Question 543 - CGEIT discussion

This is because moving all IT applications to an external SaaS cloud provider means that the organization is outsourcing the development, deployment, maintenance, and operation of its IT applications to a third-party vendor.This implies that the organization is relinquishing some control and ownership over its IT applications, and relying on the vendor to provide the required functionality, performance, quality, and security1. Therefore, the organization needs to shift its focus from delivering IT services internally to managing IT services externally.This involves the following activities2:

Establishing and maintaining a clear and comprehensive contract or service level agreement (SLA) with the SaaS vendor that defines the roles, responsibilities, expectations, and outcomes of both parties2

Monitoring and measuring the SaaS vendor's compliance with the contract or SLA, and ensuring that the vendor meets the agreed service levels, standards, and metrics2

Communicating and collaborating with the SaaS vendor regularly, and resolving any issues, conflicts, or changes that may arise during the service delivery2

Evaluating and improving the effectiveness and efficiency of the SaaS vendor's service delivery, and identifying and implementing any opportunities for innovation or optimization2

Managing the risks and challenges associated with outsourcing IT services to a SaaS vendor, such as data privacy, security, availability, compatibility, integration, dependency, cost, and performance issues2

The shift from service delivery to service management can have a significant impact on the IT governance framework, processes, policies, and practices of the organization. It can also affect the IT skills, roles, and responsibilities of the IT staff and stakeholders.Therefore, the organization needs to adapt and adjust its IT governance approach accordingly to ensure that it can effectively oversee and optimize its IT services in a SaaS environment3.

The other options, the integration of the IT department with business lines, the improvement of IT service alignment with business, and the necessity to update key risk indicators (KRIs) are not as significant as the shift from service delivery to service management for moving all IT applications to an external SaaS cloud provider from an IT governance perspective. They are more related to the outcomes or consequences of moving to a SaaS environment, rather than the impact or change itself. They may also not be unique or specific to a SaaS environment, as they may apply to other types or models of IT service delivery as well.