Week 03: IT Administrative Controls

Another great discussion full of good analysis and some great examples from the real world.  Those of you who work, please continue to bring such good examples to each of our discussions. You illustrate the learnings for all of us since we each have a different point of view.   We will give you our experiences, but that’s only two people who worked primarily in two companies.  The more views we have the better.

IT organizations are usually the largest administrative expense in a company.  In manufacturing companies, they may be only 1% or 2% of revenue but still be the most expensive support service.  In banks and trading companies IT can get to 50% of revenue.  For this reason the IT organization is always a target for cost cutting.  It must be incredibly well run with all of its administrative processes very tight or it will constantly be second guessed.

Some CIO’s and business writers lament that CIO’s should have a greater say in the strategy of the company.  While IT may be a strong strategic enabler, CIO’s need to prove themselves first to the business.  If IT’s budgeting, procurement or HR practices are a mess why should senior management trust the CIO’s opinion about strategic business matters?   It really goes beyond this.  If IT’s projects are not being done on time, on budget and  producing significant business value for the corporation, why trust IT? It may be unfair, but by being big and expensive IT puts a spot light on itself and needs to act accordingly.

Running an administratively strong organization are the table stakes for playing in the game of business leadership.

 

Jan & Rich

 

 

Readings

1. What is a compensating control?  When would you use one? Why? Can you give an example?
2. If you had to rank the importance of the basic IT controls, how would you do it?  Which is most important, which least?
3. What is segregation of duties and how does it play into basic administrative controls?  Give an example of two IT roles that should be segregated?
4. What do you consider to be the most important personnel hiring controls for an organization?
5. How are budgets handled (ie created monitored,re-forecast, etc.) in your organization?

Your Neighborhood Grocer Case

Consider the following questions about the YNG case.  Ignore the questions at the end of the case.

1. YNG has grown through acquisition resulting in a mess of systems.  Why did this happen and what controls can Larry put into place to ensure that it doesn’t continue into the future?
2. Business application procurement seems to be a big problem.  IT buys stuff the businesses’ don’t want and many of the business’ purchases have been outright failures.  Why?  What controls can Larry put into place to ensure that it doesn’t continue into the future?
3. The most recent IT Audit will produce a finding about the sorry state of access control in the company.  What controls should Larry be ready to recommend to reduce the impact of this finding?