The promise of the Cloud

Cloud computing is a on-demand service model for IT provision, often based on virtualisation and distributed computing technologies.

The attractiveness of Cloud Computing

By moving IT services to the Cloud, enterprises can take advantage of using services in an on demand-model. The infrastructure costs are reduced and services are paid on an subscription or pay-per-use basis. The Cloud offers a way to extend IT’s existing capabilities on the fly without investing in new infrastructure, training new personnel, or licensing new software.

The Cloud service delivery models

Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

• the risk management approach of personal data;
• the priorities set and the mechanisms introduced, as a result of the risk assessment;
• a planning for the policy’s taking effect;
• a description of the various responsibilities and organisational rules;
• a description of how to manage security incidents;
• a description of the awareness-raising process within the organisation;
• the measures to keep the security system up-to-date.

Why is IT governance so crucial?

Most organisations are currently facing 7 IT challenges:

• Keeping IT running is the need to guarantee the continuity of IT services for business-critical services. The discontinuity of IT services may result in lost business, reduced profits, and serious damage to the organisation’s reputation. 
   
• Creating value by identifying the right IT projects and carrying them out within time and budget to deliver the expected value. In IT projects which exceed budgetary expectations or deadlines, business requirements are often poorly defined, project management is weak, and the effort required is underestimated.
   
• Managing IT costs as carefully as the other significant business costs. Typically, costs associated with IT assets are not well understood, skilled resources are lacking and IT spending is not coordinated.
   
• Mastering complexity by organising and managing the IT function, to ensure that applications are delivered and updated within the managed cost and deadlines. Typical issues are the management of technical infrastructures, the adaptation to changes and the management of external relationships.
   
• Aligning with the business to ensure that IT works in partnership with the business to deliver value. The inability to set priorities and poor communication between business and IT creates a gap between what users expect and what IT provides.
   
• Complying with the legal and contractual requirements of service providers and trading partners. Regulations that govern business operations impact IT systems. The IT function needs to be aware of legal and regulatory requirements that relate to financial reporting, privacy and security.
   
• Ensuring information security in order to protect information adequately. Internet, external communications, the increasing misuse of information and the technical complexity all amplify the risk of information disclosure.

What IT Governance should deliver?

The 7 IT Governance principles to be considered:

• The governance context implies leadership and commitment. The management puts into place clear and precise organisational structures by establishing IT’s roles and responsibilities. The management ensures that standards, policies and procedures are created, and a code of conduct is implemented.
   
• The IT strategy defines the mission and the vision through which information systems contribute to the achievement of the enterprise strategy. Strategic alignment might imply reducing costs, supporting innovation, enhancing simplification, meeting service requirements, enabling expansion, improving business processes, etc.
   
• The value creation is accomplished by controlling IT investments and projects. Among the numerous investment proposals, the judicious choice is based on the return on investment (ROI) and strategic contribution. The focus is placed on the projects with the highest added value. IT and the business are jointly responsible for the achievements.
   
• Risk management protects against threats through the identification, the analysis and the treatment of the IT risks. Security entails management and user awareness, regarding their responsibilities and the possible risks. Information security, data confidentiality and asset protection are ensured, while the continuity of the business activities is guaranteed in the case of a disaster.
   
• Resource optimisation implies efficient and effective processes and optimal resource allocation such as people, systems, infrastructure and information. The efficient and effective use of resources will be balanced against achievements.
   
• Communication methods are put into place to provide the stakeholders with correct information at the right moment. Communication is implemented through adequate relational mechanisms, e.g., IT steering committees.
   
• The monitoring evaluates the IT achievements through performance indicators and balanced scorecards. IT audits provide independent assessments of the IT governance implementation.

        IT Governance: a major driver of business value

Governance requires a balance between the performance and conformance goals, directed and controlled by the board. Performance tends to enhance profitability, efficiency, effectiveness and to ensure business growth. Conformance involves the management of the adequate level of control for the IT risk taking approach. Implementing IT Governance is challenging, but the outcome is rewarding.

Monique Garsoux & Patrick Soenen, Qualified Audit Partners

The established defence lines

A set of common control, risk and compliance activities are executed across business units and control functions, and are organised as defence lines.

The primary goal is to organise these functions within the organisation to strengthen its defence.

