Governança da tecnologia da informação: uma análise das práticas de avaliação, direção e monitoramento utilizando o cobit®5 na Universidade Federal Rural do Semi-Árido

Abstract

Nowadays, Information Technology is considered as a strategic and value creation tool in the organizational scope. It also aims to increase competitiveness, transparency, efficiency and effectiveness between public or private organizations. Knowing this, these organizations need to understand how to plan and manage Information Technology efficiently, aiming to measure and add business-related value, considering the decision-making process related to Information Technology. To this end, IT Governance should be used as a management tool to provide direction and support for the process to achieve the organization's strategic objectives. The objective of this study was to evaluate IT Governance, using its own method, which was possible to verify the perception of the processes capacity and to identify the related problems. The application of the method was performed at the Federal Rural University of Semiarid (UFERSA) and the processes selected for evaluation were those of strategic level indicated in COBIT 5, which are part of the Evaluate, Direct and Monitor (EDM) domain. The data collection was made from questionnaires that included all the IT servers of the Information and Communication Technology Superintendence (SUTIC). After collecting the data, they were submitted to the focus group composed only by the directors and the Information Technology sector superintendent for validation and creation of an action plan. Of the items analyzed, opportunities for improvement were found in the domains that deal with ensuring the definition and maintenance of the governance model, and ensuring the optimization of risk and IT-related resources. Key points for improvement are contained in the action plan and include the creation of a reward system, risk management administration, meeting IT resource needs and delegating people to perform resource management. from you. The result confirms that the method used for data collection proved to be efficient in view of the recognition shown by managers. The processes that should be addressed to mitigate relevant threats were also pointed out.