GRC Journal - (Page 55) Governance, risk & Compliance We believe the introduction – and widespread adoption – of new business intelligence (BI) technologies, such as performance dashboards or analytics, has helped to an extent. When companies implement BI initiatives they often achieve some improvement in the quality of their information management capabilities. Unfortunately, most BI initiatives do not go far enough. In most cases, there is not an enterprise focus on information strategy, making it almost impossible to gain consolidated customer views or analyze and understand overall business performance, costs and profitability. IQ problems have often taken a back seat to the implementation of the technology. Only recently – arguably forced in part by Sarbanes-Oxley and other regulatory requirements – have we seen companies begin to view information, particularly enterprise-wide information, as an asset that requires the same stewardship in management and governance that other assets require. While we see a new thought pattern emerging regarding IQ, companies are discovering that there are formidable obstacles to achieving it. Foremost among them is a lack of ownership. Many point to the CIO − after all the “I” does stand for “information.” Certainly, the CIO has important responsibilities for people, processes and of course, the technology related to information assets. But this is not the same as being responsible for the quality of the information. CIOs are usually responsible for the infrastructure that houses, stores, distributes and maintains data security. But they don’t necessarily control the inputs and outputs, and they clearly don’t control all of the strategies, decisions, actions, processes and people that ultimately affect IQ. Indeed, CIOs often don’t even control the governance and decision-making concerning technology architecture, applications and IT processes. In many companies, the hard truth in our experience is that there is no clear definition of responsibility for IQ. As a result, even after investments in new technologies, it is still difficult for many companies to produce the type of high-quality information they need to monitor, manage and improve their business performance. To meet these challenges, many companies are seeking new ways to improve their information management capabilities. One way many companies have reached these goals is by analyzing their enterprise information assets and implementing a comprehensive program to govern them effectively, enterprise-wide. Enterprise Information Governance The old computer adage, “Garbage in, garbage out,” aptly sums up the importance of information governance. We believe an effective information governance framework is essential for providing data accuracy and preserving its integrity. This framework should encompass information management policies, procedures and principles, as well as assign ownership and accountability for information monitoring and managerial tasks. Enterprise information governance (EIG) is more than a collection of ad hoc data quality projects. Rather, it is the process of managing the quality, availability, usability, integrity and security of information enterprise-wide. The goal should be to align a company’s business information assets with its business strategy, goals, objectives and values. A well-designed and effectively implemented program requires a sound information strategy and empowered information stewards who are responsible for owning and managing information. It also requires an information governance council or committee, which oversees a clearly-defined set of information policies and procedures complete with a clear accountability structure to enforce them. An important first step in implementing a sound EIG program is to identify the information stewards, the owners or custodians of enterprise information. Assigning ownership is simply the process of specifying the parties who are accountable for the accuracy, accessibility, consistency, completeness and updating of data used or “owned” by their department or business function. Next, it is essential to define processes for data storage, archival, backup and disaster recovery. It’s also important to develop standards and procedures to specify how enterprise information is to be used by authorized personnel based on role, security status and need. Finally, it’s necessary to develop audit procedures to monitor ongoing compliance. Once implemented, an effective EIG program can provide the following benefits: n n n Improvement in information integrity and value to the business Better control of the data flow through the company Reduction in the time and effort required to collect, format and reconcile data from different information systems, and turn data into valuable information Reduction of costs through the use of standard processes, eliminating redundant efforts, and containing the proliferation of multiple reporting tools, data marts and other technologies resources throughout the enterprise n www.BTQuarterly.com Business Trends Quarterly 17 http://www.BTQuarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.