Governansi TI dan Infrastruktur Teknologi Informasi

IT Governance and Information Technology Infrastructure

• The topic is IT Governance and Information Technology Infrastructure.
• The presenter is Aryo Pinandito, ST, M.MT, Ph.D.
• The learning outcomes include explaining why organizations need IT governance, understanding the function and key IT resources, understanding the three pillars of IT governance (organization, process, and technology), and knowing COBIT as a governance framework.
• IT governance is the responsibility of executives and the board of directors. It involves leadership, organizational structures, and processes to ensure the enterprise's IT sustains and extends the organization's strategy and objectives.
• IT governance specifies decision rights and accountability frameworks to encourage desirable IT use behavior.
• IT governance is the organizational capacity exercised by the board, executive management, and IT management to control the formulation and implementation of IT strategy, ensuring the fusion of business and IT.
• IT governance is an integral part of enterprise governance.
• IT governance focuses on achieving the link between business and IT, and the primary responsibility of the board.
• Information Technology (IT) Governance is the responsibility of Executive Management and the board of directors (BOD) and is a strong representation of the "tone from the top".
• Many BODs now have an "IT Committee".
• The new infrastructure includes Local IT for Business, Firm Information Technology (combined with public infrastructure, such as customer databases and email), and Public Infrastructure (linking the firm to external industry infrastructures like the internet and EDI networks).

Why IT Governance?

• Information technology (IT) is pervasive in current dynamic and often turbulent business environments.
• In the past, business executives could delegate, ignore, or avoid IT decisions, but this is no longer possible in most sectors and industries.
• Organizations are reliant on IT to manage, develop, communicate, and maintain intangible assets such as information and knowledge.
• Successful organizations depend on secure, accurate, reliable, and timely information and knowledge provided through technology use.
• Dependence on IT introduces risks.
• IT plays a significant role in developing organizational strategies.
• IT becomes a success factor for organizational differentiation and competitive advantage.
• IT governance improves the quality and quantity of valuable goods and services.
• IT departments are changing from service providers to strategic partners.
• IT investments are expensive.

IT as a Service Provider vs IT as a Strategic Partner

• IT as a service provider is focused on efficiency, measured by external benchmarks, is seen as an expense to control, and has technically focused IT managers.
• IT as a strategic partner is focused on business growth, measured by business strategy, seen as an investment to manage, and has business-focused IT managers.

Layers of IT Governance Responsibility

• The layers of responsibility include strategic level (board of directors), management level (CEO, CIO), and operational level (IT and business management).

Corporate and Key Asset Governance

• IT governance is a part of corporate governance, falling under the responsibility of the board.
• Key assets include human, financial, physical, intellectual property, information and IT, and relationship assets.
• Financial mechanisms (committees, budgets, etc.) and IT governance mechanisms (committees, budgets, etc.) are related to key asset governance.

Key Assets

• Human assets include people, skills, career paths, training, and competencies.
• Financial assets involve cash, investments, liabilities, cash flow, and receivables.
• Physical assets cover buildings, plants, equipment, maintenance, security, and utilization.
• Intellectual property encompasses products, services, and copyrighted materials.
• IT assets consist of digitized data, information, knowledge, customer process performance, and information systems.
• Relationship assets include brand and reputation.

Why is IT Governance Required/Recommended?

• Without effective IT Governance, risk exists that existing IT assets and capabilities may not meet the organization's strategic, operational, or financial objectives.
• IT governance reviews should be part of Internal Audit planned activities.
• COBIT emphasizes the importance of IT Governance.

Focus Areas of IT Governance

• IT governance is concerned with IT's delivery of value to the business, and mitigating IT risks.
• The first is driven by strategic alignment of IT with the business.
• The second is driven by embedding accountability into the enterprise.
• Both need to be adequately measured.

IT Governance Capabilities

• Strategic alignment: Monitoring the linkage of business and IT plans, defining, maintaining, and confirming the IT value proposition, and aligning IT operations with enterprise operations.
• Risk management: Understanding risk, understanding compliance requirements, providing transparency about significant risks to the enterprise, and embedding risk management responsibilities into the organization.
• Value delivery: Executing the value proposition throughout the delivery cycle, making sure that IT delivers the promised benefits against the strategy, concentrating on optimizing costs and proving the intrinsic value of IT.
• Performance management: Tracking and monitoring resource usage, process performance, and service delivery.
• Resource management: Optimizing investment in, and the proper management of critical IT resources: applications, information, infrastructure, and people.

