IT Governance

c IT GOVERNANCE : IT AUDIT ROLE ccccccccccccccc

Definisi IT Governance
c c  c  c 


 c c 

c
c 
  
 c c  c c 
 c c  c 
c c c 
 
c   c c 
 !c c 

c 


 c c 

c   c   c
c 
 c c 
c "

c c 
c c c 
c   !c #
c 
 c c 

c c c 
c 
c 
  c  c 
 c 
c 
c  c c c 
c 
  c c 
"
c 
c 
c c 


 c 
 
 c c 
c 
c !c $%c c c c 

c
c c %c 
 c 

%c c 

c c c 
c &
&
c c "&c c 
c 
 c
c
c"%c
 ccccc
cc'c 
c
c!c (

c  c %

c
!c c  )c 

 c ?
 c %c 
 c c 
c c c c  c c c 
"&c c 
c 
c c 
 c 
c 
c  !c *c c c c +

c  )c"c 

 c ?
 c%c  c 
"c c 
c c 
 c 
c c 
c 
c  c
c 

c   c" cc  c  c
 %!c #
c 
c ?
 c 
c  %c 
 
c 
c c c  c c 
c  c c"c
 %cc   !cc c 
c 
c

c  c  c 
c c 
!c ?  c 
c c "&c c #
&c #
c c ,"

c -
c !c ?


 c %c c c %c c c 
c 
 %c c 
c c c c c   c c 

c c 
"c 

"c c   c

cc

 c 
cc"c  !c c

ccc%cc

c
ccc 
% ccc cc   c
c
c
c 
 c c 
c 
c 

%c  %!c *  c c 

c % c c
c 

  c
c   c "

c  c
c  
c cc
%c  c!c (c c 

c c

c 
c 
c c c   c 

cc
cc
 
 cc
cc
c  c   c"c c c   c c 
 !c,
c


. c  /  c

c c 

c c

c %c c c 
"&c c 
c 
 ccc c å
 
 c c c % c c c 
 c 
 c

c"

cc

c
c0c c (c c % c 
c 
 
 c 
c 
c 
c 0c c c
 
 cccc0c 1c

 cc 

 c
c
c  cc 
"c c

cc

c%c
cc /!c ,

c
ccc
c 
c  c !c 1c 

c 
c c c 
c 
c    c c   c % c 

%c 
c   c c 
 c c c   c 

!c

*!c å
c c 

c 
c   c 
c  c "c 
c 
%c c 
c c c 
%c 2c
c 
c c c c   c

 c c
 %c
 c % c
 c

c 
c 
 c %c 
c 
 c c 
c c !c (
c %c c 
c
c 
c 

c c c 

c %c 
c 

%c 
 
c c c 

 c c 
 
 c 
cc!c

!c 
% c c 
c 
c   c c c c c 
c 
c c c    c c % c 

%c c    c 
c 
"c c c   3c c c 
%c
%c c
 cc!c c 
c 
 %c c

c 
 c c 
%c c c 
 cc
ccc

ccc

cc

"cc

!c 
c   c
c c
c c 
c c 
c 
 %!c $%
c -4

c 5
 c $-5  c $%
c 5
c 5
 c $55  c $%
c 6c 5
 c $65  c $%
c c 5
 c $5  c c $%
c 
%c 5
 c $5 c
"c %&c %c 
 c c c c 
 %c
cc

cc
c

% !cc c 

c 
c 
c c 
c 

% c c
 c

 c c
 
 c  c c c 
c c 

c 
!c-

c c c cc 

c%c 

 c   c c c
c 
%c
c
cc  !cc *c   c c 

c 
c 
c c  c c %&c c 

c c c   c c  c c c 
!c  c c 
c %c

c 
%c 

 c 
 c cc 
c   !c(
c  c c 
c %cc
%c
c ccc
 %!c

est Practise for IT Governance c c 

c 
c %c c c 

c c 

c 

c c $
c 

!c c 

c 
 c 
c

 c c
 
 c 
c 
c   c 
 %c 
c c c 
c 
c c 
"c 
c %c "c 
 c 
 %!c c 

c 
c 
c
c 
c 

 c 

 c 

 c 
  c c
& c
"c cc
 cc

c
c
c  c 
 %!c #
c 

c 

 c %c 
 %c c 
c ccc
%cc
c
c 
ccc
c  c

cc
"c
%c
!cc #
c c 

c 
c   c 
"c 
%c   c c "&c
c  c c  c c c
c "
 !c #
c 
 c 
c c 
 cc 
 c c
 c 
 c
c 
 c  c
 cc
%c   cc c

