Transcript
CIO’s Guide to Risk Management
Agenda
• Introductions• IT Management Basics• IT Risk Management• Managing Application Support Risks• Application Management Case Study• Managing Project Risks
Agenda
Computer Aid, Inc
• 30 Years in IT Consulting Services Business• Privately Held Entrepreneurial Organization• 3,000 Associates Worldwide• $300 Plus Million in Revenue in 2011• Offices in 34 U.S. Metropolitan Areas• Global offices in Toronto, London, Sydney, and
Kuwait, Singapore • Off-shore delivery: Philippines, China, Argentina,
Ethiopia, and India• Headquarters: Allentown, Pa.
Introductions
CAI Managed Services• Application Support Outsourcing
– Assume full responsibility for support– Fixed Price– Service Level Commitments– Continuous Improvement Commitments
• Application Development– Fixed Price Proposals– On-Time, On-Budget, High Quality, Warranty
• Help Desk Outsourcing– Service Level Commitments– Fixed Price
CAI ClientsManufacturing
Retail
Services
Financials Transportation / Logistics
Insurance Utilities
Government
Education
Agenda
• Introductions• IT Management Basics• IT Risk Management• Managing Application Support Risks• Application Management Case Study• Managing Project Risks
IT Management Basics
What is the mission of IT?
Deliver the Information Processing
Capability required by the business at
a cost that represents value
IT Services• Implement, operate, and support
– Infrastructure (servers, mainframes, networks)– System software and Tools
• Operating Systems • Data Query and Reporting• E-mail and Internet Access• Application design, development, and support tools
• Design, build/purchase, install, operate and support application software to support the business
• Store, protect and provide secure access to business information
• Provide consulting services to the business
Dimensions of IT Management• Strategy and Business Alignment
– Strategic Planning: Management Vision, Philosophy, and Objectives– Business Planning: Identify Business Needs– Portfolio Management: Initiate and prioritize projects– Budgeting: Authorize with budgets and funding
• IT Services – Technology Architecture: Languages, DBMS, Network– Infrastructure Operation: Operations Processes– Application Development: SDLC, Project Management, Standards– User Support and Services: Help Desk, SLA’s
• Administration and Control– Human Resource Management: HR Policies, Training– Supplier Management: Purchasing
Dimensions of Project Management
• Cost• Schedule• Scope• Quality• Risk
• Integration• Communication• Human Resources• Procurement• Methodology
Dimensions of Operations & Support Management
• Reliability• Availability• Capability• Timely• Responsive/Performance• Flexibility/Adaptability
IT Risk Management
What is an IT Risk?
The possibility that IT will not be able
to deliver the required capability
SEI Service CMMI• Identify the “Commitment to Deliver”• Establish the “Ability to Deliver”• Deliver
Note: Risk identification and mitigation are ongoing activities … requirements change which results in new commitments.
Risk Management (NASA)• Identify - scenarios for failure• Analyse - likelihood and consequence of failure• Plan - actions required to track and control risks• Track - program performance against plan• Control - risk issues and verify effectiveness• Communicate and Document
Identify & Analyse Risks• Strategic
– Does the business strategic plan address information processing capabilities?
– Is there a reasonable budget? – Does the Information Processing strategy directly link
to business goals and objectives?
Identify & Analyse Risks• Service Management Processes
– Do the services management processes adequately address the following areas?
• Change and Quality Management• Incident and Problem Management• Availability and Capacity Management
• Service Level Commitments– What type of commitments does IT make (by area)?– Are they reasonable?– What scenarios would prevent IT from meeting the
commitments?– Can IT respond to changing requirements?
• Application Architecture– Is the technology obsolete?– Does the application provide flexibility to respond to changing
business requirements? – Is the application reliable and available when needed?– Does it handle spikes in processing volumes?
• Hardware and System Software– What scenarios would impact this area?– What is the required capacity, availability, and security?– Do we have visibility of availability, reliability, and performance?– Can faulty components be replaced? – Can we identify trends?
