IT Governance, Jakarta 11-13 Oktober 2010

PENDAHULUAN

IT Governance memberikan panduan untuk memastikan terjadinya IT-Business Alignment,pengelolaan risiko TI secara memadai, efisiensi penggunaan sumberdaya TI dan memungkinnya kinerja TI selalu dimonitor. Implementasi IT Governance adalah satu key success factor paling krusial implementasi TI, selain ketepatan pilihan Arsitektur TI

ISO 38500:2008 merupakan satu-satunya standar IT Governance untuk perusahaan/ organisasi. ISO 38500 menetapkan prinsip-prinsip dasar Corporate IT Governance dan panduan bagaimana pimpinan dan manajer senior perusahaan/organisasi mengimplementasikan prinsip-prinsip tersebut dalam pengelolaan TI.

Framework-framework best practices yang terkait dengan IT Governance dan sebelumnya banya digunakan adalah COBIT, ITIL, ISO 27000, CMMI. Framework-framework ini akan sangat membantu implementasi ISO 38500, sebagai referensi best practices untuk IT Processes.

METODA:

Untuk mendorong Learning Experience, peserta akan berpartisipasi aktif dalam kuesioner awal, tutorial pengantar, pembahasan hasil kuesioner dan pembahasan studi kasus.

POKOK BAHASAN:

§  6 Prinsip Dasar World Class Corporate IT Governance

§  Model Corporate IT Governance: Monitor, Evaluate, Direct & IT Processes

§  Framework IT Governance: implementasi 6 prinsip utama dalam menjalankan fungsi governance (Monitor, Evaluate, Direct)

§  Konstruksi IT Processes untuk ICT Projects: Tinjauan Best Practices berdasarkan COBIT, CMMI dan ITIL

§  Konstruksi IT Processes untuk ICT Operations: Tinjauan Best Practices berdasarkan COBIT, ITIL, dan ISO 27000

§  Studi kasus permasalahan-permasalahan dalam ICT Project dan ICT Operations

TARGET PESERTA:

Training ini ditujukan untuk Manajemen Business Manager, CIO, IT Manager, IT Architect & Planning,IT Development yang memiliki dasar dalam  perencanaan dan desain sistem TI.

TUJUAN:

Diharapkan peserta dapat memahami lebih jelas mengenai IT Governance dan mengimplementasikan IT Governance di instansi mereka.

For futher Information, Please Contact :

Yudiati, Mutia dan Retno

Telp. 021 2554 2717 ext. 151  atau 021 57958105

In BPM, “B” Stands for “Business”

“Who should lead a business performance management project: IT, finance or both?” Robert Mitchell of Computerworld asked this question in a recent article, entitled “Who Should Lead BPM?” In the piece, Mitchell asks several IT and finance tech company pros how they’d define ownership of BPM – is it a business practice or an IT practice?

This is an argument that we’ve seen debated for ages and our answer has always been the same: business owns BPM, not IT. While IT’s role is to facilitate the creation and maintenance of a company’s software and hardware infrastructure, BPM stands for business process management, and it’s the business users who create, manage, benefit from or suffer from the way these processes work.

In Mitchell’s piece, a financial planning and analysis director says flat out that business/finance should lead BPM efforts, while a senior VP at a systems integrator feels that IT should take care of initial setup and then let the business side handle all aspects of BPM from then on. Ironically, however, the CIO of the aforementioned financial group thinks BPM projects should be “jointly led, because neither finance nor IT will get it right on its own.”

While it may seem endearing to accuse both IT and finance of not being perfect, from the vantage point of IT workers having to get a BPM system up and running and then answering questions about potential technical snafus all-day every day is a nightmare. Some people say that IT relishes having control over all technological elements of a group’s operations, but as someone who worked in the trenches of IT for many years, I can tell you this is far from the truth. What IT wants is to have the freedom to focus on things that actually interest them – programming, design, communication and planning. IT won’t get a chance to directly use the data and insights that result from an automated business process – why should they be tasked with managing it?

To this same point, forcing business users to take a backseat and rely on IT’s schedule and priorities is both patronizing and wildly inefficient. BPM has advanced to a point at which it yields nearly real-time, actionable insights that can be used to improve customer relationships, flag and correct cost overruns and process bottlenecks and make entire departments and companies run more smoothly. There simply isn’t any reason for IT to swoop in and save timid business users from their own jobs or for business and IT to have to work together on something that’s totally one-sided.

If we really want IT and business to get along, let’s start by giving each their own responsibilities and control over what affects them.

From: http://www.ebizq.net/blogs/pp/2010/08/in-bpm-b-stands-for-business.php?asrc=EM_NLN_12331906&uid=10096357

In BPM, “B” Stands for “Business”

“Who should lead a business performance management project: IT, finance or both?” Robert Mitchell of Computerworld asked this question in a recent article, entitled “Who Should Lead BPM?” In the piece, Mitchell asks several IT and finance tech company pros how they’d define ownership of BPM – is it a business practice or an IT practice?

This is an argument that we’ve seen debated for ages and our answer has always been the same: business owns BPM, not IT. While IT’s role is to facilitate the creation and maintenance of a company’s software and hardware infrastructure, BPM stands for business process management, and it’s the business users who create, manage, benefit from or suffer from the way these processes work.

