Introduction
Can your company improve performance through digital transformation? The answer is almost always… yes! The real question is how?
Most companies today can achieve improvements via technology - however, in accepting this fact, more questions arise for CIO’s…these include...
- Where precisely in our company can technology improve performance for your company?
- How large or small will the technology improve performance? Is this measurable?
- Which platforms and technologies should we consider?
- What will it cost to implement (in full)?
- What are the steps required to achieve this, safely and reliably?
A Well Documented IT Audit Report
A well-structured and comprehensive audit report of your IT systems and infrastructure will uncover detailed answers to all the questions and help CIOs make recommendations to boards that are well-researched, plan out a range of suggestions and that balance the needs of all stakeholders in the company.
oOrjit has extensive experience researching and documenting IT Audit reports for companies large and small.
Let’s take a look at a few of the areas that oOrjit focus on that have proven successful for companies around the world.
Definition of Company Objectives
Each company has a particular set of objectives they would like explored or pursued. It is important that these are documented and form the basis for the report in the first place. This shows the company that oOrjit understands explicitly the reasons why your company is exploring the audit and what they are hoping to achieve from it.
Important to both. Most CIOs will not want the IT report to focus purely on the objectives set by the company, they also appreciate the research to potentially uncover further recommendations and critical reviews that are beyond the core objectives so that the company may consider such observations in their own time.
Some examples of common objectives set out by companies include: -
- Increase efficiency
- Reduce operational cost
- Produce better actionable intelligence
- Improve customer experience
- Expand addressable market reach
- Expand product or service offering
- Reduce technology systems
- Increase sales performance
- Empower salespeople
- Improve marketing performance
- Increase company profitability
- Reduce and mitigate risk
Common areas of focus that companies, like audited, include: -
- Customer Relationship Management (CRM) Capability
- Entity Relationship Management (ERP) Capability
- Data Interoperability and Integration
- Security & Performance
- Omni-Channel Inventory Management
- Supplier Management
- Sales Management
- Online Commerce & Payments
- Digital Marketing
- Business-to-Business Management
- Privacy and Legislative Compliance
These are just a few.
The Focus & Scope of Audit
While an IT audit report might research and document many or all aspects of a company's technology operations, it is good practice to focus the scope of the IT audit on a particular area.
The scope can be defined by objective, by business unit, or by budget. Either way, defining a clear scope for the report will ensure all parties understand what is ‘not’ included in the report or appreciate further why certain recommendations or observations were ‘restricted’ in the report.
Defining the Stakeholders
A definition of every stakeholder in the company is essential for a full and comprehensive audit of technology performance. This is particularly important because each stakeholder approaches the value of technology differently and often seeks a different outcome from iterating with it.
Equally important to mention is that stakeholders exist both within your company, across all business units and external to your company in the form of suppliers, customers, technology partners and many more.
The formation of this list at the beginning of the report serves to ensure the following:-
- The auditor will contact every important stakeholder nominated by the company;
- All recommendations will consider the viewpoint of each stakeholder;
- Recommendations can be explained from the perspective of each stakeholder and a balance of the needs of each stakeholder can be considered while formulating each recommendation.
The Market
In this area of the report, the company and auditor might like to document any relevant and important emerging trends or goals within the market the company operates.
Some areas that are generally considered are:
- Competitors
- Addressable Market
- New Market Opportunities
- Emerging Trends
- Leading Technologies in the Industry
This information can highlight risks or validate recommendations based on industry trends in the market.
The Assessment Criteria & Valuation Method
Over many years of working alongside the world's leading companies, oOrjit has drafted assessment criteria from which to assess the value of any current method in practice and to assess the value of adopting change.
It is not enough to report on areas that might need improvement. For companies to really formulate an assessment, they need a method from which to value a recommendation.
It is not possible for us to dive too deeply into this area in this article today, however, is a snapshot of some areas oOrjit consider when making recommendations to help companies accurately & consistently assess recommendations: -
- Return on Investment
- Time, Required Resources & Disruption to Business
- Level of Urgency/Importance/Priority
- Impact on People, Business, Stakeholders
- Change Management Process
- Certainty of Success
- The Human Element
- Risk & KPI Sensitivities
An IT Audit from oOrjit does not just make technology suggestions and observations but considers the broader impact, benefits, risks and returns to the business so that decision-makers can assess each recommendation in a consistent and measured way.
Company & Business Units Overview
Understanding how your company works is vital and documenting this is even more so. The process of documenting this gives confidence to company executives that we understand the structure of the business. It also allows the report to explore the opportunities to refine and improve performance per business unit - so decisions can be assessed by each business unit and by the entire company.
