As per Gartner’s analysis “Organisations are concentrating on IT cost reduction and aiming to improve their business performance and flexibility. …Organisations renegotiating their outsourcing contracts should avoid long-term deals and look at cloud computing and other models”. Gartner also predicts that IT outsourcing pricing is set to
shrink by 5 to 20 percent during 2009 to 2010, as traditional service providers compete with new players. All these opinions have become breeding bed for smart sourcing, collaborative sourcing, multi-sourcing, on-demand sourcing, co-sourcing and in-sourcing, nurturing SaaS and Cloud Computing models. This is the high time outsourcers and vendors embrace innovation, set higher standards and analyze new ITSM framework recommendations which is woven around Service and Outsourcing.

Today many organizations do not have the financial transparency to enable solid strategic business decisions thus pushing them to steer their strategy, service design and tactical operational decisions inappropriately or in wrong direction. So in an economic crisis like we are in today, they cut costs (as opposed to optimization), traditionally by employee lay-offs, decreasing workforce and cancelling discretionary projects or putting them on hold. In some cases, organizations have outsourced their ‘core processes’ under these pressures. In the short-run, budget targets are met while in the long-run a price must be paid….

The cost savings from outsourcing and off-shoring can be attractive but the associated risks and costs need to be clearly understood. ITIL V3 defines the structure and dependencies of sourcing relationships and creates a foundation for more customer-centric IT service management across the enterprise. ITILv3 provides guidance on sourcing options
that support different situations. The ITIL Service Strategy and Service Design publications provide guidance on modelling services across the supply chain. By taking a structured approach, clearly defining scope of the services, responsibilities and accounting for all the service assets up front there is less risk of surprises and costly unexpected changes. The ITIL Service Transition publication provides guidance on the activities required to transfer a service between two service providers. ITIL v3 outlines the accounting framework necessary to facilitate chargebacks and total cost of ownership (TCO) calculations with effective Governance of IT Planning, Accountability of IT Spending and Predictability of IT Budgets. This Financial Management process is a key input to Service Portfolio Management because by understanding cost structures applied in the provisioning of a service, a company can benchmark that service cost against other providers.

 In this way, companies can use IT financial information, together with service demand and internal capability information to make beneficial decisions regarding whether a certain service should be provisioned internally or outsourced. In todays’ macro environment, the need is to Re-Define Outsourcing Strategy. For eg: long term or fixed FTE based deals are outdated and ineffective. There is no sense of paying vendor when there is no or less work. ITILv3 describes Supplier selection criteria and various sourcing models like On-Demand Sourcing, Multi-Sourcing, Co-Sourcing and In-Sourcing.

Portfolio rationalization is another dimension which can give better accountability and financial transparency of services. The industry has matured to a point where CIOs can now review their portfolio of outsourcing partners and set themselves up with better mixes of companies, countries and models. ITILv3’s Service Portfolio, the Service Catalog (Business Service Catalog and Technical Service Catalog) and Financial Management provides cost transparency influencing buying behaviour.

Other ITILv3 disciplines, such as configuration management, capacity management and problem management, have an important part to play in cost optimization initiatives and should be leveraged to help drive substantial cost reductions throughout the IT function. Configuration management should be enhanced to proactively identify elements of the
infrastructure that may be disposed of, repurposed or have their associated maintenance contract costs reduced rather than just asset tracking. Similarly, Capacity management should be able to recommend assets for consolidation, virtualization and  re-negotiation for more preferential capacity-based contracts. The concept of a Service
Knowledge Management System (SKMS) is introduced as an overarching set of tools and databases that is used to manage service provision through the entire service lifecycle. CSI (Continuous Service Improvement) phase of ITILv3 focuses on inputs and outputs needed for a good improvement (‘Plan-Do-Check-Act’) cycle on existing services, including service retirement. IT monitors service performance and identifies ways to improve quality and reduce costs while staying aligned with changing business requirements. As per the framework, SIP (service improvement plan) should be a part of outsourcing contract and should be addressed at the outset of negotiations.

It is clear that ITIL v3 provides a much richer outsourcing oriented service management framework and the probability of success in ITO operations can be substantially improved. Coordination and communication between CIOs and business heads for their ongoing programs and strategies, become even more critical and relevant in this rapidly changing stratosphere.

