Transcript Document

IT Governance:
Webcast Sound
Title Management Practices that Deliver Results
IT Governance:
Sound Management Practices that Deliver Results
November 29, 2006
2pm EST, 11am PST
George Spafford, Principal Consultant, Pepperweed
Consulting
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Housekeeping
• Submitting questions to speaker
– Submit question at any time by using “Ask a question”
section located on lower left-hand side of your console.
– Questions about presentation content will be answered
during 10 minute Q&A session at end of webcast.
• Technical difficulties?
– Click on “Help” link
– Use “Ask a question” interface
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Main Presentation
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Agenda
• What "IT Governance" entails
• IT Mission Considerations
– Enablement
– Risk Management
•
Please email either George or Kendra for a copy of this PPT
[email protected]
[email protected]
© 2006 Jupitermedia Corporation
IT Governance:
Webcast Sound
Title Management Practices that Deliver Results
Why should we care?
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Why Governance Gets Attention
• AT Kearney 2004-2005 Technology Innovation Study:
– 72% of business leaders believe IT enabled their business strategy
but only 30% are “fully aligned”
– 45% of respondents believe IT is primarily focused on day-to-day
requirements
– 70% identify technology innovation as critical yet 80% of actual IT
investment is focused on infrastructure and core operation
• Projects
– $600 billion spent on ill conceived or poor executed IT projects –
Gartner
– 71% of IT projects fail or are challenged – Standish
• Operational Processes
– 80% of availability problems caused by human error – IDC
– 45% of operating expense budget consumed by unplanned work ITPI
© 2006 Jupitermedia Corporation
IT Governance:
Webcast Sound
Title Management Practices that Deliver Results
What is governance?
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Corporate Governance Defined
•
Governance derives from the Latin word “gubernare” relating to the
rudder and steering of a ship
•
"Corporate Governance is concerned with holding the balance between
economic and social goals and between individual and communal goals.
The corporate governance framework is there to encourage the efficient
use of resources and equally to require accountability for the stewardship
of those resources. The aim is to align as nearly as possible the interests
of individuals, corporations and society." -- Adrian Cadbury in “Global
Corporate Governance Forum”, World Bank
•
“Corporate governance is the set of processes, customs, policies, laws
and institutions affecting the way a corporation is directed, administered
or controlled. Corporate governance also includes the relationships
among the many players involved (the stakeholders) and the goals for
which the corporation is governed. The principal players are the
shareholders, management and the board of directors. Other stakeholders
include employees, suppliers, customers, banks and other lenders,
regulators, the environment and the community at large.” – Wikipedia
© 2006 Jupitermedia Corporation
IT Governance:
Webcast Sound
Title Management Practices that Deliver Results
So what is IT Governance?
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
IT Governance
•
“The overall objective of IT governance, therefore, is to
understand the issues and the strategic importance of IT, so that
the enterprise can sustain its operations and implement the
strategies required to extend its activities into the future. IT
governance aims at ensuring that expectations for IT are met and
IT risks are mitigated.” – IT Governance Institute’s “Board Briefing
on IT Governance”
•
It arose from a lack of discussions about IT at the Board and
strategy levels
– Often times IT is only discussed with capital is needed
– Organizations that had strategic IT discussions at the Board level
outperformed competitors over the past five years – AT Kearney
– The management of IT should be no different than any other functional
area.
•
In short, IT Governance outside of the Board level is really
concerned about sound management and not governance per se
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
So, What’s the Goal?
Manufacturing
Accounting
Organizational Goal
Human Resources
Sales
© 2006 Jupitermedia Corporation
Customer Service
IT Governance: Sound Management Practices that Deliver Results
To Maximize Sustainable Profits
Accounting
Manufacturing
Maximize
Sustainable
Profits
Payroll
Sales
© 2006 Jupitermedia Corporation
Customer Service
And the business
knows this best.
Alignment problems
arise when IT goes
around the business
and pushes solutions.
IT Governance: Sound Management Practices that Deliver Results
Theory of Constraints
•
•
•
•
Dr. Eliyahu Goldratt – Israeli Physicist
Organizations are systems of business units assembled to achieve a goal
If there isn’t a goal, there isn’t a system
Throughput accounting
–
–
–
–
•
•
•
•
•
Inventory is money tied up in the system
Operating Expenses are monies consumed creating units of the goal
Throughput is the conversion of units of inventory into units of the goal
We want systems that improve throughput while driving down inventory and operating expenses
Constraints are what inhibit attainment of the goal
We want to identify constraints and then act to drive them down to increases
systemic throughput
Need to recognize that we are dealing with a system and focus on system
throughput – not just local optimizations
If we can’t relate activities to the goal, then why are we performing the
activities?
Resource
–
–
Domenico Lepore and Oded Cohen. “Deming and Goldratt – The Theory of Constraints and the
System of Profound Knowledge”. North River Press. 1999.
