Development and administration of information projects: didactic guide

Texto completo

(1)Este documento forma parte de la producción editorial del Centro Interamericano de Estudios de Seguridad Social (CIESS), órgano de docencia, capacitación e investigación de la Conferencia Interamericana de Seguridad Social (CISS) Se permite su reproducción total o parcial, en copia digital o impresa; siempre y cuando se cite la fuente y se reconozca la autoría..

(2)

(3) Development and" Administration of Information Projects At-a-Distance Course. Didactic guide. Inter-American Center for Social Security Studies. Education, training and research organ of the Inter-.American Conference on Social' Security Mexico City, September 2003..

(4) Dear participant. The development of social security finds in the information technologies a fundamental element for the rendering of more efficient and reliable services and, hence, updating in this subject has become a priority matter. Therefore, it is a pleasure to welcome you most cordially to the At-a-Distance course 'Development and Administration of information Projects". In fact, the incorporation of new technologies is a strategy that social security institutions use within a growing scope and, therefore, the analysis of new informatics concepts, the review of international standards, the organization and management of information systems, the development of applications, as well as the organizational reengineering associated to the introduction or improvement of information systems, constitute topics that since the past few years, have been a part of the study and training ambit undertaken by the CIESS. Now that you are integrated to the academic community of this Studies Center, we are interested in offering you the space for a fruitful activity that will be useful in your daily work, while a the same time, we are sure, your participation will contribute with a substantial exchange of knowledge and practices that will allow us to reflect upon the best options of social security in the Continent. Please accept my sincere wishes for success in this Course and in your role as social security executive. Mexico City, September 2003.. Dr. Luis José Martinez Villalba Director of the CIESS. 3 At-a-distance Course Development and Administration of Information Projects.

(5) Index WHAT DOES MY DIDACTIC MATERIAL CONSIST OF AND HOW SHOULD I USE IT? OUTLINE OF THE AT-A-DISTANCE COURSE "DEVELOPMENT AND ADMINISTRATION OF INFORMATION PROJECTS". Page 7. 9. Basis. 9. General objective. 9. Specific objectives. 9. Outcome profile. 10. Characteristics of the final paper. 10. Module I. Basis for the development of information projects By Alejandro Dominguez Torres. 11. Module II. Information systems By Ismael Novella Perrusquia. 14. Module III. Organizational impact of informatics technology By Ricardo Loranca Gonzalez. 16 17 19. METHODOLOGY How can I consult the tutors of the CIESS?. 19. What is expected of me as participant in an at-a-distance Course?. 20. What activities do I have to carry out and how will my performance be evaluated?. 21. Schedule of activities. 22. EDUCATIONAL TEAM. 25. GLOSSARY. 27. 5 At-a-distance Course Development and Administration of Information Projects.

(6) ). ). ). 1. ). ). 1. 1. ). ) 1. 1. 1. 1. 1. ). I. 1. 1. 1. 1.

(7) 1What does my didactic J material- consist of and how should use it?. The didactic material consists of a didactic guide and the study material for each one of the Modules of the Course. Didactic guide The purpose of the didactic guide is to offer you a general orientation on the procedures for the development of the Course and recommendations as to how to obtain utmost benefits from the Course. /.■. It is important that you read the entire didactic guide before starting with the study material and even that you review it before initiating a new module. The didactic guide contains the following chapters: Outline of the Course: this chapter presents the basis, objectives and outcome profile, which will allow you to delimit the purposes of the Course and to have a point of reference that will permit you to evaluate if it meets your learning expectations. It also includes a scheme which indicates the order of the modules, so that you may carry out a follow up of the modules and distinguish the internal relationship of each one of the parts of the Course. Likewise, the key words and the evaluation exercises for each module are presented, as well as the characteristics of the final paper. Methodology: includes the communication media through which you can maintain contact with this Center and be aware of the responsibilities of your tutor. In the chapter What is expected of me as participant in an at-a-distance course? certain recommendations are included as to how to obtain utmost benefits from the Course. In the chapter What activities do I have to perform and how will my performance be evaluated? The deadlines are established for the delivery of each exercise. In the study material, at the end of each module, these activities are also described. Likewise, the procedure and the characteristics of the credits that the CIESS will grant for your successful completion of this Course are also described. Educational team: In this section the coordinators and tutors are introduced. Glossary: Offers a list of important terms for the study of the topics approached in the Course.. 7 At-a-distance Course Development and Administration of Information Projects.