== CHEERS ==

And knowing this, we certainly don’t want an Agile pod to be distracted with the details of an executive-level governance framework, of which the practices are far from the reach of the development team. But let’s take a closer look at this. According to the ISACA Web
site, Val IT establishes that “IT-enabled investments will include the full scope of activities required to achieve business value.” This means that to realize value from IT-enabled investments, we have to go beyond delivering IT solutions and services (IT projects), and
include things like changes in business processes, skills or even the business itself.

This concept changes the notion of an “IT project,” because it blends IT and business together.  Therefore, it changes the notion of a successful project, because the project no longer makes sense when detached from the program into which it was inserted.  In fact, Val IT determines that “IT-enabled investments will be managed through their full economic lifecycle.”  Roughly speaking, this means that success cannot be measured when the project is delivered – it’s necessary to consider the business goals that were initially established for the whole program and to monitor them over a period of time significantly longer than an application development
lifetime.  Does it make sense for the project team to even know about this? I think it does, for a number of reasons.

The first is because the relationship between the organizations (the business and the IT organization, including vendors) and people in these organizations should not be transaction-based, but long-term.  Only then lean principles such as “seeking perfection” (continuous improvement) and “flow” be attained.

So, assuming that this is a long-term relationship, it makes sense for the IT organization (down to the app dev team level) to (a) understand the program life-cycle benefits, and to (b) be aware of how this has been monitored and the results have been.  For once, it creates a real sense of partnership.  People feel fulfillment when they understand their roles in a bigger accomplishment. But there’s more to it than this.  It’s a bi-directional system, because when people know the expected end results up front, they can proactively participate and suggest things that will make the task easier, adding more value to the value stream.

People feel that they can make a difference and that their contribution is appreciated, just as workers in a lean manufacturing plant feel more challenged (and more valuable) than mass-production workers.   And their contribution is indeed greater.  Of course, there also has to be accountability – if things do not go as expected, what could have been done differently so the odds of success would be greater? Can we still do something to fix the route and achieve success? Should we retire the program?  In a separate post, I’ll delve further into the principles of Val IT, and examine them in broader context within the discussion of lean IT and agile methodologies

= CHEERS=

Many clients have suggested their PMO mission is already elevated to this level. They now focus their efforts on everything from guiding business leaders through building a business case for the investments they want to make, to guiding decision-makers through selection from the portfolio of investment proposals, to tracking benefits realization and ROI after the fact. PMOs with this kind of business-focused, strategic mission have greater business impact and are often close partners with executives leading their firm.

During the session, one of the attendees asked an interesting question: “At our firm, the functions you describe are led by the enterprise architecture team, as part of the strategic planning and business architecture process. Which is better suited to doing this function, EA or the PMO?” This raises a further question as to the role of the office of the CIO and IT strategic planning — should CIOs own strategic planning, and if so, where do you draw the lines between the role of the CIO, EA, and the PMO? What about IT’s demand management team (relationship mangers & business consultants) — where do they fit in?

I’m going to go out on a limb here and say that the CIO must own strategy development — it’s one of the most important parts of the CxOs’ role — and the strategy is executed through the combined efforts of business-facing professionals: EA, demand management, and the PMO, with the CIO or the office of the CIO acting as the guiding force and overall administrator of any strategic planning function.
PMO really deals with execution. EA may have a planning and execution role, but the CIO must own charter, direction, and oversight of any strategic planning or strategic investment function. What’s more, the CIO should probably own some budget that can be invested outside of business-controlled funds for strategic investments in infrastructure, architecture, scalability, or reusability.”
What about your organization? Where does strategic investment management sit within your organization? How well does this work for your business?

=Cheers=

Uwa Asep sudah pergi…dia pergi disaat setahun ini aku harusnya bisa berbicara dengan dia, mengulas kembali siapa leluhurkan dan membiarkan dia memerkan kertas lusuh berisikan silsilah keluarga.

YOSEPH Iskandar, sosok sastrawan motékar telah berpulang ke pangkuan Allah Yang Mahaakbar. Ia menderita komplikasi jantung dan gula, sampai akhirnya meninggal dunia di rumahnya, Kecamatan Ujungberung, Bandung, pada 26 Maret 2008, jam 1.00 WIB. Karya-karya besar Yoseph Iskandar telah mengakar dan menjadikan orang Sunda semakin sadar akan kekarnya sosok Ki Sunda.

