COBIT Final Draft
-
Upload
alex-frieler -
Category
Documents
-
view
93 -
download
0
Transcript of COBIT Final Draft
COBIT 5 Cascade Exercise
Prepared for: Professor Eric Thompson
Prepared by: Alex Frieler 105315054
University of Colorado Denver ISMG 6180 E01
April 4, 2016
Table of Contents Part: Identify the Relevant Stakeholder Needs............................................................................................. 3
Part 2: Identifying the Appropriate Enterprise Goals for MDMC ................................................................. 5
Part 3: Identifying IT Related Goals .............................................................................................................. 6
Part 4: Identifying Management and Governance Processes ....................................................................... 7
Part 5: Management Discussion ................................................................................................................... 8
Part 6: Measurement and Evaluation ......................................................................................................... 11
Part 7: Governance Model .......................................................................................................................... 12
Part 8: Conclusion ....................................................................................................................................... 14
Works Cited ................................................................................................................................................. 15
Part 1: Identify the Relevant Stakeholder Needs
Before identifying the relevant needs of MDMC stakeholders, it is important to identify who the firm’s
major stakeholders are. Based on the case reading, I believe the following constituencies comprise the
major stakeholders at MDMC:
MDMC Employees (Productivity and Value Creation)
Why they are relevant:
The current IT and organizational landscape is highly inefficient and has resorted to cutting
labor costs as a measure to improve the bottom line. Naturally, this has a negative impact
on employees. Developing and integrating the best practices in IT will allow the firm to
become efficient again, halting the reduction of labor costs. Additionally, the inefficient
forecasting, order, and fulfillment associated with the current IT infrastructure at MDMC is
preventing employees from performing their required function at an optimal level, leading
to burnout and lower employee satisfaction. The following quote identifies management’s
frustrations with the operational landscape at MDMC “My people can be twice as
productive if they’re getting information when they need it, not a week later” (Thompson,
2016). The employees, entry-level and higher, are the lifeblood of any organization. They are
relevant stakeholders regarding any organizational decision.
MDMC Customers (CRM)
Why they are relevant:
Without a dedicated customer base, MDMC would cease to exist. MDMC’s customers are
the organization’s reason for existing. MDMC once prided itself on its close relationship with
their consumers. However, international competition and a series of large scale acquisitions
have removed the firm from its foundational roots, creating distance between the
organization and the customers it serves.
MDMC Suppliers (SRM)
Why they are relevant:
The high customization needs associated with MDMC’s product manufacturing require that
the firm have close ties with its supplier to ensure product fulfillment occurs on time and is
up to the high standards of the firm. MDMC’s suppliers play a direct role in creating values
for MDMC consumer, and ultimately help create value for the firm’s shareholders. Despite
this, it would appear that supplier relations may have become constrained in recent years.
“We’re spending almost three times as much as we need on materials because we’re always
expediting orders from our suppliers” (Thompson, 2016). This quote demonstrates the
inefficient purchasing relationship between MDMC and its supplier(s). This scenario is a win-
lose, in favor of the supplier. If left unchecked this could result in balance of power shift that
places MDMC at a disadvantage in the competitive landscape.
MDMC COBIT Cascade
Relevant Stakeholders
MDMC Employees MDMC Customers MDMC Suppliers
Identified Stakeholder Needs
How do I get value from the use of IT? Are end users satisfied
with the quality of the IT service?
How can I best exploit new strategic opportunities?
How do I improve business agility through a more flexible IT
environment?
What concrete vital primary business processes are
dependent on IT, and what are the requirements of the business
processes?
Are sufficient IT resources and infrastructure available to meet
required enterprise strategic objectives?
How dependent am I on external providers? How well are
outsourcing agreements being managed? How do I obtain
assurance over external providers?
Analysis:
MDMC Employees:
MDMC employees must understand how IT is used and how it can help the organization. It is then a
necessity for the IT department to effectively communicate the value of IT to inspire adoption of IT and
its associated technologies. This will help to increase productivity and generate value for the firm.
Regularly analyzing end user satisfaction will help the firm to avoid a culture of complacency and ensure
IT continues to drive value for the firm.
