Tài liệu Strategy Execution for Risk Management pptx

Baselinemag - IT Management – Strategy Execution 1 Strategy Execution for Risk Management By Faisal Hoque Risk management and IT continuity are complex and critical disciplines. No investments can be effective in the long term without consideration of risk. The consequences of not doing adequate business continuity planning can be potentially disastrous. The outcomes of inadequate risk management span the gamut from financial losses to a loss of customer goodwill that may well threaten the long-term viability and survival of a firm. Today, with an increasingly unforgiving regulatory environment and legislation such as Sarbanes-Oxley that requires business technology systems to function without error, executives need to be concerned about risk management more than ever before. Business risks can be both internal to the firm, such as rolling out an inadequately tested system, as well as environmental, in the form of an unanticipated natural disaster. This two-sided model creates a challenge for business and technology executives. The former type of risk is somewhat more recurring, predictable and perhaps controllable, and, therefore, the business case for investment in risk management is often easier to justify. Meanwhile, the latter type of risk is unanticipated and episodic, and the typical firm questions the outlay of resources to protect against such rare occurrences. At its essence, risk management involves three steps: (1) Identifying the nature of risks inherent in the situation (2) Assessing the likelihood of the risks manifesting themselves (3) Taking preventive and corrective action to reduce the firm’s level of exposure to the risk. The past three decades of business computing have contributed much to our understanding of risk in the technology context. Unfortunately, a dominant focus in this prior work has been narrow – on controlling and managing projects, rather than on the broader risks that executives face in firms where technology is deeply and fundamentally embedded within the business. Indeed, the turn of the century has heralded significant changes in the business technology milieu that have created a compelling need to expand the focus of risk management from the micro project view to a broader enterprise perspective. These changes include an increasing emphasis on: (1) “Buying” and customizing packaged solutions rather than building systems in-house, i.e., on solutions integration rather than software development (2) Partnering with a wide array of providers to acquire needed technical competencies and skills, including taking advantage of off-shore resources (3) Using business technology for systems that span organizational boundaries and help link customers, through electronic commerce and CRM systems, suppliers, through fully integrated electronic supply chains, and other business partners together (4) Deploying business technology as the platform upon which the entire business is run. The Faces of Risk In this environment where business technology is pervasive, what is the nature of risk? Risks are classified into three broad categories: systems, sourcing and strategy, based on where they originate. Some risks are predominantly intra-enterprise in nature, such as systems and strategy, while others, notably sourcing, reflect the challenges that arise in inter-organizational settings. Note that although these categories are somewhat overlapping and not mutually exclusive, they nonetheless provide a conceptually simple framework that can be populated through conversations and interactions among executives from both technology and business. Effectively managing project risk requires that a structured process and organizational responsibilities be implemented at both the project and program levels. A formal risk management plan should be developed to clarify risk management roles and responsibilities; risk management processes, procedures, standards, training and tools; the method and frequency of risk progress reporting; and what should be monitored to determine if risks are occurring. A project should attempt to manage only the risks it can handle. Other risks should be elevated to the program level. Determination of whether to elevate should be made based on examination of whether the mitigation action steps are within the control of the project team. Managing risk at a program level involves a review of project risks and program risks by an Enterprise Program Management Office (EPMO). The EPMO should analyze project risk across the entire program to see if the same risk occurs in different projects and requires concerted action. Baselinemag - IT Management – Strategy Execution 2 The EPMO should document the inventory of risks, their assessment and mitigation plans in a database. If after analyzing program risk the overall program risk level is deemed to be higher than originally documented in the cost/benefit plan (i.e., the business case), then the business case should be updated-- reflecting the adjustment in the range of costs and/or benefits or a lower confidence measure. It is important that the EPMO collaborate with an Enterprise Risk Management (ERM) Group to ensure that the business impacts of project-related risks are well understood, and that a periodic evaluation can be made concerning the impact of other enterprise risks on the project. Risks in Context In an Interview with the BTM Institute, Toby Redshaw, the CIO of insurance giant, Aviva Group, explained that he reduces risk by seeing to it that activity at the project level is guided by the strategic needs of the enterprise: “Before we go to the next program or the next phase, we take a very serious look at the business. Did this deliver the benefits we said it would? What is the benefit realization picture of this? We have to get better at that here. I've seen many IT shops where this is non-existent, but that's the game. We've here to do things for the business and to deliver certain business. That sort of dialog and that sort of hard stare at ourselves will help us to become better and better at that. If technology’s real job is to have an impact on the profit and loss statement, then we need to have good discipline around portfolio demand management. Benefits realization is very important to us. From a technology perspective, we look at both internal customer satisfaction and external customer satisfaction. One of the biggest gaps that technology has is the connection back to the profit and loss statement. We often ask our front-line IT leaders who work on key projects to tell me or the other divisional CIOs how that project relates back to the profit and loss statement. How does that project affect earnings per share? What is the linkage in what they're doing to the overall business value?” Risks and threats emanating from strategy represent the dangers a firm faces when its management of business technology is poorly executed. Such systemic risks are manifest, for example, when business technology strategy is developed without the involvement of key business stakeholders, when project portfolios are constructed with a short-term orientation and with little or no consideration of strategic goals and priorities, and when sourcing decisions are made in a vacuum without sufficient understanding of the hazards of a lean in-house capability. The net negative result of not managing strategy risks is twofold. One, the firm is unable to extract the maximum value from its technology assets and business technology capabilities; over time the ability of the firm to deploy business technology effectively declines. Two, there is a potential for business sub- optimization due to either insufficient or inappropriate investment in business technology management. Although technology investments can be strategic and rational, very often they succumb to normal human tendencies. Many companies go from one extreme to the other. When things are good, the CIO promotes the idea of technology being a strategic enabler. When the business is in a downturn, the CIO is back to running technology as a cost center and trying to outsource as much as possible. Two years down the road, these organizations realize they've lost many capabilities and need to regroup. In today’s economy, the days of reward outweighing risk are a thing of the past. . Baselinemag - IT Management – Strategy Execution 1 Strategy Execution for Risk Management By Faisal Hoque Risk management and IT continuity. controllable, and, therefore, the business case for investment in risk management is often easier to justify. Meanwhile, the latter type of risk is unanticipated