ISACA Systems Implementation Assurance February 2009

Transcription

1 ISACA

2 Pressures Today Pressure to increase realization of value from IT spending Pressure to deliver on IT projects at a time when resources/budgets are constrained Pressure from risk of technology-based disruption Pressure from complex legal and regulatory requirements Slide 2

3 IT Complexity Three Dimensions Degree of heterogeneity Remediation Current state Desired state Less complex, lower cost, agile management Remediation Number of entities Remediation Number of interconnections Source: Technology forecast,, Summer 2008 Slide 3

4 Project Complexity Pressures have raised the stakes for project success and have increased project complexity - Projects are key to achieving agility and benefits and/or satisfying changing regulatory requirements - Project investments are more significant portions of company budgets - Projects often span business units or even organizations - Internal and external stakeholders demand greater visibility of project activities Slide 4

5 Risk PwC Global Survey Results Project survey indicated that 200 global companies were spending over $4.5 bn. on projects to deliver changes required to implement their strategy. 2.5% of the companies had 100% of their projects on time, within budget, to scope and delivering the right business benefits. Only 35% of the companies indicate that projects deliver expected business benefits. Slide 5

6 Root Cause Slide 6

7 Root Cause Client Example Accountability and Ownership - Project leader authority was not universally recognized. The root cause appears to be lack of role clarity, as well as issues of employee level matching. - There was insufficient oversight within the project structure. As a result, overall team success was not aligned with individual workstream success. Silos and cross-workstream ineffectiveness were prevalent. Process and Discipline - The process for managing the transitions in project leadership was limited. As a result, there was leadership inconsistency often at critical junctures in the project life. - The IT Life Cycle and PMO practices are viewed more as suggested guidelines than institutionalized policies. For a project of this magnitude, there was substantial leeway given to leaders in the use of Client standards and limited quality assurance to ensure proper judgment and completion. Communication and Transparency - Lack of transparency and openness among certain team members to report risks and issues. - Sufficient quality assurance was not applied to the numerous vendors. Slide 7

8 - Architecture Business Outcomes Business Case: Is the technology change aligned with the company strategy and does it solve a business issue with measurable outcomes? Benefits Realization Plan: Is an appropriate plan in place that clearly defines proposed benefits? Project Structure: Is ownership at a high-enough level to enact change; and are tasks aligned to realize benefits? Business Case Benefits Realization Plan Project Management Business Outcomes Project Structure Project Governance Project Outcomes Implementation methodology Business Processes Controls Outcomes Project Outcomes Project Management: Are project resources, costs, and timelines being effectively managed? Functional Readiness ITGCs Project Governance: Has the project received the appropriate level of management support? Technical Readiness Organizational Readiness Interfaces Data Quality Functional Readiness: Have effective mechanisms for establishing and developing requirements been established? Technical Readiness: Have processes been put in place to translate requirements into effective software and hardware solutions? Organizational Readiness: Have changes been effectively communicated and understood by the organization? Controls Outcomes Data Quality: Has the data been successfully migrated such that it is accurate, robust, and in a usable format? Interfaces: Has management implemented appropriate processes to flow data from one system to the next to ensure data integrity? ITGCs: Does the technical infrastructure and manual IT processes support the new environment technical infrastructure? Business Processes: Has management evaluated the optimum mix of manual and automated controls necessary to completely and accurately capture and validate data? 8 Slide 8

9 - Application Organization A Business Value: Receiving all functionality in iterative releases, flexible feedback between customer and project team. Controls: Some impact to the control environment, but not primary project driver. Project: High-level schedule estimates that were expected to change. Budget costs within acceptable range. Success: Emphasis on business outcomes Controls Outcomes Business Outcomes Organization B Controls: Delivering the required regulatory --controls within the mandated deadline is the primary driver Project: Industry compliance requires on-time delivery to avoid penalties and -----reputation risk. However, cost is not a driver Business: Compliance requirements dictate all expectations. Project Outcomes Success: Emphasis on control outcomes Organization C Project: External customer dictates acceptable price. Budget with strict penalties if exceeded. Schedule changes acceptable if costs remain inline; offshoring is always an option. Budget: Costs were within acceptable value. Business: Qualitative business value derived from key customer satisfaction. Success: Emphasis on project outcomes Slide 9

10 - Value Stakeholder Audit Committee Project Sponsor Project Manager Function Lead or End User Audit Delivery of anticipated benefits Accuracy of status reporting and oversight Project Impact on existing internal control environment PwC Stakeholder Concern Delivery of anticipated benefits Communication with various stakeholders Organizational readiness Project governance model Issue communication and resolution PMO effectiveness Readiness of the user community Efficiency / Effectiveness of the solution Issue communication and resolution Financial, operational, regulatory control Delivery of anticipated benefits Value Proposition Benefits realization, regulatory and control impacts, status validation Benefits realization, organizational readiness, expected outcomes assessment Project governance model, issues escalation, PMO procedures, end user expectations Controls assessments, organizational readiness, issue escalation Benefits realization, regulatory and control impacts, status validation Slide 10