Within the inner circle, the staff applies the policies and the procedures issued by the management, to ensure the regularity, the security and the validity of the operations. The internal control mechanisms are an essential component of the successful direction and control of the organisation. The senior executive management should focus on creating organisational transparency by defining the mechanisms an organisation uses to ensure that its constituents follow established processes and policies.

The second line of defence is composed of those functions responsible for an area of control expertise.

Internal control is a process, performed to provide reasonable assurance regarding the achievement of objectives in the following areas:

• Effectiveness of operations and efficient use of the resources;
• Reliability of financial and operational reporting;
• Compliance with applicable laws, regulations and internal policies.

Resilience ensures the ongoing business continuity, while security ensures the confidentiality, the integrity and the availability of the operations, the systems and the information.

Quality management has the responsibility to establish a Quality Management System (QMS) based on an operational framework, composed of processes and procedures, compliant with the ISO standards.

The third line of defence consists of audit and assurance functions, which are performed by internal audit, the external audit and the regulators. Internal audit provides reasonable assurance that the required controls to mitigate risks are effectively designed and operated.  Internal audit should report to the highest level within the organisation to strengthen its objectivity and confirm its independence. A close and continuous link should be established with the Audit Committee.

Risk, Control and reporting fragmentation

The multiplication of the internal control actors increases complexity, creates a duplication of effort and may reduce the effectiveness of the internal control. At a given moment, the key players may be confident someone else takes care of a specific risk or control, without investing the required level of expertise to mitigate the risks. Consequently, the control, risk, and compliance activities should be coordinated.

Organisational fragmentation: As different policies, risks events, measurements are defined, the organisation ends up with different policies, duplication of effort, difficulty of predicting risk, and lack of transparency.

Information fragmentation: Local process implementation and optimisation of specific solutions further isolate information within systems, resulting in a lack of information integrity and a limited integrating view of enterprise risks.

Entity fragmentation: Policies and risks are generally defined and measured at the local level, without proper consideration of their impact on the global, multinational, national, or regional decision making levels. The interdependencies of the risks associated with the multitude of jurisdictions, countries, and markets are usually not considered.

Initiative fragmentation: The multiplication of the risk and control key players within the organisation increases the number of separate and non coordinated initiatives concerning financial reporting, security issues, information privacy, record retention, business regulations, environmental standards, occupational safety, etc.

Each player is developing analogous risk and control models customised to their specific needs and reporting axes. Organisations finally end up with several similar approaches which are delivering managing reports, providing diverse or even conflicting recommendations. Like in Babylon, management and board members get confused due to these different risk languages.

The integrated GRC model as a solution

GRC is a system of people, processes and technology that enables an organisation to:

• Understand and prioritise stakeholder expectations;
• Set business objectives congruent with the risks;
• Operate within internal, social, ethical, legal and contractual boundaries;
• Provide relevant, reliable, transparent and timely information to the stakeholders;
• Enable the measurement of the performance and the conformance of the organisation.

The GRC model consists of several interrelated components:

• The model starts with the identification and the description of the business universe. The organisation’s main products and services, customer groups and distribution channels are defined. The major business processes representing the core value-chain processes and the support processes are represented. And finally the strategic objectives are established.
• The foundation of the GRC model is based on risk and controls categories also called assurance map. It lists universally accepted risks and controls which serve as the base for the establishment of the organisation’s risks and controls. Risks categories are those universally accepted risks which are critical to the organisation’s business objectives. For these risks, impact and likelihood are estimated. The universally accepted controls used to mitigate the risk categories are defined as controls categories.

• Risk management identifies, analyses, evaluates and mitigates risk by applying the risk categories to the business universe. Risk and control self-assessment may be performed at management level to identify the key risks. An event database keeps track of all risk events which have occurred within the organisation. The monitoring and the review of the risk management generate improvement action which is integrated into the action plan.
• Internal control management applies the control categories to the specific business processes to manage the above identified process risks. Adequate control activities are designed and implemented. The assessment of the design and operational effectiveness of these implemented controls results in corrective and improvement action, which is also integrated into the global action plan.
• The audit department uses the risk and control categories to build up the audit plan. The different audit assignments will independently assess the adequacy and the effectiveness of the implemented controls to mitigate the identified risks. An audit opinion will be rendered and recommendations are formulated. The accepted action is included in the global action plan.