c
c!cc

c c %c 
c c 
 c c "!c #
 c c   c c 
c "&c
%c
 cc

c c
 % c%c%ccc % c
 c%&c
 %c
cc

!c c

å
 c   c c c % c  c c 

%c c 
 c

c  c c 

 c 
%
  c c 
c &!c  c

c c % c 
%c  
c  c c 

%c 
 c

c

 c
 
 c 
%  c 

 c 


 c 
%c 
%c 
c c  c c


c  c c % c 

  




 
   
 
   
  cc   !c (c  ccc 
c 
ccc c
c  
c  c c 
c c 
%c 

%c 
c c  c



 c
 
  c 
%  c 
 c 


 c 

%c c 
 c 
c 
ccc  c  c
 c  cc cc

cc
%cc  c  c
 %!c

åerangka IT Governance #&%cc%c%cc
cc

c ´c Control Objectives for Information and related Technology (CoIT)c 
c 
%c c 

c  
c ,c c 
c c 

c
c

c
c
"cc
 c%&cc
 c 
c   c c 
c 
c   c c 
  c
c"&c c 
ccc c c c
cc
c
c
c ´c %
ISOIIEC 27001 (ISO 27001) Series of Standardsc %c

c 
c
cc

ccc  cc

c c

%cc
c !c ´c %
IT Infrastructure Library (ITIL)c 
c 
%c  c 5
c c 

c $

c 5$ c c 
c 
c 6c ,"

c c (

c c 
c c 
c 
"c 
c  c 

c cc
c

c"

c
c
 c!c ´c %
IT aseline Protection Catalogs, or IT-Grundschutz Catalogsc &c cc 7c c%
cc

c*
c,c%cc
c c 
c 6

c 5
c c (
c c c 
%c 6(!c

#
c 

c 
c c 


 c c 

c 
c c 
%ccc!cc ´c %
Information Security Management Maturity Model (ISM3)c %c 
c
  c(,cc
!c ´c AS8015-2005c %c c 8 c c c 
c 
c  c c !c ´c ISOIIEC 38500:2008 Corporate Governance of Information Technologyc


c 
c 
c c 8() c /7 7c 

c 
c 
"c c c 

c c

!c (5c 9c -$c *)7 c 
c c c c 
c c   c c 
%c c 

%c 
&"c %c 

 c 
c c
c c
%c 
c 
c c c   c

!c(5-$c*)7 c%c
cc  cc
c  c
 c c c 
 %c &  cc 

%c c c c  !c

6 c
ccc

ccc%c 'c Strategic alignment c
 cc
 c%c  cc
c 3c 

  c 

%c c 
 c   c c  c c 

 c
 cc
c
 c
 %!c 'c Value deliveryc c %c 
c 
"c   c c
%c  c 
 c 
 c %&c c 

c c c ""c 
%c 
 c 

 c c 
c c c 
cc c!c 'c Risk managementc c 
%c 
c  c c 
"c 
 %c
 c
%cc"
 c
c c

c
 %c c
%c 
c 
 c 
% c   c 
c  c c c

c 
 %c c 
c c "&c "

c  c 
c c  !c 'c Resource managementc c %c 
c 
 c c  c c 

c c 
c  c 
c c c c  c c c c   c   c  c c !c   c c 
c 
c c

%cc !c 'c Performance measurementc c 
"c c
c 

 c c 
 c 


c 
 c 
c 
c  c 
"c 
c c 
c
 cc
 c  c
c 
cc 

"
%c 
c 
c c c c 
c "c c %!c

 




