emerging demand for business project audits

© Raymond Young The Emerging Demand for Business Project Audits No 1

The Emerging Demandfor Business Project Audits

Presented by: Dr Raymond [email protected]

ISACA Technical SessionSydney, 14 March 2007


The Emerging Demand

for

Business Project Audits

Legislative True and fair view

Risks

Controls

Testing

Disasters & corporate collapses Cadbury

(1992)

COSOCOCO

KING

Bosch (1995)

Directors areresponsible

for risk

Hampel (1998)

Turnbull (1999)

avoid box ticking

ENRON, Worldcom

Sarbanes-OxleyCLERP9, ASX,AS8000

CorporateGovernance

Backlash against risk

AWB,James Hardie

To ensure management is focussed on above average returns

taking account of risk (Hilmer)


An emerging board level demand• Boards appear to be genuinely interested in improving their

performance (Leblanc 2005)

– PRO:NED have identified IT Governance as an emerging board trend.– Almost one third of UK firms include an executive with e-business

responsibilities on the board (CBI, 2001). It is more than 60% in US companies

• Boards are looking for guidance with respect to IT (Young and Jordan 2002)

– In the next few years, E-commerce risks will be among the most important that companies will face (SRBI, 2001)

– “there’s a lot of discussion by directors … [ecommerce] …the company might be left behind” … “some board members were saying we should be doing more, some less … nobody much was up the curve so the board members were all trying to figure it out”.

– Most companies recognised a much higher level of risk because of the uncertainties involved and relied on external advice to validate any strategy proposed by management

– … the main considerations are “the fear of the consequences of making a mistake, a fear of costing multiple times more than what anybody planned, a fear they don’t have the expertise” and the lack of successful models to guide decision making


Who do directors trust for advice?• Directors recognised a need for an understanding of technology but their

experience with IT people was disappointing. “With technocrats, the only three things you can be sure of are: nothing would get

finished on time, it would always cost vastly more than predicted and it would never do what it was promised to do”.

• Main sources of advice “I tend to be relying more on outside experts than I would normally do when

assessing a project”“there is a tendency to accept the recommendations of management, which tend to

echo the recommendations of the consultants …there is no thorough analytical review in the way you would have in other areas where the directors know what’s going on”

“the board members I talk to are very comfortable if there is someone taking responsibility and particularly comfortable if it’s McKinsey or one of the major firms”

• Recognised deficiencies in the advice“are the boards [receiving] summaries, no … it's difficult for directors to make good

decisions” … “I don’t see anyone doing a consequences analysis documenting what if we don't do it and what if we do it” … “management is gathering tons of information and don't know how to present it”

“for all the Standards that do exist, there is no guidance on how to go about making the decisions to implement an ecommerce strategy”


IT & Project Standardsvs Business Project Standards

• AS8015– “makes it sound doable”– Under consideration for

fast-track adoption by ISO• AS8016

– HB280–2006– ValIT

• Best Practice Standards– PMBOK, PRINCE2– BS15000, ITIL– ISO/IEC 12207, ISO/IEC

12207– ISO17799, NIST handbook– COBIT

• Challenges– “Little practical utility”

(Lyytinen 1987) – “no consistent impact on

success” (Kraemer and King 1986)

– Overemphasise technical & project management considerations (Lucas 1975, Sauer 1999, Young 2005)

– Untested against objective criteria (Checkland 1981, Strassman 1995, Young & Jordan 2005)

“I have checked with ISACA and they agree with your conclusion about [lack of] supporting evidence.”


HB280: a refocus on above average returnsProject Management vs. Project Success (de Wit 1985)

• project management success is less important (Baccarini 1999)

• “benefits are not delivered or realised by the project manager and project team, they require the actions of operations management.” (Cooke-Davis 2002)

• there is not a strong relationship between project management success and project success or between project management failure and project failure (Markus et. al. 2000)

4 65

1 Initiation

2 Planning

3 Development

4 Implementation

5 Benefit

6 Closedown

1 2 3

Scope of project success

Scope of project management success


HB280: Case Studies What is the most important success factor?

