In my first blog post of 2014, I described how enterprise architecture delivers value in its relationship with other disciplines within the enterprise. I showed you the picture below, outlining this context of EA, and described the main focus areas of BiZZdesign’s EA service line in 2014:

1. Realizing the enterprise strategy.

2. Supporting strategic investment decisions.

3. Fostering enterprise agility.

4. Leveraging technological opportunities.

5. Controlling risk and ensuring compliance.

 

Figure 1. Enterprise Architecture in Context

In a subsequent blog post on value-driven enterprise architecture, I focused on the right-hand side of this picture, zooming on the first three of these topics, and addressed how EA provides business value by connecting the dots between strategy, capability-based planning, portfolio management, program management, and operational delivery and change processes.

Let us now have a look at the left-hand side of the figure, in particular the value of EA in managing risk, compliance and security in the enterprise (nr. 5 in the figure).

Strategic insight into risk

To be in control of the risks you run, the first thing you need is strategic insight in your organization from a risk management perspective. This requires having a consistent and up-to-date overview of your current landscape of products, processes, applications, and infrastructure, and all related risk & security aspects. Without such an overview, you are flying blind in the fog. C-level management cannot fulfill its responsibilities without knowing what the main risk-related issues are.

Having an understanding of these relationships also helps you in assessing the effects of business decisions. This provides the business with a clear insight in the enterprise risks related to, for example, introducing new products and initiatives, outsourcing business processes or IT systems, or assimilating another organization after a merger. Thus, they can weigh the risk propensity of the enterprise against the potential consequences.

Moreover, the propagation of risks throughout the enterprise is of great concern to executives and operational management. Risks in one area may entail risks in another. For example, what are the potential ripple effects of a system failure, break-in, power outage, fraud or other mishap on critical business processes, services, clients, partners, markets, …? Enterprise architecture helps you to create insight in these relations and dependencies, and thus avoid or mitigate potential disasters.

Business-driven security and risk management

A related area in which EA provides tangible business value is in aligning security and risk management with business goals and objectives. Many organizations find it difficult to decide on the right level of security measures, and business managers often see this as a technical issue that is left to the IT people. They, in turn, don’t want to take any risk and create gold-plated solutions that are quite secure but also very expensive (and often rather unfriendly towards users).

Better alignment between business goals, architectural decisions and technical implementation helps the organization to spend its security budget wisely, focused on business-relevant risks. This may even lead to both cost savings and lower risks at the same time, because you do not invest in overly strong security measures for unimportant stuff, leaving more budget to protect the things your enterprise really cares about.

Moreover, security is not something that can be ‘tacked on’ afterwards. Inherently insecure architectures and systems are very difficult to fix later on. Rather, security and risk management should be designed in from the start, using the business goals of the enterprise to decide on appropriate measures.

Regulatory compliance and auditing

Another common reason for having a mature EA practice, especially in heavily regulated sectors such as banking and insurance, is regulatory compliance. Central banks and other regulatory bodies mandate or at least strongly recommend that financial institutions have a well-established EA practice, to ensure they are in control of their operation. They may even audit these architectures or use them in other ways to assess the risks the organization runs. Of course, internal auditors, CISO’s, and risk managers benefit from using EA artifacts as well. The insights into enterprise-wide relations and dependencies that these provide are important inputs for their tasks.

Implementing standards and policies such as SEPA, Solvency II, Basel III and others requires enterprise-wide coordination, visibility and traceability from boardroom-level decisions on e.g. risk appetite of the organization, down to the implementation of measures and controls in business processes and IT systems. Enterprise architecture as a practice, and enterprise architecture models that capture these relations, are indispensable to manage the wide-ranging impact of such developments.

Next steps

To benefit fully from the use of enterprise architecture in the context of security, compliance and risk management, we suggest that you focus on the following:

• Align security and risk management with business strategy. Always view security and risk measures from the perspective of the business value they add.

• Capture and visualize risk and security aspects of your organization. Visualize hazards, risks and mitigation measures in relation to the overall architecture and business strategy.

• Measure and visualize the impact of risks and use these insights for decision making. Visualize data from e.g. penetration tests and use this to decide at the business level about necessary IT measures.

• Prioritize security projects. Calculate the business value and impact of security projects and use this to make a prioritization of IT measures.

• Use effective tool support. Software for fast and clear modeling, analyzing and visualizing provides the necessary insights. For example, BiZZdesign Architect, our easy-to-use, powerful tool for enterprise architecture and enterprise risk & security management.

