Purpose:

Clarify and maintain the governance of enterprise IT mission and vision. Implement and maintain mechanisms and authorities to manage information and the use of IT in the enterprise in support of governance objectives in line with guiding principles and policies.

Objective:

Provide a consistent management approach to enable the enterprise governance requirements to be met, covering management processes, organisational structures, roles and responsibilities, reliable and repeatable activities, and skills and competencies.

Description:

<?>

Inputs:

• Decision-making model
• Enterprise Governance Guiding Principles
• Process Architecture Model
• Authority Levels
• Assigned Responsibilities for Resource Management
• Skill Development Plans
• Skills and Competencies Matrix
• Quality Management System (QMS) roles, responsibilities and decision rights
• Information Security Management System (ISMS) Scope Statement
• Allocated Levels of Authority
• Allocated Roles and Responsibilities
• Enterprise Governance Guiding Principles
• Strategic Road Map
• Emerging Risk Issues and Factors
• Risk Analysis Results
• Enterprise Governance Communication
• Principles for Safeguarding Resources
• Risk Impact Communication
• Communication on Value of Knowledge
• Policy and Objectives for Business Continuity
• Malicious Software Prevention Policy
• Connectivity Security Policy
• Security Policies for endpoint devices
• Feedback on Governance Effectiveness and Performance
• Updated Policies, Principles, Procedures ans Standards
• Environmental Policies
• Updated Policies, Principles, Procedures and Standards

Outputs:

• Definition of Organisational structure and functions
• Enterprise Operational Guidelines
• Communication Ground Rules
• Definition of IT-related Roles and Responsibilities
• IT-related Policies
• Communication on IT Objectives
• Evaluation of Options for IT Organisation
• Defined Operational Placement of IT Function
• Data Classification Guidelines
• Data Security and Control Guidelines
• Data Integrity Procedures
• Process Capability Assessments
• Process Improvement Opportunities
• Performance Goals and Metrics for Process Improvement Tracking
• Non-compliance Remedial Actions

Controls:

• Enterprise Operating Model
• Enterprise Strategy

Task Instructions:

Define the Organizational Structure

1. 1. Define the scope, internal and external functions, internal and external roles, and capabilities and decision rights required, including those IT activities performed by third parties.
   2. Identify decisions needed for the achievement of enterprise outcomes and the IT strategy, and for the management and execution of IT services.
   3. Establish the involvement of stakeholders who are critical to decision making (accountable, responsible, consulted, or informed).
   4. Align the IT-related organization with enterprise architecture organizational models.
   5. Define the focus, roles, and responsibilities of each function within the IT-related organizational structure.
   6. Define the management structures and relationships to support the functions and roles of management and execution in alignment with the governance direction set.
   7. Establish an IT strategy committee (or equivalent) at the board level. This committee should ensure that governance of IT, as part of enterprise governance, is adequately addressed; advise on strategic direction, and review significant investments on behalf of the full board.
   8. Establish an IT steering committee (or equivalent) composed of executive, business, and IT management to determine prioritization of IT-enabled investment programs in line with the enterprise’s business strategy and priorities; track the status of projects and resolve resource conflicts, and monitor service levels and service improvements.
   9. Provide guidelines for each management structure (including mandate, objectives, meeting attendees, timing, tracking, supervision, and oversight) as well as required inputs for and expected outcomes of meetings.
   10. Define ground rules for communication by identifying communication needs, and implementing plans based on those needs, considering top-down, bottom-up, and horizontal communication.
   11. Establish and maintain optimal coordination, communication, and liaison structure between the business and IT functions within the enterprise and with entities outside the enterprise.
   12. Regularly verify the adequacy and effectiveness of the organizational structure.

