Topics in this domain
- IT Governance vs. IT Management
- Board and Senior Management Roles
- IT Steering Committee
- IT Strategy and Business Alignment
- Balanced Scorecard
- COBIT
- ITIL
- ISO 27001/27002
- COSO: ERM and Internal Control
- Policies, Standards, Procedures, Guidelines
- IT Organizational Structure and Key Roles
- Segregation of Duties in IT
- Enterprise Architecture (Zachman, TOGAF)
- Risk Management Process
- Qualitative vs. Quantitative Risk Assessment
- Risk Responses: Mitigate, Transfer, Avoid, Accept
- Risk Appetite and Residual Risk
- Maturity Models (CMMI)
- KPIs and KGIs
- Outsourcing: Benefits and Risks
- Vendor Selection, Contracts, SLAs, Right to Audit
- Cloud and Offshore Governance
- Portfolio and Resource Management
- HR: Hiring, Training, Termination
- Legal and Regulatory Compliance
- Quality Management
IT Strategy and Business Alignment
Why alignment matters
IT exists to help the business do what it’s trying to do. A beautifully run IT department building things the business doesn’t need is wasting money.
IT strategic planning makes sure IT is heading in the same direction as the business. When the exam asks what IT strategic planning is mainly for, the answer is alignment with the business strategy, not modernising technology or cutting costs for their own sake.
Think of a family planning a holiday. If the family wants a beach trip and the person booking things researches ski resorts, every booking could be perfect and the holiday would still be wrong. IT strategy has to start from where the business wants to go.
From business goals to IT projects
Every IT project should trace back up this chain to a business goal. If it can’t, someone should ask why it’s being funded.
Long-term and yearly plans
| Strategic IT plan | Operational IT plan | |
|---|---|---|
| Looks ahead | Three to five years | Usually one year |
| Contains | Direction, target architecture, sourcing approach, major initiatives, skills needed | Specific projects, budgets, staff, milestones, targets |
| Approved by | Senior management or the board | IT management, overseen by the steering committee |
| Updated | Regularly, and whenever business strategy changes | Every year; progress tracked during the year |
The yearly plan should follow from the long-term plan. If this year’s projects have nothing to do with the strategy, the strategy isn’t being implemented.
What goes into IT strategy
- business strategy and goals
- how well current IT is working
- technology trends and opportunities
- risks and regulations
- available resources and sourcing options (build, buy, outsource)
- enterprise architecture
How the auditor checks alignment
The auditor’s starting point is always the business strategy. Then:
- Review the IT strategic plan: is it written down, approved and current?
- Map major IT initiatives and spending to business goals. Spending that maps to nothing is a red flag.
- Check business involvement: sponsors, steering committee minutes, business cases.
- Compare the yearly plan and budget with the strategy.
- Check how progress and benefits are measured and reported.
Example. The business strategy is to grow through online sales. The IT strategy, written by IT alone, focuses on data centre consolidation and never mentions e-commerce. Meanwhile, the online shop is being built with marketing money, outside IT governance. The auditor reports weak alignment and recommends rewriting the IT strategy with business input, approved by senior management.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Main objective of IT strategic planning | Align IT with business objectives |
| First document to review when assessing IT strategy | The business strategy / business plan |
| Best evidence of alignment | IT initiatives and budgets traceable to business goals, with business involvement |
| Who approves the IT strategic plan? | Senior management or the board |
| The business strategy changed significantly | Review and update the IT strategy |
In short
- IT strategy should come from, and support, the business strategy. Alignment is the main goal of IT strategic planning.
- Strategic (long-term) IT plans cover three to five years; operational (short-term) plans turn them into this year's projects and budgets.
- Strategic plans are approved by senior management or the board and reviewed regularly, especially when business strategy changes.
- The auditor starts with the business strategy, then checks IT plans, projects and budgets trace back to it.
- Business involvement (sponsors, steering committee) is key evidence of alignment.
- A strategy that exists only in IT, or isn't reflected in budgets and projects, isn't working.
Exam traps
- The first document to review when assessing IT strategy is the BUSINESS strategy.
- An IT plan focused on technology refresh with no link to business goals shows poor alignment.
- This year's projects that don't follow from the strategic plan mean the strategy isn't being implemented.
- The CIO alone doesn't approve the IT strategy; senior management or the board does.
Slides
Click the slide and use the arrow keys. F toggles full screen.
From business goals to IT projects