Sentinel, our newsletter for IT governance and information security professionals, continues to explore the great range of available resources found for us by editor Dan Swanson.

   Follow us on Twitter!
   Join us on Facebook!

>> Digital Forensics One Day Classroom Training Course
The perfect introduction to Digital Forensics and Forensic Preparedness
London - 15 July 2009 <<

This Month's Top "Picks"

The Goal: A Process of Ongoing Improvement
One of my all time favorite business books!
http://www.itgovernance.co.uk/products/2539

Value Through World-Class Financial Management
Based on research published by the Government Accountability Office (GAO), “the finance department” can best be defined in terms of the business outcomes it produces—outcomes such as improved business analysis, innovative solutions to business problems, reduced operating costs, increase capability to perform ad-hoc analysis, and improved overall business performance.
http://www.gao.gov/archive/2000/ai00134.pdf

Using the OECD Principles of Corporate Governance - A BOARDROOM PERSPECTIVE
The report clearly states the relevance of the fundamental principles laid down by the OECD, and it also highlights some of the key qualities required from individuals. It is unique in the sense that it provides practitioners with concrete examples of how important these qualities can be when applying the OECD Principles.
http://www.oecd.org/

Auditing and Assurance - Research Studies publications
The CICA Research Studies Department carries out technical research on matters of importance to CAs, the accounting profession, the business community and the government/public sector. It issues publications for both guidance and discussion and debate.
http://www.cica.ca/1/0/2/8/index1.shtml

COBIT 4.1 Foundation Course (Official ISACA 2-day Course) - in London
Find our more about this new course today >>

ITIL v3 Foundation Training Course - In London
Find our more about this new course today >>

Organisational Governance

How CFOs are Adapting to Today’s Realities
This document addresses the realities facing CFOs and offers suggestions on how they can adapt to meet the challenges. The material is presented in four sections. The first: The Roles of CFOs describes what CFOs are expected to be. The next three explore the resources CFOs need to be able to meet expectations: Relationships, Skills and Knowledge, and The Finance Function.
http://www.cica.ca/download.cfm

The Ethical Climate
According to The IIA's International Standards for the Professional Practice of Internal Auditing (Standards), the internal audit function is expected — or rather required, as the Standards use the word "must" — to assess the ethical climate at their organization. Not only does this include the tone at the top, but also whether the compensation and other programs incent appropriate or inappropriate behavior.
http://www.theiia.org/blogs/marks/

Resources for Board and Audit Committee Members
http://www.theiia.org/

IT Governance

The tipping point for board oversight of IT
Traditionally, and properly, a company's board of directors has focused on governing the organization; that is, the board ensures that the right CEO is in place, that the right business strategies have been developed, that performance is reported regularly and trending properly, and that the right questions are being asked of management.
http://www.accaglobal.com/members/

A Framework for Assessing and Improving Process Maturity
The ITIM framework is a maturity model composed of five progressive stages of maturity that an agency can achieve in its IT investment management capabilities. These maturity stages are cumulative; that is, in order to attain a higher stage of maturity, the agency must have institutionalized all of the requirements for that stage in addition to those for all of the lower stages. The framework can be used both to assess the maturity of an agency’s investment management processes and as a tool for organizational improvement.
http://www.gao.gov/new.items/d04394g.pdf

Understanding the Purpose and Use of Benchmarking
Benchmarking is a way of discovering what is the best performance being achieved – whether in a particular company, by a competitor or by an entirely different industry. This information can then be used to identify gaps in an organization's processes in order to achieve a competitive advantage. Thus it is important for Six Sigma practitioners to:

• Understand fully the purpose and use of benchmarking.
• Understand the difference between benchmarking and competitor research.
• Gain insight to ensure that benchmarking is in alignment with the company's management objectives.
• 
  http://finance.isixsigma.com/library

Risk Management and Internal Audit

INTERNAL AUDIT STANDARDS: WHY THEY MATTER
Today more than ever, audit committees need to work closely with internal auditors to ensure strong internal controls, accurate financial reporting, and adequate risk management in every company they serve. To work effectively with internal auditors, audit committee members need to know best practices for this vital function. By understanding internal audit standards, audit committees can strengthen their own work of oversight.” - Roger Raber, former CEO National Association of Corporate Directors (NACD)
http://www.theiia.org/download.cfm

Quality Assessment
Frequently Asked Questions (FAQs) about Quality Assessments and conformance with Standard 1312. Click on a category below to see questions related the topics of Quality Assessments and conformance.
http://www.theiia.org/guidance/quality/quality-faq/

The Risk Management of Everything
Michael Power describes some of the challenges of saying "we are in control".
http://www.theiia.org/download.cfm?file=9876

