Blog

Informatica Economic? vol. 14, no. 1/2010 21Information Systems Audit forUniversity Governance in Bucharest Academy of Economic StudiesIon Gh. RO?CA, Pavel N?STASE, Florin MIHAIBucharest Academy of Economic [email protected], [email protected], [email protected]’s successful audit leaders never lose sight of the importance of continually assessingand improving the organizations’ university governance structure. Focusing on small andlarge mission, and using practical exercises and individual activities, the auditors will helpgain the skills necessary to review and improve university governance structure, while developing techniques to assess risk management activities. Attendees will leave with an understanding of legal and regulatory guidelines as they pertain to university governance and discuss in-depth issues such as business ethics, transparency and disclosure, IT governance anduniversity risks management. Identification, evaluation and management of university risks, isan important element of the university governance system. Today, the Bucharest Academy ofEconomic Studies is in a complex process to realize a university governance integrate information system. In context of this paperwork there are presented the main aspects for developing and implementing in actual phase information systems audit, to recognize the risks andestablish the necessary measures to eliminate them.Keywords: University Governance, IT Governance, IS Audit, Risks Management, PerformanceIntroductionAt the world level, from the analysis of themain classification in higher education, it resultsthat the performance universities are those thatbecame entrepreneurial universities. These universities apply the concept of university governance, assume from business domain, where isknown as corporate governance.As it is define by different entities, university governance is the set of processes, customs, policies, laws, and departments affecting the way auniversity is directed, administered or controlled.University governance also includes the relationships among the many stakeholders involved andthe goals for which the entity is governed. Theprincipal stakeholders are the shareholders, management, and the board of directors. Other stakeholders include employees, customers, creditors,suppliers, students, professors, regulators, and thecommunity at large. The overriding objective ofthe university should be to optimize over time thereturns to its shareholders. Where other considerations affect this objective, they should be clearlystated and disclosed. To achieve this objective,the university should endeavor to ensure thelong-term viability of its business, and to manageeffectively its relationships with stakeholders. [1]Many universities viewed business ethics only interms of administrative compliance with legalstandards and adherence to internal rules andregulations. Today the situation is different. Attention to business ethics is on the rise across theworld and many entities realize that in order tosucceed, they must earn the respect and confidence of their customers. Like never before, universities are being asked, encouraged and prodded to improve their business practices to emphasize legal and ethical behavior. Universitiesalike are being held increasingly accountable fortheir actions, as demand grows for higher standards of social responsibility.Nevertheless, Information Technology Governance (IT Governance) [10] is the difference between success and failure in today’s high technology environment and it is an important part ofthe university governance. Regulators, studentsand professors are increasingly concerned aboutthe proper use of information and particularlypersonal data. Many organizations are identifyinginformation as an area of their operation thatneeds to be protected through university governance plans as part of their system of internalcontrol [7].IT governance focuses on IT systems and theirperformance and risk management. It is a core resource to help those responsible for universitygovernance and IT management generally to understand, direct and manage the IT governance122 Informatica Economic? vol. 14, no. 1/2010and information security efforts within their organizations. Implementing a university governance regime, it will put in compliance with theneeds of Sarbanes-Oxley and other key legislation. Any of the myriad aspects of effective ITgovernance, rang from the provision of relevantbooks and standards, through to training (bothclassroom and computer-based) and consultancy[2].The primary goals for information technologygovernance are to (1) assure that the investmentin IT generates value, and (2) mitigate the associated risks with IT implementation. This can bedone by implementing an organizational structurewith well-defined roles for the responsibility ofinformation, business processes, applications, infrastructure etc [13].It’s virtually impossible to have too much transparency or education about IT governance.Transparency and education often go together-themore education, the more transparency, and viceversa. The more transparency of the governanceprocesses, the more confidence in the governance[15].The Information Systems Audit and Control Association (ISACA) IT governance status reportfor 2008 stressed that there was substantial roomfor improvement in the alignment between ITgovernance and overall governance. Moreover,research published by ISACA has