Governance and Management of IT · Topic 5 of 5
IT Performance Monitoring and Quality Management
Measuring IT performance with KPIs, KRIs and the balanced scorecard, reporting to management, and quality assurance and quality management of IT processes.
- 3 min
- KGIs measure outcomes; KPIs measure process performance; KRIs warn of risk.
- The IT balanced scorecard adds user, operational and future perspectives to business value.
- Verify the accuracy of data behind performance reports.
What it is
IT performance monitoring shows whether IT is delivering what the business needs, using measures agreed in advance and reported to the right people. Quality assurance (QA) and quality management make sure IT processes and products meet defined standards and keep improving.
How it works
Types of measures
| Measure | What it shows | Example |
|---|---|---|
| Key goal indicator (KGI) | Whether a goal was achieved (after the fact) | Customer satisfaction with IT services reached target |
| Key performance indicator (KPI) | How well a process performs (leading) | Percentage of changes completed without incidents |
| Key risk indicator (KRI) | Early warning that risk is rising | Number of systems missing critical patches |
Good metrics are linked to business goals, measurable, owned, reported regularly and acted on. Metrics nobody uses are a cost without control value.
The IT balanced scorecard
The balanced scorecard measures IT from more than the financial angle. A common IT version uses four perspectives:
| Perspective | Question |
|---|---|
| Business contribution | How does management see IT's value? |
| User orientation | How do users see IT services? |
| Operational excellence | How effective and efficient are IT processes? |
| Future orientation | Is IT ready for future challenges (skills, technology)? |
Reporting
Performance reports should reach the level that can act: the IT steering committee for projects and services, the board for strategic and risk measures. The auditor checks that the data behind the reports is accurate, complete and from reliable sources; a dashboard is only as good as its data.
Quality assurance and quality management
| Concept | Meaning |
|---|---|
| Quality assurance | Process-focused activities that prevent defects (standards, reviews, audits of process) |
| Quality control | Product-focused checks that find defects (testing, inspection) |
| Quality management system (QMS) | The policies and processes for quality, for example certified to ISO 9001 |
| Continuous improvement | Plan, do, check, act cycles that improve processes over time |
Maturity models such as CMMI rate how well defined and managed a process is, from ad hoc to optimizing. They help an organization see where it is and set a realistic target.
The QA function should be independent of the teams whose work it reviews, so it can report problems objectively.
If a question says IT reports many metrics but management cannot tell whether IT supports the business, the answer is linking metrics to business goals, for example through a balanced scorecard.
How the exam asks about this
- "Which measure gives early warning of rising risk?" A key risk indicator.
- "What BEST shows IT's contribution to the business?" A balanced scorecard tied to business goals.
- "The QA team reports to the development manager it reviews." Independence problem.
What to remember for the exam
- KGIs measure outcomes; KPIs measure process performance; KRIs warn of risk.
- The IT balanced scorecard adds user, operational and future perspectives to business value.
- Verify the accuracy of data behind performance reports.
- QA prevents defects through process; QC finds defects in products.
- QA must be independent of the work it reviews.
Rewarding teams on a single metric invites gaming, such as closing tickets quickly without solving the problem.
Common mistakes
Confusing KPIs and KGIs. KGIs show goal achievement; KPIs show process performance.
Trusting dashboard numbers without testing the source data.
Treating testing as quality assurance. Testing is quality control.
Check yourself
What is the difference between quality assurance and quality control?
QA is process-focused and prevents defects; QC is product-focused and finds defects.
What does a key risk indicator provide?
Early warning that a risk is increasing.
Name the four perspectives of a typical IT balanced scorecard.
Business contribution, user orientation, operational excellence and future orientation.
Topic 5 of 5 in Governance and Management of IT
Test yourself on Governance and Management of IT
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.