Operational assessment of IT

348 Pages·2016·17.656 MB·English

by  Katzman, Steve

K
Information Technology
a INTERNAL AUDIT AND IT AUDIT SERIES
t
z
Operational Assessment of IT presents ideas and concepts of optimization de- m
signed to improve an organization’s business processes and assist business units a
n
in meeting organizational goals more effectively. Rather than focus on specific
technologies, computing environments, enterprise risks, resource programs, or
infrastructure, the book focuses on organizational processes. Throughout theO
book, the author presents concerns and environments encountered throughout
p
his career to demonstrate issues and explain how you, too, can successfully
e
implement the tools presented in the book.
r
a
The assessment process reviews the economics as well as the effectiveness
Operational
t
and efficiency of the process. Whether your organization is profit-based, not-
i
for-profit, or even governmental, you cannot provide services or products at ao
continuous loss. For an operational assessment to be of value, the ultimate goaln
must be to ensure that the business unit process is effective and efficient and Assessment
a
employs the financial assets and resources appropriately or helps the business
l
unit make adjustments to improve the operation and use resources more
A
efficiently and economically.
of IT
s
After reading this book, you will be able to devise more efficient and economicals
ways to meet your customers’ requirements, no matter who or where youre
customers are. You will learn that the goal of any process is to service ors
supply customers with what they want. The book provides tools and techniquess
that will assist you in gaining a 360-degree view of the process so that you canm
help the business unit improve the delivery of a quality product or a service to
e
the customer.
n
t

o
f

I
T
K26550
6000 Broken Sound Parkway, NW
Suite 300, Boca Raton, FL 33487 ISBN: 978-1-4987-3768-5
711 Third Avenue 90000
an informa business New York, NY 10017
2 Park Square, Milton Park
www.crcpress.com Abingdon, Oxon OX14 4RN, UK
9 781498 737685 Steve Katzman
www.auerbach-publications.com
K26550 cvr mech.indd 1 2/5/16 9:31 AM

Internal Audit and IT Audit
Series Editor: Dan Swanson
PUBLISHED
Leading the Internal Audit Function
by Lynn Fountain
ISBN: 978-1-4987-3042-6
Securing an IT Organization through Governance, Risk Management, and Audit
by Kenneth Sigler and James L. Rainey, III
ISBN: 978-1-4987-3731-9
CyberSecurity: A Guide to the National Initiative for Cybersecurity Education (NICE)
Framework (2.0)
by Dan Shoemaker, Anne Kohnke, Ken Sigler
ISBN: 978-1-4987-3996-2
Operational Assessment of IT
by Steve Katzman
ISBN: 978-1-4987-3768-5
FORTHCOMING
Practical Techniques for Effective Risk-Based Process Auditing
by Ann Butera
ISBN: 978-1-4987-3849-1
The Complete Guide to CyberSecurity Risks and Controls
by Anne Kohnke, Daniel Shoemaker, and Ken E. Sigler
ISBN: 978-1-4987-4054-8
Software Quality Assurance: Integrating Testing, Security, and Audit
by Abu Sayed Mahfuz
ISBN: 978-1-4987-3553-7
Internal Audit Practice from A to Z
by Patrick Onwura Nzechukwu
ISBN: 978-1-4987-4205-4

CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2016 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Version Date: 20160202
International Standard Book Number-13: 978-1-4987-3769-2 (eBook - PDF)
This book contains information obtained from authentic and highly regarded sources. Reasonable efforts
have been made to publish reliable data and information, but the author and publisher cannot assume
responsibility for the validity of all materials or the consequences of their use. The authors and publishers
have attempted to trace the copyright holders of all material reproduced in this publication and apologize to
copyright holders if permission to publish in this form has not been obtained. If any copyright material has
not been acknowledged please write and let us know so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmit-
ted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented,
including photocopying, microfilming, and recording, or in any information storage or retrieval system,
without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copyright.
com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood
Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and
registration for a variety of users. For organizations that have been granted a photocopy license by the CCC,
a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used
only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
To my dear wife, Diana,
with love and admiration. Diana, thanks for consenting
to put up with a computer nerd like me for this lifetime.

Contents
Preface xi
acknowledgments xv
about the author xvii
Part I Prelude
chaPter 1 IntroductIon 3
Overview 5
Rationale 8
Part II goals
chaPter 2 the organIzatIon 13
Organizational Goals 13
Measuring the Success of an Organization 14
Voice of the Customer 18
Process 21
Productivity 22
Measuring the Success of the Processes 25
Summary 27
Part III oPeratIonal assessments
chaPter 3 oPeratIonal audItIng 31
Background 31
Auditing 32
vii
viii Contents
Operational Assessment 35
IIA Operational Auditing Definition 36
COSO Enterprise Risk Management 36
Sarbanes–Oxley Act 37
Barron’s Accounting Dictionary Definition of
Operational Auditing 38
Operational Assessment Drivers/Impetus 38
Operational Objectives 40
Operational Factors: The Three Es 40
Process 42
Operational Performance Goals 42
Value Add 43
Keep the End in Mind 44
chaPter 4 oPeratIonal assessment PlannIng 49
Customer Relationships 51
Risk Assessment 52
Business Acumen 52
RACI Matrix (or RASCI) 54
RACI Workload Analysis 56
Planning Memo 58
Project Charter 59
Critical Success Factors 60
Project Charter (Engagement Plan) 61
Adding Value 63
Key Performance Indicator 63
Operational Process 66
Process Review (As Is) 67
SIPOC Table (Answers the Question “What?”) 68
Value Stream Map (VSM) (When) 72
Spaghetti Diagram: As-Is (Where) 80
Procurement Process Narrative 81
Activity: Procurement Audit Planning 87
The Customer 89
Customer Requirements 89
SIPOC Chart: Procurement Process 91
The Planning Data 95
The RACI Matrix 96
The SIPOC Matrix 97
The Spaghetti Diagram 97
The VSM 98
IT Support of the Business Unit 99
User Perception 99
IT’s Business 100
Background 101
IT Support Goal 103
CIA and IT 103