System Information Audit with COBIT 4.1 and Balanced Scorecard Framework (Case Study: PT. Boga Dimsum Indonesia)

The advancement of information technology has led people more easily to connect with each other and provide value added in the form of efficiency and effectiveness that produce something for meeting purposes, record customer complaints, answer customer questions, convey information to customers, provide warranty, and seek profit by this utilization. The reason for the audit of SI in this study is PT. Boga Dimsum Indonesia where the company needs an audit on the inventory and accounting intregrated system because there is an error in the purchase application. In this research, the method used is qualitative research method that is research about descriptive research and tend to use analysis. The purpose of the audit is to know whether the information technology governance applied by PT. Boga Dimsum Indonesia has gone well. The research consists of 4 stages: planning, Field Work, Reporting, Follow Up. Based on the results of this study can be concluded that the IT functions contained in PT. Boga Dimsum Indonesia is not yet optimal.


Introduction
The development of information technology is very fast. These advances have led people more easily to relate to one another. IT adds value in the form of efficiency and effectiveness that produces something for meetings, records customer complaints, answers customer inquiries, conveys information to customers, guarantees, and benefits with this utilization. The service is certainly making the company will be closer to customers and customers will also feel happy because it served well by the company, therefore getting closer to get a profit that is easier to get [1]. Successful business by utilizing technology is inseparable from good IT governance. Some companies have sought to align IT strategies with their business strategies, and assess them to facilitate decision making on IT governance [2].
PT. Boga Dimsum Indonesia produces and markets fresh and frozen foods, dimsum is a traditional Chinese dish in the form of pastries, shrimp dumplings and spring rolls which are divided into categories of fry, steam, grill and microwave. At PT. Boga Dimsum Indonesia requires an audit of the inventory and accounting intregrated system program which has an error on the purchase application, the problem that occurs is in the first month, the staff input the stock of Handy Ghasali, Kevin Christianto Jurnal RESTI (Rekayasa Sistem dan Teknologi Informasi) Vol . goods that have been used, then the next month, the stock of goods is reduced according to the input by the staff, but in the second month the stock of goods reemerged with the stock of goods first input (stock of goods is still intact or not reduced at all) resulting in rechecking on the stock of the goods.
The author conducted an audit on PT. Boga Dimsum Indonesia uses COBIT 4.1 to measure the IT performance contained within the company and the author also performs the company's performance measurement using Balanced Scorecard. The author uses the domain PO4, PO8, and AI6 and internal process perspectives. The author uses this domain to audit the application management at PT. Boga Dimsum Indonesia and also do service requests on the company. Therefore, the author wants to know whether PT. Boga Dimsum Indonesia is in accordance with the existence of applications that simplify the process of recording the purchase, sales and printing reports.

Information System
Information systems can be viewed in terms of physical and function. Information systems consist of hardware and software that useful to produce a product [3].

Audit
An information system audit is a process of collecting and evaluating evidence to determine whether the information system establishes and implements an adequate internal control system, all assets are well protected and not abused and ensured data integrity, reliability and effectiveness and efficiency of the organization of computer-based information systems [4].

Audit Information System
Information technology can provide enormous benefits to the business world for companies that are able to compete in these competencies. The advantages of this computerized information system is to increase of speed, accuracy in data processing information [5]. The organization formulates the financial goals that the organization wants to achieve in the future then the financial goals are used as the basis for the other three perspectives in setting goals and measures.

Customer Perspective
The organization identifies the customers and market segments in which the organization will compete. The goal set in this perspective is the satisfaction of customer needs Perspective Internal business processes (internal-Business-process perspective) Identify important processes of the organization to serve customers (customer perspectives) and organizational owners (financial perspectives) key components of internal business process perspective: innovation processes, operations processes, and aftersales services.

Learning and Growth perspective
Describes an organization's ability to create long-term growth. Reveals how important organizations to invest in infrastructure (workers, systems and procedures) if they want to achieve long-term financial growth goals [8].

Problem Identification
The researcher identifies the problems that often occur in the company by conducting interviews to the parties who important related to the research, which is known based on the results of interview is often error occurs in the stocking goods input. In this company uses computers for the process of availability of goods, sales, purchases and reports.

Research objectives
Once the problem is successfully identified, then the next stage is determine the purpose of research. In addition, researchers also determine the domain that use in accordance with the goals and results using the PO4, PO8, and AI6 domain. In PO4, IT organizations are defined taking into account requirements for staff, skills, functions, accountability, authority, roles and responsibilities, and oversight. A strategy committee ensures oversight of the IT board, and one or more steering committees in which business and IT participate in determining the priority of IT resources to appropriate based of the business needs. To ensure timely business requirements support, IT must be involved in the relevant decision process. In PO8, a QMS is developed and maintained that includes proven processes and development standards and acquisitions. This is possible with planning, implementing and maintaining QMS by providing clear quality requirements, procedures, and policies. Quality management is crucial to ensuring that IT provides value for business, continuous improvement and transparency for stakeholders. In AI6, A QMS is developed and maintained that includes proven development processes and standards and acquisitions. This is made possible by planning, implementing and maintaining QMS by providing clear requirements, procedures, and quality policies. Quality management is critical to ensuring that IT provides value for business, continuous improvement and transparency for stakeholders [9].

Document and interview confirmation
At this stage, researchers do the confirmation of document in company by go to companies to get the document and information needed. Information obtained by conducting interviews. Interviews were conducted to 2 resource persons namely IT staff and manager. Researchers conducted interviews on IT and managers.

