05 Institutionalization Flashcards

Question

List and describe some **important IF Capabilities (Core competencies):**

Answer 1

**Competences critical to the success of the IF:** * **Provide IS vision and direction** (managerial concerns, adequately comunicate vision) * Formulate a convincing business oriented vision * Communicate this vision to IS and business staff * **Promote business oriented IT applications** (people understanding the business demands) * Understand the business * Support and motivate IT use in business * **Respond quickly to business needs** (agile programming, flexible knowledge, profesionalization of outsourcing, get to know the offerings) * Develop application systems responsively * Make flexible use of external systems and IT services * **Informed buying and sourcing** (know the IT markets and trends) * Keep track of the IT market and its offerings * Evaluate and choose suppliers and providers deliberately * **Actively manage external providers** (monitor contracts, difficulties, cooperate/engage) * Facilitate and monitor contracts with external providers * Develop relationships to external providers and build partnerships * **Make new technology work** * ****Anticipate relevant technology developments * Show how these technologies can be used and affect the business * **Build and maintain a flexible technical infrastructure** * Build flexible architecture * Enforce standards and guidelines * **Deliver reliable IT services** (content business users) * Perform smooth IIS operations * Support users in IIS use

Answer 2

Typical job profiles in the IF * **Software Development Occupations** * ****DB developer, business analyst, system analyst, requirements engineer, software architect, programmer/software developer, test engineer, integration engineer, web designer, web developer/programmer, multimedia developer, network engineer. * **IT Operations and Support Ocupations** * Systems Administrator, data or telecommunications network administrator, network operator, DB administrator, DWH administrator, web master admin, help desk agent, support engineer, security analyst, IT Capacity engineer * **Information, Documentation and Administration roles** * Data analyst, online publisher/web editor, documentation specialist, IT Accountant, IT Controller, IT Auditor * **Management Occupations (line managers + Executives)** * ****IS Director, Head IT Infrastructure, Head Data Centre, Head Systems Development, Head User Service, Head Information & Documentation, Portfolio Manager, Programme Manager, Project Manager, Quality Manager, Risk Manager, Data Protection Officer.

Answer 3

The main **reason for a CIO is to manage a key resource in information-age organizations: Information.** * New information-age organizations need/manifest the **responsibility for information, systems and technology to be represented on the board level** in parallel to other critical resources such as Finance (CFO), HR (Chief HR Officer) or Production technology (Chief Technology/Operations Officer). * **The CIO as Top-Executive:** * ****The CIO **position should be well understood throughout the organization** and that the incumbent be a **strong contributor to strategy discussion as well as marketing and financial decisions.** * A CIO should report to the CEO, have a **background in technology and also be able to take a general management perspective.** * A CIO must have an integrated view of the business (together with the CEO). * A CIO should be **knowledgeable about all the major functions of the business and understand the information drivers in the company.**

Answer 4

**Critical survival factors for the CIO:** * **_Shared vision of how IT could make a difference in business_** * Business themes driving the IS-agenda. * **_Relationship with peers and superiors._** * Understand business problems, gather ideas, build alliances. * **_Relationship with the CEO_** * Know CEO's expectations and communicate IS needs and vision. * **_Sensitivity_** * Understand the degree of necessary change * **Anticipate change requirements for the IF** * **_Credibility_** * Good reputation for delivery * **IT organizations have 2 missions: running today's systems + work on tomorrow systems (a CIO gets credibility with top management by first achieving today's operations success).** Working on tomorrow systems comes after.

Answer 5

The CIO is a top executive not completely left on their own: * **CIO/VP IT** * **Information Technology Officer** * **Information Resource Manager** * **Digital Officer** * **Privacy Officer** * **Security Officer**

Answer 6

* **Actual skill demand** * ****Critical skill shortages: big data/analytics, project management, business analysis, development, enterprise architecture. * IF-related skill shortages impairs performance and future development * **Talent retention** * ****Great/some concern across practitioners in retaining qualified IS staff

Answer 7

Three ways of embedding the IF into the organization: * **Centralization** of the IF * **Decentralization** of the IF * **Blended** IF organization