Eliyahu Goldratt. “Beyond the Goal: Eliyahu Goldratt Speaks on the Theory of Constraints”. Coach
Series [Audio Book on CD]. 2005.
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
What Is Constraining the Goal?
Accounting
Manufacturing
Poor schedule is costing the
firm $200,000/day through
lost production and/or
expediting of orders
Maximize
Sustainable
Profits
The order entry website
crashes once a week and
the firm loses about
$5,000 in sales from
opportunistic buyers and
incurs $500 in unplanned
labor costs
Payroll
Sales
Customer Service reps are
inefficient and it is estimated
that $150,000/year could be
saved by putting in a new
system
Customer Service
When properly designed and implemented, IT is a force multiplier that
empowers functional areas to attain their objectives in support of the Goal.
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Improving the Organization
Where do we want to be?
Vision and Objectives
Where are we now?
Audits / Assessments
How do we get to where
we want to be?
Process Improvement
(Leverage Best Practices)
How do we monitor
Progress?
Metrics and Critical
Success Factors
© 2006 Jupitermedia Corporation
* Adapted from ITIL Service Support Graphic
IT Governance: Sound Management Practices that Deliver Results
Value Enablement
Positive Force Multiplication
vs.
Negative Force Multiplication
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Quality Management
• Quality means conformance to requirements –
Phil Cosby
• This means
– IT must understand the customer’s requirements
– IT must meet the customer’s requirements
– This assumes that the customer and IT understand the goals
of the organization and how functional area objectives
support them
• After WWII in Japan, Ishikawa used to tell the
people on the manufacturing line that the people
in the next step were their customer
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Business IT Alignment (BITA)
• Need the business engaged with IT and not just IT in a vacuum
• “Technology Pull” vs. “Technology Push”
• IT Service Management – services that meet customer
requirements both today and in the future
• Primus inter pares
– “First among equals” – IT and other managers working together
– IT may know the technology but the business knows the business even
better
– IT and the business must leverage each others’ strengths and
compensate for each others’ weaknesses
– Requires dialogue, regular meetings, … and lots of hard work!
– Roles & responsibilities must be understood
• It can’t just be IT – this is an organizational culture issue
• Who better than logistics to argue for a new IT logistics service with IT
playing a supporting role?
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Communication Barrier
• Need to speak in terms of enabling objectives and goals
while managing risks
– Focus on business and customer needs, technology is secondary
• Need to focus on terms that are mutually understood
• IT must avoid “geekinese” and understand what
management needs
– For example discussing requirements for a two page summary
report vs. a forty page report that serves up lots of content but little
information
• Communication must be on a regular schedule in a venue
and format that maximizes senior management’s attention
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Tone At The Top
• Senior management must support IT in deeds as
well as words
• “Just get it done” can destroy all the
organizational change work done to date
• Recognize that IT must be engaged the same as
any other technical group
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Strategic Planning
• IT and the business must work together to accomplish
objectives
• IT needs to understand strategic plans in order to support
the business and the business must understand IT’s
capabilities
• IT projects and resulting services are costly and can impact
the quality of business services rendered – they need
proper planning
– No different than planning for new production plants
• Recognition of IT value, not just cost
• Board level IT strategy committee
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Steering Committee
• Visibility and involvement into the direction of IT
• Set within context of strategy
• Steering committee defines
– Priorities
– Tracks status of projects
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Service Development Lifecycle
• Quality standards around development projects
–
–
–
–
–
–
–
–
Requirements definition
Coding standards
Testing
Identification of best practices
Migration to production
Documentation
Evidentiary requirements
Roles and responsibilities
• Resource
– Carnegie Mellon’s Capability Maturing Model Integrated (CMMI)
– Google
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Project Management
• 29% of projects delivered on-time with expected features,
53% were challenged and 18% outright failed1
• The majority of the causal factors are non-technical
including:
–
–
–
–
–
Lack of project planning
Poor requirements definition
Correct stakeholders not involved, or not involved early enough
Poor communications
Insufficient management oversight
• Resources
– PMI’s Project Management Body of Knowledge (PM-BOK)
– Projects in Controlled Environments Version Two (PRINCE2)
– Google
© 2006 Jupitermedia
Corporation
1. “Third Quarter
2004
CHAOS Report”. The Standish Group.
IT Governance: Sound Management Practices that Deliver Results
IT Service Management (ITSM)
• Three objectives
– Align IT Services with the current and future needs of the business
– To improve the quality of IT services delivered
– To manage long-term costs of services
• This is a change in mindset away from technology to one of
enabling services and quality
• People, Processes and Technology
• Resources
– Information Technology Infrastructure Library (ITIL)
– IT Service Management Forum (itSMF)
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Internal Audit
• Dr. Deming eschewed the Shewhart cycle of PlanDo-Check-Act
• Audit plays an important role in organizations by
performing a facet of the “check” function
–
–
–
–
Ethics
Regulatory Compliance
Process Compliance
Control and Process Improvement Opportunities
• Resources
– The Institute of Internal Auditors (The IIA)
– Information Systems Audit and Control Association (ISACA)
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Risk Management
Safeguarding The Goal
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Why Is Risk Management So Important?
