In one sentence: IT management is the disciplined coordination of people, processes, technologies and resources so that technology delivers measurable value and supports the organisation's goals, and over 60 years IT has moved from a back-office calculator to a strategic partner that connects whole networks of organisations.

Part A: The principles and functions of IT management

The reading says IT "has evolved from being a support function to becoming a core enabler of strategy, innovation and operational efficiency". IT management makes sure technology delivers measurable value and aligns with business goals.

The 5 principles (the "why" behind every IT decision)

The 5 functions (the daily "how")

How IT reshapes organisational structure

The reading lists seven roles IT plays in shaping structure:

1. Enabling communication and collaboration: Slack, Teams and Zoom. Flutterwave operates across continents on cloud communication platforms.
2. Enhancing decision-making: BI tools and dashboards give leaders real-time data (a logistics startup uses delivery-tracking data to optimise routes).
3. Automating processes: registration, approvals and payments. In universities this cuts manual errors and frees staff for strategic work.
4. Supporting remote and hybrid teams: cloud storage, VPNs (Virtual Private Networks) and mobile apps, made essential by COVID-19.
5. Redefining leadership and supervision: Jira and Trello dashboards replace physical, face-to-face oversight.
6. Creating new roles and departments: CISO (Chief Information Security Officer), Product Manager, Data Scientist.
7. Breaking silos through integration: enterprise systems connect finance, HR and operations, which improves transparency and reduces duplication.

Part B: The five eras of enterprise IT

Enterprise IT means the technology an organisation uses to run itself: its computers, networks, business software and data. Each era fixed the weaknesses of the one before.

Era 1: Mainframe (1960s–1980s)

A mainframe is a huge, very expensive central computer kept in a special air-conditioned data centre. Only governments, big corporations and universities could afford one.

• Batch processing: jobs were queued and run one after another, not in real time. Typical uses: payroll, census analysis, banking ledgers. No immediate feedback, so little flexibility.
• Limited access: users interacted through punched cards or terminals run by trained operators. Business users relied on IT specialists, creating a sharp divide between technical staff and the business.
• Impact: IT was a back-office service. Decision-making stayed centralised, hierarchies were reinforced, data was siloed (locked away and not used for strategy). IT was not yet a source of competitive advantage.

Era 2: Client-server (1990s–2000s)

PCs (personal computers) put computing on every desk, and LANs (Local Area Networks) linked PCs within a building. A client (your PC) requests services from a central server.

• Central servers hosted shared applications (finance, HR, procurement), accessed through client software.
• Organisations built internal IT support: help desks and system administrators. Departments gained autonomy to choose their own tools.
• Impact: collaboration within departments improved, but poor integration across departments led to fragmented data and duplicated effort. IT governance became a growing concern, and organisations started writing security and compliance policies.

Era 3: Internet and web (2000s–2010s)

• Websites and online portals served customers and partners directly, so IT moved from purely operational to a strategic enabler of customer engagement.
• Rise of e-commerce, online banking and digital marketing, creating new revenue streams.
• Nigerian pioneers: GTBank was among the first Nigerian banks with full-scale online banking. Universities launched e-portals for registration and results. Government agencies offered online exam registration and results.
• Impact: customer-centric models, online brand presence, and cybersecurity became critical because of exposure to online threats. Data protection rules began to take shape. The reading notes low broadband penetration in Africa as a limitation.

Era 4: Cloud and mobile (2010s–2020s)

• Cloud platforms give scalable, on-demand computing without buying costly on-premises hardware. SaaS (Software as a Service) means renting software over the internet.
• Mobile-first strategies design services for smartphones first.
• Flutterwave and Paystack scaled payments on the cloud, without heavy physical infrastructure, connecting to many banks and regulators through cloud-hosted APIs.
• Remote work and BYOD (Bring Your Own Device): staff use personal phones and laptops. Flexible, but a security risk, so updated IT policies are needed.
• Impact: cloud lowers cost and technical barriers, so startups and SMEs (small and medium-sized enterprises) can compete with big firms. Fast change exposes digital skills gaps, met by training, outsourcing and global hiring.

Era 5: Digital ecosystems (2020s and beyond)

A digital ecosystem is a network of interconnected organisations (suppliers, customers, regulators, platforms and technologies) that collaborate through integrated systems to create, exchange and deliver value.

