IT executives are interested in using established frameworks to improve technology governance, but they just don’t have enough bodies to do the job, according to a global survey released this week.
The IT Governance Institute publishes a global survey of 23 countries every couple of years, commissioning consulting firm PricewaterhouseCoopers to conduct the research. This year the survey showed awareness of frameworks such as the Control Objectives for Information and Related Technology (COBIT) has doubled since the study was done in 2005, but there was also a 23 per cent jump in the number who cited insufficient staff to manage IT effectively.
COBIT, which was last updated three years ago to include information on different vertical industries, offers guidance and best practices to manage 34 different processes, including planning, acquisition, delivery and monitoring. The first edition was published in 1994. It is published by the Information Systems Audit and Control Association (ISACA). Canadian COBIT users include the Ontario Pension Board, Canada Mortgage and Housing Corp. and several auditor general offices.
Fariba Anderson, a former CIO who now works as a consultant with Toronto-based Manta Group, likened the use of COBIT to improving the way you drive a vehicle. COBIT is like a brake, Anderson said. It’s a control that’s embedded in a car.
“The IT professional learns the skill sets of becoming a good manager, just as an individual learns how to drive a car,” she said. “They learn what controls they should have in place, when to focus on quality, budget, et cetera.”
John Lainhart, past-president and principal advisor to the IT Governance Institute, said a certification program launched last year will help address the skills gap around COBIT. The certification covers six different areas in which professionals will have to demonstrate their experience, including strategic alignment, value delivery and performance management.
According to Lainhart, governance can yield major benefits. He cited a financial institution he’s been working with which was juggling 900 different software systems and, through the application of COBIT and setting up the right kind of management processes, reduced that to 400 within a month’s time.
Anderson distinguished between COBIT and the IT Infrastructure Library – the third version of which was published last year – by explaining that ITIL deals with the “how” of managing IT. COBIT, in contrast deals with what’s being managed, such as the business processes.
“I think at the industry level we should really stop referring to COBIT as something you implement,” she said. “You have to adapt it to your business needs and environment. That’s something CIOs have struggled with.”
Two years ago the IT Governance Institute published a different framework, called Val IT, which had the support of IBM, HP and a number of other vendors. According to the global survey, however, more than half of respondents are still not familiar with it, even though they may be planning to apply some of its principles. Key barriers to Val IT, according to the study, include uncertainty regarding the return on investment (ROI) and lack of knowledge/expertise.
“What Val IT gives the CIO is a business plan as to why they are in this business,” said Anderson, ticking off the domains of value governance, portfolio management and investment management that are covered by the framework. “You have to look at it from these three lenses.”
Lainhart said the IT Governance Institute is getting ready to publish a second version of Val IT, possibly as early as next month.
“It’s more aligned with COBIT now,” he said. “It has the maturity models you really need.” The Institute is also working on a guide that can help organizations get a quick start on adopting COBIT and Val IT, he said.