Yoseph adalah satu-satunya sastrawan Sunda yang berhasil mempertemukan sejarah Sunda dengan karya sastra. Ia sangat gigih mengangkat ajén-inajén Sunda melalui karya-karyanya. Ketika naskah Wangsakerta menjadi bahan polemik di kalangan para sejarawan, dengan berani Yoseph menulis novel-novel yang bersumber dari naskah kontroversial tersebut, seperti Perang Bubat (1998), Wastukancana (1990), Prabu Wangisutah (1991), Pamanahrasa (1991), Putri Subanglarang (1991), dan Prabu Anom Jayadéwata (1996).

Yoseph berhasil mereka ulang sejarah ke dalam karya fiksi. Roman sejarahnya, Tanjeur na Juritan, Jaya di Buana (Unggul Dalam Perang, Sejahtera Dalam Hidup, 1991) mendapat hadiah Sastra Rancagé tahun 1992. Pada tahun 1997, ia mendapatkan kembali hadiah sastra Sunda paling bergengsi tersebut atas romannya yang berjudul Tri Tangtu di Bumi (1996). Biarlah naskah Wangsakerta diragukan kebenarannya, tetapi roman sejarah karya Yoseph Iskandar tidak diragukan lagi kehadirannya. Ia telah merasuk ke dalam hati masyarakat Sunda yang pareumeun obor kepada leluhurnya.

Ketertarikannya pada sejarah Sunda bermula dari kedekatannya pada Saleh Danasamita ketika Yoseph menjabat redaktur di majalah Manglé (1979-1985). Maka, artikel Yoseph mengenai sejarah Sunda pun menghiasi Manglé. Tentu saja, minatnya yang serius terhadap sejarah sangat membantu proses kreatifnya dalam menulis karya sastra.

Seolah tidak mau kalah oleh para sejarawan, Yoseph pun membuktikan diri bahwa ia mampu menulis sejarah. Silakan simak buku Sejarah Jawa Barat (Yuganing Rajakawasa) yang diterbitkan Geger Sunten, atau Sejarah Kebudayaan Jawa Barat (empat jilid), Sejarah Cirebon, dan Sejarah Banten. Yoseph bahkan sempat menulis peristiwa serangan pasukan RI terhadap tentara Inggris di daerah Sukabumi pada masa revolusi. Baik karya fiksi maupun sejarah, ditulisnya dengan menggunakan bahasa yang indah dan lincah sehingga sangat nikmat untuk dibaca. Buku-bukunya banyak dijadikan sumber rujukan oleh para penulis, akademisi, dan para peminat sejarah Sunda.

Selain menulis prosa, Yoseph Iskandar menulis puisi dan drama Sunda. Sastrawan kelahiran Purwakarta, 11 Januari 1953 ini tercatat sebagai penulis drama berlatar sejarah yang paling produktif. Tengok saja naskah drama berjudul “Ngadegna Pajajaran”, “Pemberontakan Cakrawarman”, “Runtagna Pajajaran”, “Nyi Puun”, “Tanjeur Pajajaran”, “Haji Prawatasari”, dan sebagainya. Ia sangat berperan dalam membangun gairah dan tradisi drama berbahasa Sunda.

Sebagai penulis yang peduli terhadap sejarah, Yoseph pun terbilang peka dalam menyelami realitas sosial di sekitarnya. Silakan tengok naskah drama berjudul “Juag Toéd”, “Haréwos Nu Gaib”, “BOM”, atau “Cucunguk”. Di dalamnya, banyak kritikan pedas nan berani. Pada Festival Drama Basa Sunda (FDBS) IX tahun 2006, “Cucunguk” menjadi naskah drama yang paling banyak dipilih oleh peserta FDBS.

Drama “Juag Toéd” (1984) dipentaskan berkali-kali di Bandung, Jakarta, dan berbagai kota lain di Jawa Barat, dengan disutradarai langsung oleh Yoseph. Drama komedi ini tidak bisa lepas dari sejarah perkembangan seni tari jaipongan yang dipopulerkan menjelang akhir tahun 1970-an oleh Gugum Gumbira, Tati Saleh (alm.), dan Euis Komariah. Cerita dalam “Juag Toéd” merupakan semacam bantahan dan pembelaan Yoseph terhadap seni jaipongan. Pada saat itu, jaipongan diprotes oleh kalangan istri pejabat karena dianggap terlalu vulgar, erotis, dan hanya membangkitkan nafsu berahi. Drama “Juag Toéd” menyindirnya dengan mengambil setting tatar Sunda sebelum zaman perang. Pada zaman itu, istri seorang wedana disebut juag toéd dan bupati pun masih disebut kangjeng dalem.

