Avoiding leaks in IT governance

Earl Perkins, research vice president, Gartner

The infrastructure and services used to deliver governance, risk and compliance management (GRCM) are much like electricity or plumbing: you only really notice their absence when they don't work. In a further plumbing analogy, if the 'pipes and pumps' of identity and access management (IAM) stop working entirely or substantially, key inputs and integration points to GRCM fail, and things can get really exciting.

Business leaders are not plumbers, nor should we expect them to be. IT departments should provide not only good plumbing, but the practices to keep it good and to avoid excitement. To do this, they need to better understand the relationship between GRCM and IAM.

IAM complements GRCM by providing an infrastructure and systems to keep business processes and behaviours within specific risk-tolerance ranges. Specific elements of IAM workflow - user provisioning, role life-cycle management, auditing and analytics - contribute to those processes and behaviours. Indeed, a significant part of IAM intelligence is involved in direct support of IT governance, risk or compliance management.

The maturing of IAM has not been fast or easy but, as managers address IAM in a top-down manner as part of governance efforts, this is changing. Businesses can exploit IAM's role in GRCM by recognising the key deliverables from IAM and the work required to produce them. These can be summarised as the 'seven Ps':

Principles: The core vision and mission of the business

Policies: These formalise the key rules, guidelines and directions that the business must take to realise that mission

Practices: These codify the behaviours of the business in delivering policy

Processes: Policies and behaviours as a formal set of actions across the whole of the business, including IT

People: The optimum organisational structure for them

Products: Only after the areas above have been addressed can technologies be chosen to aid their delivery and support

Production: The business can then move into an operational phase that has lifecycle input to each of them