(8) Study material This material is divided according to the three modules. It describes the topics selected taking into consideration the learning objectives presented in a sequential manner to permit a gradual and progressive assimilation. For the achievement of the learning objectives of each module it is important that the corresponding texts are read before working on the exercises and activities designated for the evaluation. After finalizing your evaluation activity, remember to send it in due time to the CIESS in accordance with the specified dates.. 8 Inter-American Center for Social Security Studies.

(9) 1.. Outane of the Course. Basis Social Security services are transformed continuously, among other factors due to the incorporation of information technologies and communications. Each service rendered, is a project with objectives, financial and human resources and delivery times. However, the daily dynamics, the insufficiency of human resources and the lack of effective integration of the work team, make it impossible to adhere to an established calendar, or else the dissatisfaction of the final user is frequent. It is therefore necessary to analyze, from the perspective of the social security institutions with their peculiarities as public and private service entities, how it may be possible to reach the objectives set forth in the development plans for information projects.. Purpose Promote the use of techniques and methods in the development of information projects in order to ensure a timely delivery and the satisfaction of final customers.. General objective Analyze methods for the development and administration of information projects that will permit adequate cost estimates, a correct planning, a coordinated performance, the administration of risks and the satisfactory delivery of the product.. Specific objectives • Analyze the five fundamental elements for the development of information projects as the basis for the specification of normalized practices and procedures. • Analyze the two international standards for the development of projects associated to people and processes. • Analyze the importance of communication in the development of projects. • Analyze the organization, administration, infrastructure and operations carried out for the development and administration of systems. • Analyze the organizational impact generated by the incorporation of information technologies. 9. At-a-distance Course Development and Administration of Information Projects.

(10) Outcome profile In accordance with your level of responsibility, at the end of the Course you will be able to: • Propose improvements to information systems, especially in your working area. • Carry out the organization of courses required in an information project. • Propose options to ensure that the incorporation of technologies will favor other processes of social security institutions.. Characteristics of the final paper. The final paper consists of the integration of the three individual evaluation activities developed at-a-distance, updated according to the recommendations of the tutors. The integration of evaluation activities in one single final document can be made in an individual manner or as a team; the latter option is offered to enrich the contents and make it more consistent when there are more than two participants of one single entity. The parts integrating the final paper are: • Title page with all the data of the participant(s), including the title to be given to the paper. • Index. • Introduction to the paper. This consists of a few paragraphs anticipating the current context of social security, of the institution and of the information technology, as well as a brief description of each partial paper. • Three chapters corresponding to each one of the evaluation activities. • General conclusion describing the results of the training process of the course and adding comments on the following points: o The challenge of your institution to use the information technology in a manner that will promote its competitiveness, its quality and its efficiency in the rendering of services. o The challenge of the informatics institutional areas to give a true support to organizational goals through the exercise of the administration of information systems. o The challenge of the informatics institutional areas to become a true support to the specific needs of users, thus ensuring the development of exact, opportune and relevant information systems. 10 Inter-American Center for Social Security Studies.

(11) MODULE I. BASIS FOR THE DEVELOPMENT OF INFORMATION PROJECTS. INTRODUCTION The informatics industry has developed new methods for the administration of the growing complexity of information projects. In the past there were several evolutions, revolutions and recurring success and failure topics. At present, the success of information projects depends on the ability to find an equilibrium of five principal components: people, information, processes, tools and products/services. The five components are important at the time of developing any information project. During several years, two of these elements have been explored in detail. These two components are: people and processes. People and processes require a conducting channel that will permit communication among various of their component elements, as well as between them. Without communication there is no way to develop any information project. The study and description of the relationship and equilibrium of these five components, with special attention to people and processes, as well as to communication as the integrating factor of the development of projects, are the purposes of this first module. Topic number one discusses the development of information projects as part of the assignment of the functions and of information services; it presents the five elements of the development of information projects as the basis for the specification of normalized practices and procedures, and shows the relationship among the elements and how any change in an element will affect the others. Topic number two deals with the processes and people components and discusses two models for the success of the development of projects. These modules are the "Software Capability Maturity Model (SCMM)" and Teople capability Maturity Model (P-CMM)". Both generated by the Software Engineering Institute (SEI). Finally, topic number three discusses two main subjects: the elements of a communication plan and certain communication strategies.. OBJECTIVES • Analyze the five fundamental elements for the development of informatics projects as the basis for the specification of normalized practices and procedures. • Analyze the two international standards for the development of projects associated to people and processes. • Analyze the importance of communication in the development of projects.. 11 At-a-distance Course Development and Administration of Information Projects.

