Downloaded 110 times
Uploaded byComputer Aid, Inc
IT Risk Management
This document discusses risk management in information technology. It begins with introductions and an agenda. It then covers IT management basics like strategy, operations, and project management. It defines IT risks as the possibility that IT will not be able to deliver required capabilities. It discusses identifying, analyzing, planning for, tracking, controlling, and communicating risks. It provides an example of managing application support risks and a case study on a project to improve service excellence at an organization.
More Related Content
![JPOBRIEN_CV[1][1]](https://cdn.slidesharecdn.com/ss_thumbnails/e2bb774b-38c9-4001-8d61-f26b891541cd-150331192903-conversion-gate01-thumbnail.jpg?width=640&height=640&fit=bounds)
IT Risk Management
- 1. CIO’s Guide toRisk Management
- 2. Agenda • Introductions • IT Management Basics • IT Risk Management • Managing Application Support Risks • Application Management Case Study • Managing Project Risks
- 3. Introductions Agenda Computer Aid, Inc • 30 Years in IT Consulting Services Business • Privately Held Entrepreneurial Organization • 3,000 Associates Worldwide • $300 Plus Million in Revenue in 2011 • Offices in 34 U.S. Metropolitan Areas • Global offices in Toronto, London, Sydney, and Kuwait, Singapore • Off-shore delivery: Philippines, China, Argentina, Ethiopia, and India • Headquarters: Allentown, Pa.
- 4. CAI Managed Services •Application Support Outsourcing – Assume full responsibility for support – Fixed Price – Service Level Commitments – Continuous Improvement Commitments • Application Development – Fixed Price Proposals – On-Time, On-Budget, High Quality, Warranty • Help Desk Outsourcing – Service Level Commitments – Fixed Price
- 5. CAI Clients Manufacturing Government Retail Financials Transportation / Logistics Services Education Insurance Utilities
- 6. Agenda • Introductions • IT Management Basics • IT Risk Management • Managing Application Support Risks • Application Management Case Study • Managing Project Risks
- 7. IT Management Basics
- 8. What is themission of IT? Deliver the Information Processing Capability required by the business at a cost that represents value
- 9. IT Services • Implement,operate, and support – Infrastructure (servers, mainframes, networks) – System software and Tools • Operating Systems • Data Query and Reporting • E-mail and Internet Access • Application design, development, and support tools • Design, build/purchase, install, operate and support application software to support the business • Store, protect and provide secure access to business information • Provide consulting services to the business
- 10. Dimensions of ITManagement • Strategy and Business Alignment – Strategic Planning: Management Vision, Philosophy, and Objectives – Business Planning: Identify Business Needs – Portfolio Management: Initiate and prioritize projects – Budgeting: Authorize with budgets and funding • IT Services – Technology Architecture: Languages, DBMS, Network – Infrastructure Operation: Operations Processes – Application Development: SDLC, Project Management, Standards – User Support and Services: Help Desk, SLA’s • Administration and Control – Human Resource Management: HR Policies, Training – Supplier Management: Purchasing
- 11. Dimensions of Project Management • Cost • Integration • Schedule • Communication • Scope • Human Resources • Quality • Procurement • Risk • Methodology
- 12. Dimensions of Operations& Support Management • Reliability • Availability • Capability • Timely • Responsive/Performance • Flexibility/Adaptability
- 13.
- 14. What is anIT Risk? The possibility that IT will not be able to deliver the required capability
- 15. SEI Service CMMI •Identify the “Commitment to Deliver” • Establish the “Ability to Deliver” • Deliver Note: Risk identification and mitigation are ongoing activities … requirements change which results in new commitments.
- 16. Risk Management Impacton Project Success
- 17. Risk Management (NASA) • Identify - scenarios for failure • Analyse - likelihood and consequence of failure • Plan - actions required to track and control risks • Track - program performance against plan • Control - risk issues and verify effectiveness • Communicate and Document
- 18. Identify & AnalyseRisks • Strategic – Does the business strategic plan address information processing capabilities? – Is there a reasonable budget? – Does the Information Processing strategy directly link to business goals and objectives?
- 19. Identify & AnalyseRisks • Service Management Processes – Do the services management processes adequately address the following areas? • Change and Quality Management • Incident and Problem Management • Availability and Capacity Management • Service Level Commitments – What type of commitments does IT make (by area)? – Are they reasonable? – What scenarios would prevent IT from meeting the commitments? – Can IT respond to changing requirements?