• Open APIs: an API (Application Programming Interface) is a doorway that lets one system talk to another. "Open" means outside developers can use it. Open APIs allow seamless integration and innovation.
• Trust among participants is essential for sharing sensitive data.
• Collaborative governance frameworks define roles, responsibilities and data-use policies, balancing innovation with risk and regulation.
• Impact: competitive advantage shifts from product features to access within large digital networks. IT managers need ecosystem orchestration skills (API management, security, partnerships).

The 5 key characteristics of a digital ecosystem (reading 1B)

Ecosystem enablers: APIs, IoT (Internet of Things), AI (Artificial Intelligence), big data, blockchain. Ecosystem risks: governance complexity, data privacy and vendor lock-in.

Part C: The two Nigerian case studies

Part D: What this means for IT managers

• Move from technical to strategic: align technology with organisational strategy, shift from reactive problem-solving to proactive planning and innovation leadership, orchestrate integrations with external partners.
• Responsibilities: manage APIs for secure, reliable data exchange; implement data governance (privacy and legal compliance); oversee cybersecurity; coordinate with finance, legal, marketing and partners.
• Stay current: cloud, blockchain, AI, and regulation such as NDPR and GDPR (General Data Protection Regulation, Europe).
• In the ecosystem era, the reading calls IT managers ecosystem orchestrators who enable platform interoperability, ensure privacy compliance, negotiate API access, usage and security agreements, monitor ecosystem metrics and align partner platforms with internal systems.

Example from the slides: a fintech CTO (Chief Technology Officer) ensuring smooth integration and compliance with banks, regulators and partners to keep trust and efficiency.

Summary

• 5 principles: strategic alignment, value delivery, risk, resources, performance. 5 functions: plan, organise, staff, direct, control.
• Planning has 3 levels: strategic (years), tactical (months), operational (days).
• 5 eras: mainframe (batch, centralised, back office) → client-server (PCs, LANs, silos, governance concern) → web (portals, e-commerce, GTBank, cybersecurity) → cloud and mobile (SaaS, BYOD, Paystack and Flutterwave scale) → ecosystems (open APIs, trust, collaborative governance).
• In ecosystems, competitive advantage comes from network access, and IT managers become orchestrators.
• NIS: collaboration, data governance, citizen focus. Paystack: reliability, easy integration, local-global strategy.

In one sentence: an IT strategy is a comprehensive, forward-looking plan that guides how technology, systems, people and processes will be used to reach the organisation's long-term goals. It is not an ad hoc collection of tech projects.

Why IT strategy matters

The slides give five reasons. An IT strategy:

1. Enables digital innovation (e.g. Kuda and Flutterwave).
2. Reduces costs through automation.
3. Enhances customer experience.
4. Mitigates regulatory and cyber risks.
5. Builds agility in a volatile environment.

The primary purpose of aligning IT with business goals is enabling strategic business outcomes (revenue growth, better customer experience, streamlined operations). Cutting costs or buying more technology are side effects, not the purpose.

The 8 key components of an IT strategy

The three strategic frameworks (very examinable)

1. SAM: the Strategic Alignment Model (Henderson and Venkatraman)

SAM is the framework that explicitly focuses on aligning IT and business domains. It links four domains and integrates both external (strategy, the market) and internal (infrastructure and processes) views.

In plain words: the business plan and the IT plan must agree (functional integration), and each plan must be backed by the right internal people, processes and systems (strategic fit).

2. BSC: the Balanced Scorecard (Kaplan and Norton)

The BSC links IT metrics to business outcomes across four perspectives, so IT isn't judged on money alone. It encourages balanced IT investment.

3. McFarlan's Strategic Grid

McFarlan's grid categorises IT initiatives by their strategic impact, now and in the future, to help prioritise IT resources and projects. (The slides list the four quadrants. The axes below are the standard textbook version.)

Building the strategy, step by step

Aligning with mission and vision

• Strategy must map back to the core mission. Use business KPIs to define IT success. Involve executives in IT planning.
• Example: align a CRM rollout with a goal to "increase customer retention by 25% in 18 months".

Analysing stakeholders

Stakeholders are anyone affected by, or with influence over, IT decisions: customers, employees, regulators, vendors, investors. Two tools:

Understanding business capabilities

IT must support operational, tactical and strategic capabilities. Assess maturity with CMMI (Capability Maturity Model Integration), then identify gaps and opportunities.

IT vision statement and technology roadmap

• Vision statement: how IT will empower strategic priorities, e.g. "To provide real-time, integrated digital experiences for all customer transactions by 2026."
• Roadmap: breaks the long-term vision into incremental milestones (platforms, applications, infrastructure, skills), e.g. "Year 1: cloud migration. Year 2: API integrations."

EA: Enterprise Architecture

EA gives a structured approach to IT planning. Its four components are Business, Application, Data and Technical architectures. Frameworks: TOGAF (The Open Group Architecture Framework) and the Zachman framework.

Governance structures

Define decision rights, roles, policies and escalation paths, for accountability and risk control. Example: an IT steering committee oversees major tech investments.

Managing the application portfolio: Gartner's TIME model

Slide example: decommission a legacy HR app and migrate to a cloud HRMS (Human Resource Management System).

Data strategy, cybersecurity, people and money

• Data strategy tools: data governance frameworks, dashboards, ETL (Extract, Transform, Load) pipelines. Example: an FMCG (fast-moving consumer goods) firm using real-time sales dashboards to optimise inventory.
• Cybersecurity strategy must be proactive: identify and mitigate threats, comply with NDPR (Nigeria) or GDPR (Europe), and have robust incident response plans.
• Human capital: train teams, identify skills gaps, design upskilling plans (certifications, vendor training).
• Budgeting and ROI forecasting: prioritise measurable returns, run cost-benefit analyses, define funding models and financial KPIs.
• Risk management in strategy: identify IT risks (cyber, vendor, regulatory), assess them, and choose a response: accept, avoid, transfer or mitigate. Link it to governance.

Culture, measuring success and continuous improvement

• Leadership buy-in is critical; foster a digital culture; encourage experimentation and feedback loops.
• Strategy KPIs: user adoption, service uptime, ROI, customer satisfaction. Use dashboards and scorecards and review quarterly.
• IT strategy is a living document: reassess annually or after major shifts.
• Emerging trends: AI and automation, cloud-native infrastructure, edge computing, blockchain, IoT.
• Best-practice checklist: involve all stakeholders, use standard frameworks, prioritise business value, document assumptions and risks, monitor outcomes rigorously.

IT as a driver of competitive advantage (reading 2B)

Competitive advantage is the edge an organisation gains over rivals by offering greater value through lower costs, differentiated offerings or faster responsiveness. IT enables it through: faster innovation cycles, real-time data-driven decisions, customised products and services, and better customer experiences.

Example: Flutterwave and Paystack used API-based platforms and cloud infrastructure to outpace traditional banks in digital services, gaining a first-mover advantage.

Operational efficiency

Delivering products or services at lower cost, higher quality and faster speed. IT helps through:

When does a digital initiative create real advantage?

Not all technology adoption creates strategic value. It must: align with customer expectations, address real pain points, enable faster, better or cheaper service, be integrated across systems and departments, and deliver measurable impact on KPIs. High-impact examples: CRM for personalised journeys, AI chatbots for 24/7 service, IoT for real-time tracking, blockchain for transparent transactions, data-driven marketing.

Four enablers of strategic IT value

1. Business-IT alignment: if the goal is rural expansion, IT should support mobile, low-bandwidth and offline-capable apps.
2. Enterprise architecture: new tech integrates without duplication or data silos.
3. Governance and ROI tracking: policies, ROI models, KPIs and dashboards.
4. Change management: "Even the best tech will fail if users resist or don't understand it."

Balancing innovation and efficiency

Innovation means risk-taking; efficiency means predictability and control. Leaders should build agile frameworks (DevOps, Scrum), experiment in low-risk environments, use metrics to scale only what works, and make sure innovation is driven by user needs, not technology trends.

KPIs for strategic IT impact: CSAT, uptime and reliability, process turnaround time, cost per transaction, revenue from digital channels, innovation adoption rate.

Case study: MetroHealth HMO (Health Maintenance Organisation)

A mid-sized HMO in five Nigerian states, growing through private-hospital partnerships and NHIS (National Health Insurance Scheme) clients. Claims, onboarding and reporting are manual or on fragmented Excel sheets. A new CIO (Chief Information Officer) must write a 3-year IT strategy.

How to answer the case questions: (1) Alignment is weak: no EA, no governance, silos, unclear KPIs. (2) Create an IT steering committee with executives, clinical, finance and claims heads, plus a RACI to share accountability. (3) A roadmap: Year 1 governance, EA and integrated claims system; Year 2 mobile app and APIs to hospitals; Year 3 analytics and AI, measured with a Balanced Scorecard. Apply SAM, EA (TOGAF) and TIME for the old systems. (4) Use secure APIs to connect hospitals, insurers and NHIS in an ecosystem, with offline-capable tools for rural clinics and NDPR-compliant data sharing.

Summary

• IT strategy = long-term plan linking technology to business goals; not a list of projects.
• SAM (Henderson and Venkatraman) aligns business and IT domains; BSC (Kaplan and Norton) has 4 perspectives; McFarlan's grid: Strategic, Factory, Support, Turnaround.
• EA = business, application, data, technical (TOGAF, Zachman). TIME = Tolerate, Invest, Migrate, Eliminate. RACI and power-interest grid for stakeholders. CMMI for maturity.
• Risk responses: accept, avoid, transfer, mitigate. Strategy is a living document reviewed annually; KPIs reviewed quarterly.
• Competitive advantage = lower cost, differentiation or faster responsiveness. Efficiency = lower cost, higher quality, faster speed.

In one sentence: IT governance is the framework of structures, processes and policies that makes sure IT investments support business goals, decisions are made by the right people, risks are controlled and the organisation obeys the law.

What IT governance does

It aligns IT strategy with business strategy and provides a structure for decision-making, performance monitoring and compliance. Reading 3A says it answers three questions:

1. Are we using IT resources wisely?
2. Are our systems secure and compliant?
3. Is our IT aligned with business strategy?

It also clarifies who makes decisions, how they're enforced and how performance is measured. Example: a multinational uses IT governance to manage cybersecurity compliance globally.

Four benefits: strategic alignment, risk mitigation and regulatory compliance, better resource management and accountability, value delivery and performance monitoring.

1. COBIT: Control Objectives for Information and Related Technologies

• Developed by ISACA (Information Systems Audit and Control Association). Business-focused, aimed at executives, current version COBIT 2019.
• Provides governance and management objectives across the whole enterprise. Structure: 5 domains, 40 objectives.

The 5 COBIT principles (slides)

1. Meeting stakeholder needs
2. Covering the enterprise end-to-end
3. Applying a single integrated framework
4. Enabling a holistic approach
5. Separating governance from management (the board directs; managers execute)

2. ITIL: Information Technology Infrastructure Library

• A framework for ITSM (IT Service Management). Focus: service delivery, efficiency and customer satisfaction. Aimed at IT managers; operational scope.
• Origin: UK Government in the 1980s; now managed by Axelos. Current version ITIL v4.

The 5 service lifecycle stages

Key processes: incident management, change management, problem management, service level management, availability and capacity management. (Module 4 explains these further.)

3. ISO/IEC standards

ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission) publish internationally recognised standards. Their audience is auditors and regulators, and organisations can be certified against them.

Comparing and combining the frameworks

Integration: use COBIT for governance, ITIL for operations and ISO 27001 for security. Benefits: holistic governance, cross-functional compliance, resilience. Example: banks adopting COBIT alongside agile delivery.

Governance maturity levels (CMMI-like)

Certifications: COBIT Foundation (ISACA), ITIL v4 Foundation (Axelos), ISO Lead Implementer (PECB, BSI). Future trends: governance for AI and ML, cloud governance (ISO/IEC 27017), Zero Trust security ("never trust, always verify"), and agile and DevOps integration with COBIT/ITIL.

IT governance in Nigeria

• Enforced by NITDA (National Information Technology Development Agency) and regulators.
• NDPC (Nigeria Data Protection Commission), NCC (Nigerian Communications Commission) and CBN (Central Bank of Nigeria) increasingly require these frameworks in fintech, education and public service.
• Demand for ISO certification is rising in fintech and education. Adoption improves credibility, NDPR compliance and resilience.

Compliance (reading 3A)

Compliance means adhering to applicable laws, standards and internal policies, which is crucial wherever personal, financial or medical data is handled.

Compliance is not a one-time exercise: build it into systems with compliance dashboards, automated alerts and policy enforcement engines, plus training, audits and culture.

The FinTech scenario (runs through readings 3A and 3B)

A growing fintech relies on cloud vendors and outsourced services. An internal audit finds data sent over unsecured channels and third-party partners not encrypting customer data.

• Problems: weak governance enforcement, poor compliance awareness, third-party (vendor) risk exposure.
• Fixes: a centralised data protection policy, vendor security requirements, role-specific accountability; plus vulnerability assessments, regular audits, vendor risk scoring and incident readiness plans.
• Exposure: sanctions under NDPR or GDPR. The reading stresses that reputational fallout and customer attrition can be far more damaging than legal fines.

IT risk management (reading 3B)

IT risk is any potential event that could harm the CIA of information systems: Confidentiality (only authorised people see data), Integrity (data is accurate and unaltered) and Availability (systems are up when needed). Types: cybersecurity threats, compliance failures, service downtime, vendor vulnerabilities, insider threats.

1. Identification: find vulnerabilities across systems, data flows, infrastructure, vendors and personnel, including internal controls and external dependencies.
2. Assessment: rate likelihood (how probable?) and impact (effect on operations, finances, reputation). Tools: risk matrix, SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis, threat modelling, asset inventory and classification.
3. Mitigation and control: firewalls, encryption, access controls, staff training, incident response plans, and cyber insurance (which transfers risk).
4. Monitoring and review: automated tracking; risk profiles evolve with technology, regulation and threats.

Aligning risk with governance: risk tolerance (appetite) is set at the executive level and built into governance. Tools: KRIs (Key Risk Indicators: early-warning measures such as "number of unpatched servers"), compliance risk maps, and ERM (Enterprise Risk Management) platforms.

Summary

• COBIT (ISACA): governance, executives, 5 domains (EDM, APO, BAI, DSS, MEA), 40 objectives, separates governance from management.
• ITIL (UK Gov, Axelos): service management, IT managers, lifecycle Strategy → Design → Transition → Operation → CSI.
• ISO 27001 = ISMS + PDCA; ISO 20000 = ITSM; ISO 38500 = board governance of IT.
• Use them together: COBIT for governance, ITIL for operations, ISO 27001 for security.
• Maturity: Initial → Repeatable → Defined → Managed → Optimised.
• Risk = threat to CIA. Identify → assess (likelihood × impact) → mitigate → monitor. Risk appetite is an executive decision.

In one sentence: change management is a structured approach for moving people, teams and the organisation from how things work today to a desired future state, with the goal to minimise resistance, increase user adoption and maximise business value.

Why change happens in IT

Triggers: technological advancement; regulatory requirements (e.g. NDPR); market competition and customer expectations; mergers and acquisitions; cloud migration and digital transformation. Example: introducing an enterprise-wide CRM.

Five principles of successful change: clear vision and leadership support; stakeholder engagement and communication; training and support structures; measurable goals and feedback loops; sustained reinforcement after implementation.

Model 1: Kurt Lewin's 3-stage model

• Unfreeze: prepare the organisation; communicate the need for a new ERP system.
• Change: implement it; conduct training and roll out system modules.
• Refreeze: reinforce and stabilise; integrate new workflows into processes and culture.
• Strength: simple, intuitive. Limitation: assumes static endpoints in dynamic environments. Best for small-scale, structured change (slides); reading 4B says it suits structured, organisation-wide implementations.
• Example: the University of Ibadan used Lewin's model to redesign its student portal.

Model 2: John Kotter's 8-step model

• Cloud-migration example: Step 1 highlight cost inefficiencies of the current setup; Step 4 communicate cloud benefits to all departments; Step 6 demonstrate success with a pilot migration.
• Focus: leadership. Strength: structured, comprehensive, people-oriented. Limitation: time-intensive and assumes linear progression. Best for large-scale change.
• Reading 4B adds "enlisting a volunteer army" to support the vision (from Kotter's newer version).
• Example: 9mobile used Kotter's model for its nationwide 4G rollout, gaining buy-in from leadership, staff and external stakeholders.

Model 3: ADKAR (developed by Prosci)

ADKAR focuses on the individual person's journey through change. It is the best model for personal resistance.

• Strength: personal-level focus. Limitation: less strategic at organisational level.
• Example: Access Bank used ADKAR for adopting a new core banking system, with targeted training and reinforcement.

Comparing the three models

Choosing a model depends on: scale and complexity; organisational culture and structure; stakeholder profile and engagement; resources and timeline. (The McKinsey 7S model appears as a distractor here; it's a readiness model covered in Module 6.)

Implementation (rollout) approaches

Managing people through change

Success metrics: user adoption rates, helpdesk ticket volume, system uptime and response times, stakeholder satisfaction surveys. Sustaining change: recognise and reward adoption, appoint change champions, write changes into SOPs (Standard Operating Procedures) and training. Tools: Prosci toolkit (ADKAR templates), Jira, Trello/Asana, change impact analysis tools.

The IT change management lifecycle (reading 4B)

In IT operations, "change management" also means controlling changes to live systems so services keep running.

