and CIOs must balance among many competing priorities.Mitigate risk:Ensure security and continuity of internal business operations, while minimizing exposure to external risk factorMaximize return:Improve business results; grow revenue and earnings, cash flow, reduced cost-of-operationImprove performance:Improve business operations performance end-to-end across the enterpriseIncrease customer and employee satisfactionIncrease agility:Enable the business organization and operations to adapt to changing business needs

IT Governance Event - UCISA

Needs, Issues & ChallengesProcedure, Audits, MetricsControlStrategicTacticalOperationsDemandIT andBusinessResourcesSupplyCapital, Capacity, PrioritiesPlanningLack of Business aligned strategyReduce costs across business Ineffective project ManagementDeployment Complexity through lack of standard & legacyNo Audit Trails Management of Service ChangesMust reduce IT costs by 30%Lack of IT resource transparencyMissed targets due to lack of steering control Deployment Complexity in number of projectCannot aggregate need and distribute ROINo means of governing outsourced contractsNo means of capturing demandsNo means of prioritization of business needNo means of reporting SLAMaking new outsourcing decisions

IT Governance Event - UCISA

Budget available to support innovationNote: percents do not sum to 100 due to range format question structure.Discretionary vs. Nondiscretionary36% of the average CIOs budget can be devoted to providing new capabilities.Q: What percent of your total IT budget is devoted to: Non-discretionary items infrastructure, support and maintenance or Discretionary items new capabilities?Source: CIO Magazine The State of the CIO online survey, January 2008

IT Governance Event - UCISA

How many IT projects have positive business outcomes?...still not enough!WorldwideEMEA

IT Governance Event - UCISA

By transforming the % of IT spending consumed by ongoing operations Driving Innovation

IT Governance Event - UCISA

Tangible BenefitsCost avoidanceStopped $8 mill in projects unlikely to deliver expected business valueSaved $3.7 mill by avoiding investment in non-viable projectsIT spend not aligned to IT strategy reduced by 25%IT project scope change orders reduced by 57%Cost reductionAt risk projects reduced by over 30%Audit costs reduced by 1.2 mill per yearIT labour costs reduced by $320kIT budget on targetEfficiency gainsReduced project funding process from 6 weeks to 1 weekSchedule tracking and updating lead time reduced by 67%Reporting efficiency increased by 75%IT labour efficiency increased by 10%Project management bandwidth increased by 12%Demand queue reduced by 67%

What is IT Governance?HP working definitionIT governance is the formal process of defining the strategy of the IT organization and overseeing its execution to achieve the goals of the enterprise.Decision rights framework & mechanisms

IT Governance Event - UCISA

Who are the Decision Makers? Business and IT CollaborationIT DecisionBusiness DecisionDe-centralisedCentralizedFederalBusiness Exec.Business Exec./Mgt.Business Mgt.IT Exec.IT Exec./Mgt.IT ManagementBusiness and IT Exec.Business and IT Exec./Mgt.Business and IT Mgt.Non-CooperativeCooperativeAnarchy

IT Governance Event - UCISA

Core Competencies for Effective IT GovernanceEnterprise ArchitectureManagementRelationship ManagementIT Strategy ManagementFinancial ManagementSupply / Demand ManagementPortfolio ManagementIT Operating ModelAlign operational and strategic IT investments to business strategies & objectives.Establish policies, standards, models and processes for managing IT as an enterprise assetLifecycle management of infrastructure, applications and servicesUnderstand the drivers of IT costs to allocate appropriate costs to the consumers of IT services.Establish effective, collaborative relationships with business stakeholders and suppliers.Balance the demand for IT services with available resources to meet immediate and strategic goals.