Hypothesis T-Serv T-Media ABS Agency SkyHigh Conclusion

1. Top management support Strong support

2. High level project planning Inconclusive

3. Project methodologies - Inconclusive

4. User involvement Inconclusive

5. Project staff Not supported


Average Returns(Young 2006b)

OK

Som

eN

oF

ail

ROI30%

10-20% (Clegg et al 1997)

30-40% (Willcocks and Margetts 1994)

15% (Standish 1999,2003)

2/3 of projectsdeliver no benefitswhatsoever

35%

4–10x (Brynjolfsson & Hitt 1998)or30% (Garrity 1963)


Above Average Returns(Young 2006b)

OK

Som

eN

oF

ail

ROI30%

CurrentPerformance(68% under)

OK

Som

eF

ail

ROI135%

BetterPerformance(43% under)

OK

Can

cel

ROI240%

ExcellentPerformance

(15% cancelled)

National Implicationadditional $10.5B-$21B pa (1.6 - 3.1%

GDP)


TopManagement

Support

Business processes

ICT Operations

Changed Business Processes

Changed ICT Operations

Projects

43

Evaluate2

Initiate1

Direct & Monitor

5

6

HB280:2006A better way to understand projects


TopManagement

Business processes

ICT Operations

Changed Business Processes

Changed ICT Operations

6. Are the benefits realised?

2. How much change is required to realise

the benefits?

1. What are the expected business

benefits?

3. Who should sponsor the

project?

4. Who will be accountable for the

benefits and how will they be measured and

rewarded?ie how will realisation of benefits

be measured?

Support

3

Evaluate2

Initiate1

Direct & Monitor

5

6

Projects

4

5

5. Is the culture right for unexpected issues to be

raised?

HB280 Recommendations


Conclusionpossible indicators of the emerging demand for

business project audits• Appointment of board members with IT experience• McKinsey or one of the major firms

– offer project audit services– UKIIA– c.f. Jed Simms at Capability

• Successful Models to guide decision making– AS8015, AS8016, ISO ?– ARC linkage grant, five collaboration partners contributing $550,000 over 3 years

($100,000 in cash)• When ‘Business projects’ enters the business jargon

– ValIT vs PMBOK– When project managers realise they should not be king.– When business managers finally step up to the plate

• Major negative press – an ‘James Hardie’ relating to IT c.f. API – Public sector exposure?


Key References

• Cooke-Davies, T. (2002). "The "real" success factors on projects." International Journal of Project Management 20: 185-190.

• de Wit (1985). "Measurement of project success." International Journal of Project Management 6(3): 164-170.

• Leblanc, R. and J. Gillies (2005). Inside the Boardroom: the coming revolution in corporate governance. Toronto, John Wiley and Sons.

• Lucas, H. C. (1975). Why Information Systems Fail. New York, Columbia University Press.• Markus, M. L., S. Axline, et al. (2000). "Learning from adopters' experience with ERP: problems

encountered and success achieved." Journal of Information Technology 15: 245-265.• SRBI (2001). The E-Frontier: New Challenges to Corporate Risk Management. New York, SRBI

Study for The St. Paul Companies.• Strassmann, P. A. (1995). The Politics of Information Management. New Canaan, CT.,

Information Economics Press.• Young, R. (2006a). HB 280-2006 Case Studies - How Boards and Senior Management Have

Governed ICT Projects to Succeed (or Fail). Sydney, Standards Australia.• Young, R. (2006b). What is the ROI for IT Project Governance? Engaging the board and top

management. 2006 IT Governance International Conference, Auckland, New Zealand.• Young, R. and E. Jordan (2005). The implications of Australian ICT Governance Standards for

COBIT. 2005 IT Governance International Conference, Auckland, New Zealand.• Young, R. C. and E. Jordan (2002). Lifting the Game: Board views on e-commerce risk. IFIP

TG8.6 the adoption and diffusion of IT in an environment of critical change, Sydney, Pearson Publishing Service.


Questions

Please provide your business card for a copy of this presentation

Warning: You will be “researched”

emerging demand for business project audits

Documents

project management success

project staff

project team

project manager

business project auditsno

project management failure

success edp success

project failure markus