Answer 8

IT personnel and resources are concentrated in exactly one organisational unit. * **Centralized IF in a divisional organization (corporate + divisions)** * IT is located as a shared "service centre" in a corporate function, located in parallel to all other divisions (corporate finance, corporate purchasing, ...) * Not more than one IT unit within each Business Unit. * More unrealistic, IT serving all divisions. * **Functional organization (top management & main departments)** * IT as a main department **Benefits:** economies of scale, critical mass (of IT/IS staff) for sharing expertise, common training, clear career paths and professional evaluation. Easier to enforce corporate-wide policies and standards. **Criticism:** unresponsive to the need of individual business departments. IT professionals are mere technical specialists with little functional expertise. Danger of becoming insular and unaware of the business outside.

Answer 9

General features of a decentralized IF: * **Duplicated IT units** which report to superordinate business functions * No IT unit on the corporate level, therefore, no top unit that sets standards. * IT units per-department (Production IT, Accounting IT) **Benefits:** IT/IS professionals are also knowledgeable in the business area, funding is provided and priorities are set within the business units, objectives and measurement are the same for IT and business (don't have to translate business measures to IT measures). **Criticism:** huge redundancies without an associated value of backing up each other, IT departments will optimize for local business units rather than the firm as a whole, integration and adherence to corporate policies and standards are difficult.

Answer 10

**Central IT + Local IT in business functions = federal** (mixing central and local decisions) All decisions that affect the whole organization should be centralized, other minor decisions can be taken in the business units. * **Pros:** * **Central IT:** IT vision, oversight and integration, economies of scale for shared services, critical mass of skills (expertise, backup). * **Local IT:** responsive to business needs, closeness to business/users, BU ownership and funding. * **Cons:** * **Central IT:** danger of thinking in IT silos, unresponsive to business and users, unresponsive to business and users, no BU ownership and funding. * **Local IT:** no integration, variable standards, redundancy and few specialisation, reinvention of the wheel, local (sub-)optimisation of BUs.

Answer 11

In a **blended (federal) IF, distinguishing can be done** in: * **Decision** (making authority) * General policies (central) - standards * Case-by-case decisions (local) - utilization, unique apps * (Location of) **resources** * ****General purpose (central) - shared resources, master data * Dedicated local needs (local) - specialized resources * (Professional) **tasks** * ****Interwovenness/close with business (central) - central ops, intensive use * Intensity of use (local) - sporadic use

Answer 12

* A main IT/DP department * IT controlling present * Focused on data and typical user support, tools, development, systems. * **No** presence of information and communication specific deployment.

Answer 13

* **Information & Communication as main department** * Planning and control is present * Information centre, information services + data management, dev tools, operations and support * **New Telecommunication & Data Network Management** * **Focus extended: management of information and communication deployment**

Answer 14

Changing the composition of the internal IT Department: 1. **Traditional IT** * ****Creating and operating technology, management of internal resources * Technology is owned, budgeted. Skills from employees. * IT success measured on create/provide/operate technology. 2. **IS Lite** (moderated outsourcing) * In house roles: IT leadership, architecture development, business enhancement, technology advancement, vendor management. * ****Technology provisioning and performance. * Multi-sourced environment, enterprise services and outsource partners. * IT success measured on service level costs and performance levels. 3. **Lean IT (**lightweight technology - highly outsourced) * In-house roles: CIO, office of CIO, architecture (information, process/application, infrastructure sourcing), security risk mgmt., finance and measurement * Creating productivity and capabilities that support strategy. * Internal resources create value in a multi-sourced environment (enterprise, cloud, partners). * IT success measured against changes in business performance.

Answer 15

* **Investment Committee** (IT/IS Investment planning, IT/IS Portfolio management) * Top executives, provides strategic direction, funding authority for major IT projects. * Committee meets regularly to allocate/supervise resources to IT investments. * **Steering Committee (also Board/Council)** (IT/IS Portfolio management, IS Programme management) * Senior executives with a regular schedule to review, monitor and re-direct major IT projects from cross-functional perspective. Reports to the board. * **Programme/Portfolio Management Office** (IT/IS Portfolio management, IS Programme management) * Administrative personnel supporting portfolio and programme management with continuous controlling and reporting tasks. * **Project (steering) committees** (dedicated to single projects) * A sponsor, business representatives and IT representatives to monitor the adherence of a project to time, quality and cost/budget targets. * **Project Management Office (=/= Project Office!)** * Project management experts responsible for instituting and enforcing IS/IT project standards, procedures, methods and reporting across the entire organisation. * PMO as a permanent organisational function independent of single projects. * **Project Office** * ****Office of the IT/IS project manager, comprised of administrative personnel for controlling and reporting tasks. * The PO is part of each temporary project organisation.