? 
R 

c %&cc 7c%c c 
c c % c
%ccc

cc /!c ?
Principles
c 
c 
 c c c 

c 
c 
 ccc
c  !c !c ?
Drchitecture
c 
c
c %c 
c c c 
c c
c  c

%c
%c  !c *!c ?
?nfrastructure

c

c" ccc
 cc
 c c
c c c cccc c
 %c

!c usiness Dpplication 7!c ?
†ailurec

IT AUDIT ROLE 8c
c
c
cc

% c
 cc

c c
%c   !c 8c %c   c c c c 

c



 c c c 
%c 
c "

c
c c 
c 
c cc

 c


 cc

!c (
c
 cc 
c
 cc 
c 
 c 
c 
c


 cc

cc c  !c*
c
  

 c   c c
 c 
c 
c 
c  c c 

c 

c ccc


cc
!cc *
cc

c
cccc
cc  c ccc
 c  c cc c


!c(cc% c 
 c c rc

" c
 c
 cc"
 cc c
%cc   ccc% !c c rc 
c c c  c c c  %c c 

c 
 ccc
c  !c c +c (c c c 

c  c c c c   c c c 

cc%c
!c c

8 
cc
c
cc

cc
cc c *
""c c(c
c c   c  c c"cc 
!c c *
c "c 
"c c 
c 
%c   c   c

 c c
 
 c
c c(!c c + c  c  c c 
 c   c 
 c c 
 c c c rc

c  c c %

c ccc(cccccccccccccccc ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc

INFORMATION SYSTEM STRATEGY

c c

Perencanaan Strategis *

c 
 c c c c (c 
%c 
c %c "c "c c 
 %c c c 
c 
c  cc c 

c 
c   !c #c 

c 
c 
 c c c &c c c c % c 
 %c
% c c %&c 

c 

c
 c c   
c 
c 

%c  c c "c 
 %!c ,"

c 


c  
c   c 
 c 
c 
c 

c

 
 c c 
c 
 c c 

c  c 
 c c 
%c 
c 
 c 
c 
c 
c c

cc

 c

c

!c *

c 
 ccc

c
c
c c
%c 
 %c c  
c c c c 
  c
c   c c   c c 
% c   c c 
c 

c c 
c 
c !c #c 
c 
c  c c c  
c c c % c "c c %c 
c   c c c  !c #c 
c   c c 

c 
c "c  c  c c 
 c   c c 

c c 
c %c "

c 
 c 

c c 

%c &
c 
c  cc" c ccc

c%c
 c c
c
!cc *
c 

c 
 c c %c 
c 
% c  
c c 
c  c 
c "c 

c 
c c 

%c c 
 ccccc
%
c  
c c!c
c 
 cc% c



c c 

%c  c  
c c 
c c c 
c  
ccc
c 
c  !c 8c (c % c 

c 
%c 
%c 
%c 
c 

c 
 c  c 
 c c 

c "

c c 
!c #c c  c "c c 

c 
%c 
c 
 c c c c 
 c 
c 

%c 
c   !c 8c (c % c 
 c c 
c
c

cc
c

c 
 !c8c(c% c 

%c c $5c c "

c c
c 
c c 
c
%c 
c   !c åc 

c c c 
c 
c   c 
 c %&c 
c  c %&c 
c c 
c c c
 c
c 
c  !c

åomite Pengendalian (¢teering
ommittee) ,"

c 
 %c
c 
"c c 
c 

c c 

cc
& c c(c

c !cå
c

cc c c c c 
c  c 
c c 
c c 
 c%&c


c(c
c
c cc"c
 %!cå
c c
c 
c 
&c c "

c
 c "

c c %c 
c
c  
cc


c(!cc  c cc "&c 
c
c
c cc !c 8cc
c% c

%c
" c
ccc


c(!c (
c c
c 
c &
&
c c 
c 
 c c 
cc&%c

c  !c

å
c
cc c
 c
c
&c
"ccc
 
c 
c (c c
c c 
c c 
c 
 c !c 6 c cc
cc
 c c ,
"c 
c "c "c c 

c c 


c (c c 
 c%&c

c
c
c"cc
 %!c c ,
"c c 

"c 

%c 
c 
 c c c c 
c c  cc
"c
%c
&c
 !c c ,

"c c 
& c 
c 
c c 
c c c c 
c ( c 

c  c 

"c c c 
 c
c 
& c
%c
"c(!c c ,
"c c 

"c 
c  c c
c c 
c (c 

 c 
 c   c c    c
c   c c 
c

 c c !c c ,
"c 
c 
c c  c 
c c %c & c 
 
c c
!c c ,
c 
 c
%c 
c
  c  !c 

  c
c 
 cc"&!c c ,
c 

c c 

 c c c c "

c 
c c
%c
 %!c c ,
c
c
&c
 c

c
c(!c ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: $cc"&c
cc
 cc
 %c c
c
 %ccc c"&cc
cc c
cc"&cccc
c 