Orang teknik

Yoseph Iskandar sebetulnya orang teknik. Selepas SMA, ia meneruskan kuliah ke Akademi Teknik Pekerjaan Umum (ATPU) Bandung. Meski menuntut ilmu di bidang teknik, Yoseph lebih tertarik terhadap kesenian. Terbukti, di kampus teknik itu aktivitasnya lebih banyak tercurah pada kegiatan seni, seperti memimpin Teater Khas (1977-1981).

Bahkan, selanjutnya Yoseph memilih untuk meninggalkan dunia teknik, demi mendalami sastra Sunda. Bersama sastrawan seangkatannya seperti Eddy D. Iskandar, Godi Suwarna, Juniarso Ridwan, Beni Setia, dan sebagainya, ia mendirikan sebuah organisasi para sastrawan Sunda generasi muda yang bernama Durma Kangka. Saksi dan bukti dari sejarah Durma Kangka di antaranya adalah buku Antologi Puisi Sunda Mutakhir (1980) dan Tumbal (1982).

Nama Yoseph telah terukir pula di bidang pers Sunda dan dunia pendidikan. Selain pernah menjadi redaktur Manglé, ia pun pernah menjadi redaktur tabloid Giwangkara. Sementara itu di bidang pendidikan, Yoseph pernah menjadi dosen di UNPAS, UNTIRTA, dan bahkan di UC Santa Cruz, California, Amerika.

Dari perjalanan karier Yoseph Iskandar, kita bisa menyimpulkan bahwa ia adalah seorang sastrawan yang produktif, penulis sejarah, penggiat teater Sunda, organisator, insan pers yang gigih, dan kepala rumah tangga yang bertanggung jawab terhadap keluarganya. Di hari-hari terakhirnya, dalam keadaan sakit pun Yoseph masih tetap berkarya, seakan mau nyacapkeun kasono kepada sastra Sunda, sebelum akhirnya harus berpisah untuk selama-lamanya.

Need for a Contract Review
Contract reviews facilitates new deals, re-negotiations, and exiting relationships. For existing contracts, timely contract reviews help in assessing the contract performance and identifying the areas of improvement/opportunities/potential threats that determine the favorability of the contract. The provision for periodic contract review is essential for longer engagements.

This provides an option to fine tune your baseline and optimize your spends based on actual utilization and changing market trends. On the other hand, a new contract review assists in effectively comparing solution offerings of different vendors and selecting the right vendor. An experienced Sourcing Advisor can aid in taking a more selective sourcing approach that meets specific objectives while maximizing savings. Points to Consider While Reviewing Contracts

1. Solution Competitiveness – When there is more than one competitive bid, which one is best for you?
2. Price Competitiveness – Is the deal fair financially when compared to market pricing?
3. Accuracy of Scope – Is the contract scope in line with your business and financial objectives?Example: mix of services, delivery vehicles, and level of services.
4. Appropriate Service Levels – Are the service levels fair, measurable, and enforceable?
5. Terms and Conditions – Are the all terms and clauses, like exit clauses, favorable? Are any important clauses missing?
6. Service Delivery Platform – Is the technology and delivery architecture used by the vendor to provide services aligned with contract standards?
7. Others – Are there any missing items or anything misleading? Example: scope mismatch between financial proposal and technical proposal, etc.

