1

LEADERSHIP FOR A NETWORKED WORLD PROGRAM/EXECUTIVE EDUCATION John F. Kennedy School of Government

Harvard University

TTHHEE TTWWEELLVVEE CCAAPPAABBIILLIITTIIEESS OOFF EEFFFFEECCTTIIVVEE SSHHAARREEDD SSEERRVVIICCEESS EENNTTEERRPPRRIISSEESS

Zachary Tumin, Harvard University11

Introduction

The move to “shared services” is on – locally, regionally, nationally, and globally. To many executives sharing products and services looks easier, smarter, and more “natural” today than even five years ago. From employee benefits and payrolls, to child welfare and school data, to motor pools and landscaping, information technologies provide the rails of change. Political climates support sharing to reduce costs. Drives for quality move enterprises to consolidate and standardize services. A passion for fiscal, operating and policy value brings agencies to forge new alliances. Whether outsourced entirely to business process providers, or run by a consortium of organizations for its members, or managed internally by a corporate service, sharing products and services is today “top-of-mind” for public and private chief executives.

In our current age, in particular, there are times when organizations find they must share products and services, and particularly data, information, and analysis. Law enforcement and intelligence organizations face this challenge every day in dealing with national security threats, for example. Local, national and global health organizations experience it in planning for pandemic flus. State Medicaid directors want to share data on health outcomes for individuals receiving benefits as they move across regions. Municipal officials want to improve services to a troubled family whose children are touched by schools, police, and health providers.

We have had mixed results. The fact is, sharing products and services across organizations continues to be hard. Many organizations do it exceedingly well. Some do not. Whether in classic back office operations or extended enterprises spanning the globe, sharing products and services may look easier today – more inviting, anyway -- than ever before. Yet the work involved continues to befuddle and stall even some of our most talented firms and agencies.

The variability is, in our experience, not complicated to explain: not every organization or enterprise is ready for shared services, or ready enough. It may not have addressed all the risks it will surely face in this complex effort. 1 Zachary Tumin is Executive Director, Leadership for a Networked World Program, John F. Kennedy School of Government, Harvard University. © 2007 President and Fellows of Harvard College. Please contact Zachary Tumin for information (zachary_tumin@harvard.edu ). Capability Maturity Model is registered in the U.S. Patent and Trademark Office by Carnegie Mellon University

2

Readiness “Am I ready for shared services? What do I have to do here to be successful? Are my partners up to

the challenge? Am I?”

Experienced CEOs raise these questions often, and properly so. Whether in our fieldwork or in our classrooms at Harvard, executives want a clear-eyed view of what they’re likely to give, and get, by sharing. They want to understand not just the promise, but also the risk. “Can I get what I’m promised when I need it?” “Can I deliver what I have promised?” “Will it cost me more to produce than what I charge for it?” “Will my partners act responsibly with what I give them? “How do I gain political support and financial capital for the move?” “Who will settle any disputes that arise?”

We have captured what many CEOs have told us, and what we have observed. We have distilled them here as the twelve capabilities of effective shared services enterprises. To be successful at sharing products and services, every organization, no matter what product or service they share, must have these capabilities to a specifiable degree

How capable they must be is another question altogether. For we also know that every sharing scenario has different and even unique requirements for success. For an organization to be ready for shared services, its particular capabilities must match up to the requirements of its sharing scenario. Many don’t, and that is the problem.

Take any three organizations, for example – one uniquely proficient at sharing vehicles via a motor pool, another at sharing health services in a medical facility, another at sharing data over a network in a flu pandemic. We would not expect either to be much good at the other’s business. But as sharing organizations, we would expect them each to have the same twelve capabilities, in very different constellations, each tailored just right to the requirements of running a motor pool, or a health facility, or a pandemic alert network.

In this paper we identify those twelve capabilities. We provide a framework for classifying those capabilities to match up against diverse sharing requirements. We don’t analyze particular industry requirements, except in a cursory way. That is work for particular industries to do. The corporate “line of business” owners of motor pools, or health facilities, or natural disaster response, for example, can come together, using these twelve capabilities, to agree on the requirements for any enterprise to share products or services successfully in that domain.

