case study on Modmeters, use the template for the format and subtitle

Lesson 4

1-1

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Chapter 10

10-2© 2015 Pearson Education, Inc. Publishing as Prentice Hall

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Historical view – it was a low-key activity focused on delivering projects and keeping applications up and running.

Today’s view – it has become much broader and complex, and it is recognized as an integral part of any technology- based work.

10-3

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Harm constituencies both within and outside companies.

Damage corporate reputations.

Dampens an organization’s ability to compete.

10-4

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 10-5

C R I

M I

N A L

I N T E R F E R E N C E

Legal/ Hazards Third Regulatory Parties

External Risk

Operations Information Systems Development

People Processes Culture Controls Governance

Internal Risk

ENTERPRISE RISK

Figure 10.1 A Holistic View of IT-based Risk

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Third parties (i.e., partners, software vendors, service providers, suppliers, customers).

Hazards (i.e., disasters, pandemics, geopolitical upheavals).

Legal and regulatory issues (i.e., failure to adhere to the laws and regulations).

10-6

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Information risks (i.e., privacy, quality, accuracy, and protection). People risks (i.e., poorly designed business process, failure to adapt business processes). Cultural risks (i.e., risk aversion and lack or risk awareness). Control (i.e., ineffective controls). Governance (i.e., ineffective structure, roles).

10-7

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Viruses

Hackers

Organized crime

Industrial spies

Terrorists

10-8

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

1. Focus on what’s important : • RM is not about anticipating all risks but

about attempting to reduce significant risks to a manageable level (Slywotzky and Drzik 2005).

• RM should not be about saying “no” to a risk, but how to say “yes” – thereby building a more agile enterprise (Caldwell and Mogul 2006).

10-9

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

2. Expect changes over time:

• RM actions should be continuous, iterative, and structured.

• Mandatory risk assessment should be implemented at different key stages.

• Ongoing reviews and process of evaluation need to be adapted (Coles and Moulton 2003).

10-10

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

3. View risk from multiple levels and perspectives:

• RM assessments need to include root cause and multifaceted analyses.

• Monitoring and adapting to new international standards and laws, completing overall health checks, and analysis of potential risks are new dimensions of risk.

10-11

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 10-12

The goal of a risk management framework (RMF) is to ensure that the right risks are being addresses at the right levels.

The RMF guides the development of risk policies and integrates appropriate risk standards and processes into existing practices (e.g., the SDLC).

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 10-13

Risk category Policies and standards

Risk type

Risk ownership

Risk mitigation

Risk reporting and

monitoring

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 10-14

The general area of enterprise risk involved (e.g., criminal, operations, third party, etc.).

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 10-15

It includes the general principles for guiding risk decisions.

The principles identify any standards that should apply to each risk category (i.e., SAI Global is an international standard).

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 10-16

Each risk should be identified and labeled with a generic name and definition, ideally linked to a business impact.

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 10-17

Each type of risk should have an owner, either in IT or in the business.

Owners and stakeholders should have clear responsibilities and accountabilities.

Major risks can be owned by committees (i.e., enterprise risk committee or risk review council).

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 10-18

Each type of risk should be associated with controls, practices, and tools for addressing it effectively.

The goal of the framework is to provide means by which risks can be managed consistently, effectively, and appropriately.

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 10-19

Risk metrics should be reported in a way the organization understands (e.g., high, medium, low).

Risk monitoring is an ongoing process because levels and types of risks are changing continually.

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 10-20

Look beyond technical risk

Develop a common language of risk

Simplify the presentation

Right size

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 10-21

Standardize the technology base

Rehearse

Clarify roles and responsibilities

Automate where appropriate

Educate and communicate

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

IT risk is involved in many types of business risks and therefore should be managed holistically.

An integrated risk management framework helps organizations understand risk and make better decisions associated with it.

10-22

Chapter 11

11-23© 2015 Pearson Education, Inc. Publishing as Prentice Hall

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 11-24

Although information delivery may be the responsibility of IT, information management (IM) requires a true partnership between IT and the business.

IT is involved with every aspect of IM, but information is the heart and soul of the business, and its management cannot be delegated exclusively to IT.

