Office of the Auditor General of Canada

Progress Report for the Task Force on IT Governance

17th Meeting of the INTOSAI Working Group On

IT Audit

Richard Brisebois & Marie-Claude La SalleTokyo, May 21, 2008

Office of the Auditor General of Canada

Agenda

Background What’s New in IT GovernanceProjects StatusNext Steps

Office of the Auditor General of Canada

Background

The IT Governance project was initiated by

INTOSAI Working Group On IT Audit at its 15th meeting in May 2006 in BrazilThe main objective of the project was to discuss the importance of IT Governance, identify risks and challenges being faced and propose new guidance and share best practices in this area

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Current Members of the Task Force

Project Coordinator: Richard Brisebois & Marie-Claude La Salle, Canada

Active Members:1. Mr. Jamtsho, Bhutan2. Claudia Dias & André Pacheko, Brazil 3. Nagarajan Nagarajan & Ashutosh Sharma, India4. Dainius Jakimavicius & Irmantas Aleliunas, Lithuania 5. Thomas Wijsman, Netherlands6. Thor Kristian Svendsen & Erna Jørgensen Lea, Norway 7. Shaima Al Hinai, Oman 8. Alla Petrenko, Russian Federation 9. Steve Doughty, United Kingdom 10. Madhav Panwar, USA

Commentary Project Participants:1. Sr. Ryoichi Doi, Japan2. Bjørn Undall, Sweden

Office of the Auditor General of Canada

What is IT Governance?

“IT governance is the responsibility of the board of directors and executive management. It is an integral part of enterprise governance and consists of the leadership and organisational structures and processes that ensure that the organisation’s IT sustains and extends the organisation’s strategies and objectives.”

IT Governance Institute

Office of the Auditor General of Canada

Why is IT Governance needed?

IT has become a major enabler to almost all business transformation initiatives. How IT is being used will have a very important impact on whether the organization achieve its vision, mission or strategic goals.

Office of the Auditor General of Canada

Why IT Governance is important?

Value – IT is typically an expensive assetRisk - Organizations have become reliant on ITAlignment - Overall strategy is very much dependent upon the IT strategy

Office of the Auditor General of Canada

Agenda

Background What’s New in IT GovernanceProjects StatusNext Steps

Office of the Auditor General of Canada

IT Governance Global Status Report

The purpose of the research was to determine the sense of priority and actions taken relative to IT governance as well as their tools and services to help ensure effective IT governance.

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Recent and New Development

Office of the Auditor General of Canada

Agenda

Background What’s New in IT GovernanceProjects StatusNext Steps

Office of the Auditor General of Canada

Sub-Projects

1. Integrate and present the material collected from various SAIs at the 5th Performance Auditing Seminar of INTOSAI Standing Committee on IT Audit being held in March 2007 in Muscat, Oman. Project leader: SAI USAAssist: Brazil, U.K.Due date: 2008Status: Completed

Office of the Auditor General of Canada

Material collected from various SAIs at the 5th Performance Auditing Seminar

All material is available in the INTOSAI IT Governance database http://www.nao.org.uk/INTOSAIITGOV/webforms/SAI.aspx

Copies of the CD including the proceedings is also available

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

Office of the Auditor General of Canada

2. Collection of reference material on IT Governance:

Project leader: SAI NetherlandsAssist: Lithuania, Japan, IndiaDue date: 2008Status: Partially completed

Office of the Auditor General of Canada

Reference material on IT Governance

1. Designing Effective IT Governance, Gartner Symposium ITXPO, Italy. 2. Alignment of the IS Functions with the Enterprise: Toward a model of

Antecedents.3. Experiences in Strategic Information Systems Planning. 4. Earl, M.J. and D.F. Feeny (1994), Is Your CIO Adding Value? Sloan

Management Review.5. Understanding the CEO/CIO Relationship, MIS Quarterly.6. Strategies for Information Technology Governance. Idea Group

Publishing.7. Strategic Alignment:Leveraging Information Technology for

Transforming Organizations8. IT Governance Institute (2006), Val IT Framework9. IT Governance Institute (2005). CobiT Version 4.0, Rolling Meadows10. IT Governance Institute (2003), Board Briefing on IT Governance11. Arrangements for Information Technology Governance: A theory of

multiple contingencies. 12. How Top Performers Manage IT Decision Rights for Superior Results,

Harvard Business School Press. 13. Don’t Just Lead, Govern: Implementing Effective IT Governance, MIT

Center for Information Systems Research.

Office of the Auditor General of Canada

3. Collection of various SAI’s work on IT Governance:

Project leader: NorwayAssist: Russia, Bhutan, UK & USADue date: 2008Status: Completed

Office of the Auditor General of Canada

Report on

Subproject 5Collection of various Supreme Audit Institutions

(SAI) work on IT Governance-----------------------

Setting up a database and results from a survey to all INTOSAI members

May 2008

Office of the Auditor General of Canada

Subproject 5

Office of the Auditor General of Canada

Subproject 5

Office of the Auditor General of Canada

Subproject 5

Office of the Auditor General of Canada

Subproject 5

Office of the Auditor General of Canada

Subproject 5

Office of the Auditor General of Canada

Subproject 5

Office of the Auditor General of Canada

Subproject 5

Office of the Auditor General of Canada

Subproject 5

Office of the Auditor General of Canada

Subproject 5

Office of the Auditor General of Canada

4. Produce Interim Progress Reports for Task Force:

Project leader: SAI CanadaDue date: 2008 IT Standing Committee meetingStatus: Completed

Office of the Auditor General of Canada

Agenda

Background What’s New in IT GovernanceProjects StatusNext Steps

Office of the Auditor General of Canada

Next steps

1. Collection of reference material on IT Governance Project leader: SAI Netherlands Assist: Lithuania, Japan, India Due date: 2009

2. Continue the collection of various SAI’s work on IT Governance:

Project leader: All Due date: 2009

3. Develop training material on IT Governance (2010)4. Adapt Private Sector IT Governance material for Public

Sector use (2010)5. Produce Final Report of the Task Force (2011)

Office of the Auditor General of Canada

QUESTIONS?

THANK YOU!

Richard Brisebois & Marie-Claude La Salle