CLÁUSULA ADICIONAL:
D) Entidades Dependientes del Ayuntamiento 1 Sociedades Mercantiles Municipales.
MANAGEMENT
GUIDELINES
Goals and Metrics
PO1 Strategic and tactical IT plans, IT service portfolio
PO10 Project risk management plan DS2 Supplier risks
DS4 Contingency test results
DS5 Security threats and vulnerabilities ME1 Historical risk trends and events ME4 Enterprise appetite for IT risks
Risk assessment PO1 DS4 DS5 DS12 ME4
Risk reporting ME4
IT-related risk management guidelines PO6 IT-related risk remedial action plans PO4 AI6
• Percent of IT budget spent on risk management (assessment and mitigation) activities
• Frequency of review of the IT risk management process
• Percent of approved risk assessments • Number of actioned risk monitoring
reports within the agreed-upon frequency • Percent of identified IT events used in
risk assessments
• Percent of risk management action plans approved for implementation
• Percent of critical IT objectives covered by risk assessment
• Percent of IT risk assessments integrated in the IT risk assessment approach
• Percent of identified critical IT events that have been assessed
• Number of newly identified IT risks (compared to previous exercise) • Number of significant incidents caused
by risks that were not identified by the risk assessment process
• Percent of identified critical IT risks with an action plan developed
Activities
• Ensuring that risk management is fully embedded in management processes • Performing regular risk assessments with
senior managers and key staff members • Recommending and communicating risk
remediation action plans
IT
• Protect the achievement of IT objectives. • Establish clarity on the business impact
of risks to IT objectives and resources. • Account for and protect all IT assets.
Process
• Establish and reduce the likelihood and impact of IT risks.
• Establish cost-effective action plans for critical IT risks.
Activities
RACI Chart Functions
CEO CFO Business ExecutiveCIO Business Senior Mang ement Head Oper ations Chief Ar chitect Head Developm ent Head IT Administr ation PMO Compliance, Audit,
Risk and Security
Determine risk management alignment (e.g., assess risk). A R/A C C R/A I I Understand relevant strategic business objectives. C C R/A C C I
Understand relevant business process objectives. C C R/A I
Identify internal IT objectives, and establish risk context. R/A C C C I Identify events associated with objectives (some events are business-oriented
[business is A]; some are IT-oriented [IT is A, business is C]). I A/C A R R R R C
Assess risk associated with events. A/C A R R R R C
Evaluate and select risk responses. I I A A/C A R R R R C
Prioritise and plan control activities. C C A A R R C C C C Approve and ensure funding for risk action plans. A A R I I I I I Maintain and monitor a risk action plan. A C I R R C C C C C R A RACI chart identifies who is Responsible, Accountable, Consulted and/or Informed.
PO9 Assess and Manage IT Risks
Plan and Organise
Assess and Manage IT Risks
PO9
From Inputs
Outputs
To
From Inputs
Outputs
To
measure drive measure drive measure
set set
Goals
PO9 Assess and Manage IT Risks
Management of the process of Assess and manage IT risks that satisfies the business requirement for IT of analysing and communicating IT risks and their potential impact on business processes and goals is:
0 Non-existent when
Risk assessment for processes and business decisions does not occur. The organisation does not consider the business impacts associated with security vulnerabilities and development project uncertainties. Risk management is not identified as relevant to acquiring IT solutions and delivering IT services.
1 Initial/Ad Hocwhen
IT risks are considered in an ad hoc manner. Informal assessments of project risk take place as determined by each project. Risk assessments are sometimes identified in a project plan but are rarely assigned to specific managers. Specific IT-related risks, such as security, availability and integrity, are occasionally considered on a project-by-project basis. IT-related risks affecting day-to-day operations are seldom discussed at management meetings. Where risks have been considered, mitigation is inconsistent. There is an emerging understanding that IT risks are important and need to be considered.
2 Repeatable but Intuitive when
A developing risk assessment approach exists and is implemented at the discretion of the project managers. The risk management is usually at a high level and is typically applied only to major projects or in response to problems. Risk mitigation processes are starting to be implemented where risks are identified.
3 Defined when
An organisationwide risk management policy defines when and how to conduct risk assessments. Risk management follows a defined process that is documented. Risk management training is available to all staff members. Decisions to follow the risk management process and receive training are left to the individual’s discretion. The methodology for the assessment of risk is convincing and sound and ensures that key risks to the business are identified. A process to mitigate key risks is usually instituted once the risks are identified. Job descriptions consider risk management responsibilities.
4 Managed and Measurable when
The assessment and management of risk are standard procedures. Exceptions to the risk management process are reported to IT management. IT risk management is a senior management-level responsibility. Risk is assessed and mitigated at the individual project level and also regularly with regard to the overall IT operation. Management is advised on changes in the business and IT environment that could significantly affect the IT-related risk scenarios. Management is able to monitor the risk position and make informed decisions regarding the exposure it is willing to accept. All identified risks have a nominated owner, and senior
management and IT management determine the levels of risk that the organisation will tolerate. IT management develops standard measures for assessing risk and defining risk/return ratios. Management budgets for an operational risk management project to reassess risks on a regular basis. A risk management database is established, and part of the risk management processes is beginning to be automated. IT management considers risk mitigation strategies.
