* Controlling compliance
Last week I mentioned BMC’s alignment of its Business Service Management (BSM) technology with COBIT, the IT governance framework published by ISACA, the Information Systems Audit and Control Association. COBIT (Control Objectives for Information and related Technology), is both a governance framework and a “best practices” guide for IT departments.
This week I want to draw attention to a related document just released by The IT Process Institute (ITPI), an independent research organization that exists to support its membership of IT audit, security and operations professionals. Do note, though, that the white paper is sponsored by BMC.
“Not All IT Controls Are Created Equal” is subtitled “Understanding the Performance Improvement Potential of Foundational Controls”. It’s the results of a survey “…designed to test [ITPI’s] theory about the impact of increased rigor of IT processes that are managed as IT controls, from the perspective of whether the improved process control impacted operating performance.” That’s how it begins. You should have some strong coffee standing by and not attempt to read this after a heavy meal. It’s a very meaty report, dense with detail and requires your undivided attention. Nevertheless, getting through it – and understanding it – can bring great rewards for your attempts to both improve the efficiency and reduce the cost of your regulatory compliance efforts.
How rewarding? The authors note that when they rank the survey participants as “high performing,” “medium performing” and “low performing” that “Top performers have a 12% lower rate of unplanned work (i.e., fire-fighting) than medium performers and 37% lower than low performers.” And wouldn’t you like to be able to reduce your fire-fighting efforts by a third?
A number of conclusions are drawn, and I’m especially drawn to this one: “IT should look beyond IT controls as a ‘check box’ activity, and invest resources into leveraging defined and repeatable processes as a general strategy for achieving improved results.” In other words, know the use of every tool in your toolbox and use the appropriate one for each purpose. This paper, and the other resources of ITPI, can help.
