Cis 510 Chapter 8

Front 1

Governance

Back 1

making decisions that define expectations, grant authority, or ensure performance.
aligning behavior with business goals through empowerment and monitoring.

Front 2

Empowerment

Back 2

granting the right to make decisions.
Monitoring comes from evaluating performance.

Front 3

decision rights

Back 3

it indicates who in the organization has the
responsibility to initiate, supply information for, approve, implement, and control
various types of decisions.

Front 4

centralized IS organizations

Back 4

bring together all staff, hardware, software, data, and
processing into a single location

Front 5

Decentralized IS organizations

Back 5

Scatter staff, hardware, software, data, and
processing to different locations to address local business needs

Front 6

Federalism IS organizations

Back 6

a combination of centralized and decentralized structures.

Front 7

Companies with high level of governance maturity

Back 7

have need for control made possible by Centralized IS structures

Front 8

1960s

Back 8

more Centralized IS structure

Front 9

1970s

Back 9

Remained Centralized IS structure

Front 10

1980s

Back 10

Gave rise to decentralized IS structure due to the PC

Front 11

Federalism

Back 11

is a structuring approach that distributes power, hardware, software, data, and personnel between a central IS group and IS in business units.

Front 12

hybrid

Back 12

approach enables organizations to benefit from both structural approaches

Front 13

IT governance

Back 13

specifying the decision rights and
accountability framework to encourage desirable behavior in using IT. not about what decisions are actually made. Who is making the decisions (i.e., who holds the decision rights) and how the decision makers are held accountable for them. Match the manager’s decision rights with his or her accountability for a decision

Front 14

Mismatches

Back 14

result in either an oversupply of IT resources or the inability of IT to meet business demand

Front 15

Technocentric Gap

Back 15

Danger of overspending on IT creating
an oversupply- IT assets may not be utilized to meet
business demand- Business group frustration with IT
group- low accountabi, high decision rights

Front 16

Strategic Norm
(Level 3 balance)

Back 16

Works where IT is viewed as
competent and strategic to
business - high accounta. high decision rights

Front 17

Support Norm
(Level 1 balance)

Back 17

Works for organizations where IT is
viewed as a support function; focus is
on business efficiency- Low accounta. low decision rights

Front 18

Business Gap

Back 18

- Cost considerations dominate IT decision- IT assets may not utilize internal competencies to meet business demand- IT group frustration with business group - high accounta. low decision rights

Front 19

Good IT governance

Back 19

provides a structure to make good decisions

Front 20

two major components of IT governance

Back 20

assignment of decision-making authority and decision-making responsibility.

Front 21

decision-making mechanisms

Back 21

steering committees, review boards, policies

Front 22

5 categories of IT decisions

Back 22

IT principles, IT architecture, IT infrastructure strategies, business application needs, and IT investment and prioritization

Front 23

archetype

Back 23

Proposed by Weill and Ross, a pattern for decision rights allocation; a way of labeling the combinations of people who either input information or have decision rights for key IT decisions.

Front 24

Enterprise-wide, business unit, and region/group within a business unit

Back 24

Decisions can be made at several levels in the organization

Front 25

Examples of archetypes

Back 25

Business monarchy, IT monarchy, feudal, federal, IT duopoly, and anarchy

Front 26

IT Principles

Back 26

High-level statements about how IT
is used in the business

Front 27

IT Architecture

Back 27

An integrated set of technical choices to guide the organization in satisfying business needs. a set of policies and rules for the use of IT and plots a migration path to the way business will be done.

Front 28

IT Infrastructure Strategies

Back 28

Strategies for the base foundation of budgeted-for IT capability (both technical and human) shared throughout the firm as reliable services and centrally coordinated.

Front 29

Business Application Needs

Back 29

Specification of the business need for purchased or internally-developed IT applications.

Front 30

IT Investment & Prioritization

Back 30

Decision about how much and where to invest in IT, including project approvals and justification techniques.

Front 31

Business monarchy

Back 31

A group of, or individual, business executives Includes committees comprised of senior busing. executives Excludes IT executives acting separately

Front 32

IT monarchy

Back 32

Individual or groups of IT excutives

Front 33

Feudal

Back 33

Business unit leaders, key process owners or their delegates

Front 34

Federal

Back 34

C level executives and at least one other business group. IT executives may be an additional participant. Equivalent to country and states

Front 35

IT Duopoly

Back 35

IT executives and one other group

Front 36

Anarchy

Back 36

Each individual user

Front 37

Information security strategy

Back 37

Business leaders have the knowledge of the company's strategies, on which security strategy should be based. No detailed technical knowledge is required

Front 38

Information security policies

Back 38

Technical and security implications of behaviors and processes need to be analyzed and trade-offs between security and productivity need to be made. Need to know the particularities of company's IT infrastructure.