Important to note - technology is often at its most valuable when it empowers each internal business unit to interact with another in a seamless, effective manner. This is also true for how that business unit interacts with customers and external stakeholders.
Therefore a thorough understanding of the connections internal and external between business units is vital to produce a comprehensive IT Audit Report.
Business Unit - Current Processes
Now the report is getting very detailed. To produce these observations and recommendations, an IT auditor needs to interview staff, customers and anyone else that is involved with or impacted by each process the company undertakes.
The role of the IT auditor is to document the current workflow and process, often including the reason why such a workflow or process is applied.
The more detailed this area of the report, the greater the value and more accurate the technology recommendations become.
Recommendations of Report
Now that all the business units and processes have been documented, recommendations can begin.
An experienced IT Auditor does not place attention on technology only as the only solution to improve performance and does not need to change a practice that is already working effectively. Nor should an auditor easily discard existing technologies because more often than not it is the way people are using technology that can be the problem and part of the solution.
Instead, a qualified IT auditor will make recommendations based on the following criteria.
- Cost to business, cost of sale, level of human satisfaction
- Business goals - achieved and desired
- Existing technology capability and use, new technology options
- Interoperability & integration between business units and technologies
- Level of consistency and data integrity
- Safety and risk minimisation
- Access to opportunities and markets
- Alignment with business goals
- The overall effectiveness of the process
- Human factors such as training, skill, knowledge retention
And many other factors.
Technologies Evaluated
A quality IT audit will document the technologies within the business users, their capability and their use within the organisation. They will also document what aspects are enjoyed by users and those which are not.
Equally so, a range of industry-leading alternatives will be listed along with the rationale for considering them and where capabilities align with recommendations.
This area of the report is also very valuable as it allows readers to assess if an unbias opinion of the auditor has been qualified and also gives the reader an appreciation of how and why certain products are recommended.
Performance Measurables
This area of the report is crucial to company leadership. Measurement is the best validation method for any process and recommendation.
Outlining a set of measurables is the only way to validate performance improvements. Measurables do not always need to be financial, some of them include the: -
- Human impact - staff retention for instance, or training
- Customer satisfaction and retention
- Brand equity & protection
- Risk mitigation
However, undoubtedly it is the financial benefits that speak the loudest, some of these include: -
- Cost of goods (COGS)
- Cost to Acquire Customers (CAC)
- Sales, Revenue & Profitability
- Customer Growth & Marketshare
- Operational Efficiency
- Level of Intelligence
- Operational & Administrative Expenses
And more.
In some cases, exact financial forecasts can not be supplied by the IT Auditor. This is a task that CFO, CIO or company directors will undertake. The role of the IT Auditor is to outline the impact on the measurable in such a way that company leadership can calculate the impact and value in their own way and make a critical assessment.
Change Management - Staging Your Transformation - A Safe & Reliable Roadmap
No change worth doing is achieved overnight. So planning and staging the execution of each recommendation in parallel with resources available, sustainability and the goals of the company is paramount.
This process is carried out often as phase 2 of an IT Audit and in some cases does not involve the auditor at all as the recommendations are outside their responsibility of skillset/
However, it is prudent and good practice for the IT auditor to offer advice on how to stage the preparation and execution of each recommendation and outline the resources required to complete it.
Risk Mitigation & Management
Outlining risks and uncertainties is the cornerstone of experienced IT auditing. No one can predict the future exactly, all one can do, is outline a level of certainty that considers all risks that may impact a successful outcome.
Often, it is by understanding the risks in advance, that set companies up for success, as they are able to mitigate, control and avoid certain factors occurring.
A thorough analysis of risks across all aspects of the company is a vital component of an IT Audit report.
Cost Summary & Return on Investment
In the end, digital transformation is about improving efficiency & reach for greater returns.
A well-documented IT Audit will provide a company with all the necessary intel to formulate a cost to the business and return from the investment.
This assessment will calibrate risk and allow a company to apply which recommendations, some, all or none fit their risk profile and meet their desired goals.
Executive Summary - Remove the guesswork, let us do the research!
To summarise, the value of an IT report before making any change to technology in a business cannot be overstated. Such a report will empower CIOs and CTOs to make informed recommendations in line with their vision, which considers all the thoughts and ideas that they have for their company and also include additional ideas and recommendations they may not have thought of but value.
The observations of this report can be used for both technical and non-technical change within a company and oOrjit has vast experience in this area and will help your company reach its full potential. Contact oOrjit and arrange an IT Audit of your business today.