shown thatmost organizations are not generating optimalvalue from their IT investments [11].The mostimportant factor in distinguishing between topperforming and substandard-performing organizations in both the private and public sectors isthe level of leadership from business and seniormanagers in a handful of key IT decisions. Thisholds true for government departments as theymust deliver, support and maintain successful ITprojects and IT infrastructure if they are to provide their services to the public economically, efficiently and effectively [14].Table 1. Audit objectives for IT governance MajorobjectivesImplementing good practiceAssessing existent controls or in order to be introduce, like common policy andprocesses [9] which include:– IT Help desk amalgamation with common support processes– PC/Desktop installation and deployment techniques– Information Security– Software licensing– Virtualization of desktops, servers and data hosting.Configuring of key points for information securityReducing the frequency and/or impact of major incidentsImportant objectivesAligning to the internal security policyIntegrating in the program of management risksAppearing new requests at each faculty levelGrowing the existent investmentsOther objectivesGain the competition advantagesAppearing new requests at university levelResponding to the pressure made by third entity (ministry, collaborating withother universities, suppliers, etc.)Obtain a minimum cost The objectives of this audit are to assess:? the adequacy of Committee on InstitutionalCooperation (CIC)’s IT governance structure;and? the degree of alignment and integration between CIC’s IT strategy and its businessstrategy.Some universities have established the involvement of board-level executives in IT issues to defer all key decisions to the university’s IT professionals.The main objectives are presented in the table 1.In the light of work to date these objectives canbe expanded to: review staffing, resources andprocesses for provision of IT Services and aim tomove to a situation where:? Policy, standards and common operationalprocesses are established once and implemented by all support services, faculties anddepartments.? Resources for policy implementation aredrawn from staff with appropriate skills, irrespective of their current location (i.e. establish matrix management to allow departmenInformatica Economic? vol. 14, no. 1/2010 23tal IT Support Staff to participate in organization-wide, strategic projects) [18].2 Methodology for university governanceUniversity governance methodology involves atleast six steps. This process first introduces thestudents to university governance. The investment staffs then reviews the student’s governancepractices and, where necessary, develops a university governance improvement program withthe student. Matrices, checklists, and other toolsused in this process are tailored for each of thefive paradigms (investee university model).Step 1: First Impressions? Form an initial view on whether universitygovernance poses a special risk or a good opportunity for value-added.? Select the governance paradigm (or combination of paradigms) to be applied to the university.? Identify, if possible, specific issues that arelikely to be priorities and whether there willbe need for further resources from the University Governance Unit.At the earliest practical stage in the project cycle,the investment staff should articulate their firstimpressions concerning the student’s universitygovernance. This will allow:? the selection of the appropriate paradigm touse with the student.? the IO to determine if the project requires aUniversity Governance Review (UGR) or aFull University Governance Assessment(UGA).Step 2: Student Self-Assessment? Begin the dialogue with the student and introduce university governance methodology.? Send the student the appropriate progressionmatrix and the explanatory note “Why University Governance?”? Enable students to assess their own governance against the progression matrix.Before conducts a thorough university governance analysis of the university, the studentsshould carry out its own assessment. This selfassessment not only encourages the student to“buy-in” to the university governance dialogue,but can also act as the first step in own analysis.Step 3: University Governance Analysis [6]? Send the information request list to the student, at least three weeks in advance of theon-site appraisal, so that all the necessarybackground information can be acquired bythe appraisal team prior to the review of theuniversity’s governance. The information request list (and the delivery of responses fromthe student) should be coordinated with otherparts of the investment team’s legal and financial information gathering.? Implement an on-site review of the governance of the university, assessing which approximate “level” is achieved in the five keyareas of governance outlined on the progression matrices and clarifying any outstandingissues from the Information Request List.? Decide whether the student needs to undertake a university governance improvementprogram. The basic purpose of the universitygovernance review is to acquire understanding about the university, with a view to identifying risk and opportunity and, if necessary,developing an improvement program.Step 4: University Governance ImprovementProgram? Prepare an analysis of the university’s governance, highlighting areas