**Optimized Business Value ImpactEnterprise Cost ManagementIT Cost TransferIT Cost MinimizationExpense Driven, Budget FocusedBalanced & Aligned Adaptive Enterprise Enterprise Demand DrivenSupply ConstrainedDeliver to BudgetTechnology CentricTechnology-based ServicesService Centric Business CentricCustomer Centric IT Operating ModelRelationship ManagementManagementFinancial ManagementIT Strategy ManagementAd Hoc or IT CentricTechnology BasedSupply ConstrainedValue BasedDemand DrivenSiloIT Process-BasedBusiness Process BasedInternal Service ProviderShared ServicesBalanced & Aligned Multi-SourcingITGovernanceCapabilityDomainsNoneTechnology BasedSupply ConstrainedValue BasedDemand DrivenSiloIT Process-BasedBusiness Process BasedInternal Service ProviderShared ServicesBalanced & Aligned Multi-SourcingITGovernanceCapabilityDomainsNoneUtilityUtilityDependentAgilePortfolio ManagementLevel 1: InitialLevel 2: RepeatableLevel 4: ManagedLevel 3: DefinedLevel 5: OptimizedRole of ITIT Governance Capability LevelsIT Governance Capability ModelAd Hoc Review of Portfolio SynergiesIT Cost MinimizationEmerging ROI Based FundingBusiness Unit AlignedEnterprise IT Portfolio ManagementOptimized Business Value ImpactEnterprise Cost ManagementIT Cost TransferIT Cost MinimizationExpense Driven, Budget FocusedBalanced & Aligned Adaptive Enterprise Enterprise Demand DrivenSupply ConstrainedDeliver to BudgetTechnology CentricTechnology-BasedServicesService Centric Business CentricCustomer Centric IT Operating ModelBusiness Relationship ManagementSupply / Demand ManagementFinancial ManagementAgile Enterprise ArchitectureArchitecture Driven DesignBusiness Strategy LinkedProgram-based Architecture ManagementAd hoc Technical ArchitectureEnterprise Architecture ManagementIntegrated Enterprise Architecture & Business PlanningArchitecture-Compliant DesignBusiness Strategy Aligned ArchitectureInitial Enterprise Architecture Program Ad hoc / Ineffective Enterprise ArchitectureEnterprise Architecture ManagementAgile Enterprise ArchitectureArchitecture Driven DesignBusiness Strategy LinkedProgram-based Architecture ManagementAd hoc Technical ArchitectureEnterprise Architecture ManagementIntegrated Enterprise Architecture & Business PlanningArchitecture-Compliant DesignBusiness Strategy Aligned ArchitectureInitial Enterprise Architecture Program Ad hoc / Ineffective Enterprise ArchitectureEnterprise Architecture ManagementIT Strategy ManagementAd Hoc or IT CentricTechnology BasedSupply ConstrainedValue BasedDemand DrivenSiloIT Process-BasedBusiness Process BasedInternal Service ProviderShared ServicesBalanced & Aligned Multi-SourcingITGovernanceCapabilityDomainsNoneTechnology BasedSupply ConstrainedValue BasedDemand DrivenSiloIT Process-BasedBusiness Process BasedInternal Service ProviderShared ServicesBalanced & Aligned Multi-SourcingITGovernanceCapabilityDomainsNoneUtilityUtilityDependentAgilePortfolio Management1: Initial2: Repeatable4: Managed3: Defined5: OptimizedRole of ITIT Governance Capability LevelsIT Governance Capability ModelAd Hoc Review of Portfolio SynergiesIT Cost MinimizationEmerging ROI Based FundingBusiness Unit AlignedEnterprise IT Portfolio ManagementThe HP IT Governance Capability Model

**IT Governance Models - the 5 CharacteristicsCorporate GovernanceIT Governance FrameworkBTO portfolioBusiness ChangeOrg. Alignment & CompetenciesProcessesTechnologyPeopleValueBenefits AssuranceThere are many models.But they share 5 characteristics:Underpinned by processes that must be implemented (e.g. Incident management)Supported by technologyDefine business change issues to be addressedDefine organisational realignment to be achievedInclude some way of measuring the value to be achieved (e.g. balanced scorecard)

**How to Implement Governance

Critical success factors for ITG Clarity of Purpose Senior Management Commitment Management of Business Change Focus, execute and enforce Measure achievable targets and expectations Dont over-engineer IT Governance Evolution not revolution

IT Governance Event - UCISA

Any Questions?

