT Balanced Scorecard 3% IT Governance CobiT 14% Service Delivery ITIL and ISO20000 25% Quality ISO 9000 14% Information Security ISO27000 9% Internally developed IT framework 14% Software CMMI 3%
- 19. 19 The major constraints for adoption in 2008 were concerns for budget and expected benefits as well as a lack of knowledge and expertise on IT govern- ance. The IT Governance Institute Survey published in 2010 focused on process implementation and the benefits of IT Governance Frameworks like CobiT and ValIT, and received responses from over 500 companies worldwide. Govern- ance over the processes of acquisition, change management, security and operations scored highest while nev- ertheless most processes only scoring around the middle of the scale from 1 = not implemented to 5 = fully implemented. The better implementa- tions were noted in Europe, the finance industry and with the larger companies. On achievement of business and IT goals – from 1 not achieved to 5 achieved, results are generally just above the middle with the business financial goal scoring best and the future IT capabilities goal the least. At a more detailed level, the better contributions of an IT Governance framework referred to IT compliance, information security and IT infrastruc- ture, while also service levels and cost optimisation where also positively impacted. The survey also collected information to analyse the benefits of IT Govern- ance practices by correlating process results to IT goals to business goals. The major conclusions are that this value chain is hard to analyse and prove but also the distinct and strong correlation between properly function- ing operational and support-oriented processes with IT compliance and security goals and compliance and risk business goals. Framework Benefits: Achievement of Goals Business goals Financial Orientation Customer Focus Internal Processes Learning and growth ITgoals Corporate contribution IT User Orientation IT Operations Future IT Capabilities __ Increased service levels __ Improved cost optimisation __ Increased IT compliance __ Better maintenance of information security __ Optimised IT infrastructure Properly functioning operational and support processes Achieving IT compliance and security goals Achieving business compliance and risk goals
- 20. 20 4. The Case Studies IT Governance Ben Farhangui, Director IT Governance & Compliance, Atos Worldline The nature of Atos Worldline’s business with a large range of IT products and services subject to a large number of local and global rules, calls for a well established framework for IT govern- ance embraced by the senior executive team. A framework like CobiT helps to understand the operational control requirements to drive the IT strategy and strengthen desirable behaviours irrespective of the fact that the different IT environments are centralised, de- centralised or federated. Cobit helped identify the most relevant processes to start with based on a selection of business goals. The rela- tively long list of processes was then filtered by first selecting those that were important and urgent, then those that provided opportunities and were highly feasible. Maturity and performance tar- gets for the processes present in both lists were then set to start the improve- ment programme. The programme consisted of assign- ing roles and responsibilities to ensure process governance, integrating tools in the different regions, ensuring process adherence through awareness pro- grammes, while strongly building on existing processes and know-how. The major lesson learned was that vi- sion, skills, resources and action plan should all support gradual change, avoiding confusion, anxiety, frustration and false starts. Ben called it “stealth governance”! po4ds5 ai3 ai6 po2 me1 ds1 ds4 po5 po9 ds9 po1 ds8 ds10 ds12 ds13 po8 ds6 ds11 me3 me4 10 20 30 40 50 60 70 0 10 20 30 40 50 60 70 Important& urgent Opportunity & Feasibility
- 21. 21M-team is today an IT-service service provider for 3 unions and 27 health- care payers (neutral, liberal, free) on the Belgium market. M-team provides it-services towards 5000 end-users serving 2.7 million affiliates from 1700 branch offices. A few years ago, M-team proposed a gradual IT-infrastructure centralisa- tion. The decision was mainly driven by the economy of scale potential for its customers owning and managing their own distributed infrastructure and resources. In a world where cost and quality are more and more under pressure, the management quickly recognized the need to evolve from an Dexia’s approach towards frameworks is holistic and pragmatic but while ISO2700x is a “mandatory” inspiration, the Web Application Security stand- ard, the Set of Secure Development Guidelines from MicroSoft and a very strict application of Rational SD for web