1. The Strategic Importance of IT for SAIs Vilnius, June 16th, 2005 Paul Mantelaers

2. June 16th, 2005Strategic Importance of IT for SAI's2 Agenda 2 Strategic importance of IT for SAIs 3 Seminar programme 1 Short introduction: –1.a Background of the seminar –1.b The IT Self Assessment project

3. June 16th, 2005Strategic Importance of IT for SAI's3 Agenda 1 Short introduction: –1.a Background of the seminar

4. June 16th, 2005Strategic Importance of IT for SAI's4 1.a Background of the seminar IT WG Moscow, May 2002 launched The Hague, Oct, 2002 1 st meeting IT training IT Self Assessment Training Committee Bern, March 2004 2 nd meeting Seminars ‘SAIs in control of IT’ Lisbon, Oct, 2004 Vilnius, June 2005 Copenhagen, Nov, 2003 8 th meeting Training Strategy IT seminar Portugal, 2004 Rome, Oct, 2003

5. June 16th, 2005Strategic Importance of IT for SAI's5 Agenda 1 Short introduction: –1.a Background of the seminar –1.b The IT Self Assessment project –The initiation –The activities –The product

6. June 16th, 2005Strategic Importance of IT for SAI's6 1.b The IT Self Assessment Project Initiation (The Hague, Oct. 2002): Objective: –develop a self assessment tool for all SAIs; –CobiT-based. Enable to measure the maturity of IT control of our own offices; action list. Pilot countries. Project organisation (6 countries, diversity).

7. June 16th, 2005Strategic Importance of IT for SAI's7 1.b The IT Self Assessment Project Why a self assessment? It allows « proximity ». Evaluation is carried out by the people: –who know the subject –who are interested in solving the problems It is confidential. The organization is in control of the results and their distribution. External moderation encourages the people to speak freely.

8. June 16th, 2005Strategic Importance of IT for SAI's8 1.b The IT Self Assessment Project CobiT is a well accepted standard CobiT can be downloaded free from www.isaca.org CobiT is also available in French, German and Spanish but our group wanted to be sure that CobiT is the best choice... Why Control Objectives for Information and related Technology?

9. June 16th, 2005Strategic Importance of IT for SAI's9 Activities (Jan. 2003 – Aug. 2003)  Various papers (concepts, requirements, etc.)  Studies of other tools:  ISO 9001  European Foundation for Quality Management (EFQM) Excellence Model  ITIL / Process Maturity Self-Assessment & Action Plan  CMM Capability Maturity Model  Common Assessment Framework (CAF): result of the cooperation among EU Ministers responsible for Public Administration 1.b The IT Self Assessment Project

10. June 16th, 2005Strategic Importance of IT for SAI's10  Contact with specialists:  Philips (The Netherlands),  Swisslife (Switzerland),  Prof. W. van Grembergen (University of Antwerp)  Keep it simple! E-mail; two meetings Version 1 (August 2003); pilots: October 2003 – November 2003 Version 2 (February 2004); pilot: March 2004) ITWG (Bern) 1.b The IT Self Assessment Project

11. June 16th, 2005Strategic Importance of IT for SAI's11 1.b The IT Self Assessment Project The product (Bern, March 2004): A tested CobiT-based methodology for IT Self Assessment, in terms of: –A way of working: steps –A way of modelling: graphs/tables –A way of supporting: spreadsheets –A way of presenting: slide-show –A way of preparing; instructions Ready to be used by (and to be improved based on experiences of) IT WG members and other SAIs

12. June 16th, 2005Strategic Importance of IT for SAI's12 1.b The IT Self Assessment Project Key: alignment between business and IT Two dimensions of the analysis: Business processes (users) –Most important processes in achieving goals; IT-support? IT-processes (IT-staff) –Most important? Maturity levels Business process 1 Business process N IT-1 IT-M Communicate!

13. June 16th, 2005Strategic Importance of IT for SAI's13 Agenda 2 Strategic importance of IT for SAIs 1 Short introduction: –1.a Background of the seminar –1.b The IT Self Assessment project

14. June 16th, 2005Strategic Importance of IT for SAI's14 2 Strategic Importance of IT

15. June 16th, 2005Strategic Importance of IT for SAI's15 2 Strategic Importance of IT

16. June 16th, 2005Strategic Importance of IT for SAI's16 2 Strategic Importance of IT for SAIs Group discussion Two questions: –1: Why is(n’t) IT important for SAIs? –2: If yes: what does that mean? Time Group formation

17. June 16th, 2005Strategic Importance of IT for SAI's17 Plenary discussion Topic 1: Why is(n’t) IT important for SAIs?

18. June 16th, 2005Strategic Importance of IT for SAI's18 Why is(n’t) IT important for SAIs? Auditee: Central Government + Auditor (SAI) Decision makers IT 1 2 2 1