Answer 16

* **Embeddedness of the IF:** * In the past, IF in organizations used to report to the CFO * Nowadays, more organizations have its reporting level as a board member in his own right * Top companies have IT as a main department directly reporting to top management. * **Organizational trends (expected shape of the IT department):** * ****Most services are expected to be provided externally * Small IT department residing in-house (for requirements definitions, integrations) * IT departments focuses: technical one and another one supporting business processes. * Shifts expected: * Value drivers: Business process first \> Information over process. * Delivery structure: IT as a service provider \> IT Embedded in business services * Sourcing model: Right-sourced IT \> Externalized Service Delivery * Business role: Pressure for central control \> Greater busines partner responsibility * IT Function role: Fully functional IT function \> Diminished Standalone IT role

Answer 17

* Governance = how to be **sure if managers do a good job.** * Goal: managers **working according to the expectations of the firm.** * Corporate governance refer to **mechanisms to strategically direct, manage and control a company** in an entrepreneurial and ethical way according to a context. * **Assigning responsibilities:** board of directors --\> executive management --\> line managers. * Top executives fulfilling their management and control roles with diligence. * **In line with the interests of shareholders and relevant stakeholders** (customers, employees, society, goverment). * **IS governance (practitioners: IT Governance):** * Boards and executives know that primary/key functions depend on IT * **Business models and IT are now virtually inseparable/integrated** * The **integration and co-evolution of business and IT must be managed through people understanding this and taking direct responsibility for making sure the organization meets its strategic goals** * All efforts, including IT, should be directed toward strategic goals.

Answer 18

**IS Governance** (IT Governance) **concerns the mechanisms by which decision making on IT and related resources is ruled/takes place in organisations.** * **Specifies the decision rights and accountability framework** --\> Encourages desirable behaviour in IT usage. * IS Governance is an integral part of Corporate Governance (responsibility of board of directors and executives) and cosist on the **leadership and organisational structures and processes that ensure that the organisation's IT sustains and extends the organisation's strategies and objectives**. * **IS Governance supervises IS Management** (Information Management). * ... supervises that more value from IT investments is obtained.

Answer 19

* **Formal Structure** (taken from job descriptions) * ****Mechanisms: IT Executives & accountants, Committees & councils * Examples: CIO on board, IT Programme Mgr., Business advisory board * **Formal Procedures** (through processes) * Mechanisms: SISP processes and techniques, Programme & investment mgmt. techniques * Examples: IT Business cases, IT Portfolio planning, IT Programme Management, IT evaluation, SLA * **Relational Structures** (informal) * Mechanisms: Stakeholder participation, Business-IT-partnerships * Examples: Incentives for collaboration between stakeholders, Partnerships, Collocation of IT and business * **Relational Processes** (Informal) * Mechanisms: IT-Business dialogue, Shared learning * Examples: Shared vision and understanding, Active conflict resolution policy, Job rotation, Common training

Answer 20

* **IS Governance =** concerns the location, distribution and pattern of managerial responsibilities and control that ultimately affect how IT resources are applied and implemented. * Systematically determining who makes each type of decisions (decision rights). * Who has an input to a decision (input right). * People/groups being held accountable for their roles. * **IS Management =** addresses specific decisions of location and distribution of IT.

