Introduction to IT Governance – Tools

To illustrate our path, we will “borrow” the table presented in the previous article and explain some of the items according to the sequence below:

IT Governance Tools:

In the text below, we list some IT Governance tools, providing a brief introduction to each one:

BSC (Balanced Scorecard)

The BSC is a well-proven and widespread way to develop a company’s “Corporate Strategy”. To enable good IT Governance, it is essential that the company’s IT strategy is perfectly aligned with the Corporate Strategy as a whole.

By using the BSC, the company’s big picture is visualized through four perspectives: financial; customer; internal processes; and learning/growth. Based on these, a strategic map is generated from which the company’s mission and vision are translated, in addition to vital indicators and performance measurements for good management. The following questions must be answered:

• Where do we want to go now? – Extraction of the company’s vision and business objectives.
• Where are we now? – Assessment of the company’s current situation (Includes process mapping and definition of indicators).
• How will we get there? – Definition of Corporate Strategy based on previous information. (Includes new definition of indicators and processes)
• How will we know if we have arrived? – Result measurements based on previously defined indicators.

Source: Wikipedia

COBIT

There are countless benefits derived from the use of information technology for strategic management and the business as a whole. However, the more technology is employed, the greater the control required to understand and mitigate risks associated with its use.

COBIT (Control Objectives for Information and Related Technology) facilitates control and assists in managing the use of IT in corporations. According to the definition by ISACA (Information Systems Audit and Control Association), COBIT is business-focused, process-oriented, control-based, and metric-driven. This means that COBIT provides resources to control the business, with the help of well-defined processes and the definition of measures to evaluate achieved results compared to expected results.

Remembering that COBIT is not an off-the-shelf solution, meaning its use must be adapted to the business to meet needs and achieve the alignment of IT with the company’s focus. COBIT has four domains: Plan and Organize (PO); Acquire and Implement (AI); Deliver and Support (DS); and Monitor and Evaluate (ME).

Source: Prof. André Moura (Universidade Estácio de Sá)

ITIL and ISO 20000

While COBIT is used for auditing and process control, ITIL plays its role in Service Management. Both are distinct, non-competing frameworks that complement each other.

ITIL (Information Technology Infrastructure Library) is a set of best practices for IT service management and for aligning this area with company business. Currently, ITIL is accepted as the reference for Service Management, consolidating with the publication of ISO 20000, which deals directly with IT Service Management.

ITIL describes the processes necessary to support and manage the IT Infrastructure as well as deliver quality service at acceptable costs, adding value to the business.

PMBOK

The Project Management Body of Knowledge (PMBOK) is a set of project management practices published by the Project Management Institute (PMI) and constitutes a knowledge base in project management. These practices are compiled in the form of a guide, called the PMBOK Guide.

The PMBOK Guide is based on processes and subprocesses to describe in an organized way the activities to be performed during a project.

CMMI and MPS.BR

CMMI (Capability Maturity Model Integration) is a reference model containing practices necessary for process maturity or capability. CMU/SEI (2010) defines CMMI as “a process improvement model that provides organizations with essential elements for achieving effective processes and performance improvement.”

CMMI is an evolution of CMM that seeks to establish a single model for the corporate improvement process, integrating different models and disciplines.

The current version of CMMI (version 1.3) was published in 2010 and presents three models:

• CMMI for Development (CMMI-DEV), focused on the product and service development process.
• CMMI for Acquisition (CMMI-ACQ), focused on the acquisition and outsourcing processes of goods and services.
• CMMI for Services (CMMI-SVC), focused on the processes of service provider companies.

MPS.BR is a process maturity model related to software development, essentially representing the adaptation of CMMI-DEV for the Brazilian market. This was necessary because the domestic market has a higher level of granularity than the global average and consequently evolves more gradually. Thus, the five maturity levels of CMMI-DEV were replaced by seven levels in MPS.BR.

Val IT

Val IT (Value of Information Technology) was created with the objective of helping managers evaluate, select, and measure the return on their IT investments (ROI). The demand for increasingly complex IT environments that become obsolete more quickly causes hardware and software replacement to increase significantly.

Designed specifically as a complement to the COBIT model, both form a complete IT Governance cycle. Val IT is divided into three domains: Value Governance (VG); Portfolio Management (PM); and Investment Management (IM).

Its main objectives are:

• Help management ensure that organizations achieve maximum return on IT-enabled investments at a reasonable cost and with a known and accepted level of risk.
• Provide guidelines, processes, and supporting practices to help boards, executive management teams, and other business leaders understand and perform their respective roles regarding IT-enabled investments.

TOGAF

TOGAF (The Open Group Architecture Framework) is a framework that allows you to create, evaluate, and build the right architecture for your organization.

It is based on the Architecture Development Method (ADM), a proven method for developing an IT architecture that meets the needs of the enterprise and its business.

TOGAF is designed to support at least four architectures: Business Architecture; Data Architecture; Application Architecture; and Technology Architecture;

NBR ISO/IEC 38500

ISO/IEC 38500 (Corporate governance of information technology) is an international standard for the corporate governance of IT.

This standard establishes six guiding principles for organizational directors on the effective, efficient, and acceptable use of IT within their organizations:

• Responsibility;
• Strategy;
• Acquisition;
• Performance;
• Conformance;
• Human behavior.

SIX SIGMA

Six Sigma’s main purpose is to achieve a high level of performance, reliability, and customer value. It is used worldwide as one of the main topics of TQM (Total Quality Management).

It was developed by Bill Smith of Motorola in 1986 and conceived as a way to measure defects and improve overall quality. Basically, it determines a minimum rate of 3.4 defects per million opportunities, equivalent to a quality standard of 99.9997%.

The DMAIC methodology is used (Define, Measure, Analyze, Improve, Control), as shown in the image below:

The purpose of this article was to present an overview of tools and frameworks, as well as the possibilities, advantages, and planning necessary to achieve good IT Governance.