11 Benefits Realization Provide comfort that structures are in place throughout the project to promote the achievement of future benefits and return on investment. Project life cycle approach to benefits realization involves four distinct processes: Building a business case and planning benefits Assigning benefits ownership Establishing benefits realization processes Tracking and monitoring results Qualities audited for: Be a repeatable process that extends beyond the life of the project Be a process for establishing ownership and accountability for achieving planned and unplanned benefits; Include tracking against the original/amended business case Slide 11

12 Benefits Realization Business Case Helps maximize the probability of return on investment Provides ongoing clarity and focus on the project objectives Provides momentum and commitment to the project Helps institutionalize changes; enhances sustainability Enforces that benefits realization is ongoing and not fully realizable at the point of go-live Reinforces value of the change initiative Allows quantifiable measures of success Slide 12

13 Benefits Realization Maximizing Benefits Early focus on benefits during the project may result in benefits quick wins being realized during the project Benefits Realization With focus in the post-implementation phase, benefits are realized and measured Provides the ability to recognize and incorporate unplanned benefits Performance During the Project Post- Implementation X X Target Performance with Benefits Realization Performance without Benefits Realization Project/post-implementation performance may actually decrease in the early post-implementation period adversely affecting the benefits realization Time Unless costs and benefits are tracked and actions taken (e.g., further training, more capacity) not all benefits may be realized Slide 13

14 Benefits Realization Risk Considerations Poorly defined business case results in misunderstood objectives and lack of project buy-in Insufficient definition of business benefits results in misunderstanding of scope changes on the business case Lack of accountability for achieving business results in system delivered with incomplete or unnecessary functionality Incorrectly defined business metrics result in incorrect reporting of value delivery Overlooking qualitative aspects of delivery result in incorrect perspective on project success Lack of metrics monitoring post go-live results in system not maximizing benefits potential for the business Slide 14

15 Benefits Realization Representative Points of Focus Benefits Definition Benefits Awareness & Acceptance The business case for the project clearly outlines the expected benefits that must be realised in order for the project to be considered successful (including cost, schedule and quality measures). Both quantitative (e.g. cost reductions) and qualitative (e.g. reduced risk, improved competitive position) benefits expected to be derived from the project have been clearly defined. The benefits defined in the project approval documentation (business case / request for funding) are consistent with the benefits defined in the project delivery documentation (project charter / project management plan). The project brief/ execution plan indicates the major deliverables anticipated from the project. Relevant stakeholders (including senior management) were involved in defining the objectives and expected benefits from the project. The business case (project objectives, planned business benefits and project deliverables) has been communicated to all relevant stakeholders. Project stakeholders (including senior management) understand the project objectives and costs, consider that the objectives are achievable and support the planned business benefits. A process exists to communicate any changes to planned benefits to project stakeholders throughout the life of the project Project stakeholders (including senior management) formally sign off to indicate their endorsement of the business benefits and acceptance that the business benefits are achievable. Accountability and specific responsibility for achievement of the defined business benefits has been assigned, including benefits that may not be achieved until well after the project is completed (for example subsequent head count reductions). Organisational KPI s for the key project stakeholders include the successful delivery of the project business benefits. Slide 15

16 Benefits Realization Representative Points of Focus Benefits Estimation Benefits Measurement & Monitoring The business baseline processes and performance against which project improvements will be measured have been agreed. A basis exists for objectively measuring the achievement of defined business benefits, including quantification. The expected value and timing of both tangible and non tangible benefits has been estimated and agreed. Assumptions underlying the estimation of benefits are documented, consistent and accepted by project stakeholders. A benefits realization strategy or delivery plan has been developed outlining the specific business benefits, how they will be achieved, accountability for achievement and timing. The project sponsor has primary responsibility for ensuring that the business benefits are delivered according to the benefits realization strategy. Anticipated business benefits are mapped to specific project tasks and deliverables during the project planning phase. A tracking process is in place to ensure the major project deliverables are completed and the associated business benefits are realised in a timely manner. A formal process is in place to monitor the realization of anticipated cost savings expected from the project. Project decisions regarding scope and timing are reviewed against the potential impact to anticipated business benefits. Changes to project success measures are approved by the relevant stakeholders (Project Sponsor, Steering Committee) Scope changes that impact benefit delivery require approval of all relevant stakeholders. Slide 16

17 Benefits Realization Representative Points of Focus Benefits Reporting Regular status reporting clearly indicates whether the project is on track to deliver planned business benefits and includes reporting of actual business benefits delivery against planned. Senior management and the Project Steering Committee / Project Sponsor receive status reports and assess the impact of progress to date on the planned business benefit delivery. Formal plans are in place to measure the realization of anticipated benefits and savings upon project completion (i.e. post-implementation review) Business benefits progress reporting is consistent with organisational formats and standards, including effective QA / verification processes. Slide 17

18 Peter Harries Partner LLP (213) LLP (US). All rights reserved. "" refers to LLP (US), a Delaware limited liability partnership, or, as the context requires, the global network or other member firms of the network, each of which is a separate and independent legal entity. Slide 18