based applications are even more important. ISO2700x in his view provides guide- informal technology driven organiza- tion to a service oriented organization. M-team’s approach for this transforma- tion toward industrialization has been very pragmatic from the beginning. Although it was recognized that frame- works like ITIL or CobIT can substan- tially help, proper governance and a strong focus on short term delivery with visible benefits were the most critical success factors. The motto “adopt and adapt” was intro- duced ensuring that frameworks were used only when value was delivered to M-Team customers and never for the sake of using them. lines and very good Best Practices more than directly applicable solutions, but they do not plan on certification. Reasons for this are that frameworks are not pragmatic enough, are costly and require strong process integration. Hence, Dexia’s preference for frame- works directly applicable in the field. Peter pointed out there is no magic framework for clients. It is therefore Notwithstanding the pragmatic ap- proach and value objective, a rigorous process was used: identification of es- sential processes, maturity assessment, gap definition and building momentum with quick-wins. Stefan especially stressed that in such a transformation project, if the guidance and usage of appropriate frameworks are essential, success can only be guaranteed with a clear communication plan and a build-in progress monitoring mechanism while being careful of not embracing too much at the same time. required to educate their clients to make them aware of Security and Data Privacy issues. He expressed the need to focus on real threats and their mutations and also warned that frame- works do not provide per se effective responses to current attack patterns. As a result, IT Security Incident Manage- ment, inspired by ITIL and ISO2700x is a priority. Service Delivery Stefan Mertens, Director of Operations & Customer Services @ M-team Information Security Peter Billiau, (former) CIO Dexia Group identification of essential processes A clear communication plan and a build-in progress monitoring mechanism maturity assessment gap identification build momentum with Quick-Wins
- 22. 22 5. Major findings from the Break-out Sessions Some 30 attendants discussed intensively in 6 working groups about the justifica- tion of framework investments, how to plan for success; what risks to avoid and what would a typical (successful) implementation look like. Below is a summary of their findings. 1. How to justify framework investments? __ The framework will make IT deliver to your expectations, control the schedule, promote a common language and will help you to avoid costs. __ Use a slogan, e.g.: “The framework will make IT deliver to your expectations; control the schedule, promote a com- mon language and will help you to avoid cost” __ Link argumentation to the business strategy __ Demonstrate measurable business value (end-user experi- ence, regulatory, cost reduction, positive business value, risk mitigation) 2. How to plan for success? __ Find opportunities to sell (initiatives, incidents, stakeholder having problems) __ Integrate governance practices into investment business cases (“stealth”) __ Show successes, show that it works and then tell all __ Convince the people who eventually will have to execute and make them your ambassadors __ Obtain top management support ( e.g. a framework as top- down policy) __ Manage stakeholders (actors and beneficiaries) from the beginning by identifying and managing their expectations __ While not ignoring the need to point out risks, the pri- mary relationship between champions of the framework, management and those needing to act needs to be build on TRUST, based on the alignment of organisational and personal values of those involved __ “Think big, start small” __ Get an executive sponsor __ Measure customer satisfaction (but always relate to busi- ness expectations) __ Also measure service unit cost, schedule achievement, incidents etc __ Get buy-in from the business for the metrics used 3. What are the risks to avoid? __ Focus on the implementation of the framework as an objective on its own __ Not properly managing the expectations __ Not making the goals explicit, and not highlighting the benefits __ Not identifying/recognizing the need to improve as a key driver __ Inadequate scope, or scope definition process __ Incorrect timing and phase definition __ Unbalanced or insufficient internal knowledge and skills __ Large organization: look more for generalist __ Small organization: look more for specialists __ Underestimating the impact of change to the organisation __ Poor business case (e.g. imbalance between budget, scope and objectives) __ Lack of support from the top (e.g. board, top manage- ment) __ Loss of stakeholders trust during implementation 4. What is the profile of a framework implementation? __ Gradual, incremental approach (quick-wins), holistic & pragmatic __ A good communications plan explaining the why, what is in it for everyone __ All involved understand the framework __ A change enabler community, involving stakeholders early __ Continuous Communication __ Shows the right objectives based on pain points, As Is-To be gaps, demand/supply balance and strategic drivers __ Aligns first internally, then aligns with the business __ Objectives are agreed and shared __ Objectives are measured and success is celebrated __ Run as a Project, possibly “slicing” the project and show- ing results per “slice” __ Visible, continuous and systematic measurements
- 23. 23 The benefits of implementing an IT governance framework are perceived to be less than hoped for and create a high learning curve for managers even though it usually costs 20% less than expected. Notwithstanding, they do provide a better organisa- tion, more useful management information and a higher maturity. ITIL as the example ‘par excellence’ of IT service frameworks is the most widely used and despite the detail, complexity and management learning curve, does pro- vide a better IT organisation. A security framework implementation generally costs ½ of an IT Governance framework and is often considered to be more useful than originally expected. Even though it kicks in an open door, all framework implementations also require senior management support. So if you do not have it to begin with, don’t get started! Or as some of the break-out attendees suggested, do it in a ‘stealthy’ man- ner, bottom up. But if you do have senior management support you should nevertheless take on board this very insightful comment from one of the participants: Conclusion Adoption of frameworks is neither a simple nor a self-contained project with measured costs. It is a gradual shift and interrelates with many other initiatives.
- 24. Author Erik Guldentops, CISA, CISM 2010 Executive Professor 2011 Visiting Lecturer University of Antwerp Management School Schapulierstraat 14/3/1 B-1800 Vilvoorde, Belgium tel +32-2-251-9551 gsm +32-475-432-748 net erik.guldentops@pandora.be Contributors The IT Governance Working Group consisting of: __ Georges Ataya, Solvay Business School __ Hendrik Deckers, CIONET __ Erik Guldentops, Universiteit Antwerpen Management School __ Luc Hendrikx, Accenture __ Daniel Van den Hove, ICT Control __ Johan Van Grieken, Deloitte __ Prof. dr. Steven De Haes, University of Antwerp & Antwerp Management School CIONET would like to thank the many responders to the survey as well as the presenters and attendants of the breakouts at the event on The Value of IT Frame- works held in September 2011. When not enjoying his retirement, Erik lectures on the subjects of IT secu- rity and control, IT governance, and risk management at the Management School of the University of Antwerp, Belgium. He worked for many years at SWIFT (Society for Worldwide Interbank Financial Telecommunication), where he held the positions of Inspector- general and Director of Information Security and worked with its board and executive management on the sub- jects of governance, risk, security and control. He held several positions in ISACA and the IT Governance Institute between 1989 and 2007. Often referred to as “The Father of CobiT”, he lead the development of COBIT and Val IT. He currently chairs a panel of profes- sors that reviews the master of IT audit programmes in four universities in The Netherlands. About CIONET We are CIONET, the biggest commu- nity of IT executives in Europe. Bringing together over 3500 CIOs, CTO’s and IT directors from wide ranging sectors, cultures, academic backgrounds and genera- tions, CIONET’s membership represents an impressive body of expertise in IT management. CIONET’s mission is to feed and develop that expertise by providing top-level IT executives with the resources they need to realise their full potential. CIONET develops, manages and moderates an integrated array of tools and services from the online CIONET platform – the world’s first social network for CIOs – to a range of offline networking events, conferences, workshops and executive education programmes all tailored to top-level manage- ment. CIONET also provides exclusive access to the latest research through regular online and offline publications and a number of value adding partnerships with key players from the academic and corporate worlds. Faced with the rapidly changing role of today’s IT execu- tive, CIONET not only helps its members keep up with the pace of change but empowers them to take an active role in shaping the future of their field, always challenging them with “What’s next.” What’s next.