IT Governance Audit

[CyberNerd]

The Audit team at County Hall are going to complete an IT Governance Audit at the college in the next couple of weeks. I'm sure they will want know about some of the procedures we have in place, backups, password polices etc.

 

Anyone had a governance audit? what else should I expect (other than being outsourced?)

[Soulfish]

An IT Governance audit? Is this something that I've got to look forward to as well?

[CyberNerd]

Perhaps,I was told that they have not done any IT auditing before and are trialing their system here before rolling it out to other schools.

 

I'm not really worried/bothered about it and am quite happy to tell auditors of our shortcomings.

The basics, such as backups, recordkeeping are ok but some of data handling policies are a bit sketchy.

SLT get paid a fair bit of cash to come up with policies, and it's not in my contract to come up with whole school policies. Although if they offer me an additional £20k I would be happy to write them.

 

TBH - all they need to do is 'adopt' the Becta tech specification and FITS as a requirement for IT operations at a governor/policy level. I would think that would cover most things an audit would ever ask for. Plus it would pretty much guarantee an ICT mark - but even that seems to difficult to understand...

[GrumbleDook]

Data Handling Policy - point them at your SIRO ... and you do have one of course ... who has spoken with all the Information Asset Owners ...

 

The other policies ... it might be worth you jotting down those that affect you, but might be in your remit to write. These can be raised as 'jobs to be done' and the nominated mug^Wperson will be allocated in due course.

 

Other things to note will be things like inventory (including disposal policies), budget planning mechanisms (using your inventory to plan for sustainability/refresh/etc), change management (and the communication / consultation that it implies) ... oh ... you mentioned FITS already. Damn!

 

BTW, remember that the Tech Specs are not a shopping list but a framework of baseline and top-up layers ... and have to be considered along side the functional spec. You should have reasons why you have certain kit and what it is expected to deliver after all.

 

HTH