What we do offer is a framework by which those groups can define the capability requirements for successful sharing, and by which any individual organization can assess its own capabilities for sharing against those requirements. With that knowledge, when the call comes to share products and services, every executive can know whether his or her organization is truly ready to share.

What We Mean When We Speak of Shared Services When we speak of “shared services,” we often think of classic back office

operations like payroll processing, where a centralized unit handles all payroll matters for an organization. We can also think of enterprise-wide services like human resources, which host IT infrastructure to handle employee benefits and attendance records and queries, and also

3

provides enterprise-wide sourcing and staffing services. We can also think of agencies who share their records with others -- like motor vehicle records, criminal histories, and school attendance. We can think of extended enterprises sharing data on pandemic flus, others sharing data on ships, crews and cargoes comprising the maritime domain, and others still on supply chain movements in disaster responses.

Each of these represents a different mode of sharing.

What gets shared can vary– from data and information, to expertise and services, to tangible products. Organizations share everything from weather forecasts and fire risk advisories, to legal services and health services, to print shops, landscaping, and motor pools.

How these products and services get shared also varies greatly. It can be over computer networks; or delivered in person; or handled by a call center, or interoffice mail, for example; or via web sites, web services, or email. We can think of these as the platforms for sharing. Each platform has its unique infrastructure and rules, each in turn unique to a particular product or service.

Who shares services can vary, too. Individuals and units within a single agency can share services. Agencies within the same organization can share; or across organizations and within the same jurisdiction; or across jurisdictions but within the same sector; or across sectors but within the same political unit, or globally, across political units. There are examples for all.

In every instance, however, there is a producer of a product or service; and a consumer. The producer might be a single agency, or organization, or jurisdiction, or even nation. The consumer might be a single agency, or multiple organizations, or governments. Every shared product or service involves a producer-consumer relationship.

When services or products are shared varies as well. It might be on a one-time basis, never to be repeated; or an “on-demand” basis, available upon request; or an “always-on” basis. It might be by prior agreement; or under compulsion. It might be as a result of a decree of a governing body, or by a one-to-one agreement. It could be ad-hoc, or regular, or constant, perhaps in the regular course of business; or perhaps only under extraordinary circumstances.

Why organizations share services – the rationale for sharing – varies, too. Often, it is economic: it’s cheaper to do it once rather than many times, so organizations consolidate services. Sometimes, it’s quality: it’s better to do it one place the same way than many places, different ways. Other times it is to enhance coordination: By giving or getting access to a service or product, an individual organization can improve its own response to a situation, for example, or the enterprise’s overall response.

There are times, also, where the rationale for sharing is transformation: By pooling services together, for example, organizations create something entirely new and much more valuable than any could do on their own. When five agencies combine their data about the ships, crews and cargos on the world’s oceans, for example, the new view from this new service transforms the individual data streams into a much more valuable product useful to all. Transformation “is to” coordination as chemical reaction “is to” physical reaction in the laboratory: we get something entirely new.

There are thus a great many varieties and dimensions of shared services. There are also some important commonalities. There is always a producer and a consumer of the product or

4

service, for example. The product or service always represents an asset – a thing of value – that is the subject of an exchange via a platform of some kind – a computerized alert network, for example, or a walk-in health facility, or a vehicle maintenance garage, or a weekly meeting of designees. Every platform has its own infrastructure and rules, some simple, some incredibly complicated. Every exchange takes place within some larger political economy of individuals and organizations where sharing behavior observes social norms, is subject to political power and process, and has economic costs. All exchanges, lastly, reflect some element of producers’ and consumers’ organization strategy: they engage in sharing in order to achieve results that they can’t without sharing, either by giving or getting a product or service.

Take any of these common dimensions away – producers and consumers, an exchange involving valued assets via a platform with unique infrastructure and rules, the political economy of the exchange, the organization strategy of producers and consumers – and we stop understanding shared services, generally, or being able to explain a particular shared service.

