Pertemuan 11-12
Matakuliah : A0214/Audit Sistem InformasiTahun : 2007
Bina Nusantara
PLANNING AND CONTROLLING
Bina Nusantara
Demand Management Process
Ø Ensures that Project has a business justification
Ø Ensures that projects have a business and IT sponsor
Ø Provides a consistent approach to approving all projects
Ø Ensures that all major projects identify all costs to improve decision making
Ø Provides a means to “weed out” non-essential projects
Ø Provides a means to control IT capacity and spending
Business or IT initiates Project Estimated
Joint Requirement Planning and High Level Solution Design
Business Case and Return On Investment
Cost and Savings Estimates from all Functions
Capital Appropriations Committee
Project Funding Approval and Project Initiation
Bina Nusantara
Technology ApprovalTechnical Steering Committee(ITSC) Evaluate ArchitectureDetermine impactApproval/disapprove
Account Manager works with TSC members to evaluate solution
Request For ProposalFinalize requirements and scopeRequest vendor proposalsEvaluate vendor proposals
NegotiationIT Procurement TeamDefine scope of workNegotiate services and costs
Account Manager works with IT Procurement Team to evaluate vendor proposals
Vendor ManagementIT Procurement TeamMonitor vendor performanceAdminister contractsBudget for costs
Account Manager works with IT Procurement Team to negotiate vendor terms
Technology / Contract RefreshIT Procurement TeamTrack contracts and assetsNegotiate technology refreshNegotiate contract renewal/upgrades
IT Procurement Team notifies customer of contracted date
Technology RequestReview requirements with customer Identify potential solutionsEvaluate potential solutionsRecommend vendor solutions
Customer works with Account Manager to document requirements and Identify potential solutions
Procurement and Vendor Management
Bina Nusantara
Project Planning
Project Definition and Planning
Review Present Status
SurveyInfoNeedsInitiate
Project And Organize
Identify Business Objectives/Information Strategy
Identify Hardware Software Info Structure / Envir.
Assess Packaged Systems Options
Evaluate Development Alternative
Perform Project Impact Analysis
Finalize Project Work Plan
Mgmt. Review and Approval
DevelopConceptDesign
Bina Nusantara
The Important of Project Planning and Control in SDLCSDLC flow follow steps:• A new idea is generated for a system or
improvement• The idea is preliminarily accepted for potential
funding by a sponsor, owner, or user group.
Bina Nusantara
The Important of Project Planning and Control in SDLC• Problem analysis
– The feasibility of the idea is investigated and data is gathered and analyzed related to the cost and benefits, along with other alternative courses of action
– Classic problem definition and current state analysis is performed and documented to understand the primary problem that is to be solved using root cause analysis techniques
– The constraints of existing and potentially future solutions are identified
– The resultant idea feasibility and options for moving forward are documented and presented to the sponsor for approval
Bina Nusantara
The Important of Project Planning and Control in SDLC• Solution design:
– If approved for further study, criteria are developed for a successful implementation and are documented along with the functional requirements for the system to meet the needs of the sponsor and the proposed idea
– Processes are defined by system flowcharts and data flow diagrams to better understand the possible solutions and project tasks involved with deploying the various solutions
– Various solutions are analyzed, buy versus build analysis is performed, software acquisition strategies are investigated, and in-house versus contract services are reviewed as options
– The technical feasibility of the various solutions is examined and reconciled with the organizations infrastructure, data model, current and planed system architectures, configurations and so forth
Bina Nusantara
The Important of Project Planning and Control in SDLC• Solution design:
– The economic feasibility also is examined of the top choices for solutions and compared to ROIs and the budgeted resources available.
– Risk analysis of the various options, including security and control concerns, are documented and prepared for the final proposal along with recommendations for risk mitigation
– Solution proposals are made with recommendations of the systems development goals, costs, and deliverables expectations for approval by system owner/sponsor
Bina Nusantara
The Important of Project Planning and Control in SDLC• System design:
– Based on the approved and agreed upon scope and constraints the system is designed and developed considering users needs, data requirements, functional and processing requirements, training, interfaces, inputs, outputs, internal and application controls, audit trails, availability, data integrity, security requirements, and reports
– Requests for Proposals (RFPs) are designed and submitted as appropriate and contracts are negotiated with various providers and vendors. For contract programmers, a specific contract language ensures that the adequate controls over deliverables, quality, performance to standards, and worksmanship, as well as supportability issues exist.