(12) KEY WORDS Common characteristics Communications plan Communication strategies Development of information projects Goals Information Key practices Key processes areas. Maturity level People People Capability Maturity Model Processes Product/Service Software Capability Maturity Model Software processes capability Tools. TOPICS 1. Basic elements for the development of information projects 2. The Capability Maturity Models 3. The communication process within an information project Author of all the topics: Alejandro Dominguez Tones. EVALUATION EXERCISES AND ACTIVITIES First activity (individual exercise) 1. Consider the current status of an organization; this may be the organization in which you work or any other (this organization must develop software applications). 2. Using the following chart, evaluate that organization with the purpose of determining how far it is from level 2 of the S-CMM.. 12 Inter-American Center for Social Security Studies.

(13) Repeatable KPAs. Goal 1. Requirements management. Goal 2. Goal 3. Goal 4. Invalid grid. Invalid grid. Project planning. Invalid grid. Project tracking and oversight. Invalid grid. Software subcontract management. Software quality assurance. Configuration management. Fully Satisfied. 110. Not Satisfied. 4110 Not Applicable • Not Rated. After having analyzed the situation of the organization, evaluate each goal and write a justification for each one of them. Each justification must be clear, concise and no longer than half a page. The document generated must have the following structure: • Title or introductory page, indicating the following data: full name, electronic mail address, city, country, name of the document and date of creation. Resume page (no more than 200 words). • Background of the organization where the evaluation will be applied. It must contain enough information to show the type of organization being evaluated. The evaluation and its justification. • For each "Does not Comply" indicate how to proceed to change this evaluation to "Total Compliance", that is, indicate how to solve the problem (again, the solution to each "Does not Comply" must be no longer than half a page). • Conclusions (your own and original).. 13 At-a-distance Course Development and Administration of Information Projects.

(14) MODULE II. INFORMATION SYSTEMS. INTRODUCTION No doubt, the world's move towards digitalization involves also the essence itself of social security institutions, but at a different rhythm, slower than that of other sectors such as banking, commerce, industry and private services. This difference results fundamentally from the strong investments necessary to adopt advanced technology. In the competitive and global environment of our times, information systems understood as entities formed by human elements, hardware and software, play a strategic institutional role; history tells us that up to a few years ago, information systems were in the hands of computation technicians and specialists. However, now that they have become solutions for the organization, all its levels must be involved in the planning, development and evaluation of information systems. The evolutional panorama of informatization in America's social security, has also shown, since fifteen years ago, a constant adoption on the part of institutions of technologies to automatize data processing, eliminate the enormous volumes of storage of documents and offer more efficient and better quality services. This has represented a transformation of the operating processes and an impact on the organizational culture. However, the application of the new technologies to improve quality in the rendering of services, is not per se a fact that will guarantee the success of plans. Among other factors, it is essential to count with an adequate administration of the information projects that will determine how to integrate hardware and resources, telecommunications, methodologies, information systems, users, storage and that will include, in a permanent manner, aspects of security, control, auditing and evaluation.. OBJECTIVE • Analyze the organization, administration, infrastructure and operations performed for the development and administration of systems.. KEY WORDS Application Business area Control Effectiveness Efficiency Hardware. 14 Inter-American Center for Social Security Studies. Information system Operative system Planning Procedure Project Software Strategy.

(15) TOPICS 1. Organization and management of information systems. 2. Infrastructure and operation 3. Development, acquisition and maintenance of applications 4. Administration of information systems projects Author of all the topics: Ismael Novella Perrusquia.. EVALUATION EXERCISES AND ACTIVITIES Second activity (Individual exercise) A) On the basis of the actual situation of your institution, prepare an essay no longer than ten pages on the following points: 1. Starting from an approach to systems ranging from the general to the specific, describe your institution as a service rendering entity and its principal functional areas; point out the areas in charge of information processing, describing their tasks and responsibilities. 2. Outline the practices and procedures of the systems development area (directorate or management), giving your opinion on its efficiency, effectiveness and on the controls it handles. 3. Explain the maintenance and change control requirements in the software of information systems. You may document this part with the information on the area, the review of documents, the interview or the observation. 4. Describe an actual project for the development, acquisition or maintenance of information systems or information project, its phases and features. Propose an alternate model of development to enable the system to comply with the goals of the organization.. 15 At-a-distance Course Development and Administration of Information Projects.