Principles of Corporate Governance 2005
The principles discussed here are intended to assist corporate management and boards of directors in their individual efforts to implement best practices of corporate governance, as well as to serve as guideposts for the public dialogue on evolving governance standards.
http://www.businessroundtable.org/sites/

Information Security

New ISO/IEC 27000:2009
Introduction to the ISMS family of standards.
ISO/IEC 27000:2009 provides an overview of information security management systems (ISMS) and defines related terms.
http://www.itgovernance.co.uk/products/2516

SP 800-53, Revision 3 - Initial Public Draft Recommended Security Controls for Federal Information Systems and Organizations
NIST announces the release of the Initial Public Draft (IPD) of Special Publication 800-53, Revision 3, Recommended Security Controls for Federal Information Systems and Organizations. This is the first major update of Special Publication 800-53 since its initial publication in December 2005.
http://csrc.nist.gov/publications/drafts/

Nobody's Perfect
While I never met Edwards Deming in person, this quote continues to inspire me: “You have heard the words; you must find the way. It will never be perfect. Perfection is not for this world; it is for some other world. I hope what you have heard here today will haunt you the rest of your life. I have done my best”. Continuous improvement really is a life long journey.
http://blogs.itworldcanada.com/security/

Financial reporting library
This subject library provides a single point of access for all the reading resources related to this subject to be found across the ACCA website.
http://www.accaglobal.com/

Improving Business Behaviour: Why we need Corporate Governance
By agreeing on these Principles, OECD governments have set the broad foundations for high standards of corporate governance. Looking ahead, the governments of OECD countries are committed to maintaining an open dialogue with all the parties involved so that everyone can learn and benefit from the shared experiences of putting these Principles of Corporate Governance into practice.
http://www.oecd.org/document/

ITIL, ITSM & Prince2

PRINCE2:2009 due to be released on 16 June.
We are the only place where you can pre-purchase the new PRINCE2 manual!
http://www.itgovernance.co.uk/products/2455

ITIL v3 Foundation Training Course
On this 3-day London based course - which has a unique Pass the Course GUARANTEE - you will gain an understanding of the key concepts, processes and functions that your organisation needs to promote successful IT Service Management. This qualification is also the essential initial career qualification for anyone in IT.
http://www.itgovernance.co.uk/products/2129

Implementing ISO20000 (ISO20000 Consultant Certificate) Training Course
This outstanding London training course - delivered by IT Governance's own expert trainers - prepares the IT practitioner or ISO20000 project manager to implement ISO/IEC 20000 in an organisation. It covers the interpretation and application of the ISO/IEC 20000 Standard. It has a wider scope than the Auditor training/Certification and is ideal at IT(SM) consultants who wish to assist organisations preparing for audit/certification.
This course also has a unqique "Pass the Course Guarantee"
http://www.itgovernance.co.uk/products/2134

ITIL Lifecycle Publication Suite (ITILv3 - Complete Library)
Order the Complete ITIL®v3 Service Lifecycle Publication Suite today for immediate worldwide despatch - and save money.
http://www.itgovernance.co.uk/products/793

PRINCE2™ Distance Learning
PRINCE2™ Distance Learning is a cheaper and more flexible route to train for essential PRINCE2 qualifications. We have a whole range of options available to meet your requirements.
http://www.itgovernance.co.uk/catalog/52

BugBox - PRINCE2 software for project teams
BugBox is the best PRINCE2 issue management software in the world. It solves two persistent project management problems:
Controlling ownership, and
Fixing issues.
Take the 15 day free trail to see for yourself!
http://www.BugBox.biz

Download our new Training Catalog and find out what we have to offer in 2009!

Security Awareness Resources

Information Security Awareness Posters
The posters are designed to be used as part of a general information security education and awareness initiative inside security-conscious organisations, and all organisations pursuing ISO27001 certification (which requires a staff training and awareness plan) or Data Protection Act compliance.
http://www.itgovernance.co.uk/products/1756

IT Governance: A Manager's Guide to Data Security and ISO 27001 / ISO 27002, Fourth Edition
This manual - which is also the Open University post-graduate information security text book - provides clear, unique guidance for both technical and non-technical managers. It details how to design, implement and deliver a ISMS that complies with ISO 27001.
http://www.itgovernance.co.uk/products/4

ISO 27001 Assessments Without Tears: A Pocket Guide
This pocket book explains what an ISO 27001 assessment is, why organisations bother with them, and what individual staff should do and, perhaps as importantly, not do if an auditor chooses to question them.
http://www.itgovernance.co.uk/products/776