With so much at stake and involved in sharing, managing its risk is very important to organizations. Fiscal savings, work quality, workplace happiness, effectiveness at mission, safety and security of people – all can be shaped by whether sharing is done well or badly. The dimensions of risk in any sharing environment are therefore important to articulate. And, it is important for any organization that is contemplating a move to shared services, of any kind, to understand and manage those risks. “Am I ready for the move to shared services?” asks about the gaps between requirements and capabilities, and the risk that results.

What Makes Sharing Work? Key Capabilities Our research with practitioners in many cross-boundary environments suggests that

there are twelve major risk areas for organizations making the move to shared services of any kind. These risks most often manifest themselves when capabilities for shared services fall short of requirements. Sometimes, risk arises, oddly, when these capabilities exceed requirements. Both kinds of risk are possible.

We can therefore speak of the twelve capabilities for success in shared services as a foundation against which leaders can assess their readiness for shared services, whether as producer or consumer. As each sharing environment has a unique constellation of requirements, assessing readiness -- and risk -- means being clear about those requirements and how one’s own capabilities match up against them.

The Twelve Capabilities of Effective Shared Services Enterprises

In our experience, executives understand risk intuitively: it’s what they lose sleep over. To introduce the twelve capabilities, we will use the negative language of risk, below, without much explanation. Following, we will revert to a positive explanation of each the twelve capabilities of effective shared services enterprise.

The Twelve Risks of Shared Services Enterprises

5

1. Platform Access Risk Producers and consumers cannot access sharing platforms

2. Data Readiness Risk Data to be shared is not visible, usable, understandable

3. Legal, Regulatory Risk Sharing behaviors violate law or regulation

4. Agreements Risk Partners fail to meet each other’s promises or obligations

5. Political Management Risk Leaders fail to navigate political, social and economic shoals necessary to gain authorization, resources, and support

6. Financing Risk Financing is inadequate to support the sharing strategy

7. Governance Risk Governance structure and process fail to address disputes, joint decision-making

8. Strategic Risk The organization strategy has embedded failure: sharing fails to result in the promised value

9. Communications Risk Messages fail to reach or affect critical players in desired ways

10. Dynamic Auditing Risk Sharing develops gaps and problems in critical success factors that go undetected; opportunities for improvements are missed

11. Change Risk Change that is required to assure success is not undertaken

12. Resiliency Risk Critical infrastructures, people, or facilities for sharing are exposed to failure by attack, accident, or natural disaster

The Twelve Capabilities of Effective Shared Services Enterprises 1. Capability #1 (Platform Access): Producers and consumers have access to enterprise

platforms for sharing. Producers and consumers, for example, require network access to use an ERP system. A producer of medical services requires facilities’ access to keep doctors stocked and supplied, and patients must be able to reach the front door. A producer of motor pool services must have access to a vehicle maintenance and storage facility; consumers of those services must have drivers who are appropriately trained and licensed. How much access, when, and at what cost will vary greatly by platform and service. Platform access is a required capability for sharing: producers and consumers must have access – physical, rules-based, or logical -- to the platform over which a service or product is to be shared.

2. Capability #2 (Data Readiness): Data to be shared is visible, usable, and understandable. Certain platforms involve the exchange of data, information, or analysis. Even if there is platform access – say, data producers and consumers all have access to an enterprise service bus that enables them to publish-and-subscribe to data services – still, producers’ data might not be visible, usable, or understandable. That becomes an issue for many data sharing enterprises. Assuring platform access is not sufficient: data must be available.

6

3. Capability #3 (Legal and Regulatory): Producers and consumers share and use products and services legally, in compliance with regulations, and ethically. Statutory or other restrictions on an exchange of products and services can create legal liability, regulatory violations, or other compliance problems. Unlicensed drivers or medical service providers, for example, may ruin insurance coverages; letting non-secured individuals onto computer networks may cause networks to lose valued security certifications. Sharing of confidential health data, data on juveniles, secret or top secret data, criminal history data, and competitive commercial and industrial data can create significant legal liabilities. It is important to understand the legal and regulatory issues involved in sharing products and services, and be prepared to address them.