(16) MODULE III. ORGANIZATIONAL IMPACT OF INFORMATION TECHNOLOGY. INTRODUCTION The knowledge of the previous modules on general aspects of informatics, have been aimed at offering elements that will allow you to reflect on the improvement in the daily practice of automatization work. In like manner, it is important to ask oneself: What would happen if the institution itself or the area in which I work would be faced with a major strategic change, that would imply new outlines including the updating in the mission of the organization? In this case the approach of automatization would depend totally on the new strategies. The contents of the module was thought at a start as the complementary part of the information systems (human resources, organization structure, etc.); however, to the extent that it was analyzed and structured, it was possible to conclude that all the components of the information technology (whether information systems, technologic platform or information human resources) must depend on a directive of the highest level and scope, which shall be defined by the strategic planning of the institution and perhaps carried out through a process reengineering exercise. Therefore, it is important that you, whether you work as an executive, personnel of an informatics coordination, or of a users area, are well aware of and apply the concepts contained in this module with the purpose that you may have a more ample panorama in which information technology is located, and may in turn become a protagonist agent for the change in your organization.. laf.5°) OBJECTIVE • Analyze the organizational impact generated by the incorporation of information technologies.. KEY WORDS. Basic competitiveness Chain of value Competitive scope Cost advantage Critical factors of success Discontinued thought Differentiation Empowering of employees Key decisions. 16 Inter-American Center for Social Security Studies. Outsourcing Performance measuring Process Process Reengineering Processing functions Values system Vertical integration Virtual integration.

(17) TOPICS 1 Reengineering in organizations 2. Redesign of processes for their automatization 3. The organizational development during change 4. Outsourcing• one step towards virtual integration Author of all the topics: Ricardo Loranca Gonzalez. EVALUATION EXERCISES AND ACTIVITIES Third activity (Individual exercise) A) Choose two of the process reengineering principles that you consider that the institution to which you belong has applied or could apply. Support your reply describing the manner in which they have been carried out, specifically in your department or area of competition. Maximum length: one page. • • • • • • • • • • • • • •. Eliminate activities that have no added value. Organize around results instead of around functions or tasks. Seek that the user of the result of a process is the person who carries out the process. Obtain quality and capture information from the source. Consider resources that are geographically disperse as if centralized. Standardize processes on the basis of leader practices of the industry "best practices". Promote the creation of multi-functional positions. Assign points of decision to whoever carries out the work and build the process with integrated controls. Use visual methods for the control of processes. Reduce preparation time. Use processes in parallel. Establish relationships and agreements with suppliers and customers. Apply automatization and the applicable technology. Build up a capability and a mentality for continuous improvement.. B) Which of the following types of activities have been handled in the organization to which you belong by means of outsourcing? Describe briefly the benefits obtained and comment if you consider that it could be possible to reach virtual integration with anyone of your suppliers or users of your services. Length: one page. • Informatics • Human resources 17 At-a-distance Course Development and Administration of Information Projects.

(18) • • • • • • •. Vigilance services Messenger services Telecommunications Accounting Taxes Internal auditing Inventory administration. 18 Inter-American Center for Social Security Studies.

(19) .W1e. todology. How can I consult the tutors of the CIESS? During the entire Course you may consult the tutor assigned to you, who will also guide you with respect to other exercises or activities that will allow you to take better advantage of the Course, taking in consideration at all times your educational background and needs for training. You will be able to send your messages directly to the tutors through the following media. In all cases we will appreciate your sending a copy to the CIESS:. ALEJANDRO ROMINGUEZ TORRES Electronic mail: alexdfar@yahoo.com alexdfar@hotmail.com ISMAEL NOVELLA PERRUSQUIA, M.A. and CISA Electronic mail: inovella@yahoo.com. TO COMMUNICATE DIRECTLY WITH THE CIESS: Electronic mail: ciess@servidor.unam.mx Faxes: (52-55) 5668-0094 5595-0644 5595-0011, extension 1123 Telephone:. Voice mail box destined especially for at-a-distance activities: (52-55) 5668-0094 Course Coordinator Professor Martin Gomez Silva, MSC.. Guest Professor Fabiola Sanchez Gomez, M.C.. You are welcome to let us know any doubt or comment you may have on the development of the Course.. 19 At-a-distance Course Development and Administration of Information Projects.

