Optimal value can be realized from leveraging IT Governance only if it is effectively adopted and adapted to suit each enterprise’s unique environment.
As previously discussed, all Federal departments/agencies were charged with establishing an IT Governance program per OMB Memorandum M-09-02.
Optimal value can be realized from leveraging IT Governance only if it is effectively adopted and adapted to suit each enterprise’s unique environment. Each implementation approach will need to address specific challenges, including managing changes to culture and behavior. In addition, implementation must be based on a continual improvement life cycle.
This blog highlights two critical implementation aspects – adapted from COBIT5®(COBIT5®, ISACA, 2012):
IT Governance does not occur in a vacuum. Every enterprise needs to design its own implementation plan depending on factors in the enterprise’s specific internal and external environment, including:
It is critically important to leverage and build on existing enterprise governance initiatives. The optimal approach for implementing IT Governance will be different for every enterprise, and the context needs to be understood and considered. Key success factors for successful implementation include:
IT Governance implementation initiatives must be properly and adequately managed. Support and direction from key leadership executives can ensure that improvements are adopted and sustained. Requirements based on current challenges should be identified by management as areas that need to be addressed, supported by early commitment and buy-in of relevant key leadership executive and enabled objectives and benefits that are clearly expressed in a business case. Following leadership commitment, ensuring adequate resources and assigning key program roles and responsibilities will ensure sound implementation for the IT governance program –with care taken on an ongoing basis to maintain commitment from all affected executives. Indeed, appropriate structures and processes for oversight and direction will also ensure ongoing alignment with enterprise-wide governance and risk management approaches. Leadership should provide visible support to set the ‘tone at the top’ and ensure commitment for the program at all levels.
Successful implementation depends on implementing the appropriate change in the appropriate way. In many enterprises, there is a significant focus on the first aspect—core IT Governance—but not enough emphasis on managing the human, behavioral and cultural aspects of change and motivating key leadership executives to buy in to change. Indeed, various key leadership executives involved in, or impacted by, new or revised IT Governance enablers may not readily accept and adopt change, making it necessary to address resistance through a structured and proactive approach. Also, a communication plan can optimize awareness of the implementation program – such a plan defines what will be communicated, in what way and by whom, throughout the various phases of the program. Human, behavioral and cultural barriers can be overcome to properly adopt change, instill a will to adopt change, and ensure the ability to adopt change.
The implementation life cycle provides a way for enterprises to address the complexity and challenges typically encountered during implementations. The three interrelated components of the life cycle are:
1. Core continual improvement life cycle—as opposed to a one-off project
2. Change enablement—addressing the behavioral and cultural aspects
3. Program management—following generally accepted project management principles
The implementation life cycle and its seven phases are illustrated below from figure 17 of COBIT 5.
Phase 1: recognition and agreement on the need for an implementation or improvement initiative. It identifies the current pain points and creates a desire to change at executive management levels.
Phase 2: focus on defining the scope of the implementation or improvement initiative, considering how risk scenarios could also highlight key processes on which to focus. An assessment of the current state will need to be performed to identify issues or deficiencies by carrying out a process capability assessment. (Large-scale initiatives should be structured as multiple iterations of the life cycle in order to achieve visible successes and keep key leadership interest.)
Phase 3: improvement target set, including a more detailed analysis to identify gaps and potential solutions. (Some solutions may be quick wins and others more challenging and longer-term activities – priority should be given to initiatives that are easier to achieve and those likely to yield the greatest benefits.)
Phase 4: practical solutions with defined projects supported by justifiable business cases and a change plan for implementation is developed. (Well-developed business cases help to ensure that project benefits are identified and monitored.)
Phase 5: proposed solutions implemented into day-to-day practices, measurements are defined and monitoring established, ensuring that business alignment is measured, achieved and maintained.
Phase 6: sustainable operation of the new or improved IT Governance initiatives and the monitoring of the achievement of expected benefits.
Phase 7: overall success of the initiative reviewed, further requirements for IT Governance are identified, and need for continual improvement is reinforced.
Over time, the life cycle should be followed iteratively while building a sustainable approach to the IT Governance of the enterprise.
To ensure the success of the IT Governance implementation initiative, a sponsor should take ownership, involve all key leadership executives, and provide for a business case. Initially, the business case can be at a high level from a strategic perspective—from the top down—starting with a clear understanding of the desired business outcomes and progressing to a detailed description of critical tasks and milestones as well as key roles and responsibilities; the business case is a valuable tool available to management in guiding the creation of business value. At a minimum, the business case should include the following:
It can be difficult to quantify the benefits of implementation or improvement initiatives as part of a business case, and care should be taken to commit only to benefits that are realistic and achievable. Finally, it must be recognized that the business case is not a one-time static document, but a dynamic operational tool that must be continually updated to reflect the view of the future and viability of the program.
Taking these steps can ensure that IT Governance properly addresses key agency challenges, obtains support from agency leaders, and sustains change to improve agency performance.