4. Capability #4 (Compacts and Agreements): Producers and consumers use compacts and agreements to clarify expectations and obligations. Exchanges create promises and obligations between producers and consumers. Will producers provide what they promise so that the consumer can use the product or service as hoped for? Will consumers honor their sides of the bargain by using the service or product correctly, so that they create no unanticipated issues for the producer? Who will fix or be responsible for repairs and upgrades? What understandings might be best to lock in by written, verbal, or other agreements? What force will they have, what issues might intervene when invoking them, and how might we assure compliance, and how would we resolve any disputes that arose?

5. Capability #5 (Political Management): Leadership navigates the political, economic, and social/cultural shoals to gain authorization, resources and support for the sharing enterprise. Social, political, and economic forces – comprising a defined political economy for the sharing enterprise -- can accelerate or impede attainment of goals. Leadership frames vision and the rationale for action, gains external and internal support, forges alliances and addresses conflicts; resources needed capabilities, and energizes “troops” to move along the chosen path. As the operating environments for sharing services are variably dynamic, ranging from staid corporate networks to in-the-wild multi-party extended enterprises crossing jurisdictions and nations in times of crisis, leadership may need to be variably adaptive, depending on the particular requirements of the sharing relationship and its exigencies.

6. Capability #6 (Financing): The enterprise adequately funds needed procurements and acquisitions. What investments do we require to assure that the exchange can take place as planned? Such investments could include improving partner platform capabilities; assuring interoperability of devices and systems; undertaking systems development and standard setting. Individual organizations might fund such development, or there could be some kind of joint or multi-source funding. Addressing such issues is important.

7. Capability #7 (Governance): The sharing enterprise provides an authority structure for critical decisioning. Governance pertains to decision-making over the sharing arrangements – including ratification of agreements, managing disputes, adding new partners, overseeing measurements and metrics, managing costs and procurement. Governance of a shared service enterprise can be a matter between individuals or groups or even among nations. Structure, processes and rules for governance are issues that leaders need to address.

7

8. Capability #8: (Organization Strategy): The enterprise goals are clear, its strategy to attain them sound, and the pathways for action marked. All sharing has a value rationale and an intended outcome. Sometimes it’s a financial savings; other times a quality gain, an improved service capability, or even a complex social outcome (like, “better health” or “safer children”.). Organization strategy is the means by which they propose to attain their goals by correctly aligning resources, authorities, and competencies.

9. Capability #9 (Messaging and Communications): The sharing enterprise communicates effectively with stakeholders and opinion-makers. All shared service enterprises require some ability to create messages about the sharing and to communicate them to stakeholders or interested observers. Sometimes producers and consumers will want to message and communicate with each other; other times to their respective oversight and authorizing bodies, their employees or service recipients, or to news organizations, internal staffs, or government leaders half way around the globe. How best to message and communicate to help achieve the overall goal of sharing a product or service is an issue leaders must address.

10. Capability #10: (Dynamic Auditing) Sharing organizations have awareness of operational performance, scan horizons for issue and opportunities, and are aware of their progress towards goals. In a shared service enterprise, managing overall performance risk is an important issue. Organizations develop and use sensors, measures and metrics., and monitor the status of sharing infrastructures, process, and relationships. They prize awareness of any issues or opportunities and take action as required.

11. Capability #11 (Management of Change and Remediation) : There is a process, structure, and accountability to remediate when change is required When issues arise in measured performance – perhaps costs are running too far ahead of plan, or results too meager against milestones – the sharing enterprise must address this issue. This involves taking steps to assess what is broken, design and implement fixes, and validate their results. Executive sponsorship to repair any tears and remediate any gaps in performance can be essential to success.

12. Capability #12 (Enterprise Resiliency): Critical sharing infrastructures (including people and facilities) are monitored and if degraded by attack, accident or disaster remediated. Some sharing relationships involve critical infrastructure, people and work. Understanding their exposure to attack or disaster, planning for their priority restoration, and monitoring critical systems for aberrant signs can be important.

How Much Capability is Required? In sum, enterprises who wish to share must have certain capabilities - capabilities to

provide accessible platforms, make data available, assure legally and compliant conduct, provide for enforceable agreements, provide leadership through political means, assure financing, specify adequate governance, test and validate outcomes, message and communicate around critical issues, audit operations, change when need be, and provide for resiliency.

