Previous:Shared limitations
Minding methodologies
BTEP is a methodology developed by the Government of Canada (GOC) for business process transformation, he says. "This makes for a consistent set of reusable planning assets that allow you to get to a good project." After BTEP comes the final step around project management (PM), which guides the actual execution of an IT project to ensure systems are delivered on time and on budget.
Adoption of these methodologies across the federal government is patchy. "We're well on our way in different places," he says. "There's lots of focus on project management and we're getting better at doing it. With ITIL, the CRA and Public Works have been focusing on it for the past couple of years and are delivering solid results."
At the provincial level, more formal project management discipline was introduced two years ago in Ontario and is fairly well-established, says Langhout. But the range of methodologies that are being introduced can be overwhelming. "All these methodologies are out there, but in trying to do it all, people try to evade some of those best practices as they can be onerous."
More discipline in planning and documentation makes an application more useable in the future, but in the here and now, it means telling customers their projects can't be implemented right away - which can make them unhappy. "It's important that we get buy-in from business areas so they understand why it's important to have more rigorous processes," she says.
Trends are similar at the municipal level, says Roy Wiseman, CIO of the region of Peel in Ontario. Adoption of formal project management frameworks is fairly widespread, and most IT organizations are also adopting ITIL to get their houses in order, he says.
But adoption of COBIT, which creates the master plan for aligning IT with business objectives, is still at the early stages. Although the region of Peel recently completed a COBIT assessment to get a better understanding of its objectives and IT project priorities, Wiseman says he's not hearing much about COBIT in government circles. "We happen to like COBIT, but it's not getting a lot of buzz yet. If you're a significant IT organization, you're expected to have ITIL in place, but COBIT is seen as more optional," he says.
While there are many similarities between the public and private sectors' IT governance initiatives, there is one crucial difference, says Will O'Brien, partner at the Toronto-based consultancy Manta Group, which conducted the COBIT assessment for the Region of Peel. "There's nothing linking good corporate governance to IT in the public sector. Whereas, it's directly linked in Sarbanes-Oxley legislation, so the private sector has been forced to comply."
Preventing another Enron scandal was the stimulus for improving corporate governance, but government scandals haven't created a similar reaction in the public sector, he says. "I think government scandals may put the spotlight on governance, but there's no driving force - it's really up to the leadership of whatever party is in power to initiate good governance or not."
As a consequence, there's no over-riding program around governance of IT in the public sector to drive out enterprise-wide requirements, he says. "It's ironic, but there's little governance around governance initiatives, which should be run like any other program. The net result is that few government initiatives address enterprise concerns - they're run in silos to address a particular organization's issues or they deal with point-in-time solutions."
But in both sectors, the general trend is increased focus on management of IT risks. "The risk-based approach for creating and rationalizing the right control environment to provide governance is picking up steam on both fronts.
"Many organizations recognize that a systematic approach is needed to assess and mitigate the threats, vulnerabilities and exposures of their businesses. But adopting IT governance methodologies is often a rote exercise in some organizations," O'Brien says. "Instead of really rationalizing what they need to have in place to manage their investments, people are just putting things in place to get them in place - it's a 'something is better than nothing' attitude."
O'Brien believes there will be convergence in the marketplace around different methodologies and best practices. "They will eventually all come together. But right now, we have competing methodologies."
ITIL, for example, is similar to ISO 20000 in addressing IT services management, but there are some key differences. "ITIL is fine from a government perspective. But unlike ISO 20000, ITIL isn't a standard and you can't certify an organization to it - it's a certification for staff."
Measuring governance value
Value governance is an emerging approach that tackles a perpetual problem in IT circles: how to quantify its value. "Val IT is another framework that's come out of the IT Governance Institute. It's basically an add-on to COBIT that provides better IT-business alignment, and in the government context, more voter-government alignment," says O'Brien.
IT is traditionally viewed as a cost centre, explains Fariba Anderson, a partner at the Manta Group. "Its focus has been to reuse costs and deliver more value." COBIT has changed this view to an extent. "In COBIT, the view is, forget the concept of IT as a cost centre - if you spend money, then you're a business, and as a business, you should comply with fundamental business principles."
Building a control environment that enables value governance means being able to measure the value of each initiative, says O'Brien. "Value governance is ultimately about being able to take the demands of voters - the programs and services they want - and being able to translate that demand into some sort of quantifiable value driver or metric."
To illustrate the potential benefits, O'Brien cites a successful initiative in Ontario to create one common payment process out of different modules used by various ministries to receive payments from citizens for services. This meant developing one 20-step process useable by all from various departmental payment modules that ranged from six steps to 19, he says.
Related content:
New certification seeks governance excellence
SOA: It's architecture, not technology
Shared services cut costs survey finds
icon.