Limited Resources and Seemingly Unlimited Risks!
Companies need to understand and prioritize risks in order to
safeguard functional area objectives and organizational goals
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Safeguard the Goal
Accounting
Manufacturing
Maximize
Sustainable
Profits
Payroll
Sales
Customer Service
IT must reasonably safeguard the Goal by reducing residual risk to an
acceptable level.
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
What Is a Risk?
•
•
The probability of a negative event impacting the realization of
functional area objectives and/or organizational goals
Does a risk matter if it doesn’t impact a functional area objective
or organizational goal?
– NO
•
•
Information Technologies are a threat vector
In the end there is only business risk
– It isn’t IT that goes out of business!
•
•
IT should be a stakeholder in a larger Enterprise Risk Management
(ERM) effort
Resource
– COSO Enterprise Risk Management (ERM)
– NIST
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Use Controls to Manage Risk
•
•
•
Risks cause variation around
the achievement of objectives
and goals
Some variation is always
present and inevitable
By implementing processes
with adequate controls, we
strive to create a reasonable
assurance that we can attain
our objective
Controls are found in
–
–
•
The services IT maintains and
provisions
Within the applications users access
UCL
MEASUREMENT
•
Mean
LCL
Resource
–
Information Systems Audit and
Control Association (ISACA) –
Control Objectives for IT and
Related Technologies (COBIT)
© 2006 Jupitermedia Corporation
TIME
IT Governance: Sound Management Practices that Deliver Results
Don’t Try to Eliminate Risk!
You can spend a fortune and
you will never truly hit a 100%
level of assurance – it’s not
possible
•
The objective is to lower risk to
an acceptable level, not
eliminate it because that is not
possible!
•
Work with senior management
and Internal Audit to define
what level of residual risk is
acceptable
•
There is no prize for overly
controlled processes – only costs,
frustration and lost agility
© 2006 Jupitermedia Corporation
100%
Level of Assurance
•
Level of Investment
IT Governance: Sound Management Practices that Deliver Results
Change Management
•
•
•
•
•
•
Change Management is a risk management function and a foundation
control
78-80% of unavailability is tied to human error
The result: Delayed projects and the perception that IT can not get
anything done
As the levels of complexity and integration increase, so to does the
need for effective change management otherwise forward momentum
will stop and even reverse
Properly designed Change Management can facilitate agility because
productive work can actually be accomplished
There is a huge difference between total changes and net successful
changes
– Being able to deploy 10,000 patches overnight can crash thousands of systems
overnight!
•
•
Need a company specific change management process that balances
off risks to the organization with the business’ need to change
Resources
– ITIL Service Support volume
– ITPI’s Visible Ops methodology
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Continuous Improvement
© 2006 Jupitermedia Corporation
ACT
PLAN
CHECK
DO
IT Governance: Sound Management Practices that Deliver Results
Continuous Improvement
• What is needed today will be different than what
is needed later
• Objectives, Risks, resources, and so on will all
change over time
• Continuous Improvement is a necessity
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Continuous Improvement
Where do we want to be?
Vision and Objectives
Where are we now?
Audits / Assessments
How do we get to where
we want to be?
Process Improvement
(Leverage Best Practices)
How do we monitor
Progress?
Metrics and Critical
Success Factors
© 2006 Jupitermedia Corporation
* Adapted from ITIL Service Support Graphic
IT Governance: Sound Management Practices that Deliver Results
If something doesn’t map to objectives and goals, then should it
be done?
Accounting
Manufacturing
Organizational Goal
Human Resources
© 2006 Jupitermedia Corporation
Sales
Customer Service
IT Governance: Sound Management Practices that Deliver Results
If something doesn’t map to objectives and goals, then should it
be done?
Accounting
Manufacturing
NO
Organizational Goal
Human Resources
© 2006 Jupitermedia Corporation
Sales
Customer Service
IT Governance:
Webcast Sound
Title Management Practices that Deliver Results
Thank you for the privilege of facilitating this webcast
George Spafford
[email protected]
http://www.pepperweed.com
Daily News Archive and Subscription Instructions
http://www.spaffordconsulting.com/dailynews.html
Please email either George or Kendra for a copy of this PPT
[email protected]
[email protected]
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Questions?
© 2006 Jupitermedia Corporation
IT Governance: Sound Management Practices that Deliver Results
Thank you for attending
If you have any further questions, e-mail
[email protected]
© 2006 Jupitermedia Corporation