Question

GreenTea Investment Ltd (GIL) is an investment bank. In 2015, GIL decided to purchase software for asset management from specialized vendors. This software allowed fund managers to run analytics on portfolios and run detailed simulations of market trends. GIL finally appointed a software house to customize and install the analytics system. The software house sent a team of ten system analysts to complete this project. The software house also trained two computer operators from GIL who would be responsible for minor issues and basic maintenance of the system. The software house would deal with any big problems. The development team took six months to complete the system and to integrate it into GIL’s existing accounting information systems. The two GIL computer operators took two weeks to test the new system to ensure compatibility.

GIL was very satisfied with the performance of the analytics system. After using the system for 18 months, GIL decided to upgrade the system. This time, GIL decided to use new raw market data feedto run simulations. This required significant changes to the source code of the analytics system. The two computer operators were able to implement the changes in the analytics system within a month. To speed up the process, the updating of system documentation was postponed to six months after using the new data feed. The two computer operators were deployed back to their original roles afterwards.

GIL is now thinking of not renewing the maintenance contract with the software house. Instead, it believes that the two computer operators will be able to perform system maintenance work at a lesser cost.

Required:

(a) Discuss the major internal control problems in GIL’s system development approach.

(b) With reference to the COBIT 5 Process Reference Model, suggest an appropriate control activity for each of the control problems that you have identified in (a).

Answer 1

a) System development like any other new methodology of business process management which is adopted by an organisation needs planning, monitoring and control. GIL essentially just seems to have decided to implement system development without much thought, planning and involvement. The company should have had an internal planning meet involving the team of fund managers that would be using the software and preferably their inhouse technology experts to chart out exact requirements of the company and all the main features to be integrated into the software. A team comprising two fund managers and two technical experts should have been put in charge of the process and been made rsponsible and accountable for the entire implementation. As banks also hold sensitive data the companies providing access to an external organisation without having in place internal team to coordinate with, monitor and control them is a massive management error.The checking and testing should have been an ongoing process. Lack of planning, monitoring and control led to an upgrade being required within 18 months a very short time span. GIL still externalised the entire process even further instead of internalising it. Postponement of documentation for six months, use of raw data and finally thinking of not renewing maintenance contract with the software house again show the company top level lacking management skills. After externalising the process to such a level not holding the software house accountable by not renewing their contract would be a huge error which could be costly and even lead to the software becoming redundant. The computer operators should have been made technical incharge from the beginning so as to be aware of every part of the development and how to improve or edit or maintain the software instead of juggling them.

b) As per Cobit 5 first step would be planning effectively control measure would be to draw up a requirement plan internally and have a management team coordinate with the software designer to ensure all requirements are met.

Design and building would require similar control measure with intermediate steps being tested on a regular basis to ensure faster changes and implementation.

Operating or implementing should be internally monitored and controlled to minimise risks of shut downs due to malfunctioning and initial checks should be thoroughly tested on sample systems before overall implementation. A specialised technical team should be appointed to ensure smooth fuctioning of the system and which can consecutively handle upgrades. Preferably this team should be handling the process from day 1 and be accountable for the utility, functioning and optimal design of the software internally.

Service and support should initially be handled by the software company but gradually shifted to the internal team this decision is to be taken at the initial stages so the team is well trained and capable. They should be specialised for this task. Besides service support they should be able to monitor the efficient working of the system and identify glitches before they become major breakdowns while upgrading the softwareon a regular basis. Assesment of the processes should be coordinated with the fund managers and other users to perfectly chart out improvements and additions.

Internally controlling all processes will ensure no lead time lost, safety and security of data, accountability within the organisation and constant monitoring and control of the utility, efficacy and performance of the system.