7 Best Practices for Smooth Contract Renegotiation

1. Be very clear about your Business intentions
You should be aware of all the aspects of the deal and should have a detailed understanding of your business requirements so that relevant levers in the agreement can be pulled, to achieve the stated objectives. That means spending ample time with your business leaders for understanding their needs; synthesizing their input; and translating those needs into a set of goals that need to be achieved through renegotiation.
2. Evaluate Contract Performance
Review performance levels both internally and with the vendor. Determine whether the intended objectives have been achieved or not, and if not,
why not. Bring out the points of concern in the renegotiation meetings with your vendor. The success or failure of an Outsourcing Contract is dependent on effective vendor management and the governance structures which have been put in place.
3. Have Clear Rules of Engagement Set out and agree clear rules with your vendor before you start the re-negotiation process. These should include a charter of behaviors and principles to be applied throughout the process, the number of senior-level people to be involved from client and vendor side, and a timeline for calling off the renegotiation process.
4. Avoid hastily Negotiating a Contract
You should be armed with plenty of facts and figures to make your business case. Do a detailed review of your services and have a clear picture in mind as to what are the business objectives that are to be achieved through this contract. Work on a collaborative discussion with your Vendor that brings out your concerns and goals as well as ways to manage them.
5. Bring an Appropriate Team for the Re-negotiations
Do not re-negotiate a contract using only the account, service management and governance team on both sides. They are typically focused on short term issues and actions; and lack the executive mindset and big-picture view. Your team should be aware of your wider business needs, and not just immediate requirements. Hence identify and engage a corporate leader to act as the focal point for your negotiating team. Also ensure that your Service Provider’s corporate team is aware of your goals and is engaged at every step of the process.
6. Extend Your Contract
If criteria such as end-user satisfaction and service level agreements are being met, and the contract is meeting your needs, the agreement with your existing service provider can be extended. However you still need to figure out latest developments and important amendments and build them into your existing contract. A rigorous external benchmarking exercise is critical to achieve this understanding. An Advisor can help you negotiate the best extension with their in-depth market insight and benchmarking experience.
7. Contract Termination
The cancellation of an Outsourcing Agreement may happen due to following reasons:

Your existing Provider has failed to deliver particular services to your satisfaction
• Commitments of process improvement and efficiency not being honored • Your requirements have changed to such an extent that a vendor with a different set of services and areas of expertise is now required In the event of a Contract being terminated, you can exercise a number of options:
• Bring in an Advisor to guide you on ‘Exit’ Strategy’, ‘Risk Identification & Mitigation’
• Transfer whole or a part of your Outsourced services to a different Provider
• Keep your existing Service Provider in some capacity • Bring some of the Outsourced services back in-house – here you need to determine if you have the right infrastructure and team in place to support such a move
• Enter into a new contract

= cheers =

For years, organizations have leveraged the power of learning technologies to increase knowledge and skills and to improve the performance of their internal workforce. Increasingly, similar tools are being turned to the outside and are finding new uses and new audiences.

It’s more than just delivering product training and information. It’s about enablement and breaking down old walls.
Building “smart” networks to reach extended enterprise stakeholders can facilitate top-line revenue and bottom-line results, as well as a competitive advantage. In terms of revenue growth, extended enterprise technology can ensure that products and services are sold and adopted effectively.

Not only can this establish a “training as a profit center” business model, but it can help offset the costs of integrated talent management technology. Extended enterprise technology can also reduce costs, as educated clients require less support, and educated business partners can reduce time to productivity.

Offering technology support to the extended enterprise addresses many significant business challenges, including:

Product knowledge: Increase knowledge of your products and services in the marketplace and monitor your customers’ knowledge and aptitude.
Partner incentives: Motivate partners/resellers to move your products and services.

Brand loyalty: Build closer relationships with your customers to drive repeat sales and ensure that your partners are savvy ambassadors of your
brand in the marketplace. Stakeholders throughout the extended enterprise who believe that they understand your product or service are
more likely to articulate its value accurately and passionately.

Compliance and risk: Mitigate risks by, for example, following standard operating procedures within a franchise, managing large, globally
distributed reseller networks consistently or maintaining complex channel strategies.

Visibility and metrics: Correlate investments in training to business results and increase insight into the extended enterprise.

Best Practices for Enabling Your Extended Enterprise If you are considering implementing extended enterprise technology in your organization, keep these best practices in mind:

Develop a single point of access for global needs. A single access point allows you to leverage the full value of learning technology and content
you already have in place. You can increase quality and consistency between aligning internal and external learning initiatives. You can
also gain insight into the needs of customers and partners by monitoring user-generated content, such as discussion boards.
Use e-commerce to support cost recovery or to drive profit.

You may have acquired learning technologies and developed relevant content for your employees, but rolling these out to external audiences can make these cost-neutral or even profit centers for the organization. For example, tech companies generally earn 6 to 10 percent of total revenue from
training.

