Prevent rogue IT orders

[EeboBebo]

How does everyone prevent departments ordering IT hardware, software and cloud software/services without IT’s knowledge? In our trust there is a real problem with this happening and things get purchased without ITs knowledge, delivered to site or contracts signed and then IT are the last to know and by that time it’s too late.

 

Faculties are allowed to procure themselves without going through the finance team which could have acted as a safety net as the finance team could be trained to spot IT orders and intercept them.

 

Thanks

[Ditto]

Definitely got this T-shirt! Mostly not too much wastage but when a teacher bought cursive fonts for Windows, when I said we are a 'google' school, there was a rabbit in headlights moment. I think to really crack this issue you've got to get the head, business manager/bursar and other finance colleagues onside build it in to the school process and repeat the message every year if not term. Yet when departments have delegated budgets, it's hard. However, if they don't follow process, you've got to be willing to not support, but then you need the head to back you up.

[FN-GM]

There is a policy dictating this can’t happen. Anyone who breaks the policy will be disciplined.

[EeboBebo]

There is a policy dictating this can’t happen. Anyone who breaks the policy will be disciplined.

 

Is this as part of another policy or a policy in its own right? Would you be willing to share? Hopefully I wouldn’t need to re-invent the wheel and stamp this out quickly.

[3s-gtech]

I experienced this many years back with a (very well known at the time) product that offered PDFs protected with third-party software that had to be installed. I wasn’t asked beforehand, it was bought, and I was dumped on.

 

I tried to get it to work, but something there simply didn’t want to work with the way I had the PCs set up (I think it needed much slacker permissions for staff, and it needed Adobe Acrobat which was full of holes back then). I asked the developer, who shrugged and said that too many schools had stolen the PDFs. Fair.

 

It got laid up and unused, the staff member installed it at home instead with our permission.

 

It’s been policy since (written into our AUP).

[Andrew_C]

This REALLY is a "carrot & stick" situation. Apart from the "thou shalt not" policy, you need a flexible, prompt, can do, attitude to requests. If you appear to be "blockers", you will be treated as such, whatever your motives.

[FN-GM]

Is this as part of another policy or a policy in its own right? Would you be willing to share? Hopefully I wouldn’t need to re-invent the wheel and stamp this out quickly.

 

It’s part of a particular IT procurement policy and procedure document. I am not in education anymore so I can’t share that one. I am now in the commercial setting and can’t disclose it. Sorry.

[howartp]

I'm surprised a trust doesn't have a mandatory ordering procedure, regardless of the specific problem at hand?

 

In our single-school academy, all our purchases have to be raised through our (web frontend) finance ordering system, that the finance team then import into the PC-based software and raise the POs, process the invoices, manage the budgets etc.

 

The process in itself doesn't stop your original problem, and our finance team wouldn't spot/stop IT purchases unless they were over the approval limit (£5k), but it surely helps engender an expectation and adherence to procedure including "thou shalt speak to IT/Premises/H&S for IT/Premises/H&S related products...".

 

We have good respect here and, with one or two exceptions, colleagues are pretty good at mentioning a purchase to me before they go ahead. I say mention rather than ask because they haven't all cottoned on to needing us to cast our eyes over it before giving approval, but at least they come to us so we can interject where necessary.

[psydii]

Don't give departments enough budget to spend on big-ticket IT items?

 

Also, did they complete a DPIA? No? well they need to... this gives then pause for thought. (our NM does the DPIAs* so they are forced into the loop whether the purchaser wants them there or not)

 

 

*supervised by the DPO.

[Fazza]

We prevent rogue IT orders by asking the Finance not to process any orders for IT equipment without going through us first.

[msi_school]

We prevent rogue IT orders by asking the Finance not to process any orders for IT equipment without going through us first.

 

I have worked at a couple of schools with this process but the finance departments really found it difficult to spot a shadow IT order. You have to persuade the Head

and SBM that the problem is not that you will not install/support the service that was purchased with out your input but you might not be able to do so. I always tell a horror story about an expensive piece of Mac software that was purchased for a PC network and could not be returned. but it is very easy to be seen as "blocking"

 

In the end it is a management problem not a technical one.

[Ex-MGSTech]

Get your finance team onboard not to process orders for IT kit or software. we have a SWOF for (Software Order Form) that staff complete. all heads of dept and teaching staff are told they are not authorised to sign the school up to anything without authorisation (or they may be personally liable for the bill)

SLT that try this by paying on their credit card and asking for refunds have been surprised when finance said sorry no PO no payment!

Your Finance Team are the key to stopping this....

[Sonic007]

Anything IT related needs signing off by me the NM before being ordered. No signature, no order placed.

[KK20]

We dont. But I dont sign the invoices when they inevitably get sent to me from accounts. Then they get hauled over the coals. The downside is that I do get all sorts of invoices that look vaguely IT related heading my way (USB pen drives or digital voice recorders etc) but they arent too bad to send back to the proper person.

[psydii]

Don't give departments enough budget to spend on big-ticket IT items?

 

Also, did they complete a DPIA? No? well they need to... this gives then pause for thought. (our NM does the DPIAs* so they are forced into the loop whether the purchaser wants them there or not)

 

 

*supervised by the DPO.

 

Today our NM had to retrospectively do a DPIA because "teachers will be teachers", and I had to seek permission to purchase some A4 folders on an order for which I already have an authorised PO from the finance system.

 

So make of that what you will.

[SamanthaD]

Our purchasing system requires a product type code when you place your order. All AV items come to my team for technical approval before it goes any further on the authorisation route, so we can bat off the crazy requests easily (we're using Agresso to raise all our PO's etc). Doesn't stop people buying things on credit cards though.

[dmj]

For those 'fighting' this sort of thing - it's known in the tech industry as "Shadow IT"

There's a list of arguments that you may want to use on Wikipedia (and all over the internet)

 

https://en.wikipedia.org/wiki/Shadow_IT