IT audits help a company meet end-year reporting requirements and can improve "IT governance"

Although the word “audit” has gathered new weight in the current global financial crisis, there is another type of audit that can help businesses assess and harness the true value of their IT investments. The research-oriented IT Governance Institute (ITGI) in cooperation with ISACA, formerly known as the Information Systems Audit and Control Association, has announced a major update to the Val IT framework, which is a set of proven practices to encompass all IT expenditures with something called “value management”. Basically it comes down to how to invest in and deliver good IT services and how to measure them.

IT is widely recognised as essential to most businesses today, but business decision-makers in the top tiers of management often have little understanding of the value of their information technology systems and do not understand how to utilise IT to reach their business objectives. The IT folks understand the technology and its specialised vocabulary, but often do not understand the management’s goals for the business. Therefore, the value of the IT is often underutilised or lost.

Val IT is a framework that gives executives across the business a systematic way to choose the right hardware, software and systems, and manage them across their entire economic life cycle by focusing on outcomes. This framework bases IT investment decisions on business metrics rather than IT metrics. IT sales people tend to sell “feeds and speeds” whereas the business objective should align with the strategic goals of the business.

An IT audit can be the first step in the process. Frank Yam, chief executive of Focus Strategic Group, is also the international vice president of ISACA and ITGI, with over 20 years in the IT auditing and security business. He explained what an IT audit is, and what it can achieve.

He said: “First, it is important to recognise the role management has to play in today’s IT-driven business world. Management should provide the leadership and funding, do the initial assessment of the value of proposed IT investments, and keep the big picture in mind, including defining what is mandatory in the industry and the regulatory environment.

“Then, management has to understand that the IT enablers do not set the business strategies and are not the creators of business goals and objectives, so they cannot ensure that the IT investment is actually working for the good of the company. This means more involvement by management in setting up the core values and the auditing systems that continually track the IT performance.”

Yam said that there are four “ares” or questions that management should be continually asking, as spelled out in the Val IT 2.0 document. To simplify, these four questions are: Are we doing the right things? Are we getting the benefits? Are we doing them in the right way? Are we getting them done well?

These questions cover the strategic question, the value question, the architecture question and the delivery question.

There are two types of IT audits, those that support the year-end reports that comply with statutory or regulatory environment, and give a fair and balanced representation of the financial situation of the company. The other is a full-blown IT audit that shows the way for management to improve IT governance at the process level.

A process IT audit covers certain basic aspects, such as how transactions or initiated (fill in a form, take calls, etc.), the authorisations for the next step, recording (data entry into the system), processing the data through the applications designed for the software and hardware, and reporting.

Who decides what information is presented to decision-makers and in what form? If the accountants and the sales managers distill the IT output in a spreadsheet, and add errors, either inadvertently or to inflate the numbers, these errors are not detectable by the IT systems. These errors are compounded each time they are handled because the reports are not coming directly from the IT system itself and each distillation further distorts the true picture.

“The human factor is the problem between IT reports and the way they are presented to the managers and decision-makers”, Yam said. “There is a language problem between the users and the IT specialists. Auditors may add a consolidated result column to a standard report and that’s where the errors creep in. Customised reports are often too expensive for smaller businesses so the auditors and sales people reconfigure the IT reports into something more readable for management.”

Yam also suggested that there is a new position, CIO or chief information officer, that is necessary in today’s complex IT world. He said, “This person is NOT the IT director. This officer should know about everything to do with company information no matter what department it comes from. The hierarchical and vertical ‘silo’ structure of business is gradually changing into a more horizontal structure, with the CIO and his staff handling all a company’s information, from sales to HR to accounting and other departments, depending upon the industry.”

The ITGI’s Val IT framework is now in version 2.0, called “Enterprise Value: Governance of IT Investments’, and the organisation also released a companion guide that helps business and IT executives initiate a value management initiative, “Getting Started with Value Management”. This guide helps enterprises identify and implement the most relevant and critical Val IT processes. Both publications are available as free downloads at www.itgi.org/valit.