Beating IT Risks

Case study: Agility

Successful delivery of a strategic IT initiative through an assurance program

Agility is a wholly owned subsidiary of the Australian Gas Light Company (AGL), Australia’s leading energy company. Agility provides a suite of infrastructure services across the gas, electricity, water and telecommunication industries. Agility’s core capabilities span across ‘high-level’ strategic asset management, construction, operational and maintenance services. Across Australia, Agility manages and operates over 7000 kilometres of highpressure gas transmission pipelines, 23 000 kilometres of gas distribution networks, and 950 square kilometres of electricity distribution network for AGL, associate and third party entities.

With the background of a rapidly changing Australian energy market, Agility has successfully pursued a strategy to transform itself from being part of a vertically integrated energy business into a world-class, serviceoriented infrastructure service company.

Agility had embarked on a restructure of all its SAP platforms across the business, which was in its project definition phase when the new strategic direction was finalized. Although originally viewed within the limited scope of a systems project, it was soon realized that the SAP project needed a substantial review if it was to provide an optimal system solution in support of the service-oriented strategy.

The timely completion of the SAP project was seen as critical to Agility’s ability to realize strategic intent. Consequently, Agility decided that it was prudent to appoint PA in an external advisory and assurance role.

Clarifying the strategic context and setting the new direction

A rapid review of the SAP restructure project, establishing an accurate view of the current status, identified perceptions within important stakeholder groups, and helped to crystallize the role of the project in Agility’s business strategy.

The project had become the key enabler to most of Agility’s strategic initiatives (in particular the simultaneous cultural change and performance measurement initiatives) and the cornerstone of a complex organizational change program. This insight enabled a rapid redefinition of scope and direction and the swift revision of the project leadership and governance model, which was implemented soon afterwards.

An innovative assurance program was set up that provided guidance for the full duration of the project. Unlike traditional audit approaches focusing

on compliance against pre-defined process standards, PA applied a flexible and pragmatic ‘low intervention / high-impact approