The Case for an IS Audit

"Classified,"said the BSF officer at a border outpost on the Line of Control, Kashmir. I'd asked about the operating range of the helicopter I flew in. Later, Observer's Aircraft told me the range, missiles, specs... 

I got the same answer ten years later in 1996 when I asked an officer what PCs and software the army was using. Yes, he knew it was probably in Jane's and that the US army's weaponry and assets are on numerous Websites but, well...

National security? Well, you get the same silence from many Indian PSUs and government departments. 

In a survey on banks' IT usage, all private banks shared their data, as did some younger PSUs like the IDBI and UTI banks.

But veteran PSUs, including the state banks, refused to share any data. Invited to a discussion series on enterprise IT, again, those veterans declined, while the younger and private banks came in. 

Of course, it isn't all of them; we've seen savvy IT users, from BPCL and LIC to Maruti, opening their IS to media scrutiny.

They also happen to be among India's biggest IT users. A few private groups like Reliance can be far more tight-lipped (their IT chiefs do, however, sit on our panels!).

Why is the "establishment" so cagey about information? On the record, it's anything from national security to competitive advantage. Off the record, they say it's because "anything you say may be used against you". Or even "anything you do..".

When in doubt, hibernate - especially after activist CVCs and CAGs, and
Tehelka.

And so there are thousands of old computers rotting in warehouses. Government assets cannot be disposed of without complex bureaucracy involving the DGS&D, so few bother. As a result, PCs that could have been donated to schools and NGOs and charitable institutions rust away, till they have to be sold as scrap at Rs 10 a kg.

Many of our old-style government institutions, from the military to PSU banks, are stuck in the pre-information age. They use
IT, but not confidently enough to talk about it, nor transparently enough to document their systems and processes.

Why should they? Well, transparency is the first step toward setting benchmarks and measuring an organization's efficiency against them. Without it, even the managers rarely know what's going on in their company.

Yes, competition, disinvestments, corporate governance will change things. But till then, a mandatory information systems audit would go a long way in leveraging the best returns on tech investments. The audit reports, covering deployment, leverage, returns and even upgrades and disposal and security, could be posted online, encouraging benchmarks, competitive measures, and the sharing of best practices among government organizations-and even military departments..