IT GRC Forum

The congressionally appointed Financial Crisis Inquiry Commission released a 535-page report on Thursday blaming the meltdown in part on compliance breakdowns and deficiencies.

Is there really a difference between rules, standards and models, and does it matter to IT governance? From 28-30 September I attended the ISACA Information Security and Risk Management Conference in Las Vegas. I shared my ideas on integration of the IT governance, risk, security and compliance functions. More importantly for this article, I had the time to attend presentations from other experts in the field. This gave me a number of new insights; “good stuff” for future articles. One of the presentations was titled “Harmonization of Standards” by Todd Fitzgerald. Todd is a well known figure in ISACA circles and I attended his presentation with serious expectations. As in the past, I was not disappointed. During his presentation Todd made one remark that stuck with me. He basically said that there is a lot of discussion about the difference between rules, regulations, standards and models and that in his opinion the difference was academic and of no particular interest in real life. I have seen a similar attitude with tool vendors. It is not uncommon to read claims like “tool X describes CobiT, ITIL, ISO 27000, SOX, PCI, etc.” or something to that effect. Basically I think that treating rules, standards, and models as more of the same is wrong and here comes the reason why. But first, to Todd: if I misunderstood your comment - my apologies.

Each builder knows tools are not the goal they are just the means to an end. After talking to his customer the builder knows what the goal is. He looks over the situation, decides what the solution should be and if he needs screws he reaches into his toolkit and picks up a screwdriver, and if a nail does the trick… you guessed it, a hammer.

Given the public outrage over the mess the financial sector created and the need for governments around the world to spend public money to bail out the private sector there will be a price to pay. The world might be focused on cleaning the mess right now but the first trembles are already being felt. The politicians who are now asked for approval to spend these vast amounts of money have already started mentioning the words “terms and conditions”. Some institutions do not seem to see this natural disaster waiting to happen and are fuelling it by their (what are considered extravagant) expenditures and bonuses.