FROM ERP TO COBIT MOVING TOWARD MATURE OF- THE-SHELF INFORMATION SYSTEMS. A Toy Example A Small Detergent Manufacturing Co.

Transcription

1 FROM ERP TO COBIT MOVING TOWARD MATURE OF- THE-SHELF INFORMATION SYSTEMS Armin Shmilovici and Eli Rohn Department of Information Systems Engineering Ben-Gurion University, Israel {armin, A Toy Example A Small Detergent Manufacturing Co. Products: scented liquid and solid soaps (10 customers) Materials: chemicals, packages (5 suppliers) Warehouses, pipes, tanks, mixers, boilers, etc. 25 workers (5 managers) Financial processes: sales, purchasing, taxes CRM, SCM Inventory and MRP Manufacturing processes Human Resource Management 1

2 ERP is an off-the-shelf IT Solution What is ERP? An integration of information technology and business application Covering all functional areas like Manufacturing, Sales and distribution, Payables, Receivables, Inventory, Accounts, Human resources, Purchases etc. Helps in laying down Decision Support Systems (DSS), Management Information System (MIS), Reporting, Data Mining and Early Warning Systems Implementation goes closely with business process reengineering and organizational remodelling E.g. the Priority configuration Office Management Business Process Management Executive Reports Scalability Financials CRM Sales Purchasing Inventory Control Built-in BPM and BI User level customizability Cobit 5 'Control OBjectives for Information and related Technology,' COBIT 5 is now comprised of 37 processes 5 governance processes, and 32 management processes. "a comprehensive framework that assists enterprises in achieving their objectives for the governance and management of enterprise IT ". Simply stated, it helps enterprises create optimal value from IT by maintaining a balance between realizing benefits and optimizing risk levels and resource use. 2

3 Cobit A Unified Framework עמוד 5 Motivation for Stakeholders 3

4 Business Goals COBIT s Waterfall and Navigation Aids Planning & Organisation effectiveness S efficiency confidentiality integrity P availability compliance reliability Acquisition & Implementation Delivery & Support Monitoring The control of IT Processes which satisfy Business Requirements is enabled by Control Statements and considers Control Practices people applications technology facilities data 4

5 COBIT Framework M1 Monitor the process M2 Assess internal control adequacy M3 Obtain independent assurance M4 Provide for independent audit DS1 Define service levels DS2 Manage third-party services DS3 Manage peformance and capacity DS4 Ensure continuous service DS5 Ensure systems security DS6 Identify and attribute costs DS7 Educate and train users DS8 Assist and advise IT customers DS9 Manage the configuration DS10 Manage problems and incidents DS11 Manage data DS12 Manage facilities DS13 Manage operations Business Objectives Criteria Effectiveness Efficiency Confidenciality Integrity Availability Compliance Reliability MONITOR AND EVALUATE IT RESOURCES Data Application systems Technology Facilities People DELIVER AND SUPPORT PO1 Define a strategic IT plan PO2 Define the information architecture PO3 Determine the technological direction PO4 Define the IT organisation and relationships PO5 Manage the IT investment PO6 Communicate management aims and direction PO7 Manage human resources PO8 Ensure compliance with external requirements PO9 Assess risks PO10 Manage projects PO11 Manage quality ACQUIRE AND IMPLEMENT PLAN AND ORGANISE AI1 Identify automated solutions AI2 Acquire and mantain application software AI3 Acquire and maintain technology infrastructure AI4 Develop and maintain IT procedures AI5 Install and accredit systems AI6 Manage changes Business Goals 5

6 Business Goals Cont. From Enterprise Goals to IT related Goals עמוד 12 6

7 COBIT Processes Plan and Organize PO1 PO2 PO3 PO4 PO5 PO6 PO7 PO8 PO9 PO10 Define an IT strategic plan. Define the information architecture. Determine technological direction. Define the IT processes, organisation and relationships. Manage the IT investment. Communicate management aims and direction. Manage IT human resources. Manage quality. Assess and manage IT risks. Manage projects. Acquire and Implement AI1 AI2 AI3 AI4 AI5 AI6 AI7 Identify automated solutions. Acquire and maintain application software. Acquire and maintain technology infrastructure. Enable operation and use. Procure IT resources. Manage changes. Install and accredit solutions and changes. COBIT Processes Deliver and Support DS1 DS2 DS3 DS4 DS5 DS6 DS7 DS8 DS9 DS10 DS11 DS12 DS13 Define and manage service levels. Manage third-party services. Manage performance and capacity. Ensure continuous service. Ensure systems security. Identify and allocate costs. Educate and train users. Manage service desk and incidents. Manage the configuration. Manage problems. Manage data. Manage the physical environment. Manage operations. Monitor and Evaluate ME1 ME2 ME3 ME4 Monitor and evaluate IT performance. Monitor and evaluate internal control. Ensure compliance with external requirements. Provide IT governance. 7

8 COBIT Components CMMI Maturity Model 8

9 IT Process Maturity Cobit 5 Process Maturity 9

10 Audit Guidelines The process is audited by: Obtaining an understanding of business requirements, related risks, and relevant control measures Evaluating the appropriateness of stated controls Assessing compliance by testing whether the stated controls are working as prescribed, consistently and continuously Substantiating the risk of the control objectives not being met by using analytical techniques and/or consulting alternative sources. Generic Audit Guideline Gain an understanding of: Business requirements Organization structure Roles and responsibilities Policies and procedures Laws and regulations Control measures in place Evaluate the controls Documented processes Appropriate deliverables Responsibility/accountabil ity Compensating controls Assess compliance procedures process deliverables Determine level of testing provide assurance that the IT process is adequate Substantiate the risk control weaknesses actual and potential impact 10

11 Determining Maturity in Practice Maturity in Practice Cont. 11

12 Maturity Report Gaps in Cobit 5 Reports focus on IT processes and not on business processes Reports measure current maturity Maturity determined mainly by compliance Lack of compliance may be due to temporal constraints or different intentions! Compliance to documents rather than processes 12

13 Key Ideas ERP can track compliance and enforce compliance to business processes ERP can track constraints (deadlines and partial resources) ERP can measure Key Performance Indicators (KPI) and outcome measures inspired by Cobit Compute business Dashboards for different stakeholders ERP enforces level 1 as minimum (just recording process data), typically level 2 (following a predefined process); levels 3 and 4 are also obtainable (controlled process, management involvement. The Detergent Manufacturing Co. Accounting and taxes Sales, purchasing CRM, SCM Inventory and MRP Manufacturing processes Human Resource Management 4: Predictable 3. Established 2. Managed 2. Managed 1: Performed 3. Established 13

14 Implementation Issues Implement the processes in the questionnaire to raise the maturity! Choose the KPI to be implemented by the business dashboards Enforce compliance in specific BPM, warnings in other BPMs, Report the cause of incompliance (e.g., constraints and intentions). Only top management can approve some incompliance. 14