MDMC Customers:
Identifying and exploiting new strategic opportunities will help the firm remain competitive while
promoting innovation. Additionally, regularly evaluating IT resource allocation as it pertains to the
objectives of the organization will help to promote fluid workflow and continuous improvement within
the organization. Combined, these factors will greatly increase the firm’s ability to generate value for its
consumers.
MDMC Suppliers:
Evaluating the agility and flexibility of the firm will allow MDMC to better create a win-win scenario with
its suppliers. Next, evaluating supplier dependence and outsourcing agreements will allow the firm to
effectively control external relationships to ensure that balance of power dynamics remains neutral
between the firm and its external partners.
Part 2: Identifying the Appropriate Enterprise Goals for MDMC
MDMC COBIT Cascade
Relevant Stakeholders
MDMC Employees MDMC Customers MDMC Suppliers
Identified Stakeholder Needs
How do I get value from the use of IT? Are end users satisfied
with the quality of the IT service?
How can I best exploit new strategic opportunities?
How do I improve business agility through a more flexible IT
environment?
What concrete vital primary business processes are
dependent on IT, and what are the requirements of the business
processes?
Are sufficient IT resources and infrastructure available to meet
required enterprise strategic objectives?
How dependent am I on external providers? How well are
outsourcing agreements being managed? How do I obtain
assurance over external providers?
Relevant Enterprise Goals Based on Identified Stakeholder Needs
Optimization of business process functionality
Product and business innovation culture
Agile responses to a changing business environment
Information-based strategic decision making
Business service continuity and availability
Optimization of service delivery costs
Analysis:
MDMC Employees:
Optimizing business process functionality is a crucial enterprise goal for MDMC. Currently, the firm is
operating in a highly inefficient manner. According to the management dialogue in the case, the
inefficiencies are stemming from an inability to properly forecast, a poorly designed cost structure, and
a lack of self-service technologies. Optimizing business procedures will help the firm alleviate these
issues. Additionally, incorporating or providing more emphasis on information-based strategic decision
making will greatly improve the firm’s ability to forecast and respond quickly to shifts in both their
internal and external environment.
MDMC Customers:
MDMC exists to provide value to its customers by providing them with the best medical devices in the
industry. In order to do this, MDMC must continually innovate and find ways to differentiate themselves
from the competition. Given this, it is then essential for the firm to develop and cultivate a product and
innovation culture. With a strong focus on innovation, MDMC must also take precautions to ensure that
the evolution of their offerings is sustainable and relevant to its consumers. In order to ensure this, the
firm should establish enterprise goals that ensure business service continuity and availability.
MDMC Suppliers:
MDMC currently struggles with fulfillment activities, often having to put in rush orders to suppliers,
which is extremely cost inefficient. Integrating an enterprise goal that focuses on improving the firm’s
ability to quickly respond to business environment shifts will allow MDMC to better anticipate supply
needs, effectively reducing the need/dependency for rush orders. This will, in turn, help improve
MDMC’s relations with its suppliers. The case states that MDMC has recently been experiencing financial
losses. Developing an enterprise goal that focuses on the optimization of service delivery costs, will help
the firm to become cash flow positive. Optimization may also help the firm identify underperforming
suppliers, who would then be eliminated to reduce channel clutter.
Part 3: Identifying IT Related Goals
MDMC COBIT Cascade
Relevant Stakeholders
MDMC Employees MDMC Customers MDMC Suppliers
Identified Stakeholder Needs
How do I get value from the use of IT? Are end users satisfied
with the quality of the IT service?
How can I best exploit new strategic opportunities?
How do I improve business agility through a more flexible IT
environment?
What concrete vital primary business processes are
dependent on IT, and what are the requirements of the business
processes?
Are sufficient IT resources and infrastructure available to meet
required enterprise strategic objectives?
How dependent am I on external providers? How well are
outsourcing agreements being managed? How do I obtain
assurance over external providers?
