IT Governance Case Study
Ernst & Young AG, Switzerland
ABSTRACT
Ernst & Young/Switzerland, has used COBIT (Control Objectives for Information and
related Technology), the open-standard IT governance framework for several years. The
firm recognizes COBIT as an international standardized process model that validates its
work, findings and recommendations. IT governance is a primary service offered by the
firm, and COBIT provides the framework for effective, forward-thinking IT governance
programs.
BACKGROUND
Ernst & Young is one of the "big four" international audit companies. In addition to audit
expertise, it provides advisory services for businesses in areas including tax, legal,
business risk management and information systems. A global leader in professional
services, Ernst & Young helps companies capture growth, improve financial performance
and manage risk—anywhere in the world. Worldwide revenues for Ernst & Young
increased nearly US $300 million to a record US $10.1 billion for the fiscal year ending
30 June 2002. This represented an annual growth rate of 2.7 percent in US dollars and 3.5
per cent in local currency.
There are approximately 2,300 Ernst & Young employees in Switzerland.
PROCESS
Nearly all of Ernst & Young/Switzerland IT advisory experts have obtained the CISA
(Certified Information Systems Auditor) designation. During the process of studying and
training for CISA, the firm's IT advisors learned about COBIT and how it has been
successfully implemented in diverse corporate and governmental organizations around
the world.
The firm's primary responsibility is to comply, and help its clients remain in compliance,
with existing laws and regulations (such as those covering privacy and banking). IT
governance is a primary service offered by the firm. The principles behind COBIT are
valued because they help focus management attention on the importance of high-level
oversight over IT. COBIT also provides Ernst & Young advisors with authoritative IT
control objectives accepted around the world.
Contracts with clients are negotiated with the client's senior management, such as the
CFO, department directors and internal audit. As an advisor, Ernst & Young analyzes
client needs, provides recommendations and is available with help and guidance for
clients during implementation phases.
Application areas
An IT audit can be performed independently or as part of a general financial audit of a
company. In both situations IT controls are evaluated according to accepted standards
such as COBIT or ISO 17799. A special focus is set on IT controls that have a material
impact on financial processes (controlling, establishment of financial statements, etc.)
Ernst & Young/Switzerland was able to apply successfully COBIT and other IT controlstandards in the following areas:
Banks
A larger insurance company
Specialized IT outsourcing providers for insurance companies
Companies in the pharmaceutical area including their worldwide subsidiaries
A well known Swiss watch manufacturing company
With the new legal requirements emerging in the US—specifically the Sarbanes-Oxley
Act—there will be an increasing need for formalized audits in all areas which could have
a material impact on the financial results of a company. In this context, COBIT as a
widely accepted standard will play an important part.
CONCLUSION
As the reliance on information technology and international connections further changes
the way business is accomplished, auditors and advisors must rely on a solid foundation
and structure.
COBIT continues to be successfully used by Ernst & Young in Switzerland because it
provides a standardized process model for the firm's advisory professionals. It relies on
COBIT's position as a highly regarded, globally accepted standard to support findings and
the corresponding investments recommended to clients. COBIT helps Ernst & Young's
advisors add significant value and continuous improvement for clients to help them better
manage and leverage their information technology.
Questions :
•
•
•
•
Please summarize the case
What’s generating all of the extra project requests?
What problems arise from over-commitment?
What’s your assessment of company’s IT Governance?
Sumber :
http://www.itgi.org/Template_ITGI.cfm?Section=ITGI&CONTENTID=9190&TEMPLA
TE=/ContentManagement/ContentDisplay.cfm