marcos gobernabilidad-sin-mapa-v040811

Pink Elephant Inc. 2011. Los contenidos de este documento están protegidos por derechos de autor y de ninguna manera podrán ser reproducidos sin el consentimiento de Pink Elephant Inc. ITIL es una Marca Registrada de la Office of Government Commerce y está registrada ante la Oficina de Patentes y Marcas de los Estados Unidos de Norteamérica.

Knowledge translated into results

IT Governance a Compass Without a Map?

Pink Elephant



Session Topics• Understanding the changing role of IT in relationship to

business value• Building a practical blueprint of IT Governance• Tying Business objectives and value to IT goals and

operational activities• Moving from a technology to a service approach of IT

Management• Integrating best practice frameworks, COBIT, ITIL, CMMI,

ETOM• Understanding the implications of Service Management on

traditional organizational design and IT roles



The “Risk Gap” For Business Growth Goals



What is IT Governance• IT governance is the responsibility of executives and the board of directors, and consists of

the leadership, organizational structures and processes that ensure that the enterprise’s IT sustains and extends the organization’s strategies and objectives.

• Furthermore, IT governance integrates and institutionalizes good practices to ensure that the enterprise’s IT supports the business objectives.

• ~IT Governance Institute – “COBIT 4.1”

• IT Governance encompasses five major decision areas related to management and use of IT in a firm, all of which should be driven by the operating model:

• IT principles: high level decisions about the strategic role of IT in the business• Enterprise Architecture: the organizing logic for business processes and IT infrastructure• IT Infrastructure: centrally coordinated, shared IT services providing part of the foundation for

execution• Business Application Needs: business requirements for purchased or internally developed IT

applications that both use and build the foundation for execution.• Prioritization and Investment: decisions about how much and where to invest in IT, including

project approval and justification• ~ Harvard Business Review / MIT Sloan “Enterprise Service Architecture as Strategy”



Enterprise & IT Governance

RegulatoryReporting / Privacy

CorporateObjectives

Internal Risk ControlFramework (COSO)

IT Governance Framework(COBIT?)

Drivers

Enterprise Risk Mgmt.

IT Controls

Standards Controls

ITIL / ASL / ISO 27100 / PMI

Ownership & Accountability

Monitoring & Reporting

Disciplines

ISO 38500



The Governance Model ISO 38500

Business Pressures

Business

Needs

Evaluate

Direct Monitor

ICT Projects ICT Operations

Business Processes

Corporate Governance of ICT

Prop

osal

s

PlansPolicies

Perf

orm

ance

Conf

orm

ance



IT Governance vs Management

Present Service Portfolio

Future Service Portfolio

Internal

External

IT Management

IT Governance

Business Strategy

IT Strategy

Market \ CompetitionNew Technology

Legislation

Business Governance & Strategy Drives IT

Markets

Customers

Services



Service Portfolio and Governance IT Governance

IT Strategy

Business Goals and Strategies

Enterprise Architecture

IT Guiding Principles

Service Portfolio Management

Model

IT Organizational Structure

Investment Decisions

Projects Operations

Risk Management

Measurements & Reporting

Controls/Policies

IT Management

IT Governance

Business Management

Service Provider Type

Regulatory & Environmental

IT Mgmt. tools



The Changing Role For IT

Technology Focus

Customer Focus

Business Focus

Value Network Focus

LOW

HIGH

Role Of IT/IS In The Organization

Influ

ence

On

The

Bus

ines

s

IT is perceived as an internal business partner

IT customers are the customer of the organization

IT has a single strategy and is focused on the customer, but is perceived as an external supplier

IT is focused on the integration and delivery of end-to-end IT services (business solutions)

IT is focused on technology, infrastructure and applications are treated as separate and largely unrelated domains

Service Focus

v2

v3



Four Stages or Architecture Maturity

Business Silo Architecture

Where companies look to maximize individual business unit needs of functional silo needs

Providing IT efficiencies though technology standardization and, in most cases increased centralization

Standardized Technology Architecture

Company wide data and process standardization as appropriate for the operating model

