2. Caselet: Your Neighborhood Grocers

Learning Objective

This case focuses on strategic planning and the implementation of a control framework.

Introduction

Larry Bacon is the newly appointed chief information officer (CIO) of Your Neighborhood Grocers (YNG). Management has requested that he focus on streamlining operations, removing unnecessary processes and management layers, reducing the budget, and developing a strategy for process improvement and accountability. He seeks a control framework and structure.

Background

Company YNG is a grocery chain that operates in 10 distinct markets. The company grew through acquisition, keeping the acquired brand in each of the markets.

Industry

The supermarket industry is a highly competitive environment. Senior management is typically comprised of supermarket personnel who have grown within the company through various levels of management. The applications are complexprocesses include standard accounting functions, retail-specific applications, and those applications customised to the supermarket industry. Many supermarket companies have retained legacy systems because their strategic focus has been marketing, thus delegating IT infrastructure to a lower priority.

Key Players

The key players are:

Larry Bacon, CIO

Del Salmon, Chief Executive Officer (CEO)

Issue

As the companies were acquired, the IT function within each company was integrated into the YNG data center. With each acquisition, the IT function would evaluate the software applications operating at the acquired company to determine whether the acquired company had better applications than the parent. In some cases, the acquired company was permitted to retain its application, but in most cases, the acquired company converted to the YNG applications.

The YNG applications were developed over time and were independent of one another. As a result, they utilise various database management systems, including Oracle E-Business Suite; Microsoft SQL-Server; and IBM DB2, IMS and Informix. The applications run on various platforms including an IBM mainframe; older IBM AS/400s, which are reaching the end of their supported life; IBM servers running AIX and Linux; and Sun Servers running Solaris.

The main applications include the following:

Warehouse DistributionPurchased from RetailGen, which is no longer in business. All maintenance is performed in house. This application processes receiving and storage at the distribution centres, and picking and delivery to the stores.

In-Store DeliveryA modern system, acquired from ISD-Associates. This application processes products delivered directly to the store (bread, soda, chips, etc.) to record purchases and returns.

Perishable Food ManagementPurchased from Retail Systems. This application monitors waste.

GoToMarketA combination of purchased systems and systems developed in house. These applications establish the pricing strategies, product selection, vendor negotiations and management, and store planning.

FrontOfStorePurchased from a now-defunct company. YNG has contracted with a group of retired programmers from the original company to maintain the point-of-sale equipment at the front of the store. This application requires immediate replacement.

Accounts PayableAn old batch system that receives interfaces with GoToMarket, In-Store Delivery, Warehouse Distribution and a non-resale purchasing system. All interfaces were written internally.

General LedgerAn old batch system that interfaces with all subsystems. The heritage is too old to trace.

PayrollPurchased package from U-Pay, Inc. YNG operates separate instances and versions at each of the operating companies. The newest version is quite modern and would fit the needs of the company, but has not been implemented. The versions in use range from two to five generations old.

Food Product R&DKnown as FPRD. This application was initially supplied by an applications service provider, but has been significantly patched by the research and development (R&D) staff. No programming standards were used.

Software and hardware solutions were acquired in a piecemeal fashion. Initially, IT led the selection and acquisition process. The resulting implementation did not achieve business objectives. Many systems were technically efficient, but operationally cumbersome. Subsequently, business management demanded that hardware and software solutions be selected by the business, without IT involvement. This resulted in the proliferation of disparate hardware and software permutations, as noted previously.

The success rate for systems developed in house has been poor; most of them have not realised their benefits, incurring large budget overruns. The business-acquired applications were more successful in meeting business needs; however, several attempts at software selection and implementation have resulted in substantial write-offs.

The proliferation of disparate architectures has made access control difficult. During the last financial audit, the external auditors indicated that the current access control approach was a significant weakness and would be considered a material weakness during the next audit cycle.

Decision to Be Made

Del Salmon, CEO, realized that IT requires a significant overhaul. He hired Larry Bacon as CIO to streamline operations; remove unnecessary fat from the budget; and develop a strategy for process improvement and accountability, including a framework and structure. Having used COBIT at a previous organisation, Larry would like to implement COBIT as his framework for providing governance over IT.

Questions

Larry has requested your assistance to perform a three-phase analysis of the IT organization:

1. Phase I: Identify the key issues that are the root cause of the new CIOs problems.

2. Phase II: For each of the key issues identified in phase I, how would you apply specific COBIT control objectives within PO1 through PO3 and ME4 to address these issues? Larry needs specifics and requested that you cite the control objective and how it would remediate the situation.

3. Phase III: Larry is concerned that once he has developed the framework, he will face roadblocks in implementing it. Address these issues in a talking-points outline.