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

1. Compliance

2. Operational effectiveness and efficiency

3. Strategy

11-25

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 11-26

Figure 11.1 IM is Fundamental to Organizational Success – Both IT Effectiveness and Individual Performance

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Stage One: Develop an IM policy.

Stage Two: Articulate operational components.

Stage Three: Establish information stewardship.

Stage Four: Build information standards.

11-27

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

A policy outlines the terms of reference for making decisions about information.

A policy provides guidance for accountabilities, quality, security, privacy, risk tolerances, and prioritization of efforts for IM.

A policy should be established at a very senior management level.

11-28

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 11-29

Figure 11.2 Operational Components of an IM Framework

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Clearly articulate IM roles and responsibilities. Information stewards are responsible for meaning, accuracy, timeliness, consistency, validity, completeness, privacy and security, and compliance of information. Information stewards should be business people.

11-30

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Standards ensure quality, accuracy and control goals can be met.

Use metadata repositories to cross- reference models, processes, and programs that reference information.

Standards help reduce information redundancy.

11-31

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Standards require……

A unique name and definition. Data elements, examples, and character length (e.g., name prefix). Implementation requirements. Spacing and order.

11-32

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Culture and Behavior Information Risk Management Information Value Privacy Knowledge Management The Knowledge-Doing Gap

11-33

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Integrity – defines the information usage boundaries.

Formality – enables accurate and consistent information.

Control – once information is trusted, it can be used to develop integrated performance criteria and measures.

11-34

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Transparency – describes the level of trust to speak about errors.

Sharing – exchange of sensitive and non- sensitive information amongst employees.

Proactiveness – creates an alertness to picking up new information about business conditions.

11-35

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Determine internal and external interdependencies.

Determine level of information security needed and cost to implement.

Develop an information security strategy.

11-36

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 11-37

Information Protection

Center

Risk Management

Standards

Education & Awareness

Compliance

Identity Management

IM VALUE PROPOSITION SHOULD ADDRESS:

Strategic

Tactical

Operational

Information Value is difficult to quantify.

It takes time for an IM Investment to pay off.

IM Value is a subjective assessment.

11-38

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Privacy regulations affect current and long-term IM initiatives.

Organizations must be in compliance with many new privacy regulations.

Many countries now require a chief privacy officer who helps the organization ensure IM practices for data quality and accuracy, retention, and security.

11-39

© 2015 Pearson Education, Inc. Publishing as Prentice Hall 11-40

+ Context + Judgment + Intuition

KnowledgeInformation

Knowledge is a fluid mix of framed experience, values, contextual information, and expert insight that provides a framework for evaluating and incorporating new experiences and information. It originates and is applied in the minds of knowers……Thomas Davenport and Larry Prusak (1998)

Knowledge is the capability to take effective action

=

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

It is assumed that better information will lead to better decisions.

There needs to be a clear link between desired actions and the acquisition and packaging of specific information.

11-41

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Start with what you have.

Ensure cross-functional coordination among all stakeholders.

Get the right incentives.

Establish and model sound information values.

11-42

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Strategy People Processes Technology and Architecture Culture and Behaviors Governance

11-43

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

External Environment Strategic Planning Information Life Cycle Planning Program Integration Performance Monitoring

11-44

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Roles and Responsibilities Training and Support Subject-Matter Experts Relationship Management

11-45

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Project Management Change Management Risk Management Business Continuity Information Life Cycle - Collect, create and capture - Use and dissemination - Maintenance, protection, and preservation - Retention and disposition

11-46

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

IM Tools Technology Integration Information Life Cycle Organization Data Standards

11-47

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Leadership IM Awareness Incentives IM Competencies Communities of Interest

11-48

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Principles, Policies, and Standards Compliance IM Program Evaluation Quality of Information Security of Information Privacy of Information

11-49

© 2015 Pearson Education, Inc. Publishing as Prentice Hall

Organizations face many challenges in implementing information management practices.

Although IT can take a lead in developing an information management plan, the business area must ultimately be involved in its implementation and the stewardship of information within the organization.

11-50