Canheit 2012

1. Canheit 2012 IT Governance Principles and Practicals Graham Mowbray, Memorial University of Newfoundland

2. What we’ll cover …. • Who is MUN ? • A brief history of time (1969 onwards) • The dis-integrated university ….. • What is Governance • MUN’s Governance Structure • Turning Principles into practice

3. Memorial University of Newfoundland Harlow Labrador Institute Marine Institute Grenfell Campus Corner Brook St. John’s Campus

4. A brief history of time: 2012 Canheit Repatriate Hardware Repatriate People Marine Institute Joins MUN Grenfell Campus Opened Newfoundland & Labrador Computer Services

5. The “dis-integrated” university • Grenfell & the Marine Institute brought their own cultures (academic, administration & I.T.) • Governance at all levels was largely independent • No appetite to combine I.T. services except at the ERP level • Some integration around Banner Student and Finance • Everyone gets a paycheque • IT largely in charge of IT • Not just IT but St. John’s Campus (saw itself and was feared as) the main player

6. Disintegration … Grenfell People to operate Telephone Systems Campus Networks External Networks E-mail Web Service Desk Marine Institute People to operate Telephone Systems Campus Networks External Networks E-mail Web Service Desk St. John’s People to operate Banner ERP/HR Telephone Systems Campus Networks External Networks Research Networks E-mail & Web Service Desk Purchased Services & Support Purchased Telecommunications & Networking

7. Even within the St. John’s campus • The outsourced contract created “administrative” relationships. • NLCS/NIS/xwave – really only understood “business systems” • Budgets for services controlled by traditional units (RO, Finance and H.R.) • The academic world largely had to fend for themselves • Memorial was a card played in the privatization of NLCS

8. Where we could be Integrated multi-campus IT Infrastructure & Operations People to operate Banner ERP/HR Telephone Systems Campus Networks External Networks Research Networks E-mail & Web Cloud for Students Service Desk Purchased Services & Support Purchased Telecommunications & Networking

9. Why are we not there? Governance! Enter the Center for Information Systems Research MIT Sloane School of Management

11. What is IT Governance ?(Graham’s re-working of CISR definition) Making decisions and assigning accountability to optimize IT resources (people, processes and technology) to align with the strategy and culture of an organization. • Formal Decision making • Accountability • Strategic Alignment

12. What Decisions Need to be Made?(Domains) There are five major decisions domains • Principles • Infrastructure strategies • Applications Architecture • Business application needs • Investment and prioritization

13. Domains Principles Investment and Priority Memorial’s Needs Architecture Infrastructure

14. We need a structure VP Council All campuses represented Led by the Provost History is history! Change is coming – like it or not!

15. We need a structure VP Council Information Systems Advisory council Campus Needs Functional Units Campus Technology Committee Applications & Data Architecture Committee Core Infrastructure & Operations Portal Committee

16. We need some acronyms! VP Council Information Systems Advisory council ISAC Campus Needs Functional Units Campus Technology Committee Applications & Data Architecture Committee CTC ADAC Core Infrastructure & Operations Portal Committee CIOS PSC

17. Domains Influence Decision Principles ISAC Vice President’s Council Investment and Priority ISAC Vice President’s Council Memorial’s Needs Functional units, MUN’s Strategy CTC & ADAC ISAC Data & Applications Architecture ADAC IT and functional areas Infrastructure Industry, IT & Community CTC

18. The Priority MechanismRelating Effort, Complexity & Risk to Benefits

19. The Principles

20. Principles for new IT investments • Initiatives that have an enterprise-wide impact will be favoured over initiatives which simply benefit one campus or unit. • Memorial will invest for excellence in those applications and technologies s which differentiate us from our peers and support Memorial’s Strategic Plan. Administrative and Regulatory systems, although required for stable operation, will only be built and maintained to a level appropriate for good management and conformance with appropriate laws.

21. Principles for new IT investments • All new software projects will be evaluated on a business case (Return on Investment) and a non-IT owner will be responsible to deliver the benefits expected. A benefits audit will be conducted within 6 months of completion of each project. • All constituents (Faculty, Staff and Students) should enjoy the same levels of service at all campuses and all campuses will receive the same level of service from technology and applications.

22. Principles for new IT investments • Initiatives that extend the use of existing software or hardware will be given preference over the introduction of new technologies (all other considerations being equal). • Where possible, Memorial will develop a set of standards for technology, data, and applications. Initiatives that conform to these agreed standards will be given preference over projects which do not.

23. Principles for new IT investments • Applications which streamline processes, benefit the “end user” or are self service and reduce administrative overhead will be given preference. • Purchased, commercially available or supported “open source” applications will be preferred over in-house developed applications. Customization of purchased applications will be avoided wherever possible.

24. Governing Principles for operations • Where practical and beneficial to Memorial, common or core IT services will be provided by a centralized unit. • Operations cost/benefit will be justified on a regular basis and the ISAC may recommend cancelling certain operations when they no longer add sufficient value to Memorial.

25. Six IT Decisions your IT People Shouldn’t make! CISR – Weil and Ross again.

26. The Six! • How much should we spend on IT? • Which processes/functions should receive our IT dollars? • Which IT capabilities need to be Memorial-wide? • How good do our IT services need to be ? • What security and privacy risks will we accept? • Whom do we blame if an IT initiative fails? From CISR Sloan School of Management, MIT, Ross & Weill – October 2002

27. IT Governance, Principles and Practicals with thanks to CISR’s:Peter WeilJeanne Ross Lets leave discussion until after Terry’s part?

28. DemystifyingCOBIT: the UNB experience Terry Nikkel / Janice El-Bayoumi University of New Brunswick

29. UNB’s IT Framework

30. Practical implementation of COBIT for process improvement

31. COBIT process overview

32. 4 IT Goals 6 Objectives Example: AI6 manage change • Assessment, prioritization, authorization • 6 Value and Risk Drivers • 4 Practices

33. Getting started • Who should be involved • Decision drivers • Tools

34. Review • Benchmark Moving forward • Implement Plan • Set Improvement Target • Develop Plan

35. Lessons Learned

36. To start - find something to keep them busy Provide the framework to work within. Send them to COBIT training Find someone who has done it to give practical advice Tips for Newbies

37. Define the information architecture Manage IT human resources Manage change Install and accredit solutions and changes Ensure continuous services Monitor and evaluate IT performance Processes worked on in the last year