Establish Roles and Responsibilities

1. 1. Establish, agree on, and communicate IT-related roles and responsibilities for all personnel in the enterprise, in alignment with business needs and objectives. Clearly delineate responsibilities and accountabilities, especially for decision making and approvals.
   2. Consider requirements from enterprise and IT service continuity when defining roles, including staff back-up and cross-training requirements.
   3. Provide input to the IT service continuity process by maintaining up-to-date contact information and role descriptions in the enterprise.
   4. Include in role and responsibility descriptions adherence to management policies and procedures, the code of ethics, and professional practices.
   5. Implement adequate supervisory practices to ensure that roles and responsibilities are properly exercised, to assess whether all personnel has sufficient authority and resources to execute their roles and responsibilities, and to generally review performance. The level of supervision should be in line with the sensitivity of the position and extent of responsibilities assigned.
   6. Ensure that accountability is defined through roles and responsibilities.
   7. Structure roles and responsibilities to reduce the possibility of a single role to compromise a critical process.

Maintain the Enablers of the Management System

1. 1. Obtain an understanding of the organization’s vision, direction, and strategy.
   2. Consider the enterprise’s internal environment, including management culture and philosophy, risk tolerance, security, ethical values, code of conduct, accountability, and requirements for management integrity.
   3. Derive and integrate IT principles with business principles.
   4. Align the IT control environment with the overall IT policy environment, IT governance and IT process frameworks, and existing enterprise-level risk and control frameworks. Assess industry-specific good practices or requirements (e.g., industry-specific regulations) and integrate them where appropriate.
   5. Align with any applicable national and international governance and management standards and codes of practice, and evaluate available good practices such as COSO’s Internal Control-Integrated Framework and COSO’s Enterprise Risk Management—Integrated Framework.
   6. Create a set of policies to drive the IT control expectations on relevant key topics such as quality, security, confidentiality, internal controls, usage of IT assets, ethics, and intellectual property rights.
   7. Evaluate and update the policies at least yearly to accommodate changing operating or business environments.
   8. Roll out and enforce IT policies to all relevant staff, so they are built into and are an integral part of enterprise operations.
   9. Ensure that procedures are in place to track compliance with policies and define the consequences of non-compliance.

Communicate Management Objectives and Direction

1. 1. Continuously communicate IT objectives and direction. Ensure that communications are supported by executive management in action and words, using all available channels.
   2. Ensure that the information communicated encompasses a clearly articulated mission, service objectives, security, internal controls, quality, code of ethics/conduct, policies and procedures, roles and responsibilities, etc. Communicate the information at the appropriate level of detail for the respective audiences within the enterprise.
   3. Provide sufficient and skilled resources to support the communication process.

Optimize the Placement of the IT function

1. 1. Understand the context for the placement of the IT function, including an assessment of the enterprise strategy and operating model (centralized, federated, decentralized, hybrid), the importance of IT, and sourcing situation and options.
   2. Identify, evaluate, and prioritize options for organizational placement, sourcing, and operating models.
   3. Define the placement of the IT function and obtain agreement.

Define Information (Data) and System Ownership

1. 1. Provide policies and guidelines to ensure the appropriate and consistent enterprisewide classification of information (data).
   2. Define, maintain, and provide appropriate tools, techniques, and guidelines to provide effective security and controls over information and information systems in collaboration with the owner.
   3. Create and maintain an inventory of information (systems and data) that includes a listing of owners, custodians, and classifications. Include systems that are outsourced and those for which ownership should stay within the enterprise.
   4. Define and implement procedures to ensure the integrity and consistency of all information stored in electronic forms such as databases, data warehouses, and data archives.

Manage Continual Improvement of Processes

1. 1. Identify business-critical processes based on performance and conformance drivers and related risk. Assess process capability and identify improvement targets. Analyze gaps in process capability and control. Identify options for improvement and redesign of the process. Prioritize initiatives for process improvement based on potential benefits and costs.
   2. Implement agreed-on improvements, operate as a normal business practice, and set performance goals and metrics to enable monitoring of process improvements.
   3. Consider ways to improve efficiency and effectiveness (e.g., through training, documentation, standardization, and automation of the process).
   4. Apply quality management practices to update the process.
   5. Retire outdated processes, process components, or enablers.

Maintain Compliance with Policies and Procedures

1. 1. Track compliance with policies and procedures.
   2. Analyze non-compliance and take appropriate action (this could include changing requirements).
   3. Integrate performance and accordance with individual staff members’ performance objectives.
   4. Regularly assess the performance of the framework’s enablers and take appropriate action.
   5. Analyze trends in production and compliance and take appropriate action.