IT Management

The monitoring, administration, and control of an organization’s IT assets are referred to as IT management. The primary goal of IT management is to make sure that IT assets are working properly and efficiently. IT management also aims to align the performance of IT assets in accordance with business requirements. The following topics are covered in this chapter:

• IT resource management (training, scheduling, and time-reporting terms and conditions of employment)
• IT service provider acquisition and management

IT performance monitoring and reporting

• Quality assurance and quality management in IT

In this chapter, CISA aspirants will learn about and come to understand the practical aspects of IT resource management, including managing third-party risks and various aspects of the performance-monitoring process and identifying opportunities for improvements.

IT Resource Management

One important part of IT governance is ensuring that IT resources are used to their full potential. The resources deployed should focus on attaining business objectives. An IS auditor should be familiar with the management of various resources required to supply IT services. IT service control can be further divided into the following domains:

Figure 4.1: Domains of IT control services

You will now explore each of the preceding IT resources in detail.

Human Resource Management

Human Resource (HR) management includes processes such as new employee onboarding, job allocation, performance evaluations, and other HR-related operations and procedures. Some of the most critical areas of HR management are listed in the following subsections.

Hiring

The hiring procedure includes the following:

• Conducting due diligence and background verification prior to onboarding employees
• Obtaining the employee’s acknowledgment...

IT Service Provider Acquisition and Management

Outsourcing services to a third-party vendor is a widely accepted practice in today’s world for two major reasons. One of them is the tremendous savings in cost and the other is to avail the service of experts in the field.

CISA aspirants should be aware of the following important terms with respect to outsourcing:

• Insourced: Activities performed by the organization’s own staff
• Outsourced: Activities performed by the vendor’s staff
• Hybrid: Activities performed jointly by staff from both the organization and the vendor
• Onsite: Staff working onsite in the IT department
• Offsite: Staff working from remote locations in the same geographical area
• Offshore: Staff working from remote locations in different geographical areas

Evaluation Criteria for Outsourcing

CISA aspirants should understand the evaluation criteria for the outsourcing of any function. The following functions should...

IT Performance Monitoring and Reporting

One of the important elements of IT governance is the monitoring of IT performance. The knowledge that IT operations are moving in the desired direction provides management with a level of comfort. It is extremely important to develop metrics for monitoring performance. The following sections explain these metrics.

Development of Performance Metrics

Developing performance metrics usually involves three steps:

Figure 4.3: Steps for developing performance metrics

1. Identify the critical processes: The first step is to identify the critical processes that need to be monitored.
2. Identify the expected output: The second step is to define the expected output or target for each process that needs to be monitored.
3. Compare the actual output with the target: On a periodic basis, compare the actual output with the target. If the target is not achieved, conduct a root cause analysis to determine areas of improvement...

Quality Assurance and Quality Management in IT

You will now explore quality assurance and quality management processes in IT in detail. According to the CISA Review Manual (CRM), an IS auditor must understand the concepts, processes, roles, and responsibilities of quality assurance and quality management within the company.

Quality Assurance

Quality Assurance (QA) is a process that aims to provide adequate confidence that an item or product conforms to the requirements developed. QA staff verify that changes to the system are approved, checked, and implemented in a controlled manner. Quality Control (QC) is a method for performing tests or reviews to verify that the product is free of defects and meets the user’s requirements.

Generally, QA personnel perform two distinct tasks:

• QA: This provides assurance that an object or product meets the requirements as laid down.
• QC: These are observation strategies or exercises that ensure that quality-related criteria...

Summary

In this chapter, you learned about various aspects of IT resource management, the different criteria and risks associated with outsourcing, IT monitoring, and reporting structures, and aspects of QA and quality management.

You learned about the following important topics in this chapter:

• The main goal of IT projects is to add value to business processes. The IS auditor’s primary consideration is to determine and ensure that IT initiatives are aligned with business objectives while designing and approving the project.
• An escrow agreement is entered into between a service provider and a client to ensure the permanent availability of the client’s source code. The source code is held by a third party. In the event of the vendor going out of business, the client can claim the source code back from the third party.
• In no circumstances can accountability be transferred to external parties. Regardless of the function outsourced, it is the ultimate responsibility...

Chapter Review Questions

Before you proceed to Chapter 5, Information Systems Acquisition and Development, it is recommended that you solve the practice questions from this chapter first. These chapter review questions have been carefully crafted to reinforce the knowledge you have gained throughout this chapter. By engaging with these questions, you will solidify your understanding of key topics, identify areas that require further study, and build your confidence before moving on to new concepts in the next chapter.

Note

A few of the questions may not be directly related to the topics in the chapter. They aim to test your general understanding of information systems concepts instead.

The following image shows an example of the practice questions interface.

Figure 4.4: CISA practice questions interface

To access the end-of-chapter questions from this chapter, follow these steps:

1. Open your web browser and go to https://packt.link/a8S6v...