IT Governance vs Corporate Governance

• Corporate governance is the system by which organizations direct and control.
• IT governance, as an integral part of corporate governance, falls under the responsibility of the board of directors.

IT Governance vs IT Management

• IT management focuses on effective and efficient internal supply of IT services and products, and managing current IT operations.
• IT governance is broader, performing and transforming IT to meet present and future demands of the business (internal focus) and business customers (external focus).

Governance vs Management

• Governance is the creation of a setting in which others can effectively manage.
• Management is the making of operating decisions.

Benefits of IT Governance

• Alignment of business and IT strategies.
• Greater efficiencies, increased support, and reduced costs when implementing change.
• Effective risk management and compliance.
• Effective and efficient use of IT resources for asset utilization and business growth and flexibility.
• Improved culture in adherence to company policies and procedures.
• Improved communication of the role of IT in achieving business results and the capability to meet business needs.
• Improved IT performance measurement capabilities.

IT Governance in Organizations

• Business strategy, supported by senior executives, drives the strategy of IT governance, supported by the steering committee/key business stakeholders
• Owner: CIO drives IT Delivery.
• Owner: CIO, Steering committee drives IT Strategy.
• Owner: Steering committee/Key Business Stakeholders authorizes IT Governance.

Typical Activities

• Business strategy: Business direction setting, strategic planning, growth/acquisition/divestiture strategies, geographic planning.
• IT strategy: 3-5 year planning, IT direction, applications, data, infrastructure, security, delivery strategy.
• IT governance: Budgeting and planning, technology spending authorization, initiative approval, enforcement of technology standards, technical support, hardware/network management, data management, delivery/program management, operations management.

COBIT Framework

• COBIT is a framework for the governance and management of enterprise information and technology, aimed at the whole enterprise.
• All technology and information processing that the enterprise puts in place to achieve its goals, irrespective of where it happens in the enterprise.
• The COBIT framework distinguishes between governance and management.
• Governance ensures stakeholder needs, conditions, and options meet balanced, agreed-upon enterprise objectives, and direction is set through prioritization and decision-making, ensuring performance and compliance are monitored.
• Management plans, builds, runs, and monitors activities aligned with the direction set by the governance body to achieve enterprise objectives.
• COBIT defines the components for building and sustaining a governance system, including processes, organizational structures, policies, procedures, information flows, culture, behaviors, skills, and infrastructure.
• Defines design factors for a best-fit governance system.
• Groups governance issues by governance and management objectives, to be managed at needed capability levels.
• COBIT is not a full description of the whole IT environment, a framework for organizing business processes, or an IT technical framework for managing technology.

COBIT Six Principles

• Providing stakeholder value.
• Holistic approach.
• Dynamic governance system.
• Governance distinct from management.
• Tailored to enterprise needs.
• End-to-end governance system.

COBIT Three Principles

• Based on the conceptual model.
• Open and flexible approach, adaptable to new issues.
• Aligned with major standards, frameworks, and regulations.

Governance and Management Objectives

• COBIT groups governance and management objectives into five domains with names that express their key purpose and activity areas.

COBIT Domains

• Governance Objective: Evaluate, direct, and monitor (EDM).
• Management Objective: Align, plan, and organize (APO), Build, acquire, and implement (BAI), Deliver, service, and support (DSS), Monitor, evaluate, and assess (MEA).

COBIT Core Model

• This section includes a detailed depiction of the COBIT Core Model.

IT Governance Assessment Approach

• An approach involving key contact identification, interviews, discussion facilitation, evidence gathering, maturity level evaluation, and recommendations.

Broader View of IT Governance

• People: Agency culture, values, beliefs, behavior.
• Processes: Bodies (executive leadership, IT steering committees), Tools (IT strategy, IT policies, data governance, IS controls).
• Technology: Organizational plans, IT balanced scorecard, service level oversight.