The Case for an IS Audit

"Classified,"
said the BSF officer at a border outpost on the Line of Control, Kashmir. I’d
asked about the operating range of the helicopter I flew in. Later, Observer’s
Aircraft told me the range, missiles, specs...

I got the same answer ten years later in 1996 when I asked an officer what
PCs and software the army was using. Yes, he knew it was probably in Jane’s
and that the US army’s weaponry and assets are on numerous Websites but,
well...

National security? Well, you get the same silence from many Indian PSUs and
government departments.

In a survey on banks’ IT usage, all private banks shared their data, as did
some younger PSUs like the IDBI and UTI banks. But veteran PSUs, including the
state banks, refused to share any data. Invited to a discussion series on
enterprise IT, again, those veterans declined, while the younger and private
banks came in.

Of course, it isn’t all of them; we’ve seen savvy IT users, from BPCL and
LIC to Maruti, opening their IS to media scrutiny. They also happen to be among
India’s biggest IT users. A few private groups like Reliance can be far more
tight-lipped (their IT chiefs do, however, sit on our panels!).

Why is the ‘establishment’ so cagey about information? On the record, it’s
anything from national security to competitive advantage. Off the record, they
say it’s because "anything you say may be used against you". Or even
"anything you do..". When in doubt, hibernate — especially after
activist CVCs and CAGs, and Tehelka.

And so there are thousands of old computers rotting in warehouses. Government
assets cannot be disposed off without complex bureaucracy involving the DGS&D,
so few bother. As a result, PCs that could have been donated to schools and NGOs
and charitable institutions rust away, till they have to be sold as scrap at Rs
10 a kg.

Many of our old-style government institutions, from the military to PSU
banks, are stuck in the pre-information age. They use IT, but not confidently
enough to talk about it, nor transparently enough to document their systems and
processes.

Why should they? Well, transparency is the first step toward setting
benchmarks and measuring an organization’s efficiency against them. Without
it, even the managers rarely know what’s going on in their company.

Yes, competition, disinvestments, corporate governance will change things.
But till then, a mandatory information systems audit would go a long way in
leveraging the best returns on tech investments. The audit reports, covering
deployment, leverage, returns and even upgrades and disposal and security, could
be posted online, encouraging benchmarks, competitive measures, and the sharing
of best practices among government organizations–and even military
departments..

Prasanto K Roy