Identify & Analyse Risks
• Application Operations and Support– Do the applications provide the required capabilities?– How often to they need to be enhanced?– How often do they need to be fixed?– What knowledge is required to operate and support?– Are they reliable, flexible, easy to use?– Is the technology obsolete?– Can they be easily updated to support changing
requirements?– What do they cost and what value is provided?
Identify & Analyse Risks
• Define success or the “commitment to deliver” (SLA’s, dates, estimates, scope)
• Analyse the “ability to deliver” including processes, tools, infrastructure, applications, staff, and knowledge
• Identify gaps or scenarios where the ability to deliver will not be able to meet the commitment
• Identify prevention or response actions
Risk Planning
• Is the available capacity for processing and services aligned with the demand to meet business needs without wasting resources?
• Are SLA’s being met? • Are processes being followed?• What is the level of quality and the reason for
defects? • Is the staff size and their knowledge level
adequate to meet the service demand?
Track Progress
• Is there a formal risk management process?• Are all risks logged?• Who owns the responsibility for ownership for
mitigation or prevention been assigned? • Are problems analyzed to determine the risks
that have not been addressed? • Is there a problem management process for
permanently fixing problems and eliminating risk?
Control
• Is there a formal risk management plan?• Are known risks communicated to the staff so
they can be aware of the risks? • Does the business participate in the prioritization
and mitigation of risks? • Are the causes and impacts of problems
communicated?
Communicate
Scenario:
Managing Application
Maintenance Risks
Application Risk Areas• Do the applications provide the required capabilities?• How often to they need to be enhanced?• How often do they need to be fixed?• What knowledge is required to operate and support?• Are they reliable, flexible, easy to use?• Is the technology obsolete?• Can they be easily updated to support changing
requirements?• What do they cost and what value is provided?
Plan and Manage• Inventory applications and their capabilities, availability
requirements, and redundancies. • Implement application management processes to track
costs, changes, quality, and value to business.• Identify missing or deficient capabilities and how
often they need to be enhanced. Initiate enhancements to provide user-controlled configuration.
• Eliminate recurring problems by implementing fixes. • Document required knowledge and facilitate
orientation or cross-training of staff.• Identify solutions for replacing obsolete technologies.• Develop a retirement strategy.
Management CapabilityVisibility• What services are needed?• What services are provided?• When are they provided?• How often? • Why are they provided?• How much do they cost?
Management CapabilityControl• Were the services authorized? • Did they deliver the correct result?• Were standard processes followed?• Were the services delivered on-time and on-
budget?• Did the customer receive value?
Management CapabilityOptimization• Reduce Risks and Costs• Improve Quality• Improve Processes • Improve Customer Satisfaction• Increase Value to the Business
Case Study:
Highmark Service Excellence Project
Service Excellence ProjectObjective:
Improve IT’s ability to meet or exceed commitments to the businessYear 1 Goal:
Increase value to the business by increasing time spent on enhancements from 4% to 18%
Achievements• Time spent on enhancements increased to 22.5% in 9 months and 36%
after 18 months• Enhancement backlog was eliminated• Application Problems and Support costs were reduced• Business management received increased visibility and control of their
requested services, required hours, and cost• Increased Customer Satisfaction
• Service requests were not logged
• Service Level Goals are not formally defined
• Most of the available resource hours are spent resolving incidents resulting in a large backlog of projects
• Customer satisfaction was not measured but it was assessed as poor based on informal feedback
• Most of the support management processes were informal and team specific
• Knowledge was undocumented resulting in a dependence on “hero experts for each application
• “Reactive” management because of limited visibility and control
Risk Assessment Results
Solution Framework
Visibility• Services• Resources• Performance• Metrics
Control• Implement Processes• Commitments/SLA’s• Enforce Processes• Authorize Services
Optimise• Improve Processes• Reduce/Prevent