Optimized Core Architecture

Reuse loosely coupled IT Enabled business process components (services) to preserve global standards while enabling local differences

Business Modularity Architecture

Source: HBS Enterprise Architecture as Strategy

Phase 1 Phase 3Phase 2 Phase 4



The Growing Legislation Minefield Privacy & Security

Personal Information Protection Electronic Document Act (PIPEDA)

US Patriot Act \ Homeland Security (Critical Infrastructure)

Personal Health Information Protection Act (PHIPA)

Health Insurance Portability and Accountability Act (HIPAA)

SEC Rules 17a-3 & 17a-4 re: Securities Transaction Retention

Gramm-Leach Bliley Act (GLBA) privacy of financial information

Children’s Online Privacy Protection Act Clinger-Cohen Act (US Gov.) Federal Information Security Mgmt. Act

(FISMA) Freedom of Information & Protection of

Privacy (FOIPOP) BC Gov FDA Regulated IT Systems Freedom Of Information Act Americans with Disabilities Act, Sec. 508

(website accessibility) Family Education Rights & Privacy Act

(FERPA) (Higher Education)

Finance Sarbanes Oxley (US) FFIEC US Banking Standards Basel II (World Bank) Turnbull Report (UK) Canadian Bill 198 (MI 52-109 & 52-111) CIRCULAR A-123 (US Gov.) J-Sox (Japan)

Other International IT Models Corporate Governance for ICT DR 04198

(Australia) Intragob Quality Effort (Mexico) Medical Information System Development

(Medis-DC) (Japan) Authority for IT in the Public Administration

(AIPA) (Italy) Principles of accurate data processing

supported accounting systems (GDPdu & GoBS) (Germany)

European Privacy Directive (Safe Harbor Framework)



IT Governance & Business Value LinkageCore Business Measures

• Revenue

• Market Share

• Profit

• ROE

IT Core Strategic Measures

Balanced Scorecard

IT Governance & Measures

IT Operational Processes

ITSM, SDLC, Project Mgmt., Security and Information Mgt.

IT Value Chain (Service Organization)

IT Governance / COBIT

Business Value

IT Goals

IT Processes



Process & Product Relationship



Strategy, Planningand Sourcing

Develop & Integrate

Service Components

E2E ServiceDesign & Sourcing

Run ServiceComponents

Maintain Service Components

Manage ServiceComponents

Manage CustomerServices

Man

ag

e C

lien

t R

ela

tion

ship

s

Man

ag

e S

erv

ices

Client requirements for/agreement to change

Invoicing & payments

Client strategies

Architectures

Financial information

Approvedplans & controls

Request for major Service changes

Acceptedbid

Deliver business change

Problem reportingand resolution

Acceptancedocumentation

Suppliernegotiation

requirements

11Market and

supplier info

11

Supplier strategies& profiles

Request for improvedperformance/fixes

OLA requirementsOLA reporting

Performance vs. OLA

Suppliercontract,issueresolution, feedbackandbenchmarking

Incidentescalation/resolution

Authorise major changesSupport

E2E Service informationE2E Service issues: Service delivery MI

3

4

5

Financial Processing& Reporting10

7

6

8

2

1

9

Manage Suppliers11

11

Cost & price model

Manage Risk

AggregatedreleasePlans

Demand levels& supplycapacity

Supplier performance feedback

Incident communications

OLA metricsBid support

Unplannedchangedemand

Service Portfolio

CUSTOMERS

USERS

12

Handover components

(awaiting authority to run)