Data Processing
The results obtained from the interview then then the result of the interview is given the value based on the maturity level assessment on cobit 4.1. Maturity level in cobit 4.1 consists of 5 levels, namely level 0 is the company simply does not care about the importance of information technology to be managed well by management. Level 1 is the company is implementing information technology reactively in accordance with the sudden needs of the existing, without preceded by the planning. In level 2 there is a recurrent pattern in management related to information technology governance activities, but its existence has not been well-defined and formal so it is still inconsistent. In level 3 procedures are standardized, documented and then communicated through training. In level 4 management monitor and measures the appropriateness of the procedure and takes action if the process can not be worked out effectively. In level 5, information technology is used as an integrated way to automate workflow, provision of tools to improve quality and effectiveness and make companies quickly adapt.

Data analysis
The data has been obtained by analyzing by comparing the current maturity level obtained from the calculation and expected maturity level (the value expected by the company). After that, researcher calculate the gap between current maturity level and expected maturity level.

Conclusion
In the final stages of research is to draw conclusions from the research that has been done in the company and provide recommendations or suggestions useful to improve the process of company performance.  Results of PO4 domain is the company does not ensure IT governance works well because it has only 1 IT person and there is no responsibility for IT in the business to backup. In addition, there are no IT steering committees, lack of IT staff, IT staff just as support, and IT staff do not adequately ensure resources to support the IT process because it still has errors in the application.

Results and Discussions
Recommendation on PO4, the company will be better to have a useful IT process to run IT plan, IT has good in communicating role and responsibility to all IT staff, then user and IT also better in doing data backup that once a month and also IT it would be better to have more than one person. Results of the PO8 domain is the company maintains Quality Management System maintenance on an ongoing basis, identifies the requirements and quality criteria, the quality management system reflects the organizational structure that includes the roles and responsibilities by measuring the effectiveness and acceptance of the quality management system as it is made according to user demand. With the existence of the quality management system to identify the requirements and quality performance in accordance with company standards. With the existence of the quality management system reflects the organizational structure to include the roles and responsibilities because the user has each job and supervise and measure the effectiveness and acceptance of quality management system that is useful to supervise the application is ensured good quality and the company identifies the effectiveness, acceptance of quality management system according to standards, procedures and practices have existed in accordance with the standards but there is no process documented and the company adopts and maintains quality standards for application development with programmer standards. Companies regularly maintain the overall quality of the system and encourage continuous improvements that are useful for maintance regularly but there is no improvement in case of problems. The company does not have quality management that is useful for planning and implementation of measurements to monitor the quality management system, the existence of measurement monitoring and recording of information used by the user to make correct repairs and prevention is done according to user error information which is useful to prevent errors against the user.
The recommendation for PO8 is the company has implemented a system made according to user demand, has followed the company standard and has each job required for the supervision of IT quality management system for the application is ensured good quality. The company has identified and maintained in the IT process to keep the system running properly. The company will be better if there are procedures and documentation have been doing system development by making the addition of function in the application with the standard of the programmer, by setting the format in accordance with the needs of the company for user friendly and easy to understand and test the application even though the application is heavy. In addition, the company is good at doing maintenance regularly but it would be better to make improvements in case of problems. Companies are better at standardizing the planning and implementation of measurements that are useful for monitoring the quality management system according to user error information to avoid errors. Companies better set IT practice standards to define system requirements and align IT practice standards. The result of the AI6 domain is that the company already has procedures to handle standardized maintenance in changing applications, procedures, systems and other parameters and platforms because it is more systematic, but the company does not change in a structured way to determine the impact on the operational system because it is all directed to the user. The company ensures that IT changes are categorized, prioritized and authorized because technology is more efficient and reporting faster. At the company there is no documentation process to define the process of defining, testing, documenting, approving changes that do not follow the established process and also there is no tracking reporting in documenting the company because the company has never faced it. The company updates appropriate system, documentation and procedures every time a change is applied.
The recommendation on this domain is that the company is good at carrying out useful procedures for dealing with standardized improvements it would be better to give the time specified, the structured changes should be made by the authorities and the company has implemented useful IT changes to define processes to define, testing and documentation and recommended that the process be documented. Internal business process perspective to measure company performance is known from the business process value chain. The measurement used in this perspective is innovation with the aim to improve the company's profit and the form of innovation that is done is to create new food menus. The steps that must be done to improve the company's internal performance perspective internal process is to improve employee's work where employees can be added to improve the production process, so that all orders can be more quickly met. The process of operation is the process of creating and delivering a product or service. The related performance measurements in the operating process are grouped at times and costs. It can be concluded that business objectives and IT domain objectives obtained respond to business requirements that align with business strategy. What IT does by creating their own applications to assist the sales process, input process and PO4 purchase. The company delivers the project on time and within budget, which is the application development set by the PO8 company.
Maintain information integrity and infrastructure processing with information on sales applications, purchases and stock of goods according to company requirements on AI6 domain.
In figure 3 can be seen business objectives and IT objectives by using the internal perspective of the process on the Balanced Scorecard. From the company's business objectives is to innovate by creating new menus that reflect the company's business strategy. And companies improve the quality of their services by providing training to employees who are useful to improve service.

Conclusion
Based on the results of this study can be concluded that the domain PO8 is the highest level of domain maturity of 1.7 is Repeatable but intuitive where the company has developed but the company has no documentation but standard procedures. While the lowest value of the maturity level analysis results in PO4 domain of 0.8 Initial / Ad hoc where the company is aware of the existing problems but the process has not been balanced. Companies need to implement advice to identify internal processes in innovation, improve employee performance, production processes, build customer service that is useful to respond to customer feedback and company regulation rules.

Suggestions
Companies will need to recruit IT at least 2 people to speed up the process of fixing apps and bugs in order to process company work faster. Companies need to submit recommendations on each domain in order to achieve the level of maturity level at PT. Boga Dimsum Indonesia. Companies need to implement the advice given from the internal processes perspective on the Balanced Scorecard.