Developing learning as a revenue driver can also help offset the costs for integrated talent management that are currently incurred by HR.
Leverage the power of SaaS. Software-as-a-Service (SaaS) solutions allow you to access extended enterprise technologies through any Web browser, which eliminates hardware and IT maintenance costs, makes upgrades seamless and allows access from any location with a computer and
Internet access. Costs are far lower than for technology hosted on your own servers, and security is just as stringent. Track successes and fine-tune with thorough, centralized reporting.

With the proper analytics and dashboards set up to monitor usage, you can see how users actually prefer to learn, which enables you to provide more
effort and resources in these areas.

Establish social networking functionality thecore. A sensible social media technology strategy can also help power success of extended enterprise initiatives. Because people have become more comfortable with Web 2.0 technologies, they have come to expect a greater ability to collaborate and interact with online communities to gain knowledge.

= Cheers =

IT organizations each develop their own unique cultures based on their collective experience. Many industry studies indicate IT organizations spend a significant
portion of their resources on maintaining existing infrastructure, rather than applying resources to technological innovations relevant to customers and driving top-line revenue growth.  This use of a significant portion of IT organizational resources is a primary driver of the current culture of many IT organizations, which focuses on infrastructure maintenance rather than enabling customer outcomes. With the increasing pressure to improve service while lowering costs, IT organizations increasingly need to examine their existing culture to determine if it is enabling, or hindering, the ability to improve service in a cost- constrained environment.

Changing the culture of any organization is a difficult challenge, but is often driven by external factors including the overall economic environment. Currently in industry, culture transformation is often approached as a one-time change in culture for an organization to catch up to a set of changes in both the organization’s external and internal environment.  Rather than view culture change as a one-time event, it can be an enabler of success for IT organizations when managed and improved on a continuous basis as part of ongoing
operations.
A critical first step for IT organizations to change their culture is to focus on maximizing cost savings in the IT infrastructure.  Adopting a systemic financial approach to obtaining cost savings in server and desktop refresh cycles, tighter management of IT investments to obtain target return on investment, and costs savings through virtualization and cloud computing are common starting points to move the culture toward viewing IT infrastructure as a commodity to be optimized.

A second step, once cost savings have been obtained from the existing infrastructure, is to more closely align application development and enhancement to the needs of the business and operational units, and begin to focus on IT innovation to drive top-line revenue growth. Moving away from a focus on infrastructure maintenance to aligning all aspects of your IT operations to enable and drive customer outcomes, is a concrete approach to changing the culture of your IT organization.

= Cheers =

What’s so bad about being a cost center? Nothing really… if your business isn’t too worried about profitability. Assuming it is, however, the problem with being a cost center is that you are mostly going to be valued by productivity of your people and assets without a clear link to value. Each year’s budget conversation will then focus on how to simply squeeze more out of IT. When every last dime has been squeezed out, we can finally outsource IT, because it’s not a critical capability, right?

So how can IT break with that perception? For starters, start leading IT like a true business… then manage it as a profit center.
I deliberately choose the word leading because there is a difference between managing and leading. Many people can manage as in “getting things done according to plan”. Leading, on the other hand, requires developing a vision, a value proposition and an element of differentiation.

Then comes the hard part: motivating your subordinates and colleagues to participate in the realization of that vision. First we have to internalize though that IT can be viewed as a “business within the business”. Why? It has all the attributes of a
business:
•       customers (perhaps internal, but still customers)
•       services
•       it produces quantifiable outputs
•       it consumes resources

Looking it at your IT function in that light will force you…
•       to link cost to value delivered (which will help you defend your budgets and resources),
•       to think about how to differentiate yourself at an IT level (which may help you from being outsourced),
•       to look at how to monetize  the IT services you provide (which will make the consumers of your IT services realize your value), and
•       to look at efficiency and effectiveness in your operation (which will balance cost with quality orientation)

To quote a good colleague: ”It is then that IT Service Management will take its rightful place, shoulder-to-shoulder with Sales and Product Development as a direct contributor to profits, growth, and shareholder value.

= Cheers =

Well, it doesn’t have to be so bad – besides complying with ISO 27001 & BS 25999-2 standards, internal audits could be quite useful for your other business affairs (whether related to information security & business continuity or not).

The point with internal audits is that they should discover problems that would otherwise stay hidden and would therefore harm the business.