How much of a particular capability is required will vary from sharing scenario to scenario, and depend on many factors. As leaders consider sharing, they will naturally ask,

8

“Am I ready to share services, whether as producer or consumer?” The answer is, “Depends on the scenario, and your capabilities.”

Some sharing, for example, really is not all that complicated. All it takes is a handshake between two executives and the rest will fall into place behind them. If there is failure in execution, perhaps not much was at stake, and not much really matters in success or failure.

But some sharing is very complicated, with large systems integration, vast consolidations, global reach of data and services – and with tremendous consequences at stake for people, finances, and performance. If a leader ventures to introduce a shared HR consolidation, for example, there are certain capabilities for governance, leadership, and financing that he and his partners must have to meet that challenge and be successful. If a leader ventures to stand up an extended enterprise of data producers and consumers to address an anthrax attack on a mail system, there are certain capabilities which that enterprise will require to succeed. Capabilities for platform readiness and data availability, messaging and communications, and compacts and agreements will all be tested.

We will discuss capability requirements, further, shortly.

Summing Up So Far: What We Can Say

1. First, there is great structural commonality among sharing enterprises. We always find producers and consumers involved in an exchange of a product or service, for example, a platform for sharing, a political economy as the sharing environment, and other common structural features.

2. Second, there is a great variety of actual shared products and services. These vary by who produces and who consumes, what product or service is shared, with whom, when, with what intended outcome, among other variables.

3. Third, there is a great commonality among the generic capabilities and risks that sharing enterprises must address to be successful. We have identified twelve.

4. Fourth, there is great diversity as to how capable any particular organization must be to succeed. This depends on the particular sharing scenario and its requirements.

III. The Capability Maturity Model Integration® Approach2 When a leader of an organization asks, then, “Am I ready for shared services?” he or

she is asking, “What capabilities are required of me to be successful in this particular service? Am I capable in needed respects? What must I do to ready myself further?”

We can now go on to describe ways to address those questions. Important work has been done in framing these challenges at Carnegie Mellon University, under contract to

2 CMMI is registered in the U.S. Patent and Trademark Office by Carnegie Mellon University

9

DARPA.. While researchers have not specifically focused on shared services, the CMU approach – called Capability Maturity Model Integration (CMMI®)-- is valuable as an analogue and framework.

The CMMI® methodology describes certain capabilities that organizations can be said to have, and to require, to manage any set of complex challenges – from fixing software to fixing bicycles to developing new combat platforms for America’s fleet. A process capability is a way of approaching a problem to deal with it. CMU’s work describes processes as increasingly “mature” -- ranging from ad hoc – we invent a solution on the fly to deal with a problem that arises, for example, – through defined and quantitatively managed, to highly systematized, that is, anticipatory, formalized, repeatable, geared towards total optimization for all interests with stakes in the solution, and measurable as such.

Software engineers developed the CMMI® methodology to solve quality problems in software development. Before we can use it in the services sphere we must adapt it to that world so that we are not stuffing square pegs into round holes. We need to observe seven features of our shared services terrain, in particular, which are relevant to the models’ use.

First, sharing enterprises must articulate their own requirements for success. Every shared service enterprise has requirements which can be specified in terms of the twelve capabilities that we have brought forward.

For some enterprises, we know a lot about those requirements – there have been many successful attempts, and some failed (and sometimes many failure and only a few successes!).

For example, the challenge of standing up a centralized HR operation is fairly well-known, as is that of consolidating a motor pool or print shop. However, novel sharing arrangements may have unknown or poorly defined requirements. In these instances, the task of assessing readiness requires that enterprise partners take the time to specify those requirements. Individual organizations can assess their own capabilities against them, and take action to remedy any over- or under-readiness.

Second, in addition to understanding the generic requirements for sharing, enterprises are obliged to articulate the unique local requirements. That is because the local constellation of factors that determine success – the local issues of financing, governance, or political management, for example – give decisive local “flavor” to the political economy of any sharing scenario. While most sharing scenarios have generic capability requirements – all “HR ops” consolidations have certain “nuts-and-bolts” recurring features, for example -- every sharing scenario also has great local variation. There is no “one-size fits all” in this game. The lights will flash “Game Over” if leaders proceed as if Duluth were Des Moines, or Newport News were New York.