In Mitchell’s piece, a financial planning and analysis director says flat out that business/finance should lead BPM efforts, while a senior VP at a systems integrator feels that IT should take care of initial setup and then let the business side handle all aspects of BPM from then on. Ironically, however, the CIO of the aforementioned financial group thinks BPM projects should be “jointly led, because neither finance nor IT will get it right on its own.”

While it may seem endearing to accuse both IT and finance of not being perfect, from the vantage point of IT workers having to get a BPM system up and running and then answering questions about potential technical snafus all-day every day is a nightmare. Some people say that IT relishes having control over all technological elements of a group’s operations, but as someone who worked in the trenches of IT for many years, I can tell you this is far from the truth. What IT wants is to have the freedom to focus on things that actually interest them – programming, design, communication and planning. IT won’t get a chance to directly use the data and insights that result from an automated business process – why should they be tasked with managing it?

To this same point, forcing business users to take a backseat and rely on IT’s schedule and priorities is both patronizing and wildly inefficient. BPM has advanced to a point at which it yields nearly real-time, actionable insights that can be used to improve customer relationships, flag and correct cost overruns and process bottlenecks and make entire departments and companies run more smoothly. There simply isn’t any reason for IT to swoop in and save timid business users from their own jobs or for business and IT to have to work together on something that’s totally one-sided.

If we really want IT and business to get along, let’s start by giving each their own responsibilities and control over what affects them.

From:

BPM vs Workflow (What’s the Difference?)

While sharing similar concepts, Business Process Management and Workflow Automation Software are very different in terms of their offerings and capabilities.

BPM: characterizes a series of activities independent from specific applications.

• BPM is a superset of workflow
• It is distinguished by its ability to coordinate activities and tasks among users
• BPM connects disparate systems enabling seamless data sharing and universal control from a single interface
• Business processes, once defined, are modeled, automated, managed and optimized to be effective, cost efficient and achieve high operational performance
• It is used to capture, evaluate and analyze information from outside sources efficiently and effectively
• With the ability to distinguish between execution rules and the actual flow of the process, BPM rules allow you to govern your processes

Workflow: facilitates simple routing of tasks or activities from person to person.

• Workflow Automation Software uses application-specific sequencing of tasks established with predefined rules, including either automated or manual activities
• The ability to integrate between workflow-specific systems and other external systems is often limited, only allowing document and data retrieval
• Workflow Software is very basic in its ability to analyze and report on content analysis
• The process flow is fixed, meaning cannot adapt to or provide for multiple possible paths to the same goal.

What’s in Common?… …

The need to automate core processes to eliminate bottlenecks, cut out redundancies, and achieve operational efficiency. When automating a business process, it is crucial to test your process in a virtual environment to ensure that the activities and tasks you are automating are as efficient as possible and free of bottlenecks. This where a Business Process Management Suite can enhance your workflow automation initiatives as it gives you the ability to investigate and test your processes for inefficiencies. Unfortunately, this is not possible with a simple workflow automation tool. Consider a case in which you use a workflow automation tool, which is geared specifically to automate and manage business processes. If you do not test or even model your automated business process in a virtual environment, all of the work you do to get to the process automation stage is at serious risk. You will automate a potentially inefficient, untested, and unproven process. The end result of this type of approach is that the bottlenecks in your business processes will be much more of a problem than they were before. In a Business Process Management Suite (BPMS), you not only have the ability to automate and manage your business processes, but you also can leverage two other vital concepts: modeling and optimization. Modeling allows you to test your process in a virtual environment first (before the automation stage). By mapping out your process, you will be able to determine bottlenecks, inefficiencies, and high resource usage situations in your process. It is a best practice to understand all of the risks associated with the project. In terms of Process Improvement, this is where modeling makes the most sense. By utilizing the modeling capabilities of a BPMS, you will have the ability to measure process effectiveness and identify potential process bottlenecks BEFORE investing deeply in making the automated process “live.” Identifying and resolving these situations in your process first during the modeling stage, and then proceeding with process automation, ensures all the work you have performed to get your process to the automation stage will contribute to your success.

diambil dari: http://www.bpmvsworkflow.com/bpm-vs-workflow.html

ISO issuec technical specification ISO/TS 22002-1:2009, Prerequisite programmes on food safety

ISO technical specification ISO/TS 22002-1:2009, Prerequisite programmes on food safety, www.iso.org, 4 Feb 2010

Thousands of food manufacturers worldwide stand to benefit from a newly published document in the ISO 22000 series designed to prevent and control food safety hazards.

ISO technical specification ISO/TS 22002-1:2009, Prerequisite programmes on food safety – Part 1: Food manufacturing, sets out requirements for prerequisite programmes needed to realize safe products and provide food that is safe for human consumption. It is intended to be used in conjunction with, and to support, ISO 22000:2005 which gives requirements for a food safety management system.

The new technical specification has a huge potential impact since at least 8 206 organizations in 112 countries were independently certified to ISO 22000:2005 at the end of 2008. (This is an increase on the figure announced in The ISO Survey of Certifications – 2008 as fresh information has allowed the total for France to be updated from 18 to 122.)