Let’s be realistic – it is human to make mistakes, so it‘s impossible to have a system with no mistakes; it is however possible to have a system which improves itself and learns from its mistakes. Internal audits are a crucial part of such a system.

There are a few ways to perform internal audit:

a) Employ a full time internal auditor – this is suitable only for larger organizations who would have enough work for such a person (some types of organizations – e.g. banks – are obliged by law to employ such functions)

b) Employ part time internal auditors – this is the most common situation – the organizations use their own employees to perform internal audits alongside their regular job functions. One important thing to pay attention to: in order to avoid conflict of interest (the auditors cannot audit their own work), there should be at least two internal auditors so that one could audit the regular job of the other.

c) Employ internal auditor from outside of the organization – although this is not a person employed in the organization, it is still considered internal audit because the audit is performed by the organization itself, according to its own rules. Usually this is done by a person who is knowledgeable in this field (independent consultant etc.).

However, from my experience as an auditor, the sad truth is that most of the organizations perform internal audits just to satisfy the certification body.

The result of such internal audits are a few non-conformities which do not get deep into the real problems of information security management system (ISMS) or business continuity management system (BCMS).

This is a waste of time – if the companies have invested time of their internal auditors to perform such jobs, they should gain some benefits out of it.

But how then to approach internal audits in the right way – here are some thoughts:

1. The management should view the internal audit as one of the best tools to improve the system, not only as a means to get certified.
2. The internal auditor should be qualified – this means he/she must have experience in information security, information technology and auditing techniques. It does not mean that the auditor must be an expert in those fields.
3. The internal audit should be performed in a positive way – the aim should be to improve your system, not to blame the employees for their mistakes.

On the positive side, as a certification auditor I did see some organizations performing internal audits in a right way.

Although their employees did feel a little uncomfortable about someone checking their activities, very soon they saw the benefits of such approach – problems became transparent, and were resolved rather soon.

= Cheers =

This is my mantra.  It reminds me that a project delivered on time and on budget is just two-thirds the equation.  If organizational behaviors don’t shift to absorb the IT solution, what’s the point of the project?  In other words, if I’ve neglected the people side of the project, I’ve delivered a partial solution. Let’s face it.  An often overlooked aspect of an IT project is solution adoption.  No one seems to want this daunting responsibility, yet we all tout ROI and project success. 

We tend to resist the people aspects of projects. 

 Awareness?  Socialization?  Institutionalization? Ugh.  Sounds too political.  However, this is where IT is needed.  Not enough power in the political structure, you say?  That’s no
excuse.  Instead of forcing change, affect the resistance.   Here are six key strategic moves every project team needs to drive organizational change.  Your project success depends on it.
1)      Solidify top management support, both from IT and business segments. They must be bought into the short and long term vision and must support short term pain for long term gain.  Leadership and management must raise the cost of status quo and make value visible.  Why change?  Why
change now?
2)      Meet one-on-one with each key stakeholder from the business to socialize the change.  What are their concerns?  How could this initiative help them – “what’s in it for me” (WIIFM)?  The idea is to get them all talking individually about any potential resistance and to build genuine trust.  This step may take some time, but it is vital.
3)      Create a committee consisting of key stakeholders.  They need to be closely involved with the change and have a voice through the process. Engagement helps ensure short and long-term buy in (not just initial, superficial support).  Key stakeholders need to be allies or moderate supporters, at the very least.
4)      Make the change incremental to demonstrate wins.  Which areas are most supportive and change-ready?  Start with a focused scope and iron out any issues with the process, technology, learning curve, etc. Success stories help other areas of the business get on board, recognizing benefits over pains of the process.  Have a story to tell and have others to tell the story for you.  Evolution is easier than revolution.

5)  Leverage awareness campaigns to socialize the change.  Let people know what’s on the way, how it affects them, when it’s coming their way, benefits they can expect, and what you ask of them.  Stay ahead of rumors by providing enough information early and often.
6)      Identify and use change agents to act as your “feet on the street” and the eyes and ears of the project.  Change agents are close to the people affected by the change.  They leverage formal and informal communication channels (hallway, break room, over the cube) to dispel myths, address concerns, propagate a unified change message, and communicate back any issues or concerns.

Projects are about impact.  IT must stretch beyond the design and delivery role to inspire the organization: align, engage, mobilize, anchor, and sustain the change.

= Cheers =