University ITSM

Audit is a core component of process improvement: audit tells an organization whether it's really doing what it says it's doing. Audit can also be "the stick" by which process improvement is justified. More than that, however, IT can learn what to improve most from the questions auditors ask.

The IT Process Institute and the Institute of Internal Auditors teamed up to write an article, Leveraging IT Controls to Improve IT Operating Peformance. This article suggests three controls that identify high performing IT organizations:

• A defined process to detect unauthorized access.
• Defined consequences for intentional, unauthorized changes.
• A defined process for managing known errors.

These three controls are similar to the questions in the Gallup organization's book, First Break All The Rules: they are "divisive questions," where high performers answer yes and low performers answer no.

The article lists nine additional controls that predict additional performance variation, and continues on for 81 pages.