CIO Straight Talk - Issue 7 - 74

74

specifically to meet the requirements

to be replaced by new technology.

of the King III code of governance,

Information security garners

we can quickly and clearly show the

the most attention from the board

board how we're doing - good, bad,

these days, given the high-profile

or indifferent - against the seven key

cyber-attacks that have made

issues they are charged with tracking.

headlines in recent years. We give

When they see a green, they know

our board members assurance that

we are doing well and they can move

the information assets of the firm

on. An amber indicates that things

are securely protected through

are not in good shape, but there are

authentication, firewalls, active

plans to address the issue and bring

monitoring of access, and the like.

it back in line. When it's red, they

They want to know that our data

know we're off track and they need to

assets are as locked down as they

pay attention to the problem. (See the

can be.

sidebar "A Balanced Scorecard
for IT.")

Seven Principles of IT
Excellence

Other CIOs have taken their
own approach to explaining IT's
performance to the board, but I find
the balanced scorecard works best.
Board members don't want a big
report to read. They're busy people.

We take what we're doing in IT and

They have much more to worry about

fit those activities into the seven

than IT. They like a flash of light on

principles of good IT performance

what's really important. We need to

outlined in the code:

be circumspect about what we give

* Board oversight

them. This way they can see all the

* Performance and sustainability

statuses on two pages and move on.

* IT governance framework

Of course, IT is more than the sum

* IT investments

of its metrics. So we supplement the

* Risk management

balanced scorecard with an outline

* Information security

detailing the overall performance of

* Governance structure

the technology function-including

(See the sidebar "South Africa's IT

the softer side of what makes IT

Governance Principles.")

really work. We inform them about

For performance and sustainability,

the more nuanced dynamics critical

for example, we created a matrix

to successful IT delivery: how we're

that outlines the performance of

doing managing our people, for

the strategic systems integral to our

example. How many people have we

operations. If there are major outages,

lost? How many new employees have

we indicate what the root causes were

we recruited? How is IT morale?

and what plans we've introduced

A board is usually driven by

to prevent recurrence. In terms of

metrics like return on equity,

sustainability, we let the board know,

profits, revenue targets, earnings

for example, which systems may be

before interest, taxes, depreciation,

decommissioned and which are going

and amortization. But they also

In South Africa
today, the IT function
is the most audited
component of
the business.
CIO Straight Talk - Issue 7

Table of Contents for the Digital Edition of CIO Straight Talk - Issue 7