for improvementand making proposals to address governanceweaknesses.? Develop a university governance improvement program with the student that is specifically tailored to the needs of the university.? Agree with the client on a timetable and methods for the implementation of this program.? Identify areas where can assist the universityin its university governance improvement efforts even after the transaction has takenplace.If the university governance analysis identifies aneed for an improvement program for the university, this program will be developed in universitywith the owners and senior managers of the university. In developing a program, the investmentstaff can draw upon various university governance resources. In some cases, the program willbe comprehensive, covering all five key areas ofuniversity governance. In other cases, the program will be more narrowly focused. For example, it will concentrate only on areas where risksor opportunities are identified, such as the boardof directors or equitable treatment of shareholders.Step 5: Documentation and Implementation? Draft the operational documentation outlining the agreed improvement program, such asthe Term Sheet, Loan Covenants or Shareholders Agreement.? Decide upon the appropriate degree of legalenforceability of the program and what penalties, if any, are appropriate for the failure24 Informatica Economic? vol. 14, no. 1/2010to implement the program.Identify any need for continuing assistance to theclient after the disbursement.To ensure a common understanding of the university governance improvement program and toassign clear accountability for its effective implementation, both the program and the timetablefor its implementation should be appropriatelydocumented. There is wide flexibility in the operational documentation that can contribute tothis goal, including term sheets, loan covenants,and shareholders agreements.Step 6: Supervision? Use the Supervision Checklist to ensure thecontinuing adherence to the agreed universitygovernance improvement program.? Identify the need for further university governance assistance.The staff responsible for the subsequent supervision of an investment should become well acquainted with the student’s university governanceimprovement program in order to monitor its implementation and identify need for further assistance.This process is designed to be conducted as anintegral part of the appraisal for new investments.However, the methodology is flexible so that itcan be adapted to other circumstances, such assupervision of and assistance to existing portfoliouniversity [17].3 Collaborative University Governance inEconomic domainIn 2005, at the initiative of managers from AES,there was founding Association of Economic Faculties in Romania (AEFR which is definingAFER). One of the major objectives of this association is to collaborate in management university governance. In this context, it will be presented some particularities regarding collaboration university governance.Collaboration is required when multiple universities achieve complex goals that are difficult orimpossible to attain for an individual one. Thiscollaboration takes place under conditions of incomplete information, uncertainty, and boundedrationality, much of which has been previouslystudied in economics and artificial intelligence.However, many real world domains are characterized by even greater complexity, including thepossibility of unreliable and non-complying collaborators, complex market and incentive frameworks, and complex transaction costs and organizational structures [21].Collaborative and autonomous university thatplan, negotiate, coordinate, and act under thiscomplexity aims to foster models of collaboration in distributed systems, addressing a range oftheoretical and practical issues.The main objectives for Collaborative UniversityGovernance are as follows:? enable collaborative university to form andfollow joint agreements and contracts incomplex organizational and market drivendomains.? develop a comprehensive contractual formation/maintenance framework applicable tomany application domains.? build comprehensive customer lifecycle management systems for customers, includingtelecommunication consumers, students, professors and patients.? deploy lifecycle management systems in realworld applications, such as telecommunication and smart campuses [2].? design markets that are adequate for studentsto act with incomplete and uncertain information of the behaviour of collaborating departments.? the implications of partial regulation on themanagement of contractual relationships andservice delivery.? organizational structures influence studentsduties and the distribution/execution of tasks.? cope with collaborators that exhibit unreliable and non-conformant behaviour, eg whereagreements are made but are not always conformed with.? can interventions and incentive structures assist in managing contractual relationships andservice delivery.? assign transaction costs to actions in planning, assignment, and execution in organizational structures.? can transaction costs influence the social outcome of the system which is further influenced by the organizational context underwhich the collaboration takes place.? can lessons learnt in game theoretic computation inform collaborative entity settings.? role does learning and adaptively play inbuilding organizational.Strategic planning

