Datasec - IT Security & Control

SURINVEST S.A. BANK Print
Successful Implementation Project for Best IT Governance Practices based on the COBIT Framework


Situation

The Superintendency of Financial Intermediaries of the Uruguayan Central Bank (BCU), exercising the powers and faculties granted by statute and law, established some minimum management standards as a prerequisite to achieve financial qualification. The Bank regulated technology issues, among other issues, based on international best practices. These practices refer to security, quality, reliability, efficiency and effectiveness of the information systems taking into account measurement methodologies and the management of technological risks. In order to comply with these practices, financial institutions must establish a structure of processes and relationships to direct and control the Information Technology in order to achieve goals and add value to the business while balancing risks against the IT's return of investment and its processes.

Solution

ISACA/ITGI's COBIT Framework was selected to implement the IT's Internal Control and Governance. To do so Surinvest Bank began in 2004 to document and implement COBIT's 3.0 processes setting as a target level a "Defined Process" as per the Maturity Model, all according to a strict implementation schedule. The implementation progressed with remarkable consistency with periodic reporting of results to the IT Committee chaired by the company's CEO. Throughout 2006 the project made progress in two regards: a) A target level 4 of the Maturity Model (Managed and Measurable) was set with the purpose of improving the quality of the processes and to motivate the non-IT personnel to adhere to these new internal policies that ultimately improved their own performance. b) Some processes were adjusted to COBIT 4.0 and later on to COBIT 4.1.

Benefits

A framework for IT Governance was successfully established, contributing to achieve IT objectives in line with business goals, adding value to the business, managing risks and resources and performing adequate measurements.

Conclusion

The implementation of the COBIT processes became a driving force at a corporate level (IT Committee) that encouraged the discussion of technology issues, achieving remarkable progress regarding the necessary professional integration between technology and business. The institution matured and acquired a culture of continuous improvement that will in turn result in many future successful corporate achievements.
Summary:

Country: Uruguay

Contact: Mr. Arturo Anichini

Industry: Financial Services

Customer Profile: Financial institution in the banking industry that provides a wide scope of banking services.

Situation: The organization needed to comply with the Uruguayan Central Bank (BCU) requirements for an effective management of the Information Technology.

Solution: The usage of the COBIT framework to implement the best IT Governance Practices.

Benefits: Comprehensively integrated the business and the technology through mature IT processes that contributed to the achievement of the company's objectives.