1. Planning: risk analysis, stakeholder engagement, impact and mitigation plans.
2. Approval: formal review by the CAB (Change Advisory Board) or similar body.
3. Testing: in controlled pilot environments, with rollback procedures ready.
4. Deployment: live implementation with stakeholder communication.
5. Review and closure: evaluate success, document lessons learnt, formally close.

Example: Interswitch used this lifecycle to roll out its payment gateway regionally, tracking transaction speed, reliability and customer satisfaction.

Change categories: standard (pre-approved, low-risk, routine), normal (goes through CAB) and emergency (urgent fix, fast-tracked). Tools: Jira (agile change tracking), Freshservice (integrates SLAs, Service Level Agreements with customers, and OLAs, Operational Level Agreements between internal teams), ServiceNow (enterprise-grade, used by Dangote Group). Features: change calendars, impact assessments, approval workflows, audit trails.

Best practices: involve stakeholders early; categorise changes; use dashboards for visibility; document lessons learned; train staff.

ITSM: IT Service Management (reading 4A)

ITSM is the structured delivery of IT services aligned with business goals and user needs. It is not just technical support; it integrates people, processes and technology for reliability, satisfaction and continuous improvement.

Key ITIL processes in plain English

Service quality

Availability and reliability

• Availability = uptime percentage (e.g. 99.95%), achieved with redundancy and failover, load balancing and high-availability clusters.
• Reliability is measured with MTBF (Mean Time Between Failures; higher is better) and MTTR (Mean Time To Repair; lower is better).
• Monitoring tools: Nagios, Zabbix, Splunk. KPIs, user feedback and issue tracking feed CSI (Continual Service Improvement).

Summary

• Lewin: Unfreeze → Change → Refreeze (process; simple; static). Kotter: 8 steps (leadership; large-scale; time-intensive, linear). ADKAR (Prosci): Awareness, Desire, Knowledge, Ability, Reinforcement (individuals; less strategic).
• Rollouts: Phased (gradual), Big Bang (all at once, highest risk), Parallel (old + new, costly but safe), Pilot (small group first).
• IT change lifecycle: plan → CAB approval → test with rollback → deploy → review and close. Changes are standard, normal or emergency.
• ITIL v4 SVS has the value chain, 34 practices and guiding principles. Incident = restore fast; problem = root cause.
• ISO 25010 = technical quality; SERVQUAL (RATER) = perceived quality. MTBF up, MTTR down.

In one sentence: BCP (Business Continuity Planning) keeps critical business functions running during and after a disaster, while DR (Disaster Recovery) restores IT systems and data as quickly as possible; DR is a subset of BCP.

BCP vs DR

Why both matter: they reduce downtime and financial loss, protect brand reputation and stakeholder confidence, fulfil compliance (NDPR, ISO standards), and give a structured response framework.

Common threats: natural disasters (floods, fires); cyberattacks (ransomware, DDoS or Distributed Denial of Service); hardware or software failure; accidental human error; power or network outages. Reading 5B adds pandemics and supply-chain failure.

BIA: Business Impact Analysis

The BIA evaluates the effects of a disruption on key operations, identifies critical business functions and sets recovery priorities. It also maps dependencies between processes and defines two numbers:

Risk assessment in continuity planning

Identify threats, vulnerabilities and their impact on processes, using SWOT analysis, risk matrices and threat modelling to prioritise by likelihood and severity. A documented risk register guides mitigation and response.

What goes into the plans

BCP/DR planning lifecycle

Initiation and governance → risk and impact assessment → strategy development → formal documentation → testing through scenarios → periodic maintenance and updates.

Standards and frameworks

Roles and responsibilities

Executive sponsor: strategic direction. BCP coordinator: plan execution and updates. IT staff: technical recovery. Crisis team: leads during incidents. All users: must be trained.

Backup strategies

The 3-2-1 rule: keep 3 copies of data, on 2 different media types, with 1 copy off-site.

Disaster recovery sites

Reading 5A adds auto-scaling cloud recovery, using cloud elasticity for rapid recovery. Cloud-based DR services such as AWS Backup, Azure Site Recovery and AWS Elastic Disaster Recovery give flexible, cost-effective, scalable recovery; hybrid models mix on-premises and cloud. DRaaS = Disaster Recovery as a Service.

DR approaches (reading 5B): tape or offline backups (low cost, slower); virtualised DR (rapid recovery with VMs, virtual machines); cloud-based DR (real-time replication, elastic). Failover systems take over automatically when primary systems fail.

Recovery implementation approaches (reading 5B)

Crisis communication

Internally: coordinate staff and activate roles. Externally: customers, partners, regulators and media. Pre-approved templates and contact lists are critical.

