Sunday, February 21, 2010

IT Governance Issues

I am now at the Hyatt Regency, Mumbai attending the Asia Pacific Control and Securities Conference (CACS) of ISACA. The sessions are on IT governance and security. This blog and the ones that follow do not attempt to report the proceedings but are rather an attempt to document my immediate reaction to what speakers were saying.

In the morning we had Robert E Stroud.

He was speaking about the five traps in IT governance.
He related real life anecdotes about his children and grand-children.
He describes a scene where his car has a microchip that sends a message to the dealer about a fault in the vehicle, who in return responds to the user's complaint. Well, in India we are not so seamlessly connected; Is that good or Bad?

He was also relating a situation where if the server fails on Thanksgiving day, the store fails. This is because all items are bar-coded and therefore not human-intelligible. Is this an IT incident or merely an inability to plan ahead? Why couldn't they have had someone staying over to handle glitches like this? This would have been automatic in India.

He also made the point that Governance is more than compliance. Governance is not a bottom up issue--it has to be top down.

Risk is not necessarily a bad word. You might want to take a risk to actualize a business opportunity. This is a positive acceptance of risk.

His quotations that he puts on Twitter were:

Perception is Reality.

Power Corrupts. PowerPoint Corrupts absolutely.

He also speaks about external consultants who are brought in as a "Solution". He calls it the "Outside-in-trap" and advocates solving the problem organizationally.

He suggests that we should have a Just Enough approach to Governance as over emphasis on Governance may curb innovation.

SUMMARY OF SESSION

The Deadly Sins in IT Governance are

Absence of 1. Definition, 2. Ownership, 3. Measurement, 4. Mutiple Governance System, 5. Automation. A last one, viz., Transparency was added by a participant which Robert agreed should be the First!

Questions were mainly on the Semantics of words like Security, Governanance and IT Governance. The speakers replies were possibly not the last word on this.




No comments:


Murudeeshwar