Front 39

Information security infrastructure

Back 39

In-depth technical knowledge and expertise is needed

Front 40

Information security education/training/ awareness

Back 40

Business buy-in and understanding are needed. Technical expertise and knowledge of critical security s issues is needed in building programs

Front 41

Information security investments

Back 41

Requires financial (quantitative) and qualitative evaluation of business impacts of security investments. business case has to be presented for rivaling projects

Front 42

Policies

Back 42

Are useful for the decision making process in certain situations

Front 43

A review board

Back 43

committee formally designated to approve, monitor, and review specific topics—can be an effective governance mechanism.
�

Front 44

IT Steering Committee

Back 44

an advisory committee of key stakeholders or experts can provide guidance on important IT issues. Works well with federal archetypes

Front 45

IT Governance council

Back 45

a steering committee at the highest level.
Reports to the board of the directors or the CEO�

Front 46

Governance frameworks

Back 46

Have been employed recently to define responsibility for control decisions

Front 47

Sarbanes-Oxley act of 2002 (Sox)

Back 47

was enacted to increase regulatory visibility and accountability of public companies and their financial health.
�

Front 48

CEOs and CFOs

Back 48

must personally certify and be accountable for their firms financial records and accounting

Front 49

IT

Back 49

Plays a major role in ensuring the accuracy of the financial data

Front 50

one of the 5 IT control weaknesses

Back 50

Failure to segregate duties within applications as well as failure to set up new accounts and terminate old ones in a timely manner.
�

Front 51

one of the 5 IT control weaknesses

Back 51

Lack of proper oversight for making application changes, including appointing a person to make a change and another to perform quality assurance on it.
�

Front 52

one of the 5 IT control weaknesses

Back 52

Inadequate review of audit logs to ensure that systems were running smoothly and that there was an audit log of the audit log.
�

Front 53

one of the 5 IT control weaknesses

Back 53

failure to identify abnormal transactions in a timely manner.

Front 54

one of the 5 IT control weaknesses

Back 54

Lack of understanding of key system configurations

Front 55

Auditors

Back 55

must certify the underlying controls and processes that are used to compile a company's financial results

Front 56

Treadway commission

Back 56

National commission on fraud reporting created as a result of fin. scandals of 1980s. Created 3 control objectives for managers and auditors

Front 57

Operations
Compliance
Financial reporting

Back 57

3 control objectives created by treadway commission

Front 58

COSO developed essential control components for auditors and managers

Back 58

Control environment, Risk assessment, control process, Info and communic. of procedures, Monitoring

Front 59

Control environment

Back 59

addresses the overall culture of the company

Front 60

Risk assessment

Back 60

most critical risks to internal controls

Front 61

Control processes

Back 61

outline important processes and guidelines.

Front 62

monitoring

Back 62

done by management of the internal controls

Front 63

COBIT

Back 63

provides guidelines about who in the organ. should be making decisions about the IT processes, resources, and information

Front 64

Domain

Back 64

4 areas of risk: plan and organize, acquire and implement, deliver and support, monitor and evaluate; each consists of multiple processes

Front 65

Control objective

Back 65

focuses on control of a process associated with risk; there are 34 processes

Front 66

Key goal indicator

Back 66

specific measures of the extent to which the goals of the system in regard to a control objective have been met

Front 67

Key performance indicator

Back 67

Actual, highly specific measures for measuring accomplishment of a goal

Front 68

Critical success factor

Back 68

Describes the steps that a company must take to accomplish a control objective. there are 318 critical success factors

Front 69

Maturity model

Back 69

a uniquely defined six-point ranking of a company's readiness for each control objective made in comparison with other companies in the industry

Front 70

Advantages of COBIT

Back 70

Well-suited to organ. focused on risk management and mitigation, designated clear ownership and responsibility for key processes in such way that is understood by all stakeholders

Front 71

Disadvantages of COBIT

Back 71

very detailed, costly and time consuming

Front 72

Knowledge building (CIO tactic)

Back 72

Establishing a knowledge base to implement SoX

Front 73

Knowledge Development (CIO tactic)

Back 73

Disseminating knowledge about SoX and developing an understanding of this knowledge among management and other organizational members

Front 74

Innovation directive

Back 74

Organizing for implementing SoX and announcing the approach

Front 75

Mobilization (CIO tactic)

Back 75

Persuading decentralized players and subsidiaries to participate in SoX implementation

Front 76

Standardization

Back 76

negotiating agreements between organizational members to facilitate the SoX implementation

Front 77

Business Continuity Plan

Back 77

an approved set of
preparations and sufficient procedures for responding to a variety of
disaster events.

Front 78

COBIT (Control Objectives for Information and Related Technology)
�

Back 78

an IT governance framework that is consistent with COSO
controls.

Front 79

ITIL

Back 79

set of concepts and techniques for managing IT infrastructure, development, and operations that was developed in the United Kingdom.
