IT Operating Model for a Public Audit Institution

A service-based IT operating model for a national public audit institution

MADIS assessed how the institution’s IT organisation works today and recommended a governance model, organisational structure and resource plan fit for hybrid work.

At a glance

12

IT services mapped against a standard service portfolio

3

areas identified as candidates for outsourcing

1

composite KPI linking IT performance to audit work

Summary: The pandemic turned hybrid work into the new standard and put extra pressure on the institution’s IT organisation. MADIS reviewed the current IT operating model, roles and capacities, and proposed a service-based model built on ITIL, agile product ownership and project portfolio management – with an IT steering committee, a project office, internal service level agreements and a measurable IT performance indicator.

The client

The client is a national public audit institution. Its core task is audit work; IT supports this work, while more and more of the professional know-how behind audits is now built into the institution’s software systems.

The challenge

Solutions introduced quickly at the start of the pandemic proved to be permanent. Hybrid working changed priorities across the organisation and had a particularly strong impact on resource management and IT.

The institution wanted to know how its IT organisation should be structured, governed and resourced to meet these new expectations, and which IT services might be worth outsourcing in the future – all within a short assessment period.

• Unclear service boundaries: IT services, responsibilities and expected service levels were not formally defined between IT and the business areas.
• Capacity bottlenecks: key roles such as application owners could only spend a small share of their time on these duties.
• New risks: hybrid work raised the bar for availability and endpoint security.

Our approach

Because of the short deadline, we gathered most of the information in writing and complemented it with personal interviews. We reviewed the institution’s regulations, strategy documents, job descriptions and disaster recovery documentation.

Mapping the current operating model

We matched a widely accepted IT service portfolio to the institution’s current IT services – from server operation and managed workstations to help desk, licence and asset management – defining the typical responsibilities, tasks and metrics of each. We also mapped IT roles based on security regulations and job descriptions.

Designing the target model

We described a standard IT operating model based on ITIL service management, service-based operation with SLAs and OLAs, agile software development with clear product owner and business analyst roles, and project portfolio management.

Organisational and resource recommendations

We proposed a new IT organisational structure that the institution could initially create by regrouping existing staff, together with concrete resource optimisation measures and an approach to the challenges of hybrid work.

The solution

The final report set out a practical roadmap for the institution:

• IT steering committee: strategic IT decisions taken jointly by IT, finance and professional leaders, meeting quarterly or half-yearly, based on decision papers prepared by a new project office.
• Separated IT operations and application development, both reporting to the head of resource management, with a project management office (PMO) supporting decisions.
• Application owners as product owners, supported by a dedicated, redundant team of business analysts and system analysts, independent of software suppliers.
• Internal service level agreements between business areas and IT, built along a service hierarchy.
• A composite KPI that measures how well IT supports audit work, as a weighted average of the availability of the most critical services.
• Outsourcing to consider for server infrastructure operation, network and telecommunications, and business analysis capacity – with independent audits to safeguard the institution’s independence.
• Hybrid work: keep, but do not extend, the thin-client infrastructure as a redundant option, and strengthen availability and endpoint security.

Technologies: ITIL · ISO/IEC 20000 · Scrum / agile product ownership · Project portfolio management · SLA/OLA

Results

• A clear target model: one picture of how IT should be governed, organised and measured.
• Shared responsibility: IT and the professional areas take strategic IT decisions together and agree on service levels.
• A measurable link between IT and the core mission: a single KPI that shows how well IT supports audit work.
• A basis for future decisions: a reasoned list of services that could be outsourced, and how to do it safely.

Facing a similar challenge?

Rethinking how your IT organisation is governed and resourced? Talk to our IT consulting team.