(20) When making your consultations or sending your evaluation activities do not forget to identify yourself as participant in the Course, as well as to mention your name and that of your tutor. The latter will reply to you and will inform you the results of your exercises no later than five days after having received your message through anyone of the media indicated above. Use the format to send counseling requests and evaluation activities included in the study material. The coordination of the Course will also keep a record of progress in the performance of the evaluation activities of each participant.. What is expected of me as participant in an at-a-distance Course? In at-a-distance education, independent study is very important, that is, the time in which the participant organizes and carries out his learning activities, exercises and evaluations without having to attend an educational center, although he will maintain a link and counseling relationship with the Center. This enables you to adapt the rhythm of study to your capabilities, knowledge and time availability. To be successful in independent study and obtain better benefits from this Course, it is advisable that you take the following into consideration: Recommendations • Watch yourself and learn your study habits. It is important that you appreciate if it is easier for you to make resumes or schemes, carry out practices or prepare an essay, read at the office or at home, study during hours at night or dedicate several brief periods of higher concentration during the day. Prepare yourself to work several continuous hours, whether reading or preparing your papers, but take time to rest between each study period. Try different options and increase your learning styles understood as the different manners in which individuals build knowledge. • Build a context that will favor study. Share this experience with your work mates, members of your family and friends, so that they are informed of your situation and may support you respecting your study time and your compliance with your evaluation activities. This will propitiate that they value your efforts and share your success. You may also establish personal incentives after completing each module, such as gather with friends or devote one whole day to some kind of entertainment with the family. • Be constant. Although it is true that the methodology of this Course permits a higher flexibility than an attendance course, continuity will allow you to understand and apply your knowledge faster. In this sense, it would be beneficial to prepare a chronogram and schedule of activities. You will be the first beneficiary of your own responsibility and perseverance.. Analyze and bear in mind the motivation that will create in yourself an interest for training and updating.. 20 Inter-American Center for Social Security Studies. ✓.

(21) • Relate the contents of the Course with your labor practice. Starting with your daily working life prepare questions to the study texts. At the same time, apply or exemplify what you have studied in your own labor reality; for this purpose, use the application questions shown at the end of each topic. This will allow you to read in a planned manner, aimed at the achievement of results. • Consult your tutors and companions. If you do not limit yourself to know the results of your exercises, you may obtain a value added to your academic activities. Ask your tutor for additional activities with which you can reinforce a concept or apply it in a better way. To the extent possible, try to become acquainted with other participants and share their successes, doubts or uncertainties.. Although the evaluation activities are mentioned as individual, it is advisable to seek exchange in study groups; in these groups, personal work may constitute a first component for dialogue.. What activities must I carry out and how will my performance be evaluated? After reading and studying each module, you must carry out the activities pointed out at the end of each one of them and send them, by fax or electronic mail, to your tutor or to the see of the CIESS in Mexico City. You will receive by fax or electronic mail the results of each one of your partial activities.. If you send your papers by electronic mail, please send your files captured in a Word text processor; if you use charts, send them in an Excel calculation sheet.. We will appreciate that the name of your file indicate the number of the module and your initials. For example, Modlrsg, for work relative to module 1 sent by Rail Suarez Gutierrez.. We present below a calendar with the delivery dates of the learning activities and with the duration estimated for each one of the modules, so that you will be able to plan your study times.. 21 At-a-distance Course Development and Administration of Information Projects.

(22) CALENDAR OF ACTIVITIES. MODULE/ACTIVITY. DATE OF REMITTANCE. Module I Delivery of evaluation. October 13th. Module II Delivery of evaluation. October 29th. Module III Delivery of evaluation. November 17th. Delivery of the final paper. November 29th. This Center will grant diplomas to participants who have satisfactorily complied with the activities of all the modules and presented a final paper with the characteristics indicated therefor. This diploma shall have the same curricular value and academic recognition as those granted at similar activities that the CIESS develops under the attendance modality.. 22 Inter-American Center for Social Security Studies.

(23) AT-A-DISTANCE COURSE "DEVELOPMENT AND ADMINISTRATION OF INFORMATION PROJECTS" IDENTIFICATION PAGE FOR THE REMITTANCE OF EVALUATION ACTIVITIES FROM: NAME. DATE. INSTITUTION COUNTRY Fax:. CITY Electronic mail:. FOR: FAX: (5255) 5668-0094 / 5595-0644 FAX OF THE TUTOR PROFESSOR: COORDINATOR: Mtro. Martin Gomez Silva TUTOR: You may photcopy this form and use it to send each one of the evaluation activities ACTIVITIES. DATE OF REMITTANCE. NUMBER OF PAGES ATTACHED. First activity. Second activity. Third activity. Final paper. 23 At-a-distance Course Development and Administration of Information Projects.

(24) _,,. J.

