ramin communications
Governance of Information and Communication Technology

Further Reading AS8015 Talks ICT Governance Forum About and Contact Us

No Duty of Care: The Governance of ICT

Marghanita da Cruz, Principal Consultant, Ramin Communications

ET GOVICT2008 - A Conference on the Ethical Governance of ICT and the Role of Professional Bodies
University House, Australian National University
1 - 2 May 2008

Outline

• April's News
• Straw Poll of Roles and Responsibilities
• Australian Standard for Corporate Governance of ICT
• Security
• Financial Legislation
• Regulation & Legislation of the Use of ICT
• Level of Online Fraud
• Ethics
• What could ICT Professional Ethics Offer

April's news

• ERG and the NSW Government are locked in a legal battle to recoup their losses. (April 18, 2008)
• BA and BAA in blame-game over new T5 IT error (8 April 2008)
• Immigration and Citizenship defended its biometrics project... report said it was behind schedule and without proper cost-benefit analysis. (April 15, 2008)
• E-waste pressure builds (April 14, 2008)
• Bosses' power to check email (April 14, 2008)
• MiFare RFID crack more extensive than previously thought - (April 15, 2008)
• Commonwealth Bank Core Banking Modernisation (28 April 2008)
• Risk and reward for CBA in systems upgrade (30 April 2008)

Straw Poll on ICT Roles and Responsiblities

• analysis and programming.
• Web conformance
• IT architect ...simplistic requests of "a desktop server costing a few thousand dollars" to run an enterprise class application.
• a small team of good programmers could make something that worked extremely well for very little money running open source software like apache, perl, python, postgresql..
• departments make their own decisions within a framework of technology and data standards
• Design Authority - Enterprise Architect, Business Process Architect, Business leaders, Risk, Compliance and Quality Managers
• internal auditors can provide independent and objective feedback that IT investments are being well-managed and that they are having a positive impact on the organization's operation.
• Some important choices depend upon informed judgement that is not easily accessible to people who have not acquired the requisite skills or knowledge....
• "Information Technology" is a large specialisation of "computing" concerned with the use of computers in administration. That specialisation doesn't include scientific computing, embedded computing, supercomputers, vision, etc.
• IT is about creating computers, Informatics is about using computers.

Australian Standard for Corporate Governance of ICT

ISO/IEC 38500 based on As8015 is due to be published at the end of May 2008

AS8015 Principles

1. Establish Responsibilities
2. Plan ICT
3. Acquire ICT validly
4. Ensure that ICT performs
5. Ensure ICT conforms
6. Ensure ICT respects human factors

AS8015 Model

• Evaluate against Pressure & Needs
• Direct Policies & Plans
• Monitor Conformance and Performance

Other Standards & Better Practice Guidelines

• OECD Security Principles
• Record Keeping (ISO 15489)
• Information Security (ISO27001)
• Service Management (ISO20000)
• Interchange of Client Information (AS 4590)
• Environmental Impact (ISO14000,Energy Ratings)
• PMBOK and Prince II

OECD Security of Information Systems and Networks Principles

• Awareness
• Responsibility
• Response
• Ethics
• Democracy
• Risk Assessment
• Security design and implementation
• Security Management
• Reassessment

Financial Legislation

• Goods and Services Tax Business Activity Statement (2000)
• Sarbanes Oxley (US - 2002)
• CLERP 9 Corporate Reporting & Disclosure (2004)
• Company Reports to be provided on websites (2007)
• Record Keeping
• Compulsory Superannuation

ICT Regulation and Legislation

• Commonwealth Criminal Code 1995 -Computer Offences
• Telecommunications 1997 (Interception 2006)
• Broadcasting Services 1992 (Amendments: Online Services 1999, Digital broadcasting & Datacasting 2000)
• Information Privacy 2000
• Copyright (Amendments in 2004 for US-Aus FTA)
• Do Not Call Register 2006
• SPAM 2003
• Disability Discrimination 1992 (Accessibility of Websites)
• Net Alert - content filtering

Privacy Act 1988 Personal Information Principles

• Manner and purpose of collection
• Solicitation from individual concerned and generally
• Storage and security
• Information relating to records kept by record-keeper
• Access to records
• Alteration of records
• Record-keeper to check accuracy etc before use
• Limits on Use and disclosure