Last week I talked about the differences between Service Catalog and Service Portfolio. This week is about the span of control Enterprise Architecture needs to have within an organization to be successful.
Everyone is well aware of the fact that Enter…

By: Ben Geller, VP Marketing, Troux

It’s been a month since Troux hosted more than 200 customers at our worldwide conference in Austin to talk about ways to make enterprise architecture (EA) a must-have business capability. Now that everyone has digested their Texas BBQ and cleared out their inboxes, we’d like to reflect back on what attendees experienced at this year’s Troux Worldwide Conference.

What’s all the fuss about?

We started the Worldwide Conference four years ago to bring together customers, partners, and professionals involved in Enterprise Architecture (EA) for networking and joint learning with a focus on delivering rapid results with Troux Enterprise Portfolio Management (EPM) solutions. That event has become an annual function that drives EA discussions and a lot of knowledge sharing.

The theme for the 2014 conference was Making EA Stick and featured presentations from over a dozen Troux clients and partners. We were thrilled to welcome Amway, ANZ Bank, Apptio, Atos, BDNA, Dell, Fidelity Investments, HSBC, JetBlue, MetLife, Molina Healthcare, Saudi Airlines and VMware to share key learnings and outcomes achieved on their EA journey. In addition, the Troux team presented keynotes, demos and best practice sessions that walked attendees through how to use EA to drive strategic decision-making and business success.

Rather than tell you what we thought of the experience, we gathered some key conference takeaways from attendees:

Cary Brown, Molina Healthcare said:

• Think in terms of business value: To align EA to business outcomes it is important that you think in terms of the problems you are solving for each area as if you worked there and demonstrate EA’s value every step of the way, making them equally as successful in helping the company achieve their goals.
• Change your own processes where it matters most: Just because you’ve done something a certain way doesn’t mean you need to always do it that way. Your business changes and EA needs to change along with it.
• Answer Important Questions: Once you know the chief challenges in your key business areas you can clearly identify the questions that need answering the most, then drive EA towards answering those questions.

Amway’s Dave Reinhard summed up his takeaways as:

• Sharing experiences on EPM with companies navigating new and mature programs makes it a lot easier to put headlights on our own program and avoid potential problems.
• Understanding comes with communication. Problems come without it.
• There always seems to be just one more facet that I hadn’t thought of before.

In his blog, Intact Technology, 2014 Worldwide Conference, Corey Balko wrote:

Great architects should become great communicators. The common theme heard throughout the conference was how to communicate value back to the organization. There was no shortage of valuable data, but we need to understand that it is not about the data. The way we usually communicate is hurting us. We struggle with communicating the value of EA.

Read Corey’s entire blog post for a list of pitfalls to avoid and for tips on how to turn your data into a story that people want to hear.

Keep the EA learnings going! Join us for Troux Directions EMEA 2014

Join us in London on October 1st for the 2014 Troux Directions EMEA Conference. This event is designed for business and IT executives who are actively involved in defining business strategy for their company. Troux Directions lets you enjoy peer networking and learning with a focus on delivering rapid business results with Troux EPM solutions.

In this blog post we will zoom in the Waste Scan Technique, a Lean technique that is part of the Analysis phase in the DMAIC cycle. Previous blog posts discussed different techniques of the Measure and Define Phase, and next posts will elaborate on other Analysis techniques.

What is it?
The Waste Scan focuses on waste in the process. It turns out there is a lot of waste in our processes and organizations. By recognizing and visualizing this waste we can reduce it. Lean offers many different solutions for tackling waste.

Getting started

1. The refresh button in the LeanCoach collects all yellow sticky notes; these notes are the reason for using this technique. If there are no yellow sticky notes, it can be an incentive to not use this technique.

2. The foundation of Waste Scan is the process model.

3. The process model shows waste in icons. A short introduction to waste:

   • Movement: Movement of people in the process.

   • Transport: Movement of products or information (carriers).

   • Complexity: Unnecessary complexity of the process, resources or rules.

   • Waiting: People waiting in the process.

   • Recovery work: Recovery activities in the process.

   • Inventory: Inventory or waiting lines in the process.

   • Over-processing: Adding more value than the customer is asking for.

4. Yellow sticky notes can be moved to a relevant part of the process.

5. ‘Red sticky notes’ (identified causes) can be added from scratch or from a yellow sticky note.

Tips and best practices

• Make sure that when performing this technique, you have good representation of people from the work floor.

• It is a good idea to have someone from outside of the process look over your shoulder into the process for (part of) the day, on location (observation). This helps create a good picture of the process and can open up a discussion about ingrained patterns.

 

After an almost two-year hiatus from blogging here, I have decided to return to blogging and an internet presence devoted to enterprise & data architecture, with a good dose of project managment thrown in. As part of that process, I…