- 20. Identify & AnalyseRisks • Application Architecture – Is the technology obsolete? – Does the application provide flexibility to respond to changing business requirements? – Is the application reliable and available when needed? – Does it handle spikes in processing volumes? • Hardware and System Software – What scenarios would impact this area? – What is the required capacity, availability, and security? – Do we have visibility of availability, reliability, and performance? – Can faulty components be replaced? – Can we identify trends?
- 21. Identify & AnalyseRisks • Application Operations and Support – Do the applications provide the required capabilities? – How often to they need to be enhanced? – How often do they need to be fixed? – What knowledge is required to operate and support? – Are they reliable, flexible, easy to use? – Is the technology obsolete? – Can they be easily updated to support changing requirements? – What do they cost and what value is provided?
- 22. Risk Planning • Definesuccess or the “commitment to deliver” (SLA’s, dates, estimates, scope) • Analyse the “ability to deliver” including processes, tools, infrastructure, applications, staff, and knowledge • Identify gaps or scenarios where the ability to deliver will not be able to meet the commitment • Identify prevention or response actions
- 23. Track Progress • Isthe available capacity for processing and services aligned with the demand to meet business needs without wasting resources? • Are SLA’s being met? • Are processes being followed? • What is the level of quality and the reason for defects? • Is the staff size and their knowledge level adequate to meet the service demand?
- 24. Control • Is therea formal risk management process? • Are all risks logged? • Who owns the responsibility for ownership for mitigation or prevention been assigned? • Are problems analyzed to determine the risks that have not been addressed? • Is there a problem management process for permanently fixing problems and eliminating risk?
- 25. Communicate • Is therea formal risk management plan? • Are known risks communicated to the staff so they can be aware of the risks? • Does the business participate in the prioritization and mitigation of risks? • Are the causes and impacts of problems communicated?
- 26. Scenario: Managing Application Maintenance Risks
- 27. Application Risk Areas •Do the applications provide the required capabilities? • How often to they need to be enhanced? • How often do they need to be fixed? • What knowledge is required to operate and support? • Are they reliable, flexible, easy to use? • Is the technology obsolete? • Can they be easily updated to support changing requirements? • What do they cost and what value is provided?
- 28. Plan and Manage •Inventory applications and their capabilities, availability requirements, and redundancies. • Implement application management processes to track costs, changes, quality, and value to business. • Identify missing or deficient capabilities and how often they need to be enhanced. Initiate enhancements to provide user-controlled configuration. • Eliminate recurring problems by implementing fixes. • Document required knowledge and facilitate orientation or cross-training of staff. • Identify solutions for replacing obsolete technologies. • Develop a retirement strategy.
- 29. Management Capability Visibility • What services are needed? • What services are provided? • When are they provided? • How often? • Why are they provided? • How much do they cost?
- 30. Management Capability Control • Werethe services authorized? • Did they deliver the correct result? • Were standard processes followed? • Were the services delivered on-time and on- budget? • Did the customer receive value?
- 31. Management Capability Optimization • Reduce Risks and Costs • Improve Quality • Improve Processes • Improve Customer Satisfaction • Increase Value to the Business
- 32.
- 33. Service Excellence Project Objective: Improve IT’s ability to meet or exceed commitments to the business Year 1 Goal: Increase value to the business by increasing time spent on enhancements from 4% to 18% Achievements • Time spent on enhancements increased to 22.5% in 9 months and 36% after 18 months • Enhancement backlog was eliminated • Application Problems and Support costs were reduced • Business management received increased visibility and control of their requested services, required hours, and cost • Increased Customer Satisfaction
- 34. Risk Assessment Results • Service requests were not logged • Service Level Goals are not formally defined • Most of the available resource hours are spent resolving incidents resulting in a large backlog of projects • Customer satisfaction was not measured but it was assessed as poor based on informal feedback • Most of the support management processes were informal and team specific • Knowledge was undocumented resulting in a dependence on “hero experts for each application • “Reactive” management because of limited visibility and control
- 35. Solution Framework Optimise •Improve Processes •Reduce/Prevent Problems •Increase Value Control •Implement Processes •Commitments/SLA’s •Enforce Processes •Authorize Services Visibility •Services •Resources •Performance •Metrics
- 36. Resulting Business Value • Increased quality, reduced rework and application problems, and reduced support costs • Improved process maturity • Implemented metrics to support ongoing improvement initiatives • Increased staff effectiveness and productivity • Reduced risk • Improved performance against commitments which improved customer satisfaction
- 37. Case Study Pa. Departmentof Transportation Application Management and Outsourcing
- 38. PennDOT Introduction ProvidesTransportation Management for the Commonwealth of Pennsylvania Created in 1970 to streamline transportation management Annual budget of over $6 bn of state and federal funds Total 121,000 miles of state and local highways Total 55,000 state and local bridges Manage 40,000 miles of highway and 25,000 bridges 12,000 employees 11.3 Million vehicle registrations 8.7 Million driving licenses Safety and Emissions control inspection programmes
- 39. Commonwealth Directive “Do more with less” Commonwealth Budget 2011-12 Balance budget with no tax increases Refocus investment in core functions of government Reduce general fund budget by 4% ($1.17 billion) State spending overall reset to near 2008-09 levels State agencies are directed to focus on delivery and reduce administrative overhead
- 40. Success 76,500 Function Points added 0.2% defect rate
- 41.
- 42. Risk Analysis: WhyProjects Fail? Standish Chaos Report • Incomplete Requirements 13.1% • Lack of User Involvement 12.4% • Lack of Resources 10.6% • Unrealistic Expectations 9.9% • Lack of Executive Support 9.3% • Changing Requirements 8.7% • Lack of Planning 8.1% • Didn't Need It Any Longer 7.5% • Lack of IT Management 6.2% • Technology Illiteracy 4.3% • Other 9.9%
- 43. The solution beginswith accountability • Who is responsible for managing project risk? • Who is responsible for project success? • Who is to blame for project failures? • Does the IT project team have unrealistic expectations of the business? • Does the business have unrealistic expectations of the IT project team?
- 44. Mitigating Project Risks •Cleary defining Requirements minimizes changes and re-work • Establish an achievable Scope based on available resources, budgets, and expected completion date • Plan the project to avoid Resource downtime and minimize schedule disruptions • Identify Issues early to prevent problems and avoid the resulting re-work
- 45. Will you besuccessful? Effective Risk Management answers this question • Required Information – Timely and accurate project performance data – Opinions/feedback from all participants – Status of all open issues • Risk Analysis – Is the project on-time and on-budget for completed tasks? – Is the project on-time and on-budget for active tasks? – Has anything changed (scope, resource availability, customer satisfaction, levels of overtime)? – What is the reason and impact of the change? – What is the impact of open issues?
- 46. Information Requirements • Stakeholderand Team Communications – Requirements – Status – Issues/Concerns • Project Performance data – Actual effort/cost vs. estimates – Total Changes and the impact of changes – Total Re-Work by reason (requirements changes vs. errors) – Lost time due to schedule disruptions
- 47. Solutions • Improve communicationswith all project participants without disrupting progress • Ensure compliance with processes • Collect and analyze project performance metrics to identify trends and new risks • Efficient staff orientation to the project and the management processes to enable agile staffing • Establish accountability
- 48. How does CAIsucceed? • Repeatable Processes are used to manage requirements, scope, schedules, risk, issues, changes, quality, and resources • Tracer Service Management Tool provides visibility (metrics) and status into all assigned activities across projects and support • Automated Project Office Answers the question “Will we succeed?” – Early identification of risks by conducting project health assessments to analyze project performance metrics and surveys of participants and stakeholders – Validates compliance with processes
- 49. Automated Project Office Visibility of Issues
- 50. Automated Project Office Visibility of Issues
- 51. How can CAIhelp you? • Fixed price Application Development services • Application Support Outsourcing to allow your staff to work on projects • Project Management and Transformation consulting to improve effectiveness • Automated Project Office tool to enable a rapid project office implementation • ITMPI – IT Metrics and Productivity Institute provides access to resources and knowledge from world- renowned experts in various fields
- 52.
Editor's Notes
- #10 In order to provide the required processing capability, IT provides the following services:Implement, operate and support hardware (servers, networks, printers) Implement support and utilize variety of general purpose tools such as E-mail, Query software, and tools for developing and supporting applications.Design, build/purchase, install, operate, and support applicationsStore and protect informationIT also provides a wide variety of consulting and planning services to the business
- #11 IT management consists of three major categories and 10 dimensions. It is important to note that IT is a young profession and standard management frameworks are still evolving. In order to ensure success, each of the management frameworks must address these common areas.
