Case Context
In recent years, governments have become increasingly concerned about the security of patients’ records in health systems. The Auditor General’s Office in Victoria (VAGO) has been monitoring problematic governance surrounding IT and Information security in hospitals and related agencies. A recent VAGO audit published in 2019 partially identified the scope this problem. See: Security of Patients’ Hospital Data. Preview the document

VAGO only investigated a sample of health agencies. It is reasonable, however, to assume that the level of practice observed in the test agencies also applies more generally in the state.

Revitalising ICT governance
While the state government has observed that the Auditor General has secured undertakings from the relevant chief executive officers to fix the short comings detected, the government has concluded that more needs to be done. For more than a decade, ICT projects and their governance have proven to be a headache in public administration. To date, the efforts of the VAGO, while producing useful limited short term reforms, still struggle to produce lasting productive outcomes. The State’s Cabinet has therefore agreed that a more extensive approach to ICT governance is necessary. Cabinet has decided to adopt a new IT governance framework across. This initiative is going to commence with a pilot encompassing the state’s health agencies. If that initiative proves to be successful, the framework will be extended to more government agencies.

Assume that you are part of the ICT team that services the relevant government agency in this jurisdiction. The relevant Director General wants the project to trial the implementation of COBIT 2019. This IT governance framework has existed for many years. It has a particular emphasis on audit and control. COBIT 2019, the recently revised edition, was published at the end of 2018. Further assume that the state of Victoria has so far not adopted any ISO IT related standard nor has it systematically adopted any other generally accepted IT governance framework.

COBIT 20919 is an extensive governance framework. For the purpose of this assignment we are interested only in the adoption of relevant enabling processes. Moreover, we want a management report rather than an overly detailed technical report.

Assessment Task
Assume that you’ve been assigned to design a change management project that seeks to strengthen governance practices involved with IT systems security, information security and business continuity. The context obviously involves the management of patient data. These reforms are to be guided by use of the COBIT 2019 governance framework.

The Auditor General’s report offers real factual material about contemporary governance IS performance. The proposal to initiate COBIT 2019 is, however, fictitious. It is an educational device chosen to have you explore a framework that might help reduce current weakness in governance activities. Furthermore, the case offers you an opportunity to design a relevant change management process.

For this exercise, you should assume that the Agency relies heavily on outsourced IT services. These centre on use of SaaS and Cloud Computing.

What you have to create
This individual assessment requires you to design a customised governance framework and related change management intervention. It calls on you to use COBIT 2019 to address typical shortfalls in the governance of ICT systems. The initial brief centres on the execution of a pilot project about patient data in health services agencies.

Your design answer needs to consist of two submissions.

The first is an eight-minute video that summarises the rationale and major steps proposed in your plan. The plan is to be submitted to Department’s ICT Committee. Your video can be supported by 10 to 12 PowerPoint slides. The video and related slides will be worth 10% of total marks in INTE2412.

The second submission will be a 2,500-word business report that describes in more detail the design of your governance system that will enhance the management of such data. Next, you will offer the logic and evidence that supports your anticipated change intervention. The word limit excludes footnotes, references and any relevant appendices. This report will be worth 30% of total marks. The proposed intervention needs to be based on an appropriate change management model.