(25) Educational Team. Coordinator MARTIN GOMEZ SILVA. Coordinator of the Academic Area of the CIESS. Bachelor inf Communications, Professor and candidate for a Doctor's Degree in Communications Science by the Autonomous University of Barcelona, Spain. Master's degree professor in Visual Communication and University Professor at the Simon Bolivar University, as well as at the Instituto Tecnologico de Estudios Superiores de Monterrey (Mexico). Has presented and published articles on at-a-distance education in Argentina, Brazil, Colombia, Costa Rica, Mexico and Venezuela. His most recent publication is "The independent study in at-a-distance education as from complexity and social networks" (Technology and Communication, ILCE). Areas of interest: learning networks; flexible educational schemes such as at-a-distance and open education, educational communication.. Guest Professor FABIOLA SANCHEZ GOMEZ, Counsel to the Coordinacion de Vinculacion Operativa of the Internal Control Organ of the Mexican Social Security Institute. During ten years acted as Head of the Informatics Area of the CIESS; bachelor in pedagogy, master in Administration of social Security by the University of Alcala de Henares, Spain and by the Latin American Social Security Organization; Master in Computation Science by the Arturo Rosenbleuth Foundation, Mexico. Has presented and published articles on informatics and social security in Canada, Spain and Mexico. Areas of interest: information systems, educational evaluation and informatics applied to education.. 25 At-a-distance Course Development and Administration of Information Projects.

(26) Tutors ALEJANDRO DOMINGUEZ TORRES. Under Director of the Arturo Rosenblueth Foundation (Mexico), Doctor in Philosophy by Cranfield Institute of Technology (United Kingdom), Master in Social Science in Software Techniques in Computer Aided Engineering by Cranfield Institute of Technology (United Kingdom); MSc in Software Techniques in Digital Image Processing by Cranfield Institute of Technology (United Kingdom); Physicist and Master in Science by the National Autonomous University of Mexico. Has more than ten years experience in the administration of information systems projects for institutions in Spain and Mexico. Has acted as Evaluator of study plans and programs in the area of Informatics and Computation at the Public Education Ministry (Mexico), Academic Director at the Arturo Rosenblueth Foundation, as Counsel to the Consejo Nacional de Acreditacion en Informatica y Computacion (CONAIC) and to the Comite de Acreditacion de la Ensefianza de la Ingenieria (CACEI). ISMAEL NOVELLA PERUSQUIA. Independent consultant and Senior coordinator of information systems in a transnational service enterprise. Bachelor in Administrative Computation Systems and Master in Administration by the Instituto Tecnologico y de Estudios Superiores de Monterrey; Certified Auditor in Information Systems (CISA) by ISACA (Asociacion para la Auditoria y el Control de los Sistemas de Information). His areas of interest are the management and administration of systems projects, operations in information systems and the interpretation of corporate goals.. 26 Inter-American Center for Social Security Studies.

(27) GCossary L. Access codes. Process which limits or controls access to the resources of a computerized system.. Access control. Process which limits or controls access to the resources of a computerized system.. Application. Individual program that performs a combination of well defined tasks under the control of the user.. Assets. Any good or resource available to an organization to reach its objectives. In the informatics area, assets are: hardware (computation and communications equipment), software (computation programs) and humanware (human beings). Audit. Independent evaluation of a given activity with the purpose of issuing an opinion on its reasonableness. Systematic review and supervision of one or several activities.. Audit Indexes. References incorporated to the work papers of the auditor for their easy location.. Audit marks. Symbols used by the auditor to indicate the work he has performed. Different colors can also be used. For example: u n = arithmetical operations correct u @ = verified against the previous audit = verified physically 1. Audit risk. Possibility that the auditor could give an opinion without reservations on a given activity, when there are errors and/or irregularities in excess to the relative importance of the facts.. Audit track. All the elements that make it possible to reconstruct the events occurred, the facts.. Audit work papers. Elements of judgment gathered by the auditor and shown on any physical medium (paper, photographs, records) which give attesting evidence. The evidence must be "sufficient and competent".. 27 At-a-distance Course Development and Administration of Information Projects.