19. June 16th, 2005Strategic Importance of IT for SAI's19 Why is(n’t) IT important for SAIs? 1. SAI: Mission, objectives Primary processes: Audit process Knowledge exchange Secondary processes: Personnel Finance IT Audit proposal Audit programme Policy framework Presentation publication Publication text Clearance procedure Draft report reporting Report design Four-way consultation implementation preparation planning selection Report of findings

20. June 16th, 2005Strategic Importance of IT for SAI's20 Why is(n’t) IT important for SAIs? 1. SAI: Information intensity of the product Information intensity of the process Low HighLow High Cement industry Oil refinery SAI Banking

21. June 16th, 2005Strategic Importance of IT for SAI's21 Benefits of IT….. and risks Increased productivity Improved quality of products (user satisfaction) Improved decision-making ability Enhanced communication (internal and external) Enhanced goodwill of employees Risks: huge investments, expectations vs. reality, vulnerability, system shutdowns, poor integration, manage service providers, not enough training….

22. June 16th, 2005Strategic Importance of IT for SAI's22 Why is(n’t) IT important for SAIs? Auditee: Central Government + Auditor (SAI) Decision makers IT 1 2 2 1

23. June 16th, 2005Strategic Importance of IT for SAI's23 Why is(n’t) IT important for SAIs? 2. AUDITEE: G2G: G2C:

24. June 16th, 2005Strategic Importance of IT for SAI's24 Why is(n’t) IT important for SAIs? 2. AUDITEE: Has a very high information intensity (process and product) Any audit involves information (processing) and will increasingly involve IT(-auditing) Benefits of IT…. and risks IT-control maturity?

25. June 16th, 2005Strategic Importance of IT for SAI's25 Why is(n’t) IT important for SAIs? CONCLUSION: IT is important for SAIs because: –Their primary and secondary processes can benefit from the application of IT. IT contributes to organisational performance. Risks need to be managed. –In their auditing work, SAIs will be increasingly faced with IT.

26. June 16th, 2005Strategic Importance of IT for SAI's26 Plenary discussion Question 2: If IT is important for SAI’s: what should that bring about?

27. June 16th, 2005Strategic Importance of IT for SAI's27 If yes: what does that mean? IT SAI AUDITEE Point of departure:

28. June 16th, 2005Strategic Importance of IT for SAI's28 If yes: what does that mean? SAIs should organize their: –IS-function IS-function: the totality of activities (and accompanying resources) that needs to be performed to provide for IS IT SAI AUDITEE

29. June 16th, 2005Strategic Importance of IT for SAI's29 If yes: what does that mean? SAI’s should organize their: –IS-function –IS-audit-function IS(-audit)-function: the totality of activities (and accompanying resources) that needs to be performed to provide for IS(-audits) IT SAI AUDITEE

30. June 16th, 2005Strategic Importance of IT for SAI's30 If yes: what does that mean? Skills Strategy Shared values Structure StaffStyle Systems Organize:SAI: Skills Strategy Shared values Structure StaffStyle Systems IS-function: Skills Strategy Shared values Structure StaffStyle Systems IS-audit-function:

31. June 16th, 2005Strategic Importance of IT for SAI's31 Organize the IS-function 4 domains: –Planning and organization –Acquisition and implementation –Delivery and support –Monitoring Guideline to (re-)determine the level of control over IT

32. June 16th, 2005Strategic Importance of IT for SAI's32 Organize the IS Audit function  Positions: pure (specialise)– mixed (integrate)?  Organisational units: staff - line  Organisation (SAI): externalise: Three design decisions:

33. June 16th, 2005Strategic Importance of IT for SAI's33 Summary IT is important for SAIs due to: –the information intensity of their own processes and products –the importance of IT for their auditees That is why SAIs need to: –organize their IS-function; performing an IT Self-Assessment –organize their IS-audit-function

34. June 16th, 2005Strategic Importance of IT for SAI's34 Agenda 2 Strategic importance of IT for SAIs 3 Seminar programme 1 Short introduction: –1.a Background of the seminar –1.b The IT Self Assessment project

35. June 16th, 2005Strategic Importance of IT for SAI's35 3 Seminar programme Importance of IT for SAIs IS function IT Self Assessment Day 2: IS-audit function CobiT Day 1: IS Auditing CobiT Massimo Magnini Dainius Jakimaviciu s Rune Johannessen Børre Lagesen Erik Guldentops

36. June 16th, 2005Strategic Importance of IT for SAI's36 Summary IT Self Assessment is necessary!