Policies for the governance and risk management of technology within organisations.
Evaluate policies for the governance and risk management of technology within organisations.
In this assignment students are expected to demonstrate that they can evaluate policies for the governance and risk management of technology, with particular reference to the acquisition or development of new systems.
IT Governance in General
IT Governance Institute considers that the goals of IT governance should be to ensure that:
1. IT is aligned with the business strategy, or in other words, IT delivers the functionality and services in line with the organization’s needs, so the organization can do what it wants to do.
2. IT and new technologies enable the organization to do new things that were never possible before.
3. IT-related services and functionality are delivered at the maximum economical value or in the most efficient manner. On other words, resources are used responsibly.
4. Risks related to IT are known and managed and resources are secured.
(Grant, Hackney & Edgar, 2010, Page 314)
Part A: IT Risk Management
Briefly describe the kinds of processes or activities which should be undertaken to support the 4th objective, i.e. explain how
Risks related to IT are known and managed and resources are secured.
Part B: Governance of IT Acquisition or IT Systems Development
For either IT Acquisition or IT Systems Development.
Describe the typical activities or processes which are involved in either acquiring or developing information systems (but not both) and identify how these activities or processes support the various goals of IT Governance
Sample Solution
Evaluating IT Governance and Risk Management Policies
Part A: IT Risk Management
To achieve the objective of knowing and managing IT risks and securing resources, organizations should implement a comprehensive IT risk management framework. Here are some key processes and activities:
- Risk Identification: This involves proactively identifying potential threats and vulnerabilities across the IT infrastructure. Techniques include vulnerability assessments, penetration testing, and analyzing industry trends.
- Risk Assessment: Once risks are identified, their likelihood and potential impact on the organization should be assessed. Assigning a risk score helps prioritize mitigation strategies.
- Risk Mitigation: Strategies can include risk avoidance (e.g., not implementing a risky technology), risk reduction (e.g., implementing security controls), risk transfer (e.g., cyber insurance), or risk acceptance (e.g., accepting a low-impact risk).
Full Answer Section
- Risk Monitoring and Reporting: Continuously monitor IT systems for vulnerabilities and ensure mitigation strategies are effective. Regular reporting to management keeps them informed and facilitates adjustments.
- Incident Response: Develop a plan to respond to security incidents efficiently. This includes data breach protocols, data recovery procedures, and communication strategies.
- Needs Assessment: Analyze business needs and identify the functionalities required in the new system.
- Vendor Selection: Evaluate potential vendors based on factors like product features, security standards, implementation experience, and cost.
- Contract Negotiation: Negotiate a contract that clearly defines the scope of work, deliverables, timelines, costs, and risk allocation.
- Project Management: Implement a project management methodology to ensure the acquisition stays on track, within budget, and meets its goals.
- Implementation and Testing: Thoroughly test the acquired system to ensure it functions as expected and integrates seamlessly with existing infrastructure.
- Deployment and Training: Deploy the system to users and provide adequate training to ensure smooth adoption.
- Post-Implementation Review: Evaluate the success of the acquisition based on predefined success criteria.
- Alignment with Business Strategy: The needs assessment ensures the acquired system aligns with business goals by focusing on functionalities required to achieve them.
- Enabling New Capabilities: Acquired technology can introduce new functionalities and capabilities the organization previously lacked.
- Resource Optimization: Careful vendor selection and contract negotiation ensure efficient resource utilization.
- Risk Management: Risk assessments during vendor selection and throughout the acquisition process mitigate potential risks associated with the new system.