The Strategic Importance of IT for SAIs Paul

The Strategic Importance of IT for SAIs Paul Mantelaers Vilnius, June 16 th, 2005 Strategic Importance of IT for SAI's June 16 th, 2005

Agenda • 1 Short introduction: – 1. a Background of the seminar – 1. b The IT Self Assessment project • 2 Strategic importance of IT for SAIs • 3 Seminar programme 2 Strategic Importance of IT for SAI's June 16 th, 2005

Agenda • 1 Short introduction: – 1. a Background of the seminar 3 Strategic Importance of IT for SAI's June 16 th, 2005

1. a Background of the seminar Training Committee IT WG Moscow, May 2002 launched The Hague, Oct, 2002 1 st meeting Training Strategy IT training IT Self Assessment Bern, March 2004 8 th meeting Rome, Oct, 2003 Copenhagen, Nov, 2003 IT seminar Portugal, 2004 2 nd meeting Lisbon, Oct, 2004 Vilnius, June 2005 Seminars ‘SAIs in control of IT’ 4 Strategic Importance of IT for SAI's June 16 th, 2005

Agenda • 1 Short introduction: – 1. a Background of the seminar – 1. b The IT Self Assessment project – The initiation – The activities – The product 5 Strategic Importance of IT for SAI's June 16 th, 2005

1. b The IT Self Assessment Project Initiation (The Hague, Oct. 2002): Objective: • – develop a self assessment tool for all SAIs; – Cobi. T-based. • Enable to measure the maturity of IT control of our own offices; action list. • Pilot countries. • Project organisation (6 countries, diversity). 6 Strategic Importance of IT for SAI's June 16 th, 2005

1. b The IT Self Assessment Project Why a self assessment? • It allows « proximity » . Evaluation is carried out by the people: – who know the subject – who are interested in solving the problems • It is confidential. The organization is in control of the results and their distribution. • External moderation encourages the people to speak freely. 7 Strategic Importance of IT for SAI's June 16 th, 2005

1. b The IT Self Assessment Project Why Control Objectives for Information and related Technology? ü Cobi. T is a well accepted standard ü Cobi. T can be downloaded free from www. isaca. org ü Cobi. T is also available in French, German and Spanish ü but our group wanted to be sure that Cobi. T is the best choice. . . 8 Strategic Importance of IT for SAI's June 16 th, 2005

1. b The IT Self Assessment Project Activities (Jan. 2003 – Aug. 2003) v Various papers (concepts, requirements, etc. ) v Studies of other tools: v ISO 9001 v European Foundation for Quality Management (EFQM) Excellence Model v ITIL / Process Maturity Self-Assessment & Action Plan v CMM Capability Maturity Model v Common Assessment Framework (CAF): result of the cooperation among EU Ministers responsible for Public Administration 9 Strategic Importance of IT for SAI's June 16 th, 2005

1. b The IT Self Assessment Project v Contact with specialists: v Philips (The Netherlands), v Swisslife (Switzerland), v Prof. W. van Grembergen (University of Antwerp) v Keep it simple! E-mail; two meetings Version 1 (August 2003); pilots: October 2003 – November 2003 Version 2 (February 2004); pilot: March 2004) ITWG (Bern) 10 Strategic Importance of IT for SAI's June 16 th, 2005

1. b The IT Self Assessment Project The product (Bern, March 2004): • A tested Cobi. T-based methodology for IT Self Assessment, in terms of: – A way of working: steps – A way of modelling: graphs/tables – A way of supporting: spreadsheets – A way of presenting: slide-show – A way of preparing; instructions • Ready to be used by (and to be improved based on experiences of) IT WG members and other SAIs 11 Strategic Importance of IT for SAI's June 16 th, 2005

1. b The IT Self Assessment Project Key: alignment between business and IT Two dimensions of the analysis: Business processes (users) • – Most important processes in achieving goals; IT-support? IT-processes (IT-staff) • – Most important? Maturity levels IT-1 IT-M Business process 1 Communicate! Business process N 12 Strategic Importance of IT for SAI's June 16 th, 2005

Agenda • 1 Short introduction: – 1. a Background of the seminar – 1. b The IT Self Assessment project • 13 2 Strategic importance of IT for SAIs Strategic Importance of IT for SAI's June 16 th, 2005

2 Strategic Importance of IT 14 Strategic Importance of IT for SAI's June 16 th, 2005

2 Strategic Importance of IT 15 Strategic Importance of IT for SAI's June 16 th, 2005

2 Strategic Importance of IT for SAIs • Group discussion • Two questions: – 1: Why is(n’t) IT important for SAIs? – 2: If yes: what does that mean? • Time • Group formation 16 Strategic Importance of IT for SAI's June 16 th, 2005

Plenary discussion • 17 Topic 1: Why is(n’t) IT important for SAIs? Strategic Importance of IT for SAI's June 16 th, 2005

