Take control of your IT systems
By Rick Telberg
As a financial services professional, you know the horror stories… Fidelity National, Wells Fargo, ChoicePoint, H&R Block, Ameritrade. Each has suffered data breaches in the past two years that ranks among the worst in history.
Privacy and security are already common watch-words in the financial services industry, but now independent bankers, brokers, traders and lenders are taking the next step by building protections into their corporate structures and processes. It’s called “governance.â€
By itself, it’s not immediately intuitive exactly how governance is applied to information technology. One definition—offered by an auditors group–is a bit more focused: “A structure of relationships and processes that direct and control an organization and help it achieve its goals by adding value while balancing risk and return over IT and its processes.â€
Whew! That’s a pretty typical long-winded way of saying that because IT is the underlying structure of most businesses these days, there needs to be a set of formal processes and procedures in place. These are necessary because IT is inherently vulnerable, without procedures and controls it’s just too easy to change essential data.
Some of the formal processes and procedures, most notably those which pertain to “balancing risk and returnâ€, are often targeted at internal control and, if the business is subject to it, meeting the provisions of the applicable sections of Sarbanes-Oxley and Gramm-Leach-Blilely.
But IT Governance is not restricted to internal control and Sarbanes-Oxley compliance. There are numerous other governance areas that may impose compliance issues.
For example, privacy issues are very sensitive these days, and one of the more stringent constraints on the distribution of information is HIPA—The Health Information Protection Act. If any of your clients are in the healthcare industry, you are no doubt aware of the lengths that this act requires healthcare providers to go to assure confidential information remains confidential. Restricting access to data to authorized users is an important component of IT Governance.
Another important component of IT Governance is process management—understanding the flow of information through a business entity, where the data is created, where it is captured, who handles this data, and what is done with the data.
That sounds pretty cut-and-dry, but lots of money and hours have been spent on studying this area, and while progress has been made, there’s no single framework for business process management that everyone agrees is universally applicable. One popular approach is the CobIT (Control OBjectives for Information and related Technology) model which is promulgated by ISACA (which was previously known as the Information Systems Audit and Control Association) and the IT Governance Institute. CobIT, now in its 4.0 release, provides the materials and procedures for implementing a formal set of business process procedures and controls. The ISACA offers training and certification in CobIT.
One problem with CobIT is that it is a rather complex model, which means that it is often time-consuming and expensive to implement, and might not be a realistic framework for smaller enterprises.
If it sounds like IT Governance has no easy answers, then perhaps you can see why it has jumped onto the list of concerns. The surprising thing is that these concerns haven’t appeared before.
Secure your infrastructure
A great resource is the “Board Briefing on IT Governance, 2nd Edition†document. This publication is available as a free download from the www.ITGI.org website, and contains explanations of the various components of IT Governance as well as extensive checklists and flow charts to help in implementing IT Governance policies and procedures.
[Copyright 2007 Bay Street Group LLC. All rights reserved. Used by permission. First published in HP Technology at Work.]