is about making consciouschoices concerning the key drivers shaping yourorganization’s future. Collaborative Strategies forUniversity helps to improve performance by engaging students, professors, employees, planningstrategy, and aligning capacity to reach outstanding results in organizational impact, capabilities,Informatica Economic? vol. 14, no. 1/2010 25and relationships.In many industries, on behalf of both for-profitand not-for-profit organizations as AES, it raisestrategic questions and collaborate with you totest hypotheses, find answers, and make decisions to fulfill strategic vision. The practical approach emphasizes execution. It will work to develop the metrics and define the milestones toguide successful implementation of universityplan.The approach starts with effective diagnosisthrough data gathering, accurate analysis and targeted interviewing. It applies that assembledknowledge to collaborating with leadership teamto set a course for a desired future state and buildcommitment with key constituents. It is developed and documented a clear strategy that identifies the key needs to be addressed in order tomaximize the impact of your plan in the contextof your vision and mission – addressing the markets or constituents you will serve; the products,services and programs you will offer; the salesand distribution methods you will employ; thedifferentiators that will emphasize; and the capitalization that will require [23].This focused intent and attention to what mattersmost yields breakthrough success and significantly improves results. The strategic planning services help leaders take control of their organizations’ destiny and secure valuable competitiveadvantages. The success as a collaborator forstrategic planning is linked to long-term students(master, doctoral school) who consistentlyachieve and surpass their visions by devoting sufficient attention to defining desired results, thenaligning people and resources to shape the future.The collaborative governance help to define futures with strategies that develop exceptionalpeople and systems, help attain leadership potential, enhance quality of life in campus, and advance the value and impact of university.Privately-held businesses face the complex issueof succession planning, both for company management and ownership. Likewise, not-for-profitorganizations must address leadership successionto gain the full advantage of their strategic planning efforts. In both cases, leaders must tacklethe challenging issues associated with successionplanning and management. Decisions made andactions taken – or not taken – have long-term consequences for students, professors, employees,customers, suppliers, and the campus.The work with students and professors establishrealistic succession and transition goals. The assistance in navigating the transition process maximizes achievement of goals and minimizes thefinancial, operational, and emotional risks. Thecomprehensive succession management servicescan help:? Learn the principles of succession planningas they apply to your unique situation.? Establish a clear succession vision for ownership, management, and the organization.? Assess transition variables and optionsthrough a disciplined and informed process.? Develop a comprehensive strategy and objective criteria for success.? Find the win-win forms for purchase andvaluation.? Help create a comprehensive succession planthat separates ownership succession frommanagement succession, a key variable forensuring positive outcomes.? Manage the efforts of the many specialistsrequired to achieve a successful transition.? Take universities to the “next level” in structure and management.Early planning for succession strengthens universities operating in both the for-profit and not-forprofit sectors. Planning ahead of an immediatecrisis offers the greatest flexibility and expandsoptions. Smart planning and disciplined implementation make the difference between survival –or not. Jim Collins, author of Good to Great, reminds us that great leaders prepare for the timewhen they no longer will be at the helm [22].4 IT governance model in Bucharest Academyof Economic StudiesThe Bucharest Academy of Economic Studies isimplementing a new IT governance model. StageI of the implementation, with the overall direction by the Business and Administrative SystemsEnhancement (BASE) Steering Committee, is focused on addressing the administrative needs ofthe university [4].One of the key determinants of success of governance is the degree to which people understandthe model.IT governance will evolve over time basedon learning and experience and will extend thescope of governance beyond the administrativerealm. In the near term, we will apply aspects ofthe governance model more broadly; however,for Stage I our priority is to ensure the success ofadministrative governance.The IT Project Office plays a key role in the facilitation of governance through the stewardship ofthe methodology by which we identify, define,and deliver IT initiatives, and the provision of26 Informatica Economic? vol. 14, no. 1/2010portfolio management support to the various governance bodies [5].As part of the overall IT governance model, theIT Architecture and Standards Team is responsible for defining, designing and developing theoverall solution architecture for the university. This architecture defines the role that varioustechnical components such as Microsoft