!c (
c 
 %c % c 

 c
c c c 

"c c
"cc
c

ccc(c
c
 cc


c 
 c c 
c 

c c 
%c c "&c c c  c 
c c 
!c c 
 %c 
"c 
c c 
c
c c 

!c 8c (c 
c c 

 c 
c c 
c   cc !c

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: å
c 

c (c
c 
c  c "

c c 
c c 


c ( c c 


c 
c c c c c c
c

c 
 c c 
& c 
 
c (c 
 %!c å
c
c 
& c 
"c c 
c c c
c c 
c % c c !crcc c

c
c

c(c
c
cc 

 c
cc
 c
!c c

c

POLICIES AND PROCEDURESc c å
"c c 
c 

c 
c c %c c "

c c 

c c 
%c  
c   c 
c 
c c c 
c 


c  
c !c

POLICIES c

  c c 
"c %c 
c c c c 



 c

 c 
 %c 

c   c c 
c 
c c "

c
c c 
c 
c   !c ,"

c % c 
c c  c 
%c c 
c 
c c "&c c 
  c 

 c 

  c 

c c 

c 
"c 
c"ccc
%!c

c

,"

c % c 
c %%c c 
c c


 c %&c &c 

%c 
%c 
"c 

 c 

c 
"
 c 
%c c 
"c c c 
%c  !c (
c % c 
"cc"c
cc%c
cc 
 cc
c
c 
"c
c
ccc¢


c (5 !c c

(
c 
"c 
 %c c 
c   c
c 

% c


%c  c c 


c   c % c   
c 
c 
"c c  ccc
cc&cc
 cccccc  ccc
 !c c

(c 

c &c c 

c &


c 
c


c c   c c 
"c 
 c c 
"c !c ; c 

c   c c 
c 

 c 


c 
c
c  !c *
 %
 %c 
%c c
c 

c c 
%c %
c c
"c 
"c c
c 
 c c 

 c
c % c c 
c
c  c

!cc%c

ccc
"c c 
c 

c
"c c  
 c c 


c 
!c *

c c c c 
%c  c 
c c 
c c   
 cc  ccc
"cc
!c c

,"

c % c 


&c
c 
"c
c 
!c 
c



cc% c
cc

& ccc(cc % c 

 c 

!c å
"c 
c 
%c c 


 c 
"c 
 c 
%c c c c 
%c c c 
c  cc 
c
c cc
 
 cc

 c c  c c 
c 
!c å
"c c  c % c 
c 
c "c   c c 
 c c (!c  c

"

c % c c 
%c 
%c 
c c 
%c 
"c c c 
%c 
 c 
c c 
c   c c 
c "c   !c *
c c % c 

%c 
c % c c ccc
&c
c
c
!c(c

c
c c c c c 

%c "c  c  c 
"c c c c 
%c c c 
"c c c c c 
%c 
%c % c
 c 
c"c  !c c

(c c % c 
%c %&c 
"c 
c c c 
c

c c 
"c 
%c 
"!c åc (c % c c c 
"c 
 %c c (c c % c 
c 
"c
c c c 

 c 
%!c ; c "c 
"c c c 
%c 
c "c  c
"cc% c
 cccc
!c c

(c c "c % c 

c
"%c c 
"c  c

c%c
cc 
 c

c
c
" cc%cc 
"ccc

c
c
"c
 %!c

INFORMATION SECURITY POLICY c

(
%c 
"c 
c    
 c 
 c c


c c %

c 
c 
 c "

c c c 
 !c (
%c 
"c 
c c  c c 
c 
c %c %c 
c 
"c 
c  c 
c c 
c 
  c c   !c å
"c
c 

c %c c %c c c c 
c c c
c
%c  !cå
"c
c% c

cc c
cc !c