ASPECTS OF FINANCIAL RISK : CHANGE MANAGEMENT

& IT RISK MANAGEMENT

MSC ACCOUNTANCY & FINANCE :CORPORATE GOVERNANCE

& OPERATIONS RISK ANALYSIS AND CONTROL

Stephen Ong BSc(Hons) Econs (LSE),

MBA International Business(Bradford)

Visiting Fellow, Birmingham City UniversityVisiting Professor, Shenzhen University

• Discussion : CEO Hubris1

• Change Management• IT Systems Failure• End User Computing Risks

2

• Case Presentation: IBM3

Today’s Overview

1. Open Discussion

• Petit, Vale´rie and Bollaert, Helen (2012) Flying Too Close to the Sun? Hubris Among CEOs and How to Prevent it, Journal of Business Ethics, 2012: 108: pp.265–283.

Change Management• Identify types of required strategic change.• Analyse how organisational context might affect

the design of strategic change programmes.• Undertake a forcefield analysis to identify forces

blocking and facilitating change.• Identify and assess the different styles of leading

and managing strategic change.• Assess the value of different levers for strategic

change.• Identify the pitfalls and problems of managing

change programmes.

Key elements in managingstrategic change

Diagnosis

Leading and managing

change

Leversfor

change

Managingchange

programmes

Managing change – key issuesFour key premises:Strategy matters – in identifying the need for change

and the direction of change.Context matters – the right approach to change

depends on the circumstances.Inertia and resistance – getting people to change

from existing ways of doing things is essential.Leadership matters – good leadership of change at all

levels is needed.

Diagnosing the change context

Types of change Context of change

Forcefield analysis

Types of strategic change

Figure 14.2 Types of changeSource: Adapted from J. Balogun and V. Hope Hailey, Exploring Strategic Change, 3rd edition, Prentice Hall, 2007

Types of strategic changeFour types of strategic change:Adaptation – can be accommodated with the existing

culture and can occur incrementally.Reconstruction – rapid change but without

fundamentally changing the culture.Revolution – fundamental changes in both strategy

and culture.Evolution – cultural change is required but this can be

accomplished over time.

The importance of context

Figure 14.3 The Change KaleidoscopeSource: Adapted from J. Balogun and V. Hope Hailey, Exploring Strategic Change, Prentice Hall, 2007

Forcefield analysis

A forcefield analysis provides an initial view of change problems that need to be tackled by identifying forces for and against change.Various concepts and frameworks are useful here: Mapping activity systems. Stakeholder mapping. The culture web. The 7-S framework.

A forcefield analysis for the UK forestry commission

Strategic leadership rolesLeadership is the process of influencing an organisation (or group within an organisation) in its efforts towards achieving an aim or goal.

Three key roles in leading strategic change: Envisioning future strategy. Aligning the organisation to deliver that strategy. Embodying change.

N.B. Middle managers have a key role in leading change as well as senior managers.

Newcomers and outsiders

‘Outsiders’ can also play an important role in strategic change.These could include:• A new chief executive from outside the organisation can bring a new perspective.• New management from outside can also increase the diversity of ideas.• Consultants are used to help formulate strategy or to plan the change process.

Styles of strategic leadershipSituational leadership – successful strategic leaders are able to adjust their style of leadership to the context they face.Two approaches:

– Theory E: the pursuit of economic value; top-down; ‘hard’ levers of change; emphasis on changes of structures and systems, financial incentives, portfolio changes, downsizing.

– Theory O: the development of organisational capability; emphasis on culture change, learning, participation in change programmes and experimentation.

• A combination of the two approaches may be required and can be beneficial.

Styles of managing change

Education/ Delegation

Participation Collaboration

Direction Coercion

Styles of Managing Change

Styles of managing change (1)Education and delegation – Small group briefings to discuss and explain things. The aim is to gain support for change by generating understanding and commitment.Advantages – Spreads support for change. Ensures a wide base of understanding.Disadvantages – Takes a long time. For radical change it may not be enough to convince people of the need for change. Easy to voice support, then do nothing.

Styles of managing change (2)Collaboration – Widespread involvement of the employees on decisions about what and how to change.• Advantages – Spreads not only support but ownership of change by increasing levels of involvement.• Disadvantages – Time-consuming. Little control over decisions made. May lead to change within existing paradigm.

Styles of managing change (3)Participation – Involvement of employees in how to deliver the desired changes. May include limited collaboration over aspects of ‘how’ to change as well as ‘what’ to change.Advantages – Spreads ownership and support of change, but within a more controlled framework. Easier to shape decisions.Disadvantages – Can be perceived as manipulation.

Styles of managing change (4)Direction – Change leaders make the majority of decisions about what to change and how. Use of authority to direct change.Advantages – Less time-consuming. Provides a clear change of direction and focus.Disadvantages – Potentially less support and commitment, and therefore proposed changes may be resisted.

Styles of managing change (5)Coercion – Use of power to impose change.Advantages – Allows for prompt action.Disadvantages – Unlikely to achieve buy-in without a crisis.

Levers for change

A compelling case for change

Challenging the taken-for-granted

Changing operational processes and routines

Symbolic changes

Power and political systems

Organisational rituals and change

Table 14.2 Organisational rituals and change

Political mechanisms in organisations

Table 14.3 Political mechanisms in organisations

Change tactics

• Timing: Building on an actual or perceived crisis. Exploiting windows of opportunity. Symbolic signalling of time frames.

• Visible short-term wins – the demonstration of such wins can galvanise commitment to the wider change strategy.

Turnaround strategy (1) A turnaround strategy is where the emphasis is on speed of change and rapid cost reduction and/or revenue generation.

Turnaround strategy (2) Elements of turnaround strategies:Crisis stabilisation.Management changes.Gaining stakeholder support.Clarifying the target market(s)

and core products.Financial restructuring.

Turnaround strategy

Table 14.4 Turnaround: revenue generation and cost reduction steps

Managing revolutionary change

Managing change in such circumstances is likely to involve:• Clear strategic direction.• Combining rational and symbolic levers.• Multiple styles of change management.• Working with aspects of the existing culture.• Monitoring change.

Managing evolutionary changeManaging change as evolution involves transformational change, but implemented incrementally. This requires: An empowering organisation. Clear strategic vision. Continual change and commitment to experimentation. Identifying interim stages and targets. Use of irreversible changes. Sustained top management commitment. Winning hearts and minds.

Why change programmes failResearch into why change programmes fail indicates seven main failings:1. Death by planning.2. Loss of focus.3. Reinterpretation of change in

terms of current culture.4. Disconnectedness.5. Behavioural (only) compliance.6. Misreading scrutiny and

resistance.7. Broken agreements and

violation of trust by management.

Change Management Summary (1)

• Types of strategic change differ in terms of:– extent of culture change required;– incremental change or urgency

• Aspects of organisational context (as shown in the Change Kaleidoscope) include: the resources and skills that need to be preserved, the degree of homogeneity or diversity in the

organisation, the capability, capacity and readiness for change, the power to make change happen.

• Different approaches to managing change are likely according for different types of change and context.

Change Management Summary (2)

• Forcefield analysis is a useful means of identifying blockages to change and potential levers for change.

• Situational leadership suggests that strategic leaders need to adopt different styles of managing strategic change according to different contexts and in relation to the involvement and interest of different groups.

• Levers for managing strategic change need to be considered in terms of the type of change and context of change. Such levers include building a compelling case for change, challenging the taken-for-granted, the need to change operational processes, routines and symbols, the importance of political processes, and other change tactics.

IT SYSTEMS FAILURE &

END USER COMPUTING RISKS

How Critical is IT to Business?

• Does it depend on the business?– Amazon? ($31,000 / min

globally (2008))– Asda?– Small shop?– One man business?

• NOTE: the question is NOT how much IT do they use?

Information systems Projects Frequently Fail!

• 50%-80% FAILURE rate in large projects• Compare with building an office block!

– Project sponsor– Architect– Civil engineers– Electrical engineers– Mechanical engineers– Project managers– etc

How SHOULD IT systems be put together?

• With similar engineering principles

• Good governance– Who is in charge of IT

systems?• Good project

management• Appropriate people!

Three Keys to Project Success• Top level management

support• A sound methodology• Solid technical leadership

– Someone who has successfully completed a similar project before!

Top Management Support

• Without full commitment – problems will occur

• Must stay behind project when problems occur

• Managers need to be educated on what progress they will see

• Managers often don’t understand what they see

Development Methodology

• Lack of attention to process can kill a system• Many systems built with little thought

– Why?• Major areas of user requirements ignored

– Why?• Large amounts of code need to be rewritten

– Why?• If completed, system often put into place with

inadequate testing– Why?

• We can see that without a well thought out process there is little chance a system will be completed!

Development Methodology• Surprisingly WHICH methodology doesn’t

matter– Many different

• UML• SSADM• Yourdon• Soft Systems

• What matters is a methodology is used!• All methodologies gather the same

information but organize it differently and view the system differently

Solid Technical Leadership• Technical lead must be in

control of the “architecture”– The data model– Application design

• If no overall control the pieces won’t fit together

• Must have built similar systems before– Requires experience

Other Factors

• Cost• Quality• Speed• Risk

10 Ways to Guarantee Failure of a Systems Project1. Don’t use a specific methodology because coding is all that is really

important2. Create the project plan by working backwards from a drop dead system

completion date3. Don’t bother with a data model. Just build whatever tables you need4. Use a technical lead that has never built a similar system. Hiring such a

talent is too expensive5. Hire 40 developers to make the coding go faster6. Build the system in Java, even though most of the development team still

thinks that Java is coffee and you have no intention of ever deploying to the Web

7. Three months before the system goes live, assign one junior developer to handle the data migration.

8. Skip the testing phase because the project is way behind schedule.9. Change the system to support critical new requirements discovered during

final development.10. Buy a commercial, off-the-shelf package and customize it … a lot.

Conclusions

• Don’t cut corners, methodologically. In the long run, this results in system failure or an inadequate system that doesn’t meet the users’ needs.

• Audit each major deliverable and step along the way for accuracy and correctness.