Experience of Online Credit Card Fraud (aic.gov.au)

Internet Scams (fido.gov.au)

• Online auction & shopping scams
• Fake Domain name renewals
• Spam (junk mail) offers
• Modem jacking & Spyware
• Phishing & Card Skimming

Ethics pop up all over the place

• AS8015 Principle 1 - Establish Clearly Understood Responsibilities for ICT includes "ensure those given responsibilities are competent"
• As8015 Principle 2 - Ensure ICT conforms with formal rules includes "direct that all actions relating to ICT be ethical"
• OECD Security Principle 4 - Ethics - participants should respect the legitimate interests of others
• ASX Corporate Governance Principles (2007) Principle 6 "Promote Ethical and Responsible decision making"
• The Australian Public Service Values "the highest ethical standards";
• Australian Ethical Investment Charter Social and Environmental Effects of Investment
• Malaysian Islamic Capital Market - Shariah compliant securities and trading

What could ICT professional ethics offer

• Distinguish Advice from Sales Pitch
• Improve Project Risk and Uncertainty Analysis
• Improve Risk and Uncertainty Management
• Improve Utilisation of real ICT opportunities
• Improve collaboration
• More effective Regulation & Policies

References & Further Reading

1. Straw Poll of Roles and Responsibilities
2. AS8015-2005 - Australian Standard for Corporate Governance of Information and Communication Technology (ICT)
3. Survey of IT Governance Instruments, Standards, Guides, Regulations, Laws and Frameworks - ramin.com.au/itgovernance
4. Ethics, Mike Bowern, Information Age 14/02/2006
5. Achieving value from ICT: key management strategies (2005)
6. Building ethics into quality assurance Craig McDonald, Information Age (18/08/2005)
7. ICT Integrity: bringing the ACS code of ethics up to date, Michael Bowern, Oliver Burmeister, Don Gotterbarn, John Weckert
8. Striking a balance between Ethics and IT Governance Graeme Pye, Matthew Warren
9. AS8015-2005 - Australian Standard for Corporate Governance of Information and Communication Technology (ICT) - ramin.com.au/itgovernance/as8015.html
10. OECD Guidelines for the Security of Information Systems and Networks: Towards a Culture of Security - www.oecd.org
11. Types of fraud relating to other purchases - www.aic.gov.au
12. Do Not Call Register - www.donotcall.gov.au
13. Spam & e-Security - www.acma.gov.au
14. Protecting Australian Families Online - www.netalert.gov.au
15. Information Privacy Principles under the Privacy Act 1988 - www.privacy.gov.au
16. Digital switchover date confirmed (18 December 2007) - www.minister.dbcde.gov.au/
17. The whole-of-government IT outsourcing initiative - www.aph.gov.au
18. Unisys Australia Ltd v RACV Insurance Pty Ltd & Anor [2004] VSCA 81 (14 May 2004) - www.austlii.edu.au
19. Australian Customs - more flak than facts? (14/02/2006) - www.infoage.idg.com.au
20. Going cheap: One.Tel's last jewel (July 14, 2004) - www.smh.com.au
21. MoneyTree Venture Capital Profile for United States - PricewaterhouseCoopers/Venture Economics/NVCA - vx.thomsonib.com
22. ASIC reaches agreement with John Greaves in One.Tel proceedings (6 September 2004) - www.asic.gov.au
23. Former FAI officer sentenced (1 December 2006) - www.asic.gov.au
24. ASIC commences investigation into Ansett (14 September 2001) - www.asic.gov.au
25. Key superannuation information - www.ato.gov.au
26. Values in the APS
27. Corporate Law Economic Reform Program (CLERP 9) - www.asic.gov.au
28. Principles of Good Corporate Governance and Best Practice Recommendations - www.asx.com.au
29. www.acs.org.au/governance
30. Australian Ethical Charter - austethical.com.au
31. Malaysian Islamic Capital Market
32. "Understanding and Managing Risk Attitude", Hilson and Murray-Webster
33. Frameworks for IT Management
34. Professionalisation, Ethics And Integrity Systems: Summary Account

www.ramin.com.au/itgovernance/no-duty-of-care-governance-of-ict.shtml © Ramin Communications last updated 5 May 2008.