By Stephen Hoops
Do any of these sound like something that could happen at your company?
- Your technology and infrastructure team wants to move everything to the Cloud, but your sales and marketing team sells on the basis that no service is based on the cloud.
- One of your business units thinks something is a risk, but another disagrees. After much debate, you find that the two units were defining the risk differently.
- You have a formal governance program in place, but it’s not running at its best in part because it fails to distribute ownership and enforcement.
Risk management frameworks for business transformation programs offer a systematic approach to assess, prioritize, and mitigate risks. Executed right, you can define risks, provide a foundation for your mitigation plan, recognize that precision in language matters, and encourage collaboration throughout the creation and execution of the initiative. In the case of the erstwhile governance program, the good news is having one indicates leadership buy-in exists.
Companies seeking to ensure risk is integrated into their project-management processes often ask us to work with their project teams to develop business requirements for technology transformation; create vendor scorecards to identify the optimal technology vendor is selected; manage the PMO infrastructure of a transformation project; and triage and measure the results of change.
Before we start work, we suggest they sit down to clearly articulate the desired future state, identify gaps in their technological capabilities, and create a Business Requirements Document (BRD) that the entire organization can embrace. One of the areas where data analytics companies can help is by analyzing data from a variety of sources (e.g., financial, customer, and operational data) to identify trends and patterns that may indicate the likelihood of a particular risk occurring.
Transformation projects tend to fall operations heads, chief technology officers, and, increasingly, chief financial officers. Regardless of who it is, someone is being asked to integrate multiple complex, interrelated initiatives with tight deadlines.
Simplicity is key to a successful transformation project, and we urge project leaders to be ready to answer questions from senior executives and board members like:
- Are the right defenses in place and the right resources at hand?
- Do the people who require permissions have them?
- Will the solution impede our business needs?
- How does this solution grow our business?
When adopting and developing digital transformation, business leaders should take their risk management strategies into account, according to PwC’s Global Risk Survey 2022, which recommends that leaders continually ask themselves about the risk and rewards from any digital transformation journey.
Strategic decisions might include assessing the timing to spin off a business unit and the risks to the brand, reputation, and cash flow; setting clear goals for a multi-year digital transformation project, including vendor qualifications, scheduled downtimes, and futureproofing; and determining the capital needed to expand or create a new business model.
Accenture recently released The Paradox of Choice for CFOs: A Guide For Enterprise Reinvention in the Age of Complexity, which recognizes that multiple options regarding scale, pace, technology, and approach can hinder decision-making to the point where two-thirds of the CFOs Accenture survey said they feel paralyzed at times by the decisions and options they’re facing.
As we talk to prospects and existing clients who are facing similar issues, our initial questions center on the quality (or bandwidth) of their project leadership; whether they have an executive steering committee to clear obstacles and quickly make decisions; and whether they’ve documented business requirements. In the absence of that, we’ve seen organizations end up with technology that doesn’t meet their business needs from the day after migration or in the future as the company grows or becomes more complex.
McKinsey focused on this issue in a June 2021 article that outlined six coordinated risk-and-compliance actions that should take place during digital transformation, emphasizing the importance of avoid doing them on a one-off basis. These concrete actions include increasing ownership at the first line of defense; automating controls; upskilling and managing talent; and modernizing risk identification.
Executives leading transformation efforts need to consider such risk categories as technology and cybersecurity (e.g., system stability or unauthorized access to systems), privacy and obtaining customer consent to use their data, credit, legal (e.g., failure to juggle jurisdictional requirements in digital channels) and reputational.
It’s great advice for businesses of any size. Getting everyone on the same framework that focuses on risk management and business continuity is mission-critical. While there are risks associated with the implementation of new technologies, there are even bigger risks associated with the organization’s ability to make effective use of the solutions chosen.
In a digital environment, no transformation will succeed without defining and implementing the appropriate controls and security. The Cloud can be a key enabling technology for transformation initiatives, and the risk function can help keep your cloud strategy on track by recommending effective controls related to concerns such as data privacy, security of ecosystem partners, and protection of data in physical as well as virtual locations.
Digital transformation can happen without risk management, but it is – in a word — risky. Conversely, if your risk management program isn’t informed by transformation strategies, it could be a possible opening waiting to be exploited. In the end, you can’t do one without the other.
Stephen Hoops is CEO of Predictive Analytics Group, a Newark, DE-based data analytics firm that helps clients cost-effectively bridge the gap between analysis and making impactful strategic or tactical decisions.