Testing and maintaining the plan

Common testing issues: out-of-date backup files; missing documentation; unavailable team members; unclear dependencies. Testing should reveal these before a real incident. Review plans annually or after any incident, and feed lessons learnt into revisions.

Regulation in Nigeria: NDPR data protection; ISO 27001 risk treatment; CBN (banking) and NCC (telecoms) require demonstrable BCP/DR policies.

Emerging trends: AI and ML for predictive threat analysis; cloud-native automated failover; zero-trust architecture; blockchain-based audit trails for post-incident investigation.

KPIs in IT operations (reading 5A)

KPIs are quantifiable metrics of the effectiveness, efficiency and quality of IT services.

KPIs should be SMART (Specific, Measurable, Achievable, Relevant, Time-bound) and linked to SLAs or business expectations. (MTTR is expanded as "Mean Time To Repair" in reading 4A and "Mean Time to Resolve/Resolution" in 5A and 6B; all mean time to restore service.)

Benchmarking

Comparing performance metrics internally over time or externally against industry standards and best practice.

External benchmarking sources: Gartner's IT Score and Forrester Wave reports.

Resilience engineering

Building IT systems that can adapt, withstand and recover from failures without collapsing. Four principles:

Summary

• BCP = keep the business running (broad). DR = restore IT (narrow, a subset of BCP).
• BIA finds critical functions and sets RTO (downtime allowed) and RPO (data loss allowed).
• Backups: full, incremental (since last backup), differential (since last full); 3-2-1 rule.
• Sites: hot (fastest, costliest), warm, cold (cheapest, slowest); cloud DR and DRaaS.
• Tests: walkthrough, tabletop, simulation, full-scale drill. Review annually or after incidents.
• Standards: ISO 22301 (BCP), ISO/IEC 27031 (ICT DR), NIST SP 800-34.
• KPIs: MTTD, MTTR, FCR, uptime, CSAT (SMART). Benchmarking: internal, external, functional. Resilience: graceful degradation, redundancy, observability, chaos engineering.

In one sentence: IT budgeting is the estimation, allocation and monitoring of money for technology, so organisations can plan, prioritise and justify IT investments in line with business strategy, and get real value from every naira.

Part A: IT budgeting basics

What's in an IT budget

Why budgeting matters: aligns IT with strategic priorities; enables transparency and accountability; manages financial risk; ensures IT services are sustainable; supports long-term planning.

The four budgeting models

Budgeting cycle (reading 6B): needs assessment → cost estimation → prioritisation by business impact → review and adjustment against actual spending.

Cost centre vs profit centre

Traditionally IT is a cost centre (judged on managing spending). In modern firms IT increasingly acts as a profit centre by enabling new revenue streams such as digital services (e.g. a bank's mobile app that earns transaction fees).

Part B: Cost optimisation

Cost optimisation means reducing IT spending while maintaining or improving service levels. Reading 6B stresses it is about maximising value, not simply cutting cost.

Cost drivers: infrastructure, software licensing, labour and consultancy. Cost visibility tools:

• ABC (Activity-Based Costing): identifies which activities consume resources and assigns costs accordingly.
• Chargeback models: allocate IT costs back to the business units that use them, to encourage accountability.

Sourcing models: outsourcing (third-party vendors), insourcing (in-house), hybrid (both, for flexibility and control). Governance must prevent vendor lock-in (being stuck with one supplier), duplicated effort and lack of accountability.

Part C: Financial planning

Financial planning anticipates and allocates resources for IT projects and services, using forecasting, scenario analysis and cost-benefit assessment.

• Scenario planning: analyse "what-if" scenarios such as a breach or a sudden demand surge.
• Governance oversight: finance or IT steering boards guide allocations and policy.
• Agile adaptability: allow responsive changes in fast-moving environments.

Framework (slides): define scope and objectives → estimate costs → identify funding sources → implement controls → track and review financial performance.

Alignment: use strategic objectives to guide funding; collaborate with finance, operations and leadership; monitor KPIs that reflect financial and strategic performance.

Key challenges: unpredictable tech trends; cloud pricing complexity; shadow IT (departments buying tech without IT's knowledge); fluctuating business needs; difficulty quantifying ROI for some initiatives.

Part D: PPM: Project Portfolio Management

PPM is the centralised management of IT projects as a strategic whole, rather than judging each project alone. It enables prioritisation, risk assessment and resource planning.