Relevant Enterprise Goals Based on Identified Stakeholder Needs
Optimization of business process functionality
Product and business innovation culture
Agile responses to a changing business environment
Information-based strategic decision making
Business service continuity and availability
Optimization of service delivery costs
Relevant IT Related Goals Based on Enterprise Goals
Delivery of IT services in line with business requirements (P)
Knowledge, expertise and initiatives for business
innovation (P)
IT agility (P)
Optimization of IT assets, resources and capabilities (S)
Adequate use of applications, information and technology
solutions (S)
Enablement and support of business processes by
integrating applications and technology into business
processes (S)
Alignment of IT and business strategy(P)
Security of information, processing infrastructure and
applications (P)
Optimization of IT assets, resources and capabilities (P)
Adequate use of applications, Adequate use of applications, Delivery of programs delivering
information and technology solutions (S)
information and technology solutions (S)
benefits, on time, on budget, and meeting requirements and
quality standards(S)
Analysis:
Each goal was selected to support the corresponding enterprise goal. The overall focus of the IT related
goals is to make the IT group at MDMC more business facing. Notice that three of the six primary IT
goals are directly associated with integrating the IT group with business operations. The remaining
primary goals all work to enhance the IT group’s ability to effectively service the business side of the
organization. Each secondary goal was selected to support the primary IT goal, but consideration was
also given to how the goal would help address the issues articulated in the management discussion
presented at the start of the case. For example, the secondary goal “optimization of IT assets, resources
and capabilities” would help the firm to become cash flow positive by promoting cost savings and more
efficient resource allocation.
Part 4: Identifying Management and Governance Processes
Relevant Stakeholders
MDMC Employees MDMC Customers MDMC Suppliers
Identified Stakeholder Needs
How do I get value from the use of IT? Are end users satisfied
with the quality of the IT service?
How can I best exploit new strategic opportunities?
How do I improve business agility through a more flexible IT
environment?
What concrete vital primary business processes are
dependent on IT, and what are the requirements of the business
processes?
Are sufficient IT resources and infrastructure available to meet
required enterprise strategic objectives?
How dependent am I on external providers? How well are
outsourcing agreements being managed? How do I obtain
assurance over external providers?
Relevant Enterprise Goals Based on Identified Stakeholder Needs
Optimization of business process functionality
Product and business innovation culture
Agile responses to a changing business environment
Information-based strategic decision making
Business service continuity and availability
Optimization of service delivery costs
Relevant IT Related Goals Based on Enterprise Goals
Delivery of IT services in line with business requirements (P)
Knowledge, expertise and initiatives for business
innovation (P)
IT agility (P)
Optimization of IT assets, resources and capabilities (S)
Adequate use of applications, information and technology
solutions (S)
Enablement and support of business processes by
integrating applications and technology into business
processes (S)
Alignment of IT and business strategy(P)
Security of information, processing infrastructure and
applications (P)
Optimization of IT assets, resources and capabilities (P)
Adequate use of applications, information and technology
solutions (S)
Adequate use of applications, information and technology
solutions (S)
Delivery of programs delivering benefits, on time, on budget,
and meeting requirements and quality standards(S)
Relevant Management and Governance Processes Based on IT Related Goals
Manage Relationships (APO08)(P)
Manage Innovation(APO04) (P) Manage the IT Management Framework (APO01)(P)
Manage Human Resources (APO07)(S)
Manage Programs & Projects(BAI01) (S)
Manage Strategy (APO02) (P)
Ensure Governance Framework Setting & Maintenance(EDMO1)
(P)
Manage Risk (APO12) (P) Monitor, Evaluate & Assess Performance & Compliance
(MEA01)(P)
Ensure Resource Optimization (EDM04) (S)
Manage Continuity (DSS04) (S) Manage Knowledge (BAI08) (S)
Analysis:
Moving into management and governance processes, MDMC should develop a forward thinking, long
term, orientation. All primary goals presented have a long term orientation. The time horizon for the
primary goals is 3-5 years. The secondary goals also have a long term orientation, but were selected
more to help address the immediate issues facing MDMC (i.e. resource allocation, forecasting, etc.). The
hybridization of the primary and secondary goals is intended to provide immediate reliefs to some of the
issues currently facing the firm, but the overall objective is to begin establishing a well-structured IT
infrastructure that will support MDMC into the future.