ISO/TS 22002-1 specifies requirements for establishing, implementing and maintaining prerequisite programmes designed to help food manufacturers be able to control:

• The likelihood of introducing food safety hazards to the product through the work environment
• Biological, chemical and physical contamination of the product, including cross contamination between products
• Food safety hazard levels in the product and product processing environment.

Jacob Faergemand, Chair of the subcommittee which is responsible for the ISO 22000 series, comments: “As the introduction of food safety hazards can occur at the manufacturing stage of the food supply chain, a hygienic environment is essential. That is why this ISO technical specification is very useful to reduce the likelihood that products will be exposed to hazards, that they will be contaminated, and that hazards will proliferate.”

The new technical specification applies to all organizations involved in the manufacturing step of the food chain, regardless of size or complexity. It is not a requirement of ISO 22000 and may be used in parts or in its entirety, depending on the nature of food manufacturing operations.

“ISO 220002-1 is the first technical specification in a series planned for relevant food sector PRP. It is expected that other parts of the food chain will over time ask for specific PRP based on the same model. This proves that ISO has now established the structure to help and facilitate the future needs for the worldwide food industry,” further notes Jacob Faergemand.

ISO 17021-2: what will it mean

IRCA Newsletter, July 10, Roger Bennett gives an up-to-date insight into the controversial auditor competency standard



ISO/IEC 17021 took seven years to develop and brought together text from ISO Guide 62 (quality management systems), ISO Guide 66 (environmental management systems) and their associated International Accreditation Forum guidance documents. When it was published it brought together all the requirements for third-party certification for the first time. However, the standard was not restricted to quality and environmental management systems and has been widely used as the basis for third-party certification for other schemes.

The impact of its publication was profound and it introduced principles upon which requirements were built. It required certification bodies to refocus on the competence of their auditors and certification staff and the impartiality of their operations. Two years were allowed for transition to the standard; a period needed by both certification bodies and the bodies that accredited them.

A new work item for part 2 of ISO/IEC 17021 was proposed in June 2006. It sought to complement ISO/IEC 17021 with requirements based on guidance in ISO 19011 and to provide a framework for the development of specific criteria for sector applications. In spite of reservations from several countries, the project was given the go ahead and work started immediately.

Work was conducted in two streams working in parallel: one on processes and the other on competence. As the new text was effectively an extension of that already in ISO/IEC 17021, it was realized early on that it would be easier for users if the standard contained the full part 1 text in addition to any new requirements and that it would be preferable to publish the standard as a new combined document.

After two committee drafts, a draft international standard (DIS) was published for comment and voted to proceed to final draft standard (FDIS) in September 2009. This ballot succeeded and ISO/WG 21 completed the review of more than 400 comments to enable the FDIS to be published at their postponed meeting at the end of June 2010.

Structure and significant changes

The existing structure of ISO/IEC 17021 has been retained and the principles remain unchanged. Changes include the removal of all references to ISO 19011 and the incorporation of essential text. There are several new definitions, but the one that matters is ‘ ‘competence’. This is now defined as: ‘Ability to apply knowledge and skills to achieve intended results’.

Reference to ‘personal attributes’ has been removed as has the need to demonstrate the knowledge and skills which have been included in the process section. Sections 4, 5 and 6 are unchanged. Section 7 (resource requirements) has been expanded to include a section on the need for a certification body to determine and document competence criteria for its auditors and certification staff, and then to have a process for evaluating its personnel against those criteria. It is otherwise unchanged, as is section 8.

Section 9 (process requirements) has been developed to include requirements for a number of areas including the determination of audit objectives and scope, the audit plan, audit team selection, opening and closing meetings, audit findings, communication with the client and the audit report. The use of observers and guides is clarified as is the use of opportunities for improvement. The rest of section 9 (clause 9.2 onwards) and the whole of section 10 are unchanged.

There are, however, a number of new annexes. There is a one page normative annex and several informative annexes. Annex A (normative) simply lists the knowledge and skills required of key certification body personnel (application reviewers, report reviewers, auditors, lead auditors) and indicates a level of achievement (see figure 1).

For example, a lead auditor would be expected to have very good knowledge of a client’s business and technology and an audit report reviewer a little less and the application reviewer less again. The absolute requirements are not specified as these will vary according to standard or scheme and will be left to scheme owners or certification bodies to define.

Figure 1 – Simplified extract from annex A

Knowledge and skills

The informative annexes provide some guidance on possible competence evaluation methods, an example of how to determine competence, the personal behaviours expected of people involved in certification and additional areas that a certification body may need to consider when constructing an audit plan.

From DIS to FDIS

The DIS included complex informative annexes on examples of competence evaluation and determination. These gave many respondents difficulty and may not have translated well into other languages. With the simplification of annex A and incorporation of an indication of different levels, it was possible to remove these annexes.

Compared with the gestation of ISO/IEC 17021, this project has progressed quickly. If all goes well, the FDIS should be published in late 2010 and published as ISO/IEC 17021 in the spring of 2011.

Next Page »