Bina Nusantara
The Important of Project Planning and Control in SDLC• System design:
– Project plans are built defining the required resources, timeframes, deliverable milestones, and so forth. This is the point where review criteria is developed and agreed upon to ensure that design goals are met.
– Mock ups and a cost benefit analysis are presented for approval and final sign off of development by the departments of management and the affected users.
Bina Nusantara
The Important of Project Planning and Control in SDLC• System development:
– Equipment is purchased and installed properly– Systems are developed in the test environments– Programming occurs either through internal or contracts
resources– Several iterations of programming and testing are
staged and integrated to achieve the final objectives
Bina Nusantara
The Important of Project Planning and Control in SDLC• System development:
– The testing staged includes unit testing, integration testing, regression testing, hardware and component testing, load and stress testing, pilot testing, user acceptance testing, performance testing, and total system testing. This testing should have provisions for protecting sensitive data in the testing phases. The testing duties should be segregated from development tasks as much as possible to ensure the fair analysis and testing of the resultant system or programming components
Bina Nusantara
The Important of Project Planning and Control in SDLC• System development:
– User screens are developed and tested– Initial systems documentation is produced– Test data is processed for the required objectives testing– Facilities planning and implementation is developed with
acceptance procedures defined for all of the environment and support needs
Bina Nusantara
The Important of Project Planning and Control in SDLC• System implementation:
– Based on approval and sign off, implementation and production deployment is planned
– File conversion is performed to populate the final system– Systems conversion is planned and executed using pilot,
parallel or full system cutover methodologies– User and operations manuals are documented and completed– User and operators are trained– The final cutover is created, involving close interaction and
communication with the system users
Bina Nusantara
The Important of Project Planning and Control in SDLC• Maintenance and Modifications:
– The system undergoes routine maintenance and bug fixes with scheduled improvements prepared over time using mini SDLCs
– An ongoing, operational use and utilization of system occurs.
– The periodic assessment of design and performance based on the needs and changes in technologies also occurs.
Bina Nusantara
The Important of Project Planning and Control in SDLC• Cycle repeats:
– A new idea is generated for the improved system to better meet the needs of the owner/sponsor of the user group
Bina Nusantara
The Important of Project Planning and Control in SDLCWhy control important?• Discussion of methods, tools, tasks, resources, project
schedules and user inputs are critical review point for the IT auditor
• Project plan are personnel assignments, cost estimates, risks, and organizational impacts associated with the project, and plans for future phases of development including the related cost estimates.
Bina Nusantara
Project Planning and Control : E-Commerce Security as a Strategic and Structural Problem
• An effective security management system should be made an integral part of an organization’s business strategy.
• The development and management of security should support the core business of the organization.
• Security management consists of guidelines that are based on the security practices that support the business strategy as a whole.
• In E-commerce businesses, information security should be seen as strategic asset and not as a cost.
Bina Nusantara
Information Security Management Systems • Policy and procedures• Scope• Risk assessment• Risk areas• Controls• Documentation
Bina Nusantara
The Planning and Control Approach to E-Commerce Security Management
• Strategic Aspect– Planning corporate objectives– Defining budgets– Defining information security policy
• Organizational Aspect– Setting up security team of managers and technical personnel– Defining responsibility– Drawing up training program in technology and methods– Documenting information security procedures– Application of security procedures– Compliance with security procedures
Bina Nusantara
The Planning and Control Approach to E-Commerce Security Management
• Technical aspect• Financial aspect• Legal Aspect
Bina Nusantara
Conclusion
• Auditor influence is significantly increased when there are formal procedures and guidelines identifying each phase in the SDLC and the extent of auditor involvement
• Auditors will be able to review all relevant areas and phases of the SDLC and report independently to management the adherence to planned objectives and company procedures
• Auditors can identify selected parts of the system and become involved in the technical aspects based upon their skills and abilities
Bina Nusantara
Audit Involvement in Planning and Analysis
• The auditor makes a determination of the reasonableness and merits of the project, potential for satisfying the business need and consistent agreement with company policy and objectives
• The auditor identifies the existence of the communication of the organizational goals from top management downward.
• Auditor requirements are introduced in a timely manner.