5 Optimised when
Risk management develops to the stage where a structured, organisationwide process is enforced and well managed. Good practices are applied across the entire organisation. The capture, analysis and reporting of risk management data are highly automated. Guidance is drawn from leaders in the field, and the IT organisation takes part in peer groups to exchange experiences. Risk management is truly integrated into all business and IT operations, is well accepted and extensively involves the users of IT services. Management detects and acts when major IT operational and investment decisions are made without consideration of the risk management plan. Management continually assesses risk mitigation strategies.
MATURITY
MODEL
© 2007 IT Governance Institute. All rights reserved. www.itgi.org 66
Plan and Organise
Assess and Manage IT Risks
PROCESS
DESCRIPTION
Control over the IT process of Manage projects
that satisfies the business requirement for IT of
ensuring the delivery of project results within agreed-upon time frames, budget and quality by focusing on
a defined programme and project management approach that is applied to IT projects and enables stakeholder participation in and monitoring of project risks and progress
is achieved by
• Defining and enforcing programme and project frameworks and approach • Issuing project management guidelines
• Performing project planning for each project detailed in the project portfolio and is measured by
• Percent of projects meeting stakeholders’ expectations (on time, on budget and meeting requirement—weighted by importance) • Percent of projects receiving post-implementation reviews • Percent of projects following project management standards
and practices
PO10 Manage Projects
A programme and project management framework for the management of all IT projects is established. The framework ensures the correct prioritisation and co-ordination of all projects. The framework includes a master plan, assignment of resources, definition of deliverables, approval by users, a phased approach to delivery, QA, a formal test plan, and testing and post-implementation review after installation to ensure project risk management and value delivery to the business. This approach reduces the risk of unexpected costs and project cancellations, improves communications to and involvement of business and end users, ensures the value and quality of project deliverables, and maximises their contribution to IT-enabled investment programmes.
Effectiv eness
Efficiency
ConfidentialityInteg
rity
AvailabilityComplianceReliability
P
P
People Infor mation Applications Infrastr ucture STRA TEGIC ALIG NMEN T PER FO RMAN CE MEASU REM EN T VALUE DELIVERY RISK MA NAG EM EN T RESOURCE MANAGEMENT IT GOVERNANCE Primary SecondaryPlan and Organise
PO10 Manage Projects
PO10.1 Programme Management Framework
Maintain the programme of projects, related to the portfolio of IT-enabled investment programmes, by identifying, defining, evaluating, prioritising, selecting, initiating, managing and controlling projects. Ensure that the projects support the programme’s objectives. Co-ordinate the activities and interdependencies of multiple projects, manage the contribution of all the projects within the programme to expected outcomes, and resolve resource requirements and conflicts.
PO10.2 Project Management Framework
Establish and maintain a project management framework that defines the scope and boundaries of managing projects, as well as the method to be adopted and applied to each project undertaken. The framework and supporting method should be integrated with the programme management processes.
PO10.3 Project Management Approach
Establish a project management approach commensurate with the size, complexity and regulatory requirements of each project. The project governance structure can include the roles, responsibilities and accountabilities of the programme sponsor, project sponsors, steering committee, project office and project manager, and the mechanisms through which they can meet those responsibilities (such as reporting and stage reviews). Make sure all IT projects have sponsors with sufficient authority to own the execution of the project within the overall strategic programme.
PO10.4 Stakeholder Commitment
Obtain commitment and participation from the affected stakeholders in the definition and execution of the project within the context of the overall IT-enabled investment programme.
PO10.5 Project Scope Statement
Define and document the nature and scope of the project to confirm and develop amongst stakeholders a common understanding of project scope and how it relates to other projects within the overall IT-enabled investment programme. The definition should be formally approved by the programme and project sponsors before project initiation.
PO10.6 Project Phase Initiation
Approve the initiation of each major project phase and communicate it to all stakeholders. Base the approval of the initial phase on programme governance decisions. Approval of subsequent phases should be based on review and acceptance of the deliverables of the previous phase, and approval of an updated business case at the next major review of the programme. In the event of overlapping project phases, an approval point should be established by programme and project sponsors to authorise project progression. PO10.7 Integrated Project Plan
Establish a formal, approved integrated project plan (covering business and information systems resources) to guide project execution and control throughout the life of the project. The activities and interdependencies of multiple projects within a programme should be understood and documented. The project plan should be maintained throughout the life of the project. The project plan, and changes to it, should be approved in line with the programme and project governance framework.
PO10.8 Project Resources
Define the responsibilities, relationships, authorities and performance criteria of project team members, and specify the basis for acquiring and assigning competent staff members and/or contractors to the project. The procurement of products and services required for each project should be planned and managed to achieve project objectives using the organisation’s procurement practices.
PO10.9 Project Risk Management
Eliminate or minimise specific risks associated with individual projects through a systematic process of planning, identifying, analysing, responding to, monitoring and controlling the areas or events that have the potential to cause unwanted change. Risks faced by the project management process and the project deliverable should be established and centrally recorded.
PO10.10 Project Quality Plan
Prepare a quality management plan that describes the project quality system and how it will be implemented. The plan should be formally reviewed and agreed to by all parties concerned and then incorporated into the integrated project plan.
CONTROL
OBJECTIVES
© 2007 IT Governance Institute. All rights reserved. www.itgi.org 68