Compliance

You Should, But Can You?

InfoManagement Direct, January 2006

Eugen Oetringer, Stephanie Case

In today's global environment, companies are overwhelmed with complexity, information overload and cultural obstacles. With this background, it shouldn't come as a surprise that the money lost in the information technology (IT) space has become unacceptable. It was the financial loss in combination with corporate fraud that led to the creation of Sarbanes-Oxley, Basel II and other regulations all over the globe. Basic business requirements and now regulatory needs require the creation of strategies and standards. Control and enforcement techniques currently receiving industry attention are believed to deliver the necessary compliance. But what if target audiences are unable to find the strategies and standards in the information overload? What if the instructions are unclear or outdated? What if the feedback loop is broken? What sound like trivial issues are major obstacles to compliance. The current trends of more regulation, control and enforcement simply cannot be effective if standards and corporate strategies do not exist or are unclear. Before compliance can be expected, target audiences must be brought into a position in which they can be compliant. Surprisingly, this doesn't have the industry's attention (yet).

What has happened? The way medium and large companies operate has changed considerably in recent years. Companies that were once working in local environments have become global companies. At the same time, IT made things possible that were unthinkable before. On the flip side, new challenges emerged along with the benefits. Many of those challenges have been overcome through well-known solutions. However, in this rather important area of IT strategies and the implementation of instructions for the strategies, known as standards, directions and implementation guides, there are substantial shortcomings. Therefore, it is no surprise if the true value of strategies lags well behind expectations or if projects are canceled after large sums of money have been spent.

Through IT, it became substantially easier to work together across organizational or country borders. Initially, it was an opportunity companies could explore. Then, driven by cost savings and globalization pressures, "working together" became a necessity. However, the new way of working together, combined with very complex IT structures, is not straightforward. New obstacles must be overcome. Some obstacles are of human nature and can't be overcome by any IT solution. Others are embedded deep in the day-to-day work and can't be seen by decision-makers. The matter is complicated, as companies today have to react to changing markets quicker than ever before. Opportunities have to be realized fast. The company must develop into an "agile enterprise."

Among other things, the combination of these factors has made strategies and their implementation instructions much more important than before. What was once solvable with colleagues nearby is quite different if the colleagues are thousands of miles away, speak a different language and are accustomed to a different culture. Of course, there are a multitude of frameworks that provide solutions. To name just a few, there are quality management, knowledge management and, in the IT space, ITIL, CMMI and IT Governance/COBIT. However, finding the instructions in the information overload requires satisfactory answers to questions such as: What about the interaction space between those frameworks? What about the interaction space between organizations, locations and processes?

It appears, however, that all of the aforementioned industry topics have something to do with IT strategies and the implementation instructions for those strategies. It also appears that, for larger companies, particularly those in the international environment, relationships between the industry topics, processes, organizations and locations can get extremely complex. From there, it is no surprise if important functionality in support of strategies is missing. Broken processes and disrupted information flows are a logical consequence.

Figure 1: Organizations and Processes on the Development and Production Sides Try to Connect

Figure 1 contains a graphical illustration of the problem. Organizations and processes on the development side try to connect with their counterparts in the production environments, and vice versa. Between both sides, there are additional complications such as competitive pressures demanding a productivity improvement program. Because of corporate complexity and missing functionality between both sides, too much is lost when information (strategies, standards, feedback, etc.) must cross the bridge.

With the increased importance of strategies and standards established, we asked questions such as: Where is the solution that manages the strategies and implementation instructions for the strategies? Where is the solution that drives compliance with the strategies and implementation instructions in a proactive, positive way? Where is the solution that constantly drives the owners of the strategies and implementation instructions to keep their documents current and connected to the needs of the production environment? We didn't get a satisfactory answer.

Looking at Figure 1, it should be obvious that the most logical place for a solution is between development and production. It should further be obvious that adding a complex solution to a complex environment is doomed to fail. Hence, the requirements for building an effective bridge become: 1) keep it simple to make it powerful, 2) include only the most important structures, and 3) get it exactly to the point at which things happen - as much as needed, as little as possible.

From this, a minimal functionality was developed that ensures the important information flows in both directions. At the development side, it drives owners of strategies and implementation instructions to keep their documents current and connected to the needs out in the field. It drives production environments to be compliant and to use the best practices in a proactive, positive way. Corrective actions are triggered as issues emerge. At any time, executives can check the health of their strategies. Figure 2 illustrates this functionality.

Figure 2: The Six Elements of The IT Strategy Management Process

The solution, called the IT Strategy Management Process, consists of six elements:

1. The technology repository is the single place where the IT strategies, standards, solutions and best practices are stored and managed.
2. The technical community is the place where individuals, organizations, processes and locations connect to collaborate and make decisions on technical matters.
3. Incentive techniques are used to overcome obstacles that are particularly relevant when departmental, country, culture and language boundaries must be crossed (often there is no cost for incentive techniques).
4. Integration between all process elements is required to achieve the full value.
5. The right balance is required to compromise between conflicting needs. Conflicts and out-of-balance situations are likely to show up in quality reporting, triggering corrective actions.
6. Ground rules put the IT Strategy Management Process in production and guide individuals as they take part in the process.

One could opt to position the IT Strategy Management Process between existing processes. This would cause endless debates. To obtain optimum value, the IT Strategy Management Process needs to be positioned as a lead process to all other IT processes (see Figure 3).

Figure 3: The IT Strategy Management Process Provides a Single Solution for Common Functionality

From Figure 3, it should be obvious that the IT Strategy Management Process does not replace any existing process, nor any of the industry frameworks previously mentioned. Its goal is to provide a single solution for common functionality between processes, organizations, locations and the industry frameworks, "gluing" them together. Through this process, it is possible to achieve, for example, a higher value from ITIL.

An extended description of the IT Strategy Management Process is available in The IT Strategy Management Process by Eugen Oetringer, available in the DM Review Bookstore under Strategic Intelligence. 

Eugen Oetringer is an infrastructure consultant for EDS. He is also the author of the book The IT Strategy Management Process (Van Haren Publishing). He can be reached at eugen.oetringer@eds.com.

Stephanie Case is a managing consultant for EDS and is a specialist in the areas of knowledge management, organizational learning and change management. She can be reached at stephanie.case@eds.com.

For more information on related topics, visit the following channels:

• Governance, Risk and Compliance