I.T. Governance

In today’s environment, many compliance processes are driven or highly influenced by IT systems.  Such systems, whether QMS (Quality Management System), ERP (Enterprise Resource Planning) or other, are integral to initiating, recording, approving, and reporting crucial compliance information in accordance to internal and external mandates.  One particular regulation, the Sarbanes Oxley Act (SOX), mandates that an internal control framework over financial reporting is established and monitored.  IT systems are highly integrated into the various financial reporting processes targeted by this regulation.  In fact, the SEC’s Final Rule for the Commission Guidance Regarding Management’s Report on Internal Control over Financial Reporting, underscored the importance of the influence of IT controls and governance stating “while IT general controls alone ordinarily do not adequately address financial reporting risks, the proper and consistent operation of automated controls or IT functionality often depends upon effective IT general controls.  The identification of risks and controls within IT should not be a separate evaluation.  Instead, it should be an integral part of management’s top-down, risk-based approach to identifying risks and controls and in determining evidential matter necessary to support the (control) assessment.”

In response to these regulations, various organizations and bodies have released guidance such as ITGI’s IT Control Objectives for Sarbanes Oxley and Control Objectives for Information and related Technology (COBIT).  In addition, the IT Infrastructure Library (ITIL) provides a framework to allow organizations to meet corporate governance obligations, monitor and reduce IT spending, and manage assets more effectively. 

Web-based eQCM allows organizations to manage IT governance within the organization by managing two critical components; the monitoring and assessment of IT objectives, including the risks and controls established to ensure effective governance, and the capability to manage and monitor IT changes. With eQCM, the various framework’s such as COBIT can be modeled in the system and assessments run to determine the effectiveness of reaching the control objectives.  Issues and corrective actions can be effortlessly initiated and managed.  eQCM also allows IT managers to consistently follow best practices to initiate an IT change request, follow a risk-based approach to assess the change impacts, create action plans, obtain the appropriate approvals and sign-offs, and provide communication and collaboration throughout all stages of the change cycle.  With the Processes-In-Control dashboard, the managers can see the status of current processes, identify bottlenecks and review critical indicators in order to optimize process performance.