Subsequently, the GRC action plan contains the whole action set which corrects and enhances the global risk and control management within the organisation. Appropriate action selection, prioritisation and follow-up are required to ensure that the action contributing most to the improvement of the control and risk environment is executed first.

Implementing the GRC model

A set of requirements condition the successful implementation of the GRC model:

• Support of the top management, which is directly interested by the benefits of a global risk and control approach;
• Cooperation between the different management, control, risk and audit functions within the organisation;
• A definition of the business universe consisting of the strategic objectives, the business products/services definition, and the description of the enterprise business model in terms of core and support processes;
• A stepwise implementation ensuring a phased roll out of the model;
• Adequate project management to attain the defined goals.

Key roles and accountabilities

The board has the oversight of the GRC system and should

• Set business objectives and ensure they are congruent with values and risks;
• Be knowledgeable about the design and the operation of the GRC model;
• Obtain regular assurance the system is effective;

The management must undertake the implementation and the follow-up of the GRC system.

• Design, implement and operate an efficient GRC system;
• Communicate transparently with stakeholders about the GRC’s efficiency;
• Evaluate and optimise the effectiveness and the efficiency of the GRC system.

Audit should provide assurance to the board and the management that

• Risks are appropriately identified, evaluated, managed and monitored;
• The GRC system is effectively designed to mitigate risks;
• The GRC system is operating effectively.
• The other risk and assurance providers are functioning effectively.

As a best practice, a GRC steering committee is set up to manage the GRC global structure and to coordinate the different key players.

Impact of the GRC model

The Global Risk and Control approach impacts the organisation and implies good coordination through:

• The integration of the GRC disciplines which act as a backbone for the management of enterprise risks and controls;
• The integration of the GRC activities ensuring common action to achieve the strategic objectives;
• The GRC integration with the business, by aligning the risk and control activities on common business processes;
• The distribution of adequate GRC information to all levels of the organisation;
• The adjustment of the mechanism to the exposed risks, the costs of the controls and the size of the organisation.

Benefits of the GRC model

GRC brings multiple benefits to the organisation:

• Reducing costs as redundant activities are streamlined;
• Reducing the impact of risk events due to the global risk and control approach;
• More effective improvement action through an integrated and coordinated risk and control action plan;

Optimising competencies and scarce resources;

Increased quality of risk based information for strategic planning;

Enhanced board and management trust resulting from an integrated oversight and reporting on risks and controls, increasing stakeholder’s confidence.

Monique Garsoux & Patrick Soenen, Qualified Audit Partners

Over the past decade, agile methods have completely changed the technical software development. But the project management methods, which remained very traditional, aren’t any more adapted to these very agile development techniques. Agile management both at executive and at project level provides innovative and new solutions. The agile principles were already applied in the famous Deming PDCA circle where at each iteration, action is planned and executed, the results are checked and the approach is adjusted.

The benefits

The success of an agile organisation lies in its ability to develop methods and structures through which the organisation can adapt quickly to changed environmental circumstances. Agility is different from agitation, the hustle, and requires a very strict methodology, far away from the chaotic image that is sometimes linked to the concept of agility.

The agile management methods were originally developed in the computer industry in parallel with agile programming methods. Today they tend to spread in the field of services and affect even areas traditionally hostile to this type of approach, such as engineering. This sector is indeed under pressure from its customers, who want to adapt their projects underway, with the changing economic and financial context. This impacts even the industrial and energy infrastructure, enforcing a cultural revolution to the engineering teams to adjust projects with dynamic boundaries.

Even the health sector is interested in the agile approach, as both financial and socio-economic conditions change very quickly. The numerous mergers of hospital institutions, the crisis of public finances, the aging population, the computerisation of patient records and the e-health developments are all events that have compelled the non-profit sector to adapt to rapidly evolving situations, requiring new management approaches.

The principles of agile management

Agile management structures the interactions between the main operational components of an organisation: human resources, processes and technology systems. An agile organisation is functionally operational when its components interact to capture and integrate change.

The agile organisation is based on 3 vectors:

1. The rational motivation of human resources brings the collective intelligence that maximises the human potential. The proactive involvement of human resources promotes systematic improvement. Skills, attitude and mindset are the most important factors in agility.
2. The formalised control of continuous process improvement allows optimisation of resources used. Continuous process optimisation projects represent powerful means to obtain competitive advantages at the best price.
3. The optimal use of new technologies allows economical mass customisation of products and services and reduces time to market. An agile information system is characterised by its ability to provide optimum response to changes in the organisation.

