IT having too much power [closed]

Question

I work for a small/medium-sized business (SMB) that has about 250 employees. I have two employees below me. And I am in charge of the IT department.

We recently had an issue that caused of some data loss. After dealing with all of that, I am now being asked by the senior team that the question is coming up that IT has too much power and nobody to really account to it.

Or really that I have too much power for only reporting to the CFO only. I don't really know how to respond to that except I think we should have an audit of our systems from an external party annually or something. To ensure to management that we aren't doing anything sketchy. Maybe the real issue is that some persons in senior management do not trust me. But overall, I want what's best for this organization, however I am just not sure how to respond to this issue.

How can I improve my department to make sure we're as transparent as possible, to ensure people that we're just not spending our day looking at their files or whatever?

Answer 1

Unfortunately, IT is one of those parts of a business that is almost completely invisible to the rest of the business as long as things are going well. Generally, people don't know, don't understand, and don't care what IT does as long as they can get to their files, read their their email, and look at funny cat pictures during their lunch break.

You've now experienced the typical backlash of when things go wrong. Again, most people don't know and don't understand, but they now very strongly care about what you do. If all things go well, this will ease off again over time.

There are, however, things you can do to improve your team and people's perception of your team which should help people to understand what IT does:

• Develop risk assessment, risk mitigation and disaster recovery plans, and enact them. Publish them somewhere accessible to all staff.
• Start producing an email newsletter - it doesn't have to be extreme detail or too frequent. Things like "we're replacing an old server" and stuff
• When things go wrong, alert the organisation, tell them roughly what you're doing to fix it ( point them to your mitigation and disaster documents), and then be transparent about what happened and what steps you will take in the future to reduce the risk.

Answer 2

I have faced the same kind of knee jerk reaction. Here are some tips:

• Have your department follow some established IT processes (such as ITIL), and have these processes audited.

• Consider getting audited against a known standard for information security such as ISO-27001 which can assure your management that sufficient controls are in place to ensure information integrity (which is the main concern for any business).

• Other than your normal reports to your CFO, you should publish quarterly reports for all management and stakeholders summarizing the activities in the IT department and highlight any areas. This keeps IT in their minds rather than some dark hole where magic happens and will make sure there are no surprises

Answer 3

My knee-jerk reaction is to treat this like any other project, and first thing is to elicit requirements and figure out what their needs are. Then come up with some tentative plans that would meet those needs. That way if nothing else then you are seen as a thought leader and problem solver. Then the question becomes what is the value of the requirements you've gathered, and will they be funded? Either way, you're working problems and providing options, which will elevate any IT manager to near rock star status. If these endeavors aren't funded, then it's the businesses decision and not yours.

I do get that this isn't in your current job description, so nothing here is directly your fault.

• for only reporting to the CFO only.

Yes, this is common that CEO's don't want the head of IT reporting directly to them, or they don't value IT's contribution enough to elevate that person to a CIO position.

One thing I can say with absolute confidence is that IT leaders that do not meet business needs are eventually shown the door.

Answer 4

I don't think too much power is the problem. IT needs the power to inspect data, change data if require, backup, and restore.

You should focus on accountability part. Business impact statement.

If a task needs business sign off before proceeding then have that in writing. For example you may need sign off from accounting before changing any data in certain tables.

If there is data that IT is not supposed to see then encrypted tables or something. Let them know the cost / impact to IT.

I suggest a report of the duties of IT and let them adjust if necessary. If the business wants to interject over site on identified tasks then fine.

• Network support
• PC support
• System support (server room)
• Application support - list out all the applications
  Identify the mission critical applications (and data)
• Development - how are projects identified and prioritized
• Disaster recovery
  I bet this the main concern. If the server room burns down can we come up at a recovery site. If you don't have it then propose a project to have one.

Answer 5

Establishing very visible boundaries in practices can help - eg not even trying to be smart when anything that affects a user profile has to be done, instead saying "please log in and stay around, we really do not have easy access to what happens under your login". Also, whenever it comes to equipment and software configuration, a good rule to always follow is "IT owns the defaults, the user owns the setting".

Demonstrate awareness of privacy issues - any question like "why do we not automate this and this beyond, why do we not restrict this and this..." is an opportunity to signal "because that way, we would give ourselves more access to this and this than we want and need to have to do our job".

Sometimes, even small accidents (not ones with major data loss, though :) happening can HELP here - "preventing it would have meant this and this unnecessary privacy compromise", "this will take a little longer to figure out, since we do not keep that kind of information conveniently accessible since it could be used for bad things.."