A model and an application for information technology governance, risk and compliance and implementation in a bank

Continuous developments in information and related technologies increase the importance of effective governance in IT (Information Technology) day by day. One of the important approaches developed is the GRC (Governance Risk and Compliance) approach, where governance, risk, and compliance are evaluated together instead of considering IT governance alone. Although GRC is an enterprise-wide model, IT GRC models are also developed as a subset, and it is aimed to manage IT processes more effectively & efficiently. IT governance includes the alignment of business strategies, and IT strategies, associating IT goals with corporate goals, determining IT goals in line with business goals, and continuous monitoring in order to ensure effective management and executive oversight. On the other hand, IT risk management includes developing response strategies against the positive/negative risks that the IT-based operating processes of the enterprises may encounter, observing the increasing or decreasing impacts of the risks, and continuous improvement processes according to their realization possibilities. Considering that IT risks include the risks arising from cyber threats for businesses working on information technologies, the importance of effective management, and surveillance of IT risks will be understood. IT compliance processes may increase in importance for businesses operating in sectors that require intense legislation, and if they are not managed effectively, they may be subject to heavy penalties by the legislator/regulatory boards against legislative incompatibilities. Internal audit and control activities, as well as external audits, and audits by the authority themselves, can become processes that can be easily carried out by the enterprise operating an effective GRC model. Within the scope of this thesis, it is aimed to create an IT GRC model to define which IT processes need to be evolved, and the maturity levels get higher. As this model can be used in all businesses, an exemplary application has been made especially in the banking sector, which is subject to strict regulations, and continuously audited. In the compliance dimension, it is aimed to complete the IT GRC process by including the most up-to-date legislation provisions, which are obligatory for Turkish banks to comply with in IT processes, into the model. In Turkey, BRSA (Banking Regulation and Supervision Authority) offers Cobit (Control Objectives for Information and Related Technologies) as a reference resource in applied regulation to use in information technology process management. ISACA's (Information Systems Audit and Control Association) latest best practice "Cobit 2019" serves a tailored governance model, but its design guide suggests a method that is not suitable for a collaborative approach. This thesis suggests a model for implementing the Cobit 2019 collaboratively by the enterprise's governing body. As a result of the proposed collaboratively quantitative research, based on Cobit 2019, targeting the entire IT governance team of the sample bank, the model, which includes the results of 10 design factors, and prioritized processes, was designed. For the first time in the academic field, a tailored GRC model has been created with the help of the Cobit 2019 design guide. IT risks and all 10-design factor inputs were collected by the sample bank's IT governing body. BRSA's IT-related legislations were renewed in 2021, and its latest edition is named "Bank IT Systems and Electronic Banking Services". This regulation implementation has become mandatory for sector. In order to find the legislative equivalents or relations of Cobit's 1202 practice, the relationship between BRSA's 214 legislation clauses was revealed by the latent semantic analysis methodology, and the data set created with a 1202 * 214 matrix, and transposition, reporting dashboards were created with the help of the Power BI v.2.87 application. Results show that the 5 most important (or that need to be addressed first) processes of the sample bank according to the determined model; • DSS 05, ("Deliver, Service and Support") "Managed Security Services" • DSS 04, "Managed Continuity" • APO 12, ("Align, Plan and Organize") "Managed Risk" • APO 13, "Managed Security" • EDM 03, ("Evaluate, Direct and Monitor") "Ensured Risk Optimization" When these processes are evaluated together, it is seen that the bank needs to have more mature processes basis on best practices, and taking into account legislative requirements in order to increase the level of maturity in its processes for security and continuity management. In addition to these 2 main processes, it has been concluded that IT risks need to be managed more mature at both governance and organizational levels. Best practices and legislative provisions in line with the proposal is modeled from the LSA (Latent Semantic Analysis) based data set, and made available to the bank. According to the processes determined according to the lowest importance level, the bank; operates mature processes in IT strategy and innovation management, budget and cost management, resource optimization, portfolio/program/project management, service level agreements management, and it has not been seen that it is compulsory to apply new practices. At this stage, it is recommended that the enterprise first make situational analyzes in order to increase the maturity levels of these processes, identify the areas open to improvement and carry out remedial studies to increase the maturity levels of these areas. While carrying out these studies, the process can be accelerated by using the Power BI dashboards created within the scope of the thesis. These processes' regulation gaps can be found, with the help of the application and then Cobit actions can be defined to align with best practice. As a result, with this model and application, it is easier for banks to comply with regulation and international best practices. With the created relatedness matrix, the businesses can both examine the points that it is subject to regulation in all domains whose priority order is determined within the scope of the model, and determine which practices/actions it should implement based on the regulation. This method, which can be used in the entire banking sector, will also benefit the academy for further studies on finding the relationship between regulation and good practices. Keywords: Cobit, IT GRC, LSA, IT Governance