4

Major changerequests

9

Incidents & 1st line supportRequests/fixes

SUPPLYDevelop & Maintain Deliver Service

DEMAND MANAGEMENTOrders Commitments

Service

6Incidentescalation

Orders

10

Servicecost info

IndustryBest practice

Group governance

Majorchangerequest

Minor changerequests

Supplier profiles



1. Manage ClientRelationships

2. Manage Services5. Develop& IntegrateService Components

6. Run Service Components

7. Maintain Service Components

11. Manage Suppliers

4. E2E Service Design & Sourcing

3. Strategy, Planning & Sourcing

8. Manage Service Components

10. Financial Processing & Reporting

9. Manage Customer Services

12. Manage Risk

1.1 Facilitate client business strategy

1.2 Manage client demand

1.3 Manage client contact

1.4 Facilitate overallclient satisfaction

1.5 Manage marketing& account opportunities

3.1 Define Vision & Strategy

3.3 Develop / Maintain Service Portfolio, OM & Architectures

3.5 Develop SP Business Plan and Budget

3.2 Define StrategicInvestment Portfolio

3.6 Apply StrategicGovernance

3.4 Define StrategicRoadmaps

5.1 Manage projects

5.2 Manage integrated service components/business change

6.1 Operate & monitor services 6.2 Service recovery

8.1 Implement changed/ new service component 8.2 OLA management

8.4 Service componentperformance management

8.3 Operational suppliermanagement

8.6 Update SCP database & reporting8.5 Benchmarking

2.1 Produce Service Plan

2.3 Review & report service performance

2.4 Identify service improvements

2.5 Update SLAs (existing services)

2.2 Track sservice performance

4.1 Change demandcapture

4.2 Route to appropriatechange process

4.4 Mobilise team &prepare bid

4.3 Confirm feasibility of bid

4.5 Agree with clients

4.7 Aggregate businessrelease/ plan entry

4.6 Portfolio entry

7.1 Component acceptance

7.2 Release planning

7.3 Maintain component

7.4 Production change control

7.5 Business, operations, IT & supplier support

9.3 Manage order

9.4 Manage major incident

9.2 Manage problem9.1 Manage incidents

9.5 Manage knowledge

12.1 Provide local risk governance

12.2 Lead risk management

12.3 Provide risk consultancy

12.4 Provide tools, techniques & standards

12.5 Provide risk training & awareness

12.6 Provide IT security solutions

10.1 Operate and maintain accounting systems

10.2 Maintain financial accounts

10.3 Maintain & manage cost (ABC) and pricing models

10.4 Charging and invoicing

10.5 Management & financial reporting

11.1 Provide market & supplier intelligence

11.5 Manage supplierrelationships

11.4 Communicatewith suppliers

11.3 Select suppliers11.2 Negotiate with suppliers

11.6 Review supplierperformance

11.7 Resolve disputewith supplier

10.6 Investment Appraisal



Value Service Network

Service Unit 3

ExternalBusiness Unit A

External Supplier

Business Unit D

Service Unit 4

Embedded IT

Business Unit A

Business Unit C

Business Unit B

Business Units

Service Ecosystem

Service Unit 1

Service Unit 2

Shared IT Services

3 Service Supplier Types

Service X

Service Z

Service Y

Service WDedicatedService

SharedService

OutsourcedService

Service Catalog



IT Governance Model

CobIT

IT OPERATIONS

Audit Models

Quality Systems & Mgmt. Frameworks

Service Mgm

t.

App. Dev. (SD

LC)

Project Mgm

t.

IT Planning

IT Security

Quality System

COSO

ISO27001

PMI

ISO

SixSigma

TOGAFZachman

ASL

CMMi

Sarbanes- Oxley

US Securities & Exchange Commission

ITIL

ISO 20k



Where Do We Want To Be?



Service and Process Architectures



The Evolving IT Service Organization



Service Organization Model

Infrastructure ApplicationsService Delivery

• ITSM• Security • QA assurance / testing• PMO• Performance Mgmt.• Planning / Consulting• IT Finance• Risk Mgmt./ Compliance• IT Audit• Human Resources

Customer

Service

SLMCatalog

SLA

All of these functions have a enterprise IT mandate and not a vertical technology focus



ITSM Tool Strategy & Integrations



Adoption Curve Of ITSM



Pink Elephant - Expertos en Gestión de Servicios de TI

[email protected]

mailto:[email protected]

http://www.pinkelephant.com/

marcos gobernabilidad-sin-mapa-v040811

Business

business value

service approach

business objectives

changing role

best practice frameworks

pink elephant

session topics