- #12 Delivery of IT services consists of scheduled activities and on-demand services. Scheduled activities are typically managed as projects and success requires management of the following areas:
- #13 Delivery of IT services consists of scheduled activities and on-demand services. Scheduled activities are typically managed as projects and success requires management of the following areas:
- #16 SEI defines provides a process maturity framework and they have defined a Capability Maturity model for services. This framework says that service organizations must first “Identify their commitment to deliver” and then “establish the ability to deliver”Commitments can be tactical (short-term) or strategic and business requirements may require new commitments. As a result, Risk identification and mitigation are ongoing activities.Keep in mind: Business expectations may be unreasonable and they may be impossible to meet. The mission of IT is to manage expectations and meet their commitments.
- #17 According to this study by Interlink consulting, Risk Management has the biggest impact on project success.
- #18 Let us discuss some risk management theory. NASA specializes in managing risk. Their missions are some of the riskiest endeavors ever attempted by man. NASA identifies the following activities for identifying and managing risk:Identify failure scenarios. Analyse the likelihood that the scenario will occur. There is a possibility that you will leave your house and be struck by a meteor but the likelihood of such an event is so remote that you would not take any precautions. On the other hand, if it is cloudy and humid, it is likely there will be rain so you should mitigate the risk by taking an umbrella.Planning includes defining the activities required to track risks and control their impact through mitigation or recovery actions.If you choose not to mitigate the risk, it is important to track the frequency and impact if problems when they occur. Effective Risk Management also includes communication and awareness
- #19 The next step is to Analyse the risks. If we agree that a risk is the possibility of not meeting commitments then we should analyse the scenarios that may cause us to meet commitments.Identify the types of commitments, how they align with expectations, determine if they are reasonable, and how to ensure they are met. We must also recognize that requirements will change which will require new commitments.Finally, management processes should be analysed to determine if they are adequate.
- #20 The next step is to Analyse the risks. If we agree that a risk is the possibility of not meeting commitments then we should analyse the scenarios that may cause us to meet commitments.Identify the types of commitments, how they align with expectations, determine if they are reasonable, and how to ensure they are met. We must also recognize that requirements will change which will require new commitments.Finally, management processes should be analysed to determine if they are adequate.
- #21 The next step is to Analyse the risks. If we agree that a risk is the possibility of not meeting commitments then we should analyse the scenarios that may cause us to meet commitments.Identify the types of commitments, how they align with expectations, determine if they are reasonable, and how to ensure they are met. We must also recognize that requirements will change which will require new commitments.Finally, management processes should be analysed to determine if they are adequate.
- #22 Application management is one of the highest risk areas for IT. Applications provide the direct link to the business. They are difficult/expensive to develop or purchase and they also require extensive support. Application inventories should be assessed based on the following criteria:
- #23 In order to identify risk scenarios, we need to define success based on commitments. Then we need to address issues with our ability to deliver on these commitments,
- #24 Tracking progress is a proactive step. If we do not track progress then we cannot identify trends and anticipate and prevent problems. Examples of progress tracking include:
- #25 Control cannot be achieved without a formal risk management process that includes logging risks and issues and assigning ownership for mitigation or resolution. This includes an analysis of problems to identify new risks. This requires incident tracking and problem management capabilities.
- #26 If the Risk Management Team does not communicate risks and implement processes to mitigate risks, then they will have to react to the resulting problems without the ability to prevent them. A formal Risk Management Plan provides an excellent mechanism for communicating risks. This also makes it easier for the business to participate in the prioritization and mitigation of risks and the identification of problems.
- #28 The following questions should be answered for each application, gaps should be identified, and a plan should be prepared to address the gaps.
- #29 A plan should be created to address the following areas. Each of these activities should be repeated on a periodic basis. Changes to business requirements or technology may introduce new risks or problems.
- #36 The transformation involved three phases:We ran queries to collect metrics to identify the types of support services, frequency, priority, and cost. Processes were implemented to enhance the ability to manage the support services, establish commitments, authorise work, and enforce processes.Finally, we trained the team to look for new risks or opportunities for improvement. This included implementing permanent solutions to recurring problems to reduce support costs.