Week 02: IT's Role & the Control Environment

As a group you did rather well on the first quiz.  Jeff pointed out that I had a questions on “Compensating Controls” which really should have been in your Week 3 quiz.  Not sure how I did that but I eliminated it from the grading and based everything on four questions, instead of five.  The question that gave people the most trouble was the one about what organizations are looking for out of their IT systems.  About half of you put the easy answer, but the rest tried to explain it in other ways.

• Effective
• Efficient
• Confidential
• Integrity
• Available
• Compliant
• Reliable

I gave points for each that I could identify in your answer.

Your quiz average and all grades are available at community.mis.temple.edu/gradebook.  Logon and check them out anytime, but generally it will be Monday or Tuesday before I update them.  If you did not do well on the first quiz, not to worry.  Remember I drop one from your final average.

Great job on the discussion, this is what I want to see every week.   I think you raised all the salient points but let me summarize.

To be effective any organization needs to establish as certain structure, responsibilities and a strong sense of how they will operate.  A company’s board of directors is there to hold its most senior management accountable in terms of performance, compliance and managing risk.  Thus, the tone for how the corporation will behave starts at the top with the board of directors and flows down through senior management.

Most companies need information systems to operate, so they create an IT organization.  To be effective, that sub-organization (IT) needs certain things:

• Terms of Reference or a Charter – What is its mission? Why is it there?  What is it trying to achieve?  On this last point, the COSO list of objectives for an IT organization (Confidentiality, Integrity, Availability and so on) is a good list.  You should learn it.
• A basic organizational structure, arranged to insure that the work required to satisfy the Terms of Reference will get done.  This implies that resources are allocated to different tasks and that someone is responsible for leading each area of work.
• Monitoring – there needs to be a “culture” of monitoring, each leader should be monitoring his/her people and each level should be monitoring the work of the level below in order to make sure the required work is being done.  Monitoring also implies that when problems arise, they are addressed.
• Performance Metrics – You can only monitor if you can tell a good job from a bad job and you can only tell that if you have some way of measuring success.

If you have these things, you are off to a good start.  This coming week we will look at another level of administrative controls that all organizations have, not just IT organizations (things like budgets, HR policies, etc.

As for DentDel, I hope you all got the point.  Even the most basic controls like assigning responsibilities and monitoring were missing.  Yes the CIO picked a technology without doing due diligence, but why?  Because there was no expectation set that due diligence should be done on every project being initiated.  Note that they didn’t ask the client (in this case Sales) what they needed.  There was a much better project out there, but it never got visibility because there was no process to check.  Its all too easy to assume that governance at this level is being done correctly, but it often isn’t.  Always ask the basic questions first and then follow where they lead.

Readings

1. In your own words, how would you define a control environment?
2. Define the three kinds of common controls and give two examples of each from your everyday life.
3. What is the difference between and IT Strategy committee and an IT Steering Committee?

The Dentdel Case

Think about the following questions before class on Tuesday.

1. What processes were ineffective and allowed this situation to occur
2. Where could stronger  IT Administrative controls  have helped Dentdel avoid this situation?

 

OK, so now we get to the first week of the course when we will handle everything asynchronously.  I want to make sure that you know what I am expecting and what you need to do:

1. Early tomorrow morning, I will post several questions for you to think about when you are reading about this week’s topic.
2. Watch the video lecture, read the assignments and explore the additional materials.
3. By Thursday evening at 11:59 you will need to answer one of my published questions by selecting the Leave a Reply option at the bottom of my post.  Remember, I must approve your first reply or comment so don’t expect to see it right away. After that it will be automatic.
4. Also by Thursday evening at 11:59 pm, you will need to have made three (3) additional substantive replies to the comments of your peers.
5. On Friday, I will post a wrap-up note to close out the week’s topic.
6. On Saturday morning, a quiz on the topic will be published on Blackboard.  You have until 11:59 Sunday to take the quiz.  You will have 15 minutes to answer the five (5) questions.

To learn to the material well you need to be actively engaged in the online discussion.  Check it out and contribute everyday.  If you have questions, put them in a post or reply online so that everyone can see the answer.  If you find yourself confused, call me and we will talk about it (910 880 1254).