Why is(n’t) IT important for SAIs? 1 Decision makers Auditor (SAI) 1 IT Auditee: 2 18 Central Government+ Strategic Importance of IT for SAI's 2 June 16 th, 2005

Why is(n’t) IT important for SAIs? 1. SAI: Audit programme Policy framework selection planning preparation Audit proposal implementation Report of findings Four-way consultation Report design reporting Draft report Publication text Clearance procedure Presentation publication Strategic Importance of IT for SAI's June 16 th, 2005 • Mission, objectives • Primary processes: • Audit process • Knowledge exchange • Secondary processes: • Personnel • Finance • IT 19

Why is(n’t) IT important for SAIs? 1. SAI: High Banking SAI Information intensity of the product Low Cement industry Oil refinery Low High Information intensity of the process 20 Strategic Importance of IT for SAI's June 16 th, 2005

Benefits of IT…. . and risks • Increased productivity • Improved quality of products (user satisfaction) • Improved decision-making ability • Enhanced communication (internal and external) • Enhanced goodwill of employees • Risks: huge investments, expectations vs. reality, vulnerability, system shutdowns, poor integration, manage service providers, not enough training…. 21 Strategic Importance of IT for SAI's June 16 th, 2005

Why is(n’t) IT important for SAIs? 1 Decision makers Auditor (SAI) 1 IT Auditee: 2 22 Central Government+ Strategic Importance of IT for SAI's 2 June 16 th, 2005

Why is(n’t) IT important for SAIs? 2. AUDITEE: G 2 G: G 2 C: 23 Strategic Importance of IT for SAI's June 16 th, 2005

Why is(n’t) IT important for SAIs? 2. AUDITEE: • Has a very high information intensity (process and product) • Any audit involves information (processing) and will increasingly involve IT(-auditing) • Benefits of IT…. and risks • IT-control maturity? 24 Strategic Importance of IT for SAI's June 16 th, 2005

Why is(n’t) IT important for SAIs? CONCLUSION: IT is important for SAIs because: – Their primary and secondary processes can benefit from the application of IT. IT contributes to organisational performance. Risks need to be managed. – In their auditing work, SAIs will be increasingly faced with IT. 25 Strategic Importance of IT for SAI's June 16 th, 2005

Plenary discussion • 26 Question 2: If IT is important for SAI’s: what should that bring about? Strategic Importance of IT for SAI's June 16 th, 2005

If yes: what does that mean? SAI Point of departure: IT AUDITEE 27 Strategic Importance of IT for SAI's June 16 th, 2005

If yes: what does that mean? • SAIs should organize their: SAI –IS-function IT AUDITEE • 28 IS-function: the totality of activities (and accompanying resources) that needs to be performed to provide for IS Strategic Importance of IT for SAI's June 16 th, 2005

If yes: what does that mean? • SAI’s should organize their: SAI –IS-function IT –IS-audit-function • 29 AUDITEE IS(-audit)-function: the totality of activities (and accompanying resources) that needs to be performed to provide for IS(-audits) Strategic Importance of IT for SAI's June 16 th, 2005

If yes: what does that mean? Organize: SAI: IS-function: Structure Skills Systems Strategy Skills Systems Staff Style Shared values Strategy Structure Skills Staff Systems Strategy Style Staff Shared values 30 Strategic Importance of IT for SAI's Style Shared values IS-audit-function: June 16 th, 2005

Organize the IS-function • 4 domains: –Planning and organization –Acquisition and implementation –Delivery and support –Monitoring • Guideline to (re-)determine the level of control over IT 31 Strategic Importance of IT for SAI's June 16 th, 2005

Organize the IS Audit function Three design decisions: q Positions: pure (specialise)– mixed (integrate)? q Organisational units: staff - line q Organisation (SAI): externalise: 32 Strategic Importance of IT for SAI's June 16 th, 2005

Summary • IT is important for SAIs due to: –the information intensity of their own processes and products –the importance of IT for their auditees • That is why SAIs need to: –organize their IS-function; performing an IT Self-Assessment –organize their IS-audit-function 33 Strategic Importance of IT for SAI's June 16 th, 2005

Agenda • 1 Short introduction: – 1. a Background of the seminar – 1. b The IT Self Assessment project • 2 Strategic importance of IT for SAIs • 3 Seminar programme 34 Strategic Importance of IT for SAI's June 16 th, 2005

3 Seminar programme Importance of IT for SAIs IS function IS-audit function Dainius Jakimavicius Massimo Magnini IT Self Assessment Day 2: Rune Johannessen IS Auditing Børre Lagesen Erik Guldentops Day 1: Cobi. T 35 Cobi. T Strategic Importance of IT for SAI's June 16 th, 2005

Summary • 36 IT Self Assessment is necessary! Strategic Importance of IT for SAI's June 16 th, 2005