The agile management therefore incorporates the concept of “lean management” which seeks to maximise efficiency through the elimination of waste by removing processes that add no value. Agile management implies process control and a search for continuous process improvement (through Business Process Management – BPM). It also requires optimal use of new information and communication technologies (ICTs). However, only the combination of these three dimensions enables agility.

Today, a successful company is “service oriented”. And its tools are performance and quality of its processes. To be agile, the company must simultaneously master the dynamic evolution of human resources, business processes and information system.

The characteristics of the agile management compared to traditional management

In the traditional approach, the ultimate goal is translated early in a scope, a planning and (financial, human and technical) resources. In the agile management, the emphasis is on achieving goals, broken down into sub goals of affordable size per iteration. Over the iterations, the scope becomes dynamic.

The traditional planning involves initially considerable preparation with subsequent minor updates throughout the project. Agile planning is divided into multiple levels ranging from a high-level planning (macro-planning) up to detailed planning, established at the beginning of each iteration. The initial planning should be flexible to allow changes in customer demand throughout the project.

While the traditional approach breaks down the project by cascading a series of sequential tasks, the achievement in agile is iterative and incremental, making sure to deliver a tangible result to the client at each iteration.

The management role is in coaching teams to remove barriers to advancement. Decision making is decentralised to the teams. The roles and responsibilities aren’t based any more on titles and functions, but organised according to the expertise of the people.

Work organisation is decentralised and focused on results and on a watch of the constantly changing market environment. Confidence in the team, composed of individuals mastering the processes, improves the efficiency and effectiveness of the work performed.

Traditional risk management is descriptive, identifying the starting point of the potential risks along with mitigation actions. In the agile approach, risk management is based on experimentation. Learning takes place over the iterations. And within the iterations, the impact of failures is limited. 

The agile methodology in project management

The diagram below shows the methodology applied to agile project management.

The agile methodology is broken down into 5 steps

1. In the “Version Scope” phase, the requirements are identified. Even if the scope can evolve throughout the project, the scope is clearly defined at the start. The project terms of reference detail the project costs and benefits, taking into account the implications of identified risks. This first step is important for the specification of the requirements and for setting priorities.
2. Based on the initial plan and the achievements from the previous iterations, the cycle plan describes activities for the next iteration accurately and in detail. Each new iteration begins with a planning stage.
3. The Build cycle is realised in an iterative way, making sure that each iteration delivers a concrete and usable result for the user.
4. The Client checkpoint includes a quality review at the end of each iteration. The work done during the iteration is validated.
5. The Post-Version review generates feedback resulting into improvement plans. The effective realisation of initial expectations is evaluated.

The criteria

Agile management is based on 7 criteria:

• sharing the goal by emphasising cooperation at all company levels;
• a cooperative decision making process;
• leadership, combined with a collaborative work team;
• performance assessmen, ensuring control is replaced by result measurements and individual performance by group performance;
• adaptive resources depending on the context and the environment;
• value creation in order to innovate for greater customer satisfaction;
• stimulation of horizontal and vertical cooperation between departments, individuals and disciplines.

The implementation at the management level

The agile approach covers the main operational components of the company, i.e. human resources, process and technology. To avoid to destabilise the organisation, agility must be implemented in steps and in a iterative manner.

The first step is to readjust the organisation by establishing the roles and responsibilities across the organisation. Afterwards, human resources skills are adjusted in relation to this new organisational structure. During the next step, the processes are formalised and improved. Finally, the introduction of new technologies allows the process optimisation. And the changes made require a new realignment of the organisation, thus launching a new iteration.

An agile approach to dashboards

The agile approach is perfectly suited to scorecard methodologies (Balanced Scorecards), which like agile management methods put the focus on performance. To achieve the financial and collective performance and satisfy customers or users, organisations must optimise their resources and their internal processes. The learning and growth perspective incorporates the concept of the learning organisation and the collective intelligence.

Jean-Pierre Palante | jp.palante[at]qap.eu ♦ Patrick Soenen | p.soenen[at]qap.eu