Answer 21

Similar to IF function location, traditional research proposed two "ideal" types of IS Governance: * **Centralised** = Places all decision-making authority in a central IT unit.**** * ****Overview and control of IT resources * Standardisation -\> Economies of scale * Expertise and specialisation * **Decentralised =** all decision-making authority is in local IT departments within individual business units/functions. * Business (Unit) ownership * Business and user understanding * Responsiveness to business needs ... this is actually a dichotomy, meaningless when applied as a generality to IT and IT governance. * **Blended IS Governance = not one perfect solution, depends on what owners or shareholders want. Best of both worlds.**

Answer 22

* **More centralized = Profit** * ****Profitability via enterprisewide integration and focus on core competencies. * Centrally mandated shared services. * Low business costs through standardized business processes. * **Blended = Asset utilization** * ****Efficient operation by encouraging sharing and reuse. * Shared services centrally coordinated. Service oriented. * Low IT unit costs, reuse of standard models or services. * **More decentralized = Growth** * Encourage business unit innovation with few mandated processes. * Local customized capabilities, few required shared services. Budget approval, risk management and local accountability. * Local innovation with communities of practice; optional shared services.

Answer 23

* **IT Principles** * ****Business principles translated to IT principles. IT role in business. * **IT Architecture** * Core business processes and information that drives it. Technical capabilities standardized to support IT-efficient process standardization and integration. * **IT Infrastructure Strategies** * ****Most critical infrastructure services. Service level of infrastructures, pricing. Keeping technology up-to-date. Outsourcing of infrastructure. * **Business Application Needs** * ****Market/Business process opportunities for new business applications. Business needs and architectural standards, exceptions to standards. Owners of outcomes of projects and institutionalization of organizational changes. * **IT Investment and Prioritization** * Distribution of IT Portfolio. Investment practices and stategic objectives. Assessing business value of IT projects after implementation.

Answer 24

MIT IS Governance Framework archetypes and decision or input rights: * **Business Monarchy =** Business executives (CxO). Commitees, senior business executives (CIO). Centralized, driven by business. * **IT Monarchy =** Individuals or groups of IT executives (CTO). Centralized, driven by IT. * **Federal =** C-level execs and business groups (BU's leaders, key process owners). IT executives may be additional participants. "Central-States" governments. * **IT Duopoly =** IT executives and one other group. * **Feudal =** BU's leaders, key process owners or delegates making separate decisions for their respective units. Decentralized by Business Units. * **Anarchy =** Each individual user makes separate decisions. No group decisions.

Answer 25

* Designing IT Governance

Answer 26

* Choosing IT Governance Configurations

Answer 27

* **Enterprise Maturity for IS Governance** * IT + Business: companies go from "Having defined governance IT measures and processes" to "ad hoc measures" to "understanding and starting to see what needs tobe done". * **Proliferation of IS Governance Practices** * Business: IT policies and standards, Defined and managed IT processes, IT performance monitoring practices. * IT: IT Governance frameworks, IT principles, IT policies and standards * **Proliferation of Gov. Archetypes and Mechanisms (Decision bodies):** * **Archetypes:** **** * ****Business monarchy, IT monarchy, Federal, Duopoly * **Mechanisms (Decision bodies):** * ****Executive or senior management committees (big role, CIO, 90%) * IT leadership committees (BU CIO's, diversified orgs., \>85%) * Architecture committees (alternative/supplement to IT leadership) * Process teams with IT members (process-oriented orgs., business appls) * Business/IT relationship managers (business+IT savvy managers) * Joint IT/business leadership councils (IT duopoly mostly)

Answer 28

**IS Governance Industry Standards** * **COBIT** = **Control Objectives for Information and Related Technology** * IT control objectives for **use by business managers and auditors.** * **Facilitates integration of IT Governance into Corporate Governance** * Became an international standard de jure. * Gives **pracmatic guidance on how to direct and monitor the activities of IM.** * Those who govern act as stewards and take responsibility for ensuring the organisation delivers what the stakeholders expect. Done by: * **Evaluating internal and external environment.** * **Directing management.** * **Monitoring operational performance.**

Answer 29

**GRC: IS Governance, Risk, Compliance:** * Consultancy using GRC as umbrella acronym that related IT Governance to managerial responsibilities in Risk and Compliance. * Consultants argue that the terms are closely related and should be integrated. * **Critically, these terms might lead to a confusion about the purposes and lenses of Governance, Risk and Compliance.** * "GRC" servers to market SW and consultancies their products and services.