These goals are the result or output of combining two business functions together

Doing the right things:Planning & Demand = Alignment: make prioritised financial and resource decisions (investment portfolio) with respect to demand from businessPlanning & Supply = Flexibility: define and adjust project plans to deliver on a chosen (and often changing) investment portfolio

Doing things right:Control & Supply = Efficiency: execute programs and projects in the most cost effective and efficient wayControl & Demand = Quality: deliver on agreed expectations set at time of demand intake

This provides a business framework for PPM. To put it into use requires input from the customer. Gather the needs, issues and challenges from the organization to reveal the pain points and identify where the likely starting point is. *Q. What percent of your total IT budget is devoted to: Non-discretionary items infrastructure, support and maintenance (keeping the lights on) or Discretionary items new capabilities (i.e., new projectsnot software upgrades)Heads of IT report that 36%, on average, of the IT budget is devoted to discretionary projects providing new capabilities, fairly consistent with the 37% reported last year. 60% of the IT budget is devoted to nondiscretionary projects keeping the lights on, consistent with 58% average in 2007. Healthcare CIOs lead in discretionary spendingCIOs in healthcare devote an average of 43% to discretionary projects, significantly higher than their education, government and manufacturing counterparts.Note: percents do not sum to 100 due to range format question structureThe percents don't sum to 100 because the question is asked in range format rather than exact percents (so 0-10%, 10-20% etc) and it was asked separately for both discretionary and nondiscretionary. So technically a respondent could select ranges that don't sum to 100. A terrible admission by IT professionals. They cannot link their work to Business Outcomes.External Auditors are using COBITCOBIT is a good framework talking about the what and also including control objectives

Build Slide: When you look at the myriad of regulations out that, as well as what it means to have good IT Governance, a common set of IT Controls will boil up to the top. Whether its SOX 404, Basel II Operational Risk, FDA 21 CFR Part 11requirement such has effective Change Mgmt, Security, Availability, Transaction Integrity ALL need to be considered and proven in order to be considered compliant.

COSO, or the Committee of Sponsoring Organizations, built a Risk Management Framework several years ago to give organizations a guideline or model as to what they should do in order to put risk management processes in place and ensure it on an ongoing basis. It is very high level framework and doesnt get too specific as to what IT needs to do.

COBIT, or Control Objectives for Information (and related) Technology, was published jointly by the IT Governance Institute and ISACA (Information Systems Audit and Control Association). In conjunction with COSO, it provides specific direction to IT departments as to what they need to do to satisfy regulations such as SOX 404. Examples include ensuring change management processes are in place and being follows, or ensuring that access to applications is restricted and monitored, systems are kept up to date with the latest patches and configurations, etc, etc. In essences.it is WHAT you need to do to become compliant.

ITIL is the HOW you should do it. ITIL provides a recognized set of best practices for managing IT processes. Many customers (like HP) are using, and Analysts are prescribing the use of ITIL in conjunction with COSO and COBIT to achieve compliance with regulations and ensure good IT Governance. Additionally, some of the large security standards such as ISO 17799 and new standards such as ISO20000 are becoming even more prescriptive.

HP and HP OpenView has long been a proponent of ITIL, building in and automating ITIL processes in the product suite. (Service Desk, SDO, Config, etc all support ITIL, and additionally, IdM support ISO 17799.) The release of OV Compliance Manager reinforces the linkage of the models such as COBIT and ITIL by reporting out-of-the-box on those key process areas such as change, config, release, incidents, availability, and security.

OpenView helps by automating these controls, monitoring and reporting on this data.