Third, there is always some gap (except, see below) between the capabilities that are required, and what an organization, or an enterprise, is capable of.

For example, governance is one of the twelve capabilities that any sharing scenario requires. Looking at their capabilities, partners to a HR consolidation might notice that they don’t yet have a governance arrangement mapped out. Whoops! We know that ad hoc governance arrangements create real problems in the environment of a HR consolidation. Managing the governance risk appropriately for a HR consolidation requires having a much more sophisticated capability – a capability for governance that is proceduralized,

10

systematized, and can be said to optimize, in its own process, for the benefit of the enterprise. Until these partners work out a more sophisticated governance plan, they are not ready for the HR consolidation.

Just as importantly, in another example, the FBI and a city police department may plan to cross-designate investigators (another sharing mode!) for the purpose of a joint law enforcement investigation. The CMMI® models let us see that, looking at all the capabilities that are required, they may be able to get along just fine with an ad-hoc governance process. That is, their process capability for governance is adequate to the requirement. They don’t need more process than they have. In terms of governance risk and capability, rather, the FBI and the local police department are “good to go”.

Fourth, not all gaps “are created equal”. Some matter a lot, some not much at all; some are really expensive in terms of resources and time to fix; some are easy. There will always be gaps, because performance must be understood in human terms, and that is not always wonderfully or precisely measurable. Which gap you work on first or hardest depends on your tolerance for risk, your sensitivity to cost, and other factors.

Fifth, capable organizations seek the correct fit between capabilities and requirements. They do not seek to optimize of all processes, for example – just those that require it. It is entirely possible that success may require only ad-hoc processes capability in some capability areas, but optimizing capability in others. Organizations can over-prepare by seeking optimization, for example, where ad hoc will do just fine.

Correlatively, it is entirely possible for an organization to be variably ready across the twelve capabilities. Think of the twelve capabilities as your readiness portfolio. You can be ready in some capabilities, but ill-prepared in others. Sharing may require no more than ad hoc governance capability, for example, and that’s exactly the capability level of the enterprise partners. However, their enterprise may require more systematic approaches to platform access, data readiness, or outcome assurance, for example, and cannot settle for ad hoc capability. An organization can be variably ready across the twelve capabilities.

Sixth, there is a commandment here, and it works as well for organizations and enterprises as it does individuals: Know thyself. The known requirements for success, weighed against capabilities, create an imperative for leaders to assure overall readiness. Whether just starting out, expanding, or winding down sharing, readiness is the obligation of leadership. These known requirements in effect caution leaders, “Look, if you’re going to take this on, here are the requirements of success. Are your capabilities up to it? Get ready before you move.” So requirements have a normative aspect to them: they impel leaders to assure that their enterprise is ready. Summing up then, the CMMI models give us a framework for assessing capabilities for sharing as against requirements. They give us a view, in other words, to enterprise readiness. The CMMI® framework can and should be used both descriptively and normatively, in three ways:

• First, to describe the requirements of the sharing scenario for the capabilities of the sharing participants

• Second, to describe the sharing participants’ actual capabilities

11

• Third, prescriptively, to assess how the capabilities of participants match up against the requirements of the scenario – that is, whether the partners are ready to share.

Conclusions We have described a great variety of sharing configurations, and twelve capabilities

of sharing enterprises. We have suggested that the CMMI® framework gives us a good way, further, to map actual organization capabilities against sharing scenario requirements on a process spectrum ranging from ad hoc to optimizing. We have noted, further, that for each of the twelve capabilities, organizations may be “good to go” for some capabilities (i.e., they’re at ad-hoc governance and need nothing more) to “better hold” for others (i.e., they’re at ad-hoc governance but need to be optimizing). Lastly, we have observed that a sharing scenario can require a different process levels for each of the twelve capabilities – some ad hoc, others not, for example. Similarly, an organization is likely able to deploy only ad-hoc processes for some capabilities, and optimizing processes for others.