Part 5: Management Discussion
Before applying the cascade progression, presented above, we must first restate the issues currently
facing the firm. Based off the dialogue from MDMC management presented in the case, the following
appear to be the most prevalent issues facing MDMC:
1. Inefficient Cost Structure
2. Lack of Self-Service Technology
3. Inability to Adequately Forecast
The above issues are indicative of a much larger problem facing MDMC, lack of integration between the
IT group and the business side of the organization. To once again become an industry leader, MDMC
must foster a symbiotic relationship between IT and the business functions of the organization.
The cascade presented above offers a strategic framework that MDMC management can use to address
the issues mentioned above and ultimately fix the underlying problem, lack of integration between the
IT groups and business units.
The relevant stakeholders in this scenario are MDMC employees, suppliers, and customers. These
stakeholders were selected, because the interactions establish the cycle that ultimately creates and
delivers value for the end users. This value cycle is also what creates value for the firms shareholders. By
cascading goals and processes down from these groups MDMC is not only developing their internal and
external relationships, but they are improving upon and creating more value for their shareholders. In
short, by appealing to the needs of the firm’s major stakeholders, MDMC will maximize value for its
shareholders.
Recommendations:
Based on the cascade process depicted in the above content, the analysis of issues, and the underlying
problem facing MDMC the following recommendations have been established. These recommendations
will help to meet the needs of MDMC’s major stakeholders while appealing to the management
processes, governance modeling, and IT goals that have been recommended. Combined, these
recommendations will make the MDMC’s IT group business facing.
Recommendation 1: Create a Business-IT Council
The first step in making the IT group more business facing is to unite IT and business leaders. At
MDMC, I think this could be done through the creation of a “Business-IT” council. This council
would meet regularly to discuss the needs of the organization and to identify ways that the IT
group and business functions could work together collaboratively. The ultimate goal of this
council would be to show business leaders that IT is not just a tool; rather IT is a value added
and an integral part of the organization and is essential in ensuring the long term success of the
firm. Once IT and business leadership understand this, they can share benefits of integrating
business and IT with their subordinates, creating a culture of business and IT collaboration and
integration. Developing this kind of relationship and culture will vastly improve relationships
with all major stakeholders and ultimately create more value for the firm’s shareholders. This is
a win-win scenario for everyone.
How it will be Accomplished:
MDMC should appoint leaders from both IT groups and business side of the organization to be
part of the council. An outside mediator may want to be brought in to facilitate dialogue during
the early stage council meetings. The mediator or facilitator would need to be both IT and
business savvy. The formality of language in business and in IT is enormous. Without a bipartisan
interpreter, getting each side to see the benefits of integrating with one another would be a
troubling process. Once leaders from each side realize the benefits of integration, then the
council would focus on how this new collaborative relationship could be used to meet the
objectives of the firm.
Recommendation 2: Standardize MDMC’s IT Landscape
MDMC must streamline and standardize IT operations and systems throughout the company. A
consequence of massive acquisitions is incompatibility across the IT systems of each
organization. While incongruence of systems is not expressly stated in the case, it is assumed to
be present given the inefficient depiction of IT related operations (i.e. poor forecasting). Having
multiple systems across multiple organizations creates an IT nightmare. Systems maintenance,
upgrades, and troubleshooting become a herculean task rather than just being part of day-to-
day operations. This slows the IT group’s ability to effectively adapt to environmental shifts,
which also impacts MDMC’s ability to react. The IT group is the glue that binds all of the unique
SBU’s of MDMC, and to be effective IT must be standardized across the organization. This will
increase the firm’s ability to allocate resources, identify product and service gaps, and respond
quickly to shifts. Standardizing systems and operations across the organization will satisfy
employees by allowing them to operate using better more consistent data. It will also improve
supplier relations by eliminating regular rush orders through better forecasting, and will
ultimately allow MDMC to produce more value for its consumers.
How it will be Accomplished:
MDMC will need to come together as a whole organization to research and analyze the various
IT/ business systems that exist. MDMC should consider how each system impacts its employees,
suppliers, and customers. Consideration must also be given to whether or not it is more
beneficial to make or buy an IT/business system platform. In its current state, I believe that
MDMC would benefit more from buying a standardized IT/business system. Purchasing a system
will allow them to focus more resources on their competitive advantage, which is quality
medical device manufacturing.