Evaluation criteria: strategic alignment; ROI and cost-benefit; risk exposure; regulatory impact; resource availability.

Financial metrics, explained simply

Prioritisation techniques

• Weighted scoring model: score each project on criteria with weights (e.g. strategic alignment 40%, financial return 30%, risk 30%) and rank by total.
• MoSCoW: Must-have, Should-have, Could-have, Won't-have. The standard technique for prioritising project features.
• Cost vs impact matrix: low cost + high impact first ("quick wins").
• Balanced scorecard: aligns projects with financial, customer, internal-process and learning objectives.

Pitfalls: stakeholder bias skewing priorities; overemphasis on short-term ROI at the expense of strategic impact; poor documentation and unclear criteria.

Part E: Resource allocation and value realisation

Strategic allocation techniques (reading 6B):

• Stage-gating: projects are evaluated at checkpoints before getting more money.
• Dependency mapping: find interdependent tasks or teams to avoid bottlenecks.
• Cross-training: widen team skills to cover shortages.
• Outsourcing or subcontracting: fill capacity or expertise gaps.

Value realisation: turning IT spending into tangible benefits (better customer service, more revenue, efficiency), guided by COBIT (align IT with business goals) and ITIL (operational excellence). VSM (Value Stream Mapping) visualises end-to-end workflows to expose inefficiencies.

Governance in financial planning: steering committees, audit and compliance checks, budget approval workflows, periodic reporting.

Financial KPIs: cost per user; project ROI; budget variance (planned vs actual); asset utilisation rate; IT spend as a percentage of revenue; cost per transaction; MTTR.

Part F: Financial risk

Tools: ERP (SAP, Oracle Financials); project tools (Jira, MS Project); financial modelling (Excel, Adaptive Insights). Future trends: AI and predictive budgeting; FinOps (financial operations for cloud cost management); agile budgeting; Green IT and sustainability-linked budgets.

Part G: Digital transformation (reading 6A)

Example: a logistics firm using AI route optimisation and cloud inventory doesn't just get faster; it reimagines its supply chain as a transparent, predictive ecosystem. It requires leadership commitment, workforce upskilling and agile governance.

Disruptive technologies

1. AI and machine learning: chatbots cut banking costs; retail recommendations. Ethical concerns: bias and transparency.
2. Blockchain: secure, decentralised transactions; supply-chain traceability; smart contracts.
3. Cloud computing: scalable infrastructure; shifts costs from CapEx to OpEx.
4. IoT: real-time data in logistics and agriculture; needs strong cybersecurity.
5. Industry 4.0: digital and physical systems combined into intelligent, self-regulating networks; pushes investment towards subscription-based services.

Drivers: technological maturity (accessible AI), evolving customer expectations (personalised, real-time), intensified global competition (digital-native disruptors). Enablers: leadership support, and a culture shift from risk aversion to experimentation. Barriers: cultural resistance, legacy systems, skills gaps, cybersecurity risk and uncertain ROI.

These frameworks keep transformation evidence-based, not driven by hype.

Case study: EcoTrans Ltd (Lagos logistics)

How to answer: Like Siemens, frame the change around new value and involve staff early (use ADKAR and Kotter from Module 4) so automation feels like upskilling, not job loss. Re-run the NPV with the ₦50m integration risk and ₦30m cyber cost: ₦150m − ₦80m leaves about ₦70m, still positive but thinner, so keep milestone-based funding, stage-gates and a contingency reserve. Fix the AI bottleneck with cross-training and dependency mapping under COBIT governance, with ITIL managing the service side. A reasonable recommendation is a modified option 2 or 3: protect cash, optimise the successful pilot, then scale through stage-gates rather than borrow. Edge computing would let trucks process sensor data locally where network coverage is weak.

Summary

• OpEx = running costs; CapEx = long-term assets; cloud shifts CapEx to OpEx.
• Budget models: top-down, bottom-up, zero-based (justify everything from scratch), hybrid.
• Cost optimisation maximises value: rationalise apps, rightsize cloud, automate, consolidate vendors, review licences; ABC and chargeback create visibility.
• PPM evaluates projects as a portfolio: NPV > 0, IRR, payback, TCO; prioritise with weighted scoring, MoSCoW, cost-impact matrix.
• Allocation: stage-gating, dependency mapping, cross-training, outsourcing. Risks: overruns, lock-in, scope creep; mitigate with contingency and milestone funding.
• Digital transformation redesigns the business model; digitisation only changes the format. Siemens moved to subscriptions with MindSphere.