Isaca CGEIT Online Access

Total cost of ownership (TCO) is the purchase price of an asset plus the costs of operation over its lifespan1. TCO includes hardware and software acquisition, management and support, communications, end-user expenses and the opportunity cost of downtime, training and other productivity losses2. By considering TCO in investment decisions, an enterprise can avoid unexpected costs and optimize the value of its IT assets3. A policy to consider TCO in investment decisions can help the enterprise to plan ahead for the lease or purchase of ITinfrastructure and software licenses, and avoid cost overruns due to lease extensions or other factors. References :=

CGEIT Review Manual (Digital Version), Chapter 4: Value Optimization, Section 4.2: IT Value Delivery, Subsection 4.2.3: IT Resource Management, Page 123

CGEIT Review Manual (Print Version), Chapter 4: Value Optimization, Section 4.2: IT Value Delivery, Subsection 4.2.3: IT Resource Management, Page 123

How to Calculate Total Cost of Ownership for Software - GetApp4

Total Cost of Ownership: How It’s Calculated With Example - Investopedia1

Regulatory requirements are the rules and standards that an organization must follow to comply with the laws and regulations that apply to its industry, sector, or jurisdiction. Regulatory requirements can affect how an organization manages its information assets, such as data, documents, records, and reports. Information assets are valuable and sensitive resources that need to be protected from unauthorized access, use, disclosure, modification, or destruction1. Regulatory requirements can specify how information assets should be classified, labeled, handled, stored, transmitted, retained, disposed, and audited23. Failing to comply with regulatory requirements can result in legal penalties, reputational damage, financial losses, or operational disruptions for the organization3. Therefore, regulatory requirements are the primary consideration when developing an information asset management program. The other options are not the primary consideration when developing an information asset management program, although they may be relevant or important factors. Operational requirements are the needs and expectations of the organization and its stakeholders for how information assets should support its business processes and objectives4. Industry best practice are the methods and techniques that have proven to be effective and efficient in managing information assets in a similar context or domain5. Cost benefit is the analysis of the advantages and disadvantages of investing in an information asset management program in terms of resources, time, and money6. These options are all secondary or subordinate to regulatory requirements, because they do not have the same legal or mandatory force. An organization can choose to adapt or modify its operational requirements, industry best practice, or cost benefit analysis based on its situation and preferences, but it cannot ignore or violate its regulatory requirements without consequences. References:

1:

5:

4:

2:

3:

6:

The best long-term solution to address the concern regarding loss of experienced staff is to implement knowledge management practices, because knowledge management is the process of creating, sharing, using, and managing the knowledge and information of an organization1. Knowledge management practices can help capture, document, and transfer the valuable knowledge and expertise of the experienced staff before they leave the organization, as well as facilitate the learning and development of the new or existing staff. Knowledge management practices can also enhance the organizational performance, innovation, and competitiveness by leveraging the intellectual capital and creating a culture of knowledge sharing2. According to a study by 3, the impact of knowledge management practices on employee retention is significant and positive in both IT and banking industries. Another study by 4 found that knowledge management practices can improve job satisfaction and employee retention by fostering a supportive work environment, providing growth opportunities, and rewarding knowledge contributions. Therefore, implementing knowledge management practices can help mitigate the risk of losing experienced staff and their knowledge in the long run.

The other options are not the best long-term solutions, because they are either short-term or partial solutions. Establishing a mentoring program for IT staff can help transfer some of the knowledge and skills of the experienced staff to the mentees, but it may not be sufficient or systematic enough to capture and preserve all the relevant knowledge. Determining key risk indicators (KRIs) can help monitor and measure the risk exposure of losing experienced staff, but it does not address the root cause or provide a solution for the problem. Retaining key staff as consultants can help retain some of the expertise and experience of the staff, but it may not be feasible or cost-effective in the long term, and it may also create dependency and vulnerability issues for the organization.

 An IT balanced scorecard (BSC) is a tool that helps align IT goals and performance with the business strategy and vision. The first step in designing an IT BSC is to analyze the business strategy and understand its objectives, priorities, and challenges. This will help identify the key stakeholders, customers, and value propositions of the IT function, as well as the critical success factors and risks that affect IT performance. Analyzing the business strategy will also help define the scope and purpose of the IT BSC, and establish the linkages between the IT goals and the business goals. Analyzing the business strategy should be done before developing key performance indicators (KPIs), communicating to stakeholders, or reviewing the IT resource plan, as these steps depend on the clarity and alignment of the business strategy.