Problems• Increase Value
Resulting Business Value• Increased quality, reduced rework and application problems, and
reduced support costs
• Improved process maturity
• Implemented metrics to support ongoing improvement initiatives
• Increased staff effectiveness and productivity
• Reduced risk
• Improved performance against commitments which improved customer satisfaction
Case Study
Pa. Department of Transportation
Application Management and Outsourcing
PennDOT Introduction Provides Transportation Management for
the Commonwealth of Pennsylvania
Created in 1970 to streamline transportation management Annual budget of over $6 bn of state and federal funds Total 121,000 miles of state and local highways Total 55,000 state and local bridges Manage 40,000 miles of highway and 25,000 bridges 12,000 employees 11.3 Million vehicle registrations 8.7 Million driving licenses Safety and Emissions control inspection programmes
Commonwealth Directive “Do more with less”
Commonwealth Budget 2011-12
Balance budget with no tax increases Refocus investment in core functions of government Reduce general fund budget by 4% ($1.17 billion) State spending overall reset to near 2008-09 levels State agencies are directed to focus on delivery and reduce
administrative overhead
Success
76,500 Function Points added0.2% defect rate
Scenario:
Managing Project Risks
Risk Analysis: Why Projects Fail?Standish Chaos Report
• Incomplete Requirements 13.1%• Lack of User Involvement 12.4%• Lack of Resources 10.6%• Unrealistic Expectations 9.9%• Lack of Executive Support 9.3%• Changing Requirements 8.7%• Lack of Planning 8.1%• Didn't Need It Any Longer 7.5%• Lack of IT Management 6.2%• Technology Illiteracy 4.3%• Other 9.9%
The solution begins with accountability
• Who is responsible for managing project risk?
• Who is responsible for project success?
• Who is to blame for project failures?
• Does the IT project team have unrealistic expectations of the business?
• Does the business have unrealistic expectations of the IT project team?
Mitigating Project Risks• Cleary defining Requirements minimizes changes and
re-work
• Establish an achievable Scope based on available resources, budgets, and expected completion date
• Plan the project to avoid Resource downtime and minimize schedule disruptions
• Identify Issues early to prevent problems and avoid the resulting re-work
Will you be successful?Effective Risk Management answers this question
• Required Information– Timely and accurate project performance data– Opinions/feedback from all participants– Status of all open issues
• Risk Analysis– Is the project on-time and on-budget for completed tasks?
– Is the project on-time and on-budget for active tasks?
– Has anything changed (scope, resource availability, customer satisfaction, levels of overtime)?
– What is the reason and impact of the change?– What is the impact of open issues?
Information Requirements• Stakeholder and Team Communications
– Requirements
– Status
– Issues/Concerns
• Project Performance data– Actual effort/cost vs. estimates
– Total Changes and the impact of changes
– Total Re-Work by reason (requirements changes vs. errors)
– Lost time due to schedule disruptions
Solutions• Improve communications with all project
participants without disrupting progress
• Ensure compliance with processes
• Collect and analyze project performance metrics to identify trends and new risks
• Efficient staff orientation to the project and the management processes to enable agile staffing
• Establish accountability
How does CAI succeed?• Repeatable Processes are used to manage requirements,
scope, schedules, risk, issues, changes, quality, and resources
• Tracer Service Management Tool provides visibility (metrics) and status into all assigned activities across projects and support
• Automated Project Office Answers the question “Will we succeed?”
– Early identification of risks by conducting project health assessments to analyze project performance metrics and surveys of participants and stakeholders
– Validates compliance with processes
Automated Project Office Visibility of Issues
Automated Project Office Visibility of Issues
How can CAI help you?• Fixed price Application Development services
• Application Support Outsourcing to allow your staff to work on projects
• Project Management and Transformation consulting to improve effectiveness
• Automated Project Office tool to enable a rapid project office implementation
• ITMPI – IT Metrics and Productivity Institute provides access to resources and knowledge from world-renowned experts in various fields
Thank You.
top related