• Carefully monitor top management support for the project. Make sure that managers are aware of the progress of the team.

• Secure the correct technical lead for the project.

So Now You Have a Working System• Surely nothing else can go wrong?

– Requirements change over time– Software / Hardware become obsolete– People change– Natural disasters– Non natural disasters– Security breaches– Data loss– Virus– etc

What is Important in IT• Good Governance

– Should avoid many of the issues discussed• COBIT

– Including VAL IT & RISK IT• At the highest level governance means:

– Including and implementing the mission, vision and strategy– Having an appropriate management structure to manage the

function– Having a suitable organisational structure in place to undertake

the work required – Implementing some form of performance management of

senior managers to ensure targets are achieved and strategies successfully implemented

– An effective level of management to achieve the objectives of the function

Information systems governance• Day to day aspects include

– Liaison between IS and wider organisation– Controlling the IS function– Managing the workflow to achieve requirements– Compliance– Managing budgets and expenditure– Ensuring accountability and transparency– Developing the function to meet forward needs– Managing and controlling changes

COBIT• Control objectives for

information and related technology

• Set of best practice / framework– 4 areas– 34 high level processes – 210 control objectives

COBITPlan and Organise

Acquire and

Implement

Deliver and

Support

Monitor and

Evaluate

Val IT• Collection of proven management practices• Fosters the partnership between IT and rest

of business

Val IT

Risk IT• New framework• Looks at how to ensure value from IT• Fits COBIT framework

Exercise• Evaluating a system

End User ComputingUser created or acquired systems that are

maintained and operated outside of traditional Information Systems Controls.

Traditional Communication Chain

DatabaseAdministrator

UserBusinessAnalyst Programmer Operator Computer

NetworkSpecialist

End-User Computing (EUC)• End-user computing

– Development of all or part of applications– Information specialists act as consultants

• Stimulants to EUC– Increased computer literacy– IS backlog– Low-cost hardware (the PC)– Prewritten software (electronic spreadsheets)

IS and EUCThe End-User Computing Communication Chain

User Computer

InformationSpecialists

Support

Communication

Why has EUC Grown• Declining costs and increasing functionality of hardware

and software• Increasing importance of information + more timely

access to management information• Inability of organisations to satisfy demands of users -

users more self reliant.• Aggressive marketing of EUC computing by vendors of

software and hardware.• IS Costs• Users seek alternatives• Increased interest in and familiarity with computers• Often compliments de-centralised organisational

philosophy

Where does EUC happen?

Strategic

Tactical

Operational

Benefits of EUC1. Increased flexibility and responsiveness -

Management Information2. User Self Reliance3. Reduced Development Life Cycle4. Reduced costs

– Development– Maintenance– Support

5. Ability to respond to competitive pressures

Concerns

• In many organisations, EUC operates in an unstructured environment.

• Traditional IS procedures may be circumvented

• Formal review procedures may not exist• Removes / distracts users from core role• Undermining of Purchasing department

Metaphor

EUC Risks1. Poorly aimed systems2. Poorly designed/ documented systems3. Inefficient use of information

resources4. Loss of data integrity5. Loss of security6. Loss of control

PROMPTPresentation Use of language, style, layout

Relevance Is the information relevant geographically, is the emphasis correct, is the level of information what you desire

Objectivity Are the authors likely to be objective? Do they have a balanced perspective, use emotive language, have biased opinions or financial backing of an interested party?

Method If it is a research paper, is the research laid out clearly, were appropriate methods used etc

Provenance Can the source be traced? Are the authors or organisations involved named?

Timeliness Is the information dated clearly and is that date applicable to your needs or might the information already have become obsolete?

Exercise

• Read the paper–Mitigating Security Risks for End

User Computing Application (EUCA) Data

• Evaluate the paper using the PROMPT criteria

EUC Findings

• Has experienced tremendous growth• Growth should continue • It’s getting easier • But, many traditional controls may be

overlooked • Or - some controls may not be appropriate

for the environment.

The Strategic Implications of End-User Computing (EUC)• Levels of end users in

terms of capabilities– menu-level end users– command-level end users– end-user programmers– functional support

personnel

• EUC application considerations– shifts workload so that end-

users and information specialists’ talents are better used

– reduces communications gap

Core Readings

• CIMA - Performance Strategy: Study Text (2011) BPP Learning Media Ltd. Part D : 13 & 14

• Johnson, Scholes & Whittington (2012) Ch.14

Ideas for Discussion• Abernethy, Margaret A. and Brownell,

Peter (1999) The role of budgets in organizations facing strategic change: an exploratory study, Accounting, Organizations and Society No.24 : pp.189-204

Casestudy 5 : Gertsner’s Pay Package at IBM

Read and prepare the Casestudy on Gertsner’s Pay Package at IBM (Monks & Minow (2011)) for discussion next class. Identify the corporate governance issues faced.

You are required to:

– Map out the stakeholder power/interest issues.

– Evaluate the executive compensation & incentives scheme and model of executive succession planning.

– Propose a more equitable scheme and model to satisfy all stakeholders.

QUESTIONS?