Profiling your organisation’s IT Governance

Why is AS8015 Alignment Important?

Most organisations regardless of size, ownership and profit orientation depend on information and communication technology for their effective day to day and long term operations. This dependence includes ubiquitous functions like telephone and email, basic administrative functions like financial records keeping and banking, and, increasingly, essential business growth functions like customer retention, management and acquisition. In larger organisations, many fundamental business processes are designed to operate partly or wholly with information systems support. If systems are not effective, generally the processes perform poorly and limit the organisation.

So it is not surprising that business performance and improvement generally involves the efficient, effective and acceptable use of information and communication technology (IT). But often, problems with IT in projects and operations can result in wasted funds, distraction of managers, disruption in business operations, poor business performance, unacceptable risk and in extreme cases, destruction of the business. Extensive, rigorous research in Australia and globally reveals that probability of success with use of IT is strongly linked to effectiveness of IT Governance, and particularly to the aspects of governance that deal with the demand for, or business use of IT.

AS8015-2005: Corporate Governance of Information and Communication Technology provides guidance to directors, including business owners and their advisors, to assist them in ensuring that their organisations use of IT is effective, efficient and acceptable, and that it maintains proper balance in contributing to organisation performance and control of risk. It is written in non-technical language, addressed to senior officers including directors, provides a straight-forward governance framework comprising three tasks and six principles (for more information see Infonomics Executive Brief # 2 ).

The Thumbnail Assessment

Does your organisation exhibit the characteristics and behaviours of good corporate governance of IT? This thumbnail assessment assists you in forming an initial view. To use it, rank each assertion using this scale:

I don’t know enough to express a view:	We are not like this at all:	We are a little like this, but only a little:	We mostly match, with some lapses:	We match strongly and consistently:	We match the best in the world
1	2	3	4	5	6

System of IT Governance		Ongoing Operations and Risk		Improving Business Performance
Assertion	Rank	Assertion	Rank	Assertion	Rank
We have an effective system for governance of IT:		Ongoing business dependence on IT is well understood:		IT capability matches business needs and forward plans:
Everybody understands and complies:		IT adequately protects business continuity and sustainability:		Use of IT balances business innovation against risk:
It protects you from IT failures in operations and projects:		IT resource allocation matches the needs of the organisation:		IT investments deliver results as per a formal business case:
It keeps management and directors properly informed of IT status:		The business risk of serious IT failure is understood and managed:		Demonstrated capability to deploy IT initiatives matches aspiration:
Governance System Total		Ongoing Total		Improving Total
Grand Total – Your Thumbnail Index of Alignment

Understanding Your Results

The most fundamental part of understanding your result in this thumbnail assessment is to reflect on your scoring pattern. Were you brutally honest? Do your scores reflect reality, or were you more generous, giving yourself, your organisation and the people you work with the benefit of the doubt? Can you afford to be optimistic about something as fundamental as whether or not your organisation’s IT is effective, efficient and acceptable? Before proceeding, you may want to go back and revise some of the scores you allocated.

How many one’s did you allocate? Recently published research suggests that less than 40% of managers in leadership positions can accurately describe their organisation’s IT governance, but in top performing organisations, this rises to around 80%. If you scored any one’s, ask questions and find out what the situation is.

Did you score higher in the middle column? That’s normal, particularly in larger organisations with distinct IT services. The IT specialists tend to ensure that operational matters are under control, because they can do so with a moderate deal of autonomy.

	Score	What it may mean and what you might do next
System of IT Governance	4 – 12	Key managers may not know enough about what’s happening with IT. Decisions may be isolated and inappropriate. Try to get a big picture view of how you use and control IT.
	13 – 18	Some foundations exist, but key decision makers may not be properly involved. There is a risk of poor decisions and of surprises. Try to get top level executives fully engaged in IT Governance.
	19 – 24	Good information and sound decisions underpin effective use of IT and continuous governance improvement. Look for opportunities to improve the detail.
Ongoing Operations and Risk	4 – 12	Problems with IT probably occur frequently and may damage the business. Fire-fighting mode may prevail – especially at busy times. Try to better manage and learn from problems.
	13 – 18	Day to day operations are probably secure, but surprises may be just around the corner. Use current knowledge as a basis for forward assessment to check that demand will be satisfied.
	19 – 24	Strong operational governance delivers stability and provides a sound base for ongoing improvement. Maintain balance and ensure that that routine does not diminish attention to detail.
Improving Business Performance	4 – 12	IT probably does not figure in business planning, and attempts to add new IT capabilities may prove quite troublesome. Look critically at business plans, and ask how IT should be used.
	13 – 18	The need for IT in support of business improvement may not be matched by capability to deliver. Prioritise work and focus on a small portfolio of initiatives that are within your capability to succeed.
	19 – 24	Your experience and controls probably gives you a competitive advantage. Ensure that your control mechanisms keep balance between essential, safe activities and high risk, high reward projects.
Overall	4 – 24	Unless you are a very small organisation, you probably have no real control over IT, and are at risk of serious business damage through operational and project failures.
	25 – 48	Most contemporary organisations score in the 20’s. Don’t be concerned if you are in this range, but look objectively at your approach and consider the benefits of stronger governance.
	49 – 72	If this is an accurate reflection, your organisation probably is making effective, efficient and acceptable use of IT. Use this competitive advantage to the benefit of your stakeholders.

Comparing with Other Organisations

The Thumbnail Assessment of IT Governance is intended to give you a first awareness of whether or not your organisation might benefit from improving alignment with AS8015. While experience to date is limited, it appears likely that most Australian organisations will rank in the lower to middle part of the 25 – 48 range, and relative strength in operational governance will be apparent. This is because IT departments tend to have more independent responsibility in these areas and maintain control, albeit often in the face of dissatisfaction from non-IT departments. Poorer performance is generally likely in IT Governance and Business Performance, where there is a much greater need for strong executive leadership and engagement. Future Executive Briefs will provide high level comparison of results from the Thumbnail Assessment.

Rigorous Alignment Assessment

The Thumbnail assessment necessarily avoids detail. To increase your organisation’s understanding of what is important and how it performs, Infonomics offers a range of comprehensive assessment tools. Each assessment provides high impact graphics and no-nonsense discussion that expose the reality of your situation, and puts all of your managers and executives “on the same page” so that you can identify the most relevant opportunities for improvement. Every organisation is different, and few are perfect. Can better IT Governance improve yours?

Critical factors in ICT Governance Change

Probably the most fundamental guidance given in AS8015 is that responsibility for the use of ICT in an organisation should rest, in most cases, with the business. While an ICT department or supplier may well be responsible for the supply, it is the business that should determine what business processes are used, and how they are supported and implemented using ICT. Clearly, the processes needed for planning, implementing and operating ICT in a business need to be founded on clear and appropriate allocation of responsibility across business and IT executives. The processes need to ensure that the right executives are engaged at the appropriate points.

It can require strong persuasive capability to establish and embed changes in assignment of responsibility and adjustment of processes. Meeting the AS8015 expectations of business responsibility for the use of ICT is likely to involve business managers addressing matters that have been previously outside their field of attention and the change may not be a comfortable one. Ensuring that the need for change is recognised, and that the delivery of change is successful depends on strong sponsorship. Our experience is that peer sponsorship (ie CIO sponsoring change across the executive level) is often unsuccessful. For this reason we generally recommend that sponsorship of an AS8015 assessment should be from the CEO or board. This does not mean that the CIO can’t initiate an AS8015 improvement program – it means that the CIO’s first task is to secure strong sponsorship from the highest levels in the organisation.