Recommendation 3: Establish a Business- IT Liaison
In any organizational change initiative, it is not uncommon for the implemented change to fail
after a brief time. By nature, humans are creatures of habit, and are generally resistant to
change. That being said, if MDMC truly intends to integrate its business functions with the IT
group then they need to establish a liaison(s) that span the gap between these two groups. This
will help ensure that this change initiative sticks. If left to their own devices, the IT group and the
business functions would likely drift apart, going back to the way things used to be done prior to
integration. The liaison would help to ensure communication flowed efficiently between groups
and would also facilitate interaction between parties to ensure that they were working
collaboratively. The liaison could also act as an unbiased third party in the event of disputes
between business functions and the IT group.
How will it be Accomplished:
To accomplish or implement this recommendation MDMC will need to vet candidates that
possess a high level of both business and IT acumen. It may behoove MDMC to bring in an
external candidate, since an outside individual will not have any preconceived biases. This role
should be established and trained to be prepared for the first day that integration is announced
or takes place.
Part 6: Measurement and Evaluation
To measure MDMC’s success in becoming more business facing, the firm should conduct survey
research on individuals from both the IT group and business functions. A simple survey, like the one
seen below, could be distributed to all relevant employees early on during the integration initiative:
IT-Business Integration Survey
The first survey would be distributed to the business functions, and the second survey would be
distributed to the IT group. Notice that each survey contains one quantitative and qualitative question.
This is so that a relevant benchmark related to satisfaction can be established. The Business- IT Council,
Business-IT Liaison, and other managers can then actively track and evaluate each party’s satisfaction
with the other. This would also provide information on the overall success of the integration initiative.
The qualitative question for each survey is intended to provide management and other senior leaders
with immediate actionable information. The responses to these questions will help drive discussion in
the Business-IT Council meetings, and identify things that the Business-IT liaison can work to remedy.
The surveys are extremely simplistic, this is intentional. The simplistic nature of these surveys will allow
for faster data collection and analysis, which translates into faster, more fluid decision making between
IT and the business functions.
Part 7: Governance Model
Before Recommendations and Integration
After Recommendations and Integration
Analysis:
The changes to governance modeling, pre and post recommendation and integration, are relatively
minor. However, these small changes will have profound and far reaching effects on the entire
organization. The overall goal is to make MDMC’s IT group more business facing. To achieve this goal
MDMC does not need to grant more power and autonomy to their IT group, rather they just need to be
more cognizant about involving IT in all aspects of the business process. This change to greater IT
involvement can be seen in the shift from Feudal Governance Archetypes to Federal Governance
Archetypes within the input framework for IT Principles, IT Infrastructure Strategies, and IT Investment
and Prioritization. The goal is not to let IT dictate the business; rather the goal is to have IT become a
part of the business. In the pre-integration model business application decisions were made using a
Feudal Governance Archetype (assumption), in the post-integration model these decisions are made
under a Federal Governance Archetype. This is the most major change to MDMC’s governance resulting
from integration. Decisions related to the firms business applications should be made in collaboration
with IT, rather than be dictated to IT. This will allow the firm to get a better idea of what business
applications are available and which ones would be relevant to their organization.
Part 8: Conclusion
MDMC has become a victim of its own success, the implementation of the Horizon 2010 initiative and
the large number of acquisitions in the early 2000’s fragmented the company. This fragmentation has
resulted in a loss of direction, ultimately manifesting in countless other issues including poor resource
allocation, forecasting, and lack of relevant technology. All is not lost however. If MDMC follows the
goals, processes, and governance dictated in the provided cascade, the firm will pull itself back together.
Following the cascade will not be enough though. To truly rise to prominence once again, MDMC must
integrate its IT group with its numerous business functions. The recommendations provide MDMC with
the necessary tools. These recommendations can be implemented immediately and will have profound
benefits for the company in the short-term and in the long-term.
Works Cited Thompson, E. (2016). COBIT 5 Goals Cascade Exercise- MDCM, Inc. Denver: University of Colorado
Denver.