Page 170 - DCOM509_ADVANCED_AUDITING

Unit 9: Audit of Limited Companies

Notes
Technology) from the Gartner Group, SAB Ltd. used COBIT to develop an IT and enterprise
architecture strategy document. The SAB Ltd. approach fostered partnering opportunities
between IS audit and the IT community. The IS audit team implemented value-added
components to the reviews, which allowed a more rigorous interpretation of IT risk. Once
the business benefits of COBIT were communicated, senior business executives realised
the framework could help determine accountability for processes and improve IT
governance. By using the framework as the basis for an accountability matrix, SAB Ltd.
began achieving a role-based IT organisation with defined process measures to ensure
customer value.
Background

SAB Ltd. (South African Breweries Limited) is a division of SAB plc, which has more than
34,000 employees working for 70 breweries in 21 countries, as well as substantial hotel
and gaming interests in Southern Africa. SAB plc was first registered in London in 1895 as
SAB Limited. It was registered on the Johannesburg Stock Exchange in 1897 as the first
industrial share. Since then it has grown to manufacture and distribute beer and non-
alcoholic beverages in Europe, Asia and Africa.
SAB Ltd. generates 53 percent of the SAB plc operating profit and employs 6,500 full-time
and 500 part-time employees. More than 200 of these employees work in the information
systems field.

Process
SAB Ltd. first heard about Control Objectives for Information and related Technology
(COBIT) through the ISACA web site (www.isaca.org) and soon after used COBIT when
developing the SAB Ltd. IT/enterprise architecture strategy document. Gartner Group
research was used extensively in the development of this document. After thoroughly
researching COBIT’s methodology to improve IT governance at SAB Ltd., Stuart
MacGregor, then manager of SAB Ltd’s Information Resource Management (IRM) team,
was invited to Chicago, IL, USA to participate in ISACA’s development of the COBIT.
SAB Ltd. began its implementation by developing a COBIT questionnaire that assessed
the IT management team’s perception of IT process effectiveness, risk and the relative
priority for improvement. This approach increased the IT organisation’s readiness to
adopt COBIT as its primary IT governance tool.
SAB Ltd. then used several techniques to gain senior management support for adopting
COBIT. Presentations were given to groups including regional IT managers, the IT steering
committee and IT managers. Pre-presentation reading, such as the COBIT Executive
Summary, was distributed widely throughout the business and IT departments.

Although there was early resistance to the COBIT framework, the education campaign
fostered a critical mass and resulted in strong support from the IT management team,
which recognized that the COBIT framework could assist in assigning accountability for
processes and improving governance within the IT organisation. SAB Ltd. then used the
framework as the basis for an accountability matrix. The strategy was to move toward a
role-based IT organisation with defined process measures to ensure customer value.
Using COBIT as a resource, SAB Ltd. developed an IT and enterprise architecture strategy
document. This document served to further increase awareness of COBIT’s benefits among
SAB Ltd.’s IT and business communities. For each of the 34 COBIT processes, the
development team documented the SAB Ltd.:
 Target environment
Contd....

LOVELY PROFESSIONAL UNIVERSITY 165