I’ll let you into a little secret: I don’t know everything about IT.
And here’s another one: In most of the areas where I do know something, I’m still far from expert.
The same goes for you I’m afraid. And indeed, for everyone else.
So no wonder that IT assurance is becoming increasingly popular. The pace of technology change and the scale of its impact are both still increasing, and in parallel the CIO role is morphing in several directions at once. In that environment even the best CIOs can’t be authoritative in everything ... at least not without some outside help.
Can a CIO who has shifted to a new industry sector really be an expert in the sector-specific regulations he now faces?
Can the Programme Manager promoted last month to IT Director really take an independent view of the full programme portfolio she inherited?
Can the Head of IM&T at a hospital cut through the supplier hype to discover what really constitutes best practice in mobile device management?
Unlikely. So it’s usually best to get some help. But what kind of assurance will work best for you? We recognise three types:
- Audit – A formal, fixed, checklist-based activity. Quantitative, with little room for manoeuvre, an audit is probably the best tool where compliance is the primary objective.
- Assessment – A middle-ground option, with some scope for tailoring, but usually delivered using a low-cost team and a prescribed methodology.
- Advisory – With little or no focus on box-ticking, an advisory engagement brings best practice into context, draw intelligently on the widest range of resources, and bringing a meaningful plan for improving your situation
It’s horses for courses. Buyers must be acutely aware of what they want to achieve with assurance, and be careful to pick a service which can be relied upon to yield the right result.
If you’re in the market for an audit, then look for a strong method clearly aligned to your compliance needs, and look for a team which has experience of pleasing clients by delivering with that method.
But if you’re looking for advisory support, consider the domain experience of the individuals you meet, their ability to frame your questions in a useful form, the relevance of their immediate observations, and their willingness to adapt to your needs.
If you’d like to discuss this or any related subject please feel free to get in touch.