PO04 Process Description

PO04: IT Organization & Relationships

1. Description

Planning and control to enable an organization suitable in numbers and skills with roles and responsibilities defined and communicated, aligned with the business and that facilitates the strategy and provides for effective direction and adequate control.

2. Control Objectives

IS Oversight Committee - oversee the information services function and its activities. Committee membership should include representatives from senior management, user management and the information services function. The committee should regularly meet and report to senior management
Organizational Placement of the IT Function - Authority and independence, critical mass, relationships, partnerships
Review Of Organizational Achievements - reviewing the organizational structure to continuously meet objectives and changing circumstances
Roles and Responsibilities - Explicit roles and responsibilities
Quality Assurance - ensure that appropriate quality assurance, systems, controls and communications expertise exist. The organisational placement within the information services function, the responsibilities and the size of the quality assurance group should satisfy the requirements of the organisation
Logical And Physical Security - assuring both the logical and physical security of the organizationrsquo;s information assets to an information security manager, reporting to the organization’s senior management. At a minimum, security management responsibility should be established at the organisation-wide level to deal with overall security issues in an organization. If needed, additional security management responsibilities should be assigned at a system-specific level to cope with the related security issues
Ownership And Custodianship - create and regularly review structures for formally appointing the data owners and custodians. Clearly define their roles and responsibilities
Data And System Ownership - ensure that all information assets (systems and data) have an appointed owner who makes decisions about classification and access rights. System owners typically delegate day-to-day custodianship to the systems delivery/operations group and delegate security responsibilities to a security administrator. Owners, however, remain accountable for the maintenance of appropriate security measures
Supervision - implement adequate supervisory practices in the information services organization to ensure that roles and responsibilities are properly exercized, to assess whether all personnel have sufficient authority and resources to exact their roles and responsibilities, and to generally review key performance indicators
Segregation Of Duties - implement and review a division of roles and responsibilities which should exclude the possibility for a single individual to subvert a critical process. Management should also make sure that personnel are performing only those duties stipulated for their respective jobs or positions. In particular, a segregation of duties should be maintained between the system development maintenance function, the processing operations function and the client organization. In addition, the security responsibility should be clearly separated from the processing operations function
Information Technology Staffing - staffing requirements evaluations should be regularly performed to ensure the information services function has a sufficient number of competent information technology staff. Staffing requirements should be evaluated at least annually or upon major changes to the business, operational or information technology environment. Evaluation results should be acted upon promptly to ensure adequate staffing currently and in the future
Job Or Position Descriptions For Information Services Function Staff - ensure that position descriptions for information services function staff are established and regularly updated. These position descriptions should clearly delineate both authority and responsibility, include definitions of skills and experience needed in the relevant position, and be suitable for use in performance evaluation
Key Information Technology Personnel - define and identify key information technology personnel
Contracted Staff Procedures - define and implement relevant procedures for controlling the activities of consultants and other contract personnel by the information services function to assure the protection of the organization’s information assets
Relationships - establish and maintain an optimal coordination, communication and liaison structure between the information services function and various other interests inside and outside the information services function (users, suppliers, security officers, risk managers).

3. Key Goal Indicators

Number of delayed business projects due to IT organizational inertia or unavailability of necessary capabilities
Number of core IT activities outside of the IT organization that are not approved or are not subject to IT organizational standards
Number of business units supported by the IT organization
Survey rating of IT staff’s business focus, morale and job satisfaction
Percent utilization of IT personnel on IT processes that produce direct business benefits

4. Key Performance Indicators

Age of organizational change, including reorganization or organizational reassessment
Number of organizational assessment recommendations not acted upon
Percent of IT organizational functions which are mapped into the business organizational structure
Number of IT units with business objectives directly cascaded into individual roles and responsibilities
Percent of roles with documented position descriptions
Average lag time between change in business direction and the reflection of the change in the IT organizational structure
Percent of essential functions which are`explicitly identified in the organizational model with clear roles and responsibilities

5. Critical Success Factors

The IT organization communicates its goals and results at all levels
IT is organised to be involved in all decision processes, respond to key business initiatives and focus on all corporate automation needs
The IT organizational model is aligned with the business functions and adapts rapidly to changes in the business environment
Through encouraging and promoting the taking of responsibility, an IT organization develops and grows individuals and heightens collaboration
There are clear command and control processes, with segregation where needed, specialization where required and empowerment where beneficial
The IT organization properly positions security, internal control and quality functions, and adequately balances supervision and empowerment
The IT organization is flexible to adapt to risk and crisis situations and moves from a hierarchical model, when all is well, to a team-based model when pressure mounts, empowering individuals in times of crisis
Strong management control is established over the outsourcing of IT services, with a clear policy, and awareness of the total cost of outsourcing
Essential IT functions are explicitly identified in the organization model, with clearly specified roles and responsibilities

6. Service Maturity Variations

0 Non-existent	The IT organization is not effectively established to focus on the achievement of business objectives.
1 (Initial/Ad Hoc)	IT activities and functions are reactive and inconsistently implemented. There is no defined organizational structure, roles and responsibilities are informally assigned, and no clear lines of responsibilities exist. The IT function is considered a support function, without an overall organization perspective.
2 (Repeatable but Intuitive)	There is implicit understanding of the need for and importance of technology planning. This need and importance is communicated. Planning is, however, tactical and focused on generating technical solutions to technical problems, rather than on the use of technology to meet business needs. Evaluation of technological changes is left to different individuals who follow intuitive, but similar processes. There is no formal training and communication of roles and responsibilities. Common techniques and standards are emerging for the development of infrastructure components.
3 (Defined Process)	Defined roles and responsibilities for the IT organisation and third parties exist. The IT organisation is developed, documented, communicated and aligned with the IT strategy. Organisational design and the internal control environment are defined. There is formalisation of relationships with other parties, including steering committees, internal audit and vendor management. The IT organisation is functionally complete; however, IT is still more focused on technological solutions rather than on using technology to solve business problems. There are definitions of the functions to be performed by IT personnel and of those which will be performed by users.
4 (Managed and Measurable)	The IT organisation is sophisticated, proactively responds to change and includes all roles necessary to meet business requirements. IT management, process ownership, accountability and responsibility are defined and balanced. Essential IT staffing requirements and expertise needs are satisfied. Internal best practices have been applied in the organisation of the IT functions. IT management has the appropriate expertise and skills to define, implement and monitor the preferred organisation and relationships. Measurable metrics to support business objectives and user defined critical success factors are standardised. Skill inventories are available to support project staffing and professional development. The balance between the skills and resources available internally and those needed from external organisations is defined and enforced.
5 Optimized	The IT organisational structure appropriately reflects the business needs by providing services aligned with strategic business processes, rather than with isolated technologies. The IT organisational structure is flexible and adaptive. There is a formal definition of relationships with users and third parties. Industry best practices are deployed. The process to develop and manage the organisational structure is sophisticated, followed and well managed. Extensive internal and external technical knowledge is utilised. There is extensive use of technology to assist in the monitoring of organisational roles and responsibilities. IT leverages technology to support complex, geographically distributed and virtual organisations. There is a continuous improvement process in place.