(using JavaScript, cookies & logg.htm)
This framework provides management with a structure to measure and control information technology in accordance with generally accepted criteria incorporated in the guideline Control OBjectives for IT (COBIT) published by the Information Systems Audit and Control Association (ISACA).



PO4  The Information Technology Organisation and Relationships
Control over the IT process of ...
defining the IT organisation and relationships
    that satisfies the business requirement
    to deliver the right IT services
     
      is enabled by
      • an organisation suitable in numbers and skills
      • with roles and responsibilities defined and communicated
      • aligned with the business
      • that facilitates the strategy and provides for effective direction and adequate control

        and takes consideration

        • board level responsibility for IT
        • management's direction and supervision of IT
        • IT's alignment with the business
        • IT's involvement in key decision processes
        • organisational flexibility
        • clear roles and responsibilities
        • balance between supervision and empowerment
        • job descriptions
        • staffing levels and key personnel
        • organisational positioning of security, quality and internal control
        • segregation of duties
           

Record of Assessment
Assignment ID: * Enter Name:*
Reference Code: * Enter Location:* Tel. Num: *
Enter Full e-mail Address: *
  Control Objective:
Define the IT Organisation and Relationships. 
*
 IT as part of the Organisation's Long- and Short- Range Plan
*
 IT Long-Range Plan
*
 IT Long-Range Planning - Approach and Structure
*
 IT Long-Range Plan Changes
*
 Short-Range Planning for the IT Function
*
 Technical Infrasteucture Planning
*
 Monitoring Future Trends and Regulations
*
 Technical Infrastructure Contingency
*
 Harware and Software Acquisition Plans
*
 Technology Standards
*
 Technical Infrasteucture Planning
*
 Monitoring Future Trends and Regulations
*
 Technical Infrastructure Contingency
*
 Harware and Software Acquisition Plans
*
 Technology Standards
 NOTES: (works best with IE)
  Conclusions:
* Non-existent 
IT strategic planning is not performed. There is no management awareness that IT strategic planning is needed to support business goals.
* Optimised 
IT strategic planning is a documented, living process, is continuously considered in business goal setting and results in discernable business value through investments in IT. Risk and value added considerations are continuously updated in the IT strategic planning process. There is an IT strategic planning function that is integral to the business planning function. Realistic long-range IT plans are developed and constantly being updated to reflect changing technology and business-related developments. Short-range IT plans contain project task milestones and deliverables, which are continuously monitored and updated, as changes occur. Benchmarking against well-understood and reliable industry norms is a well-defined process and is integrated with the strategy formulation process. The IT organisation identifies and leverages new technology developments to drive the creation of new business capabilities and improve the competitive advantage of the organisation.
* Managed and Measurable 
IT strategic planning is standard practice and exceptions would be noticed by management. IT strategic planning is a defined management function with senior level responsibilities. With respect to the IT strategic planning process, management is able to monitor it, make informed decisions based on it and measure its effectiveness. Both short-range and long-range IT planning occurs and is cascaded down into the organisation, with updates done as needed. The IT strategy and organisation-wide strategy are increasingly becoming more coordinated by addressing business processes and value-added capabilities and by leveraging the use of applications and technologies through business process re-engineering. There is a well-defined process for balancing the internal and external resources required in system development and operations. Benchmarking against industry norms and competitors is becoming increasingly formalised.
* Defined Process 
A policy defines when and how to perform IT strategic planning. IT strategic planning follows a structured approach, which is documented and known to all staff. The IT planning process is reasonably sound and ensures that appropriate planning is likely to be performed. However, discretion is given to individual managers with respect to implementation of the process and there are no procedures to examine the process on a regular basis. The overall IT strategy includes a consistent definition of risks that the organisation is willing to take as an innovator or follower. The IT financial, technical and human resources strategies increasingly drive the acquisition of new products and technologies.
* Repeatable but Intuitive 
IT strategic planning is understood by IT management, but is not documented. IT strategic planning is performed by IT management, but only shared with business management on an as needed basis. Updating of the IT strategic plan occurs only in response to requests by management and there is no proactive process for identifying those IT and business developments that require updates to the plan. Strategic decisions are driven on a project-by-project basis, without consistency with an overall organisation strategy. The risks and user benefits of major strategic decisions are being recognised, but their definition is intuitive. 
* Initial / Adhoc 
The need for IT strategic planning is known by IT management, but there is no structured decision process in place. IT strategic planning is performed on an as needed basis in response to a specific business requirement and results are therefore sporadic and inconsistent. IT strategic planning is occasionally discussed at IT management meetings, but not at business management meetings. The alignment of business requirements, applications and technology takes place reactively, driven by vendor offerings, rather than by an organisation-wide strategy. The strategic risk position is identified informally on a project-by-project basis.
Settings will expire on: 

(Do NOT edit.) Field set by Form.		 Save and E-mail this form. (Saves only "*" fields & sends E-mail to address above):


Maintenance Functions

Note: If using Netscape on a Macintosh you may have to submit twice, the first will fail, or you can push the "Save Changes and/or Set New Expiration" then Submit.