SQLServer, Enterprise Reporting, the Application Data Warehouse, and .Net applications play in meeting the information transaction and reportingneeds of the University. Although clearly not asapparent from an application perspective, it extends to the entire supporting infrastructure required to provide a secure and dependable computing environment.Partnering with units and faculties, the IT Architecture and Standards Team will work with thevarious delivery teams to apply existing, new andemerging technology to help support and improve business processes. They also will help toensure interoperability with existing informationsystems and technology. As part of the overallIT governance model, this team will providetechnical input and recommendations at the appropriate phases and gates as defined in the ITDefinition and Delivery Methodology.The mission of the Business Administrative Systems Enhancement (BASE) Governance Committee is to represent the interests of the variousstakeholders to ensure that administrativeprocesses and related IT solutions effectivelysupport, and are responsive to, the evolving needsof the Core Mission of the University as presented in figure 1 (adapted from [20]).Fig. 1. University Administrative scope (model) In support of this mission BASE has defined thefollowing principles:? Resources allocation should be based uponthe degree of alignment with institutionalpriorities.end) with increased collaboration across former silos.? Focus and resource allocation should be balanced on strategic, tactical, and operationalissues. ? We need to target, measure, and assess ourperformance against those priorities.? Our decision-making process needs to be focused on, and responsive to, the needs of ourcustomer groups, (students, researchers, faculty, staff, community) and compliance.? Solutions should be integrated (end-to? Our preference is to focus on and resolve rootcauses rather than symptoms.? Solutions must be delivered and maintainedin a sustainable, secure manner that supportsthe availability and capacity needs of theUniversity.? We want to assist our customer stakeholdersInformatica Economic? vol. 14, no. 1/2010 27in the transition from task-focused to valueadded knowledge work.? Focus should be on reducing the number ofsteps within processes (especially for higherfrequency processes).? We will adopt a continuous improvement approach towards governance.Management at all levels needs to support thegovernance model.The BASE Steering Committee defined a numberof risks to our administrative capabilities. Usingthe same method of risk assessment used for Enterprise Risk Management the BASE SteeringCommittee evaluated the priority of the variousrisks [3]. While all of the risks are of significantimportance to warrant attention, BASE identifiedseveral that should be given priority for attentionin the near term. The risks defined by BASE areas follows: research noncompliance, can’t support student needs, failure to support key business processes due to systems availability andsupport, poor data – quality/timeliness, action byexternal bodies, provincial auditor noncompliance, poor donor reporting, faculty lossdue to administrative frustration, staff loss due toadministrative frustration, research loss due toadministrative frustration, administrative inefficiencies, cost of systems duplication, system misuse and fraud, liability to support systemsgrowth, systems failure in event of disaster, inability to attract/retain IT staff, security breach andothers.5 Information System audit for risks management in Bucharest Academy of EconomicStudies (AES)Understanding and managing risk is an inherentpart of the business process. In order for youruniversity to survive and maintain a competitiveadvantage, it must take planned risks that will berewarded with profit and growth. By confrontingthe risks that await the university before they become a threat, it gain the clarity to formulate effective controls that will offset the danger thatthey pose. With compliance initiatives such asthe Sarbanes-Oxley Act (SOX), BASEL II, andISO, it has become imperative that a universitymodels its controls to ensure a transparent audittrail. Without an effective tool to help managerisk and controls, the compliance audit processbecomes an obstacle to your business [16].Risk management allows business owners to include risks in their business strategy. By conceiving of the risks related to business activities, theuniversity can focus on preventative rather thanreactive risk management. By looking at riskmanagement in terms of processes, a businesscan use known risks to its advantage, while offsetting the threat that they pose with specific controls. Risks no longer become threats, butplanned activities in the business process. Thisbrings the added benefit of maintaining a clearrepository of risks and controls and how they arerelated to the business process management alongthe dimensions of time and ownership. Coupledwith a reporting tool, the entity can achieve compliance with as little hassle as possible.Overall, regarding the conditions to elaborate,editing and archive the electronic documents,there must be following:? From the databases point of view, there mustbe possibility to backup and restore the documents anytime ;? Documents archives on WORM (Write OnceRead Many) supports, must be sign by persons who do such an archive, as the law455/2001 regarding electronic signaturesaid ;? There must be a security plan for informationsystems with technical and organizationalmeasures to assure the next minimal request:a) Confidentiality and integrity of communications;b) Confidentiality and nonrepudiation oftransactions;c) Confidentiality and data integrity;d) Restriction, detection and monitoring theaccess in the system;e) Restoring information managed by the system by natural cause or other events unknown, as follows:– archive the data using WORM technology, which allow to write one time andmulti access of the saved data;– recording the data from documents inreal time, from a system to another withthe same configurations placed in othersite.? There must assure to print all the documents,when there is a request.To identify risks factors it was realized an IT audit mission over information system if the Bucharest Academy of Economic Studies, where therisks were calculate with Mehari method – ClusifFr [12] and the results are in the table 2.28 Informatica Economic? vol. 14, no. 1/2010Table 2. Risks assessment at the university level in IT governance No.Risks factorsRisk assessmentRiskValueObservations1.Organizationlow1.04The low level of the risk is because the efficiency of the specifypersonnel responsibilities; maintain a contact with different organizations, other entities, to solve very quickly any problem.2.Siteslow0.5The access in the sites is realized at the person level and less byactivity. Also, there are small problems regarding the access inrestricted sites because of the inexistence of special lists of authorized personnel.In the university there is no monitories center even if in the internal security policy there is mentioned such a system to monitories24 h by 24. The System is partial integrated in some buildings,but not all.3.Premiseslow0.96In generally, the level risk is low because of existing controls(key, card, intrusion detection systems, guard)Problems were found on the power sector. There are no measuresfor losing data and information during technical problems at general level, just on local level.4.ExtendedNetwork (inter-sites)medium2.15University has equipment with license and there is a permanentcontact with suppliers for technical support.A very good protection is accorded to backup and recovery planswhere the access is restricted.5.Local AreaNetwork(LAN)medium2.34It was taking to account the initiation of procedures to grow thenetwork safety by implement firewall and filters.Frequent problems appear at equipment service with warranty,which is done superficial and very slowly, from one to six month.6.NetworkOperationslow1.07There are missing documents to report some data, there are notraining.Inexistence of some explicit rules regarding how to add new application tools do that employees not respect rules verbal communicate.7.Security ofSystems Architecturelow0.8There are superficial tests to demonstrate performance equipmentsecurity.8.IT Production Environmentmedium2.25There are missing trainings for risks analysis and procedures andalso rules regarding software installation.All documents are secures.9.ApplicationSecurityhigh3.15The access to the computer and to the applications is done by userand password, incorrect introducing of these induces temporaryinvalid state.10.Security ofApplicationProjects andDevelopmentsmedium2.77There are problems regarding not apply support, of the projectswhere security employees are not present.Management takes into account the application continuity deployment plans, with equal responsibilities between specialistsavoiding segregation of duties for one person.11.Work Environmentmedium2.08Physic: The problem regarding security, the method apply inpresent, guard-peoples in fixed places, is an inefficient one,which must change with an automat surveillance system withwaking guardians.There are no register to introduce data about visitors.Logic: The entity has a security policy and procedures regardingprotection against viruses’ attacks and takes into account the necessity to actualize the antivirus applications and system patch.12.Legal andRegulatoryhigh3.43The software has license; the control over this software is regulating done.Managers understand the importance of kipping a long time theapplications which use this software, but also the control of theseto avoid modifications done by employees not well intentioned. Informatica Economic? vol. 14, no. 1/2010 29Analyzing the partial risks, it results a generalrisk level of 1.93. The low level of the risk fromthe entire university is because the managementby implementing control measures to reduce theIT risks and/or elaborate some different measuresto minimize the impact of the threats and vulnerabilities of the system.Because the risks values were low as average,there is no necessary a general reorganization,but just in areas where the risk is higher than 1.93(considering being materiality level, if this wouldbe calculated just from risks), the general riskvalue of the university:4. Extended Network: the risk level is 2.15 and itis a medium risk5. Local Area Network (LAN): the risk is medium, as 2.348. IT Production Environment: the medium risk2.259. Application Security: the risk is 3.15 – highrisk10. Security of Application Projects and Developments: the risk is 2.77 medium11. Work Environment: the risk 2.08 medium12. Legal and Regulatory: the risk is high 3.43.The exact proposal to reorganized will be elaborate in the future stu