Page 93 - CITP Review

6
The first key plan related to IT is the strategic plan. In the strategic plan, executive management should
provide general guidance for the primary roles and responsibilities of IT in the organization, including the
following:

1. Management should provide a vision or purpose statement regarding the overall role of IT for the
entity.
2. The strategic plan should provide general direction for future developments and changes
in IT.
3. The plan should include a formal mechanism for making sure IT meets strategic objectives and is
valued by some objective measure, for example, ROI of some kind.
4. Other long-term issues should be provided for in this plan.

To illustrate, consider Southwest airlines. A primary goal of Southwest is to have a high number
of turns at the airport gates to spread out the fixed cost of gate rentals across more flights
than its competition. Therefore, part of its IT strategy is to develop systems that can facilitate
7
faster turnarounds at the gate.

A second key plan would be a risk assessment including plans to mitigate the identified risks. Executive
management should do an IT risk assessment to effectively mitigate risks that can potentially adversely
affect the business, its operations, its ability to compete effectively, its ability to reach its strategic goals
and objectives, or to accomplish the business model.

Another key part of the strategic plan is for executive management to establish plans for an operational
budget and capital budget for the IT function. The IT function will naturally need financial (budget)
resources annually. In the case of the capital budget, the IT function will need funding for major IT
projects to keep the IT portfolio efficient and effective, and for IT projects to satisfy strategic direction.

A parallel consideration is the need for executive management to plan how it will assess the value of IT
as a portfolio, on individual projects, and as a strategic resource. The capital budget and strategic plan
should be aligned with valuation (ROI) to mitigate the risk of IT inefficiencies.

Although other aspects of plans may exist, one common planning document is the entity’s P&P. In this
document, executive management establishes a method and control mechanism to ensure that the
employees function consistently within areas, across employees, and over time (including turnover of
employees). Generally speaking, management is particularly interested in making sure business
processes are

 standardized,
 function as prescribed, and
 are adjusted formally as needed.

6
The IT strategy could be embedded in the strategic plan of the business or be a separate document; the latter
tends to happen in larger-sized companies.
7
This strategy explains why Southwest does not transfer luggage to other carriers.

© 2019 Association of International Certified Professional Accountants. All rights reserved. 3-9