(28) Authentication. Confirmation process that makes it possible to determine the legitimacy of the subject.. Availability. Characteristic of safety in informatics that ensures that the computation resources will be available for the authorized users when needed. This characteristic protects against the denial of the service.. Band width. Maximum size of the information or data that can be sent through a connection at a given moment. It is measured in bips per second (bps).. Basic competitiveness. Is represented by the identification and selection of the activities that constitute the nucleus of an organization, and that, in terms of originality and experience make it possible to furnish a value added higher than that of its competitors.. Business area. Functional business unit.. Chain of values. Tool that permits breaking up an organization in those activities that are strategically relevant to create or maintain the competitive advantage of an organization.. Classification. Category assigned to the information according to established protection attributes.. Classified information. Category assigned to the information according to established protection attributes. Confidentiality. Degree of restriction assigned to the access and use of the information on the part of its owners.. Contingency plan. Specific actions that provide an opportune response in the event of any type of urgent situation.. Control. Practices and procedures that allow the personnel performing a task, to measure its execution and to correct deviations in time, cost or quality.. Control objectives. Aspects that must be controlled in the process of information. They are the "what" of control.. Control risk. Risk that exists because internal control has failed to prevent, detect or correct errors and/or irregularities.. Control techniques. Controlled aspect in the process of information. They are the "how" of control.. 28 Inter-American Center for Social Security Studies.

(29) e•'-%. Cost advantage. One of the basic types of competitive advantage. Cost also plays an important role within the differentiation strategies, because any differentiator must try to maintain costs close to those of its competitors.. Critical factors of success. The areas in which a good performance is essential to ensure the achievement of the objectives of the organization.. Criticality. Level of importance and value assigned to the information for the purposes of the rendering of the service.. Cryptography. Modification of the data of a filing card system or of those transmitted by modem, radio, etc., to avoid that they may be read by undesirable persons.. Dangers. Imminent risks or contingencies that may provoke some harm.. Data base. Integrated collection of data stored in different types of records, in a manner that they will be accessible for multiple applications.. Data warehouse. Integrated collection of corporate information designed for recovery and analysis to support the taking of decisions.. Detection risk. Risk that exists due to an inadequate selection or application of auditing procedures.. Differentiation. Competitive advantage that is not limited to the physical product or to the marketing functions but considers all the components of the chain of values as its source.. Discontinued thought. Makes it possible to recognize and break with old paradigms or schemes that may not correspond to the mission and strategy required by the organization.. DP. Disaster Plan. Safeguards the business by identifying the tasks that could be performed better and the tasks that should not be performed at all.. Effectiveness. Do things well with the best use of resources.. Efficiency. Relationship existing between the work performed, the time invested, the investment made and the results obtained.. Empowerment of employees. The granting of decision capacities to the employees.. File. Collection of related records belonging to the same entity.. 29 At-a-distance Course Development and Administration of Information Projects.

(30) Hackers. Experts in computation that rummage through the systems, but whose code of ethics does not lead them to cause harm, except to erase their tracks, nor to obtain economic benefit.. Hardware. Refers to all the physical resources of a computation system and to the physical infrastructure in general.. Information. Data organized in such manner that it will be significant and useful for different activities of their receiver.. Information architecture. Refers to how to arrange, coordinate and integrate the technology of information (including information systems) to the central functions of the institution.. Information safety. Discipline that has as a purpose to protect the informatics assets and the information against risks that may cause loss and/or damage, through the establishment of prevention, detection and control policies and standards. It develops, supports and supervises the efficiency and effectiveness of the rules.. Information system. Interrelated components that make it possible to capture, process, store and distribute information to support the different activities performed within an organization.. Inherent risk. Risks that exists due to being or acting or due to the type of entity.. Integrity. Obtainment and articulation of material and human elements that organization and planning designate as necessary for the adequate operation of an organization.. Internal control. The organization plan, the methods and procedures and the control environment.. Key decisions. Elements of support for managers to enable them to achieve the critical factors of success. They are represented in the form of questions.. LAN. Local Area Network. Group of computers (users) connected to a central equipment (server) that share printing, storage, communications, and processing services, etc.. Monitoring. Informs and permits taking the appropriate action; records the use of the system.. Network architecture. A concept that includes the specifications and descriptions of the components in the data communication system, including transmission routes, protocols, safety measures and interconnection methods.. 30 Inter-American Center for Social Security Studies.

(31) Operative system. The most important component of the software in an information system, as it contains programs that are the inter-phase of understanding between the user, the processor and the applications. It makes it possible to share the resources such as: processor, memory and incoming/outgoing fixtures.. Outsourcing. Hiring of an external enterprise whether as a supplier of goods and services or as a consultant, for the development of an information system (all or part) or of a technology updating project (implementation).. Ownership. Assignment of responsibility in the handling of information delegated to the persons responsible of the areas, who grant access and use privileges in the handling of information.. Password. Access code integrated by numbers and letters to have access to and use the information resources.. Performance measuring. Element additional to the critical factor of success that permits the manager to evaluate how well a function is being carried out.. Physical safety. Minimum specifications used to safeguard a structure or facilities from any tangible or intangible object exposed to the threats of the environment.. Planning. Process of systematic and organized preparation of the activities of a project.. Policy. Guide emanating from the objectives of the enterprise, that orients the thought of people for the performance of their functions.. Privileges. Privileges are granted to data bases, consultations, readings, purging and creation, limited to times and to the segregation of functions.. Procedures. Chronological and sequential events of inter-connected operations, that constitute a unit, as regards the performance of a specific activity or task within a predetermined application ambit.. Process. Series of activities that taken jointly produce a valuable result for the customer or user of the service.. Process Reengineering. Identification, redesign and implementation of the processes of the business to obtain improvements in time, cost and quality.. Processing functions. Elements complementary to the critical factor of success, presented in the form of reports or consultations that the automatized system must have.. 31 At-a-distance Course Development and Administration of Information Projects.

(32) Project. Non routine activities in an organization with specific initiation and termination dates, measurable objectives and with restrictions in time, cost and quality.. Protocol. Communication rules that permit different fixtures to communicate between them, so that each one of them can send and receive understandable signals.. Recovery. Temporary or permanent restoration of a critical operational capacity.. Responsibility. Determination of the degree of commitment in the handling of information that must be acquired by the persons responsible for the areas, who assume control and care in the safe use of the information.. Risk. Possibility that a negative event may occur for the persons and/or enterprises, which are present in all activities.. Risks analysis. Analysis of the assets and of the vulnerabilities of a system to establish a loss or damage expected from certain events, based on estimated probabilities of occurrence of those events.. Rules. Guidelines to control behaviors and to preserve safety in a physical or logical asset.. Sabotage. Damage that affects systems, people or organizations, causing high recovery costs.. Safety. Administration and protection of the resources of the enterprise to which users have access.. Safety attributes. Characteristics or standards that any asset to be protected from threats should have, in order to be able to say that it is "safe".. Safety system. Reduces the probabilities of losses to a minimum acceptable level at a reasonable cost and ensures adequate recovery.. Scope of Competitiveness. Combination of different chains of values in which an organization incurs to improve the economy of one or all of its chains of values.. Sensitive data. Data that require a higher protection against risk.. Sensitive information. Information that requires total protection against the risk to which it is exposed, as well as for the magnitude of its loss or damage in case of deliberate diffusion, alteration or destruction of the information.. 32 Inter-American Center for Social Security Studies.

(33) Software. Group of instructions logically scheduled and organized to control and coordinate the processing of data, as well as the work of the hardware of a computation system.. Strategy. The art of managing the operations of a business, ability to manage an event.. Supports. Includes the maintenance of critical parts between the loss of the service or resource and its recovery.. Telecommunications. Refers to the fixtures and procedures to communicate several computation equipments through the communication networks.. User. Any person working in a specific enterprise as well as persons outside the enterprise (suppliers, customers, contractors) that enter into any of the facilities of the enterprise.. Values system. Chains of values integrated as from the existing chains of values in different activities, as the creation of a product, its acquisition, its sale and its delivery to the final customer.. Vertical integration. Consists in the growth of an organization through the absorption of a higher number of activities in a specific industry or sector, with the purpose of incrementing profits and of achieving independence with respect to other organizations that previously acted as its suppliers or distributors.. Virtual integration. Consists, in the first place, of the identification of those activities that conform the essence of the organization and that the organization can perform better than any other similar organization (basic competition), to later on select other specialized enterprises that can perform all the other non essential activities. From the combination of the best activities of each entity, better results and lower costs are obtained, as compared to the results and costs that would result if operating in a separate manner.. Vulnerability. Weakness in an organization that can be used by a threat to provoke a damage to the organization.. Weakness of control. Situation in which the auditor appreciates that the established procedures, or the degree of compliance therewith, does not provide a reasonable safety and may bring as a consequence errors or irregularities.. 33 At-a-distance Course Development and Administration of Information Projects.

(34) Directory. SANTIAGO LEVY ALGAZI. Chairman of the CISS and to the Board of Directors of the CIESS. JORGE MELENDEZ BARRON. Secretary General of the CISS. LUIS JOSE MARTINEZ VILLALBA Director of the CIESS. MARTIN GOMEZ SILVA. RAQUEL ABRANTES. PEGO. Coordinators of the Academic Area of the CIESS. HECTOR CASTILLO FLORES. Administrative Coordinator of the Academic Area of the CIESS. JUAN JOSE ZERMEN- 0 CORDOVA Head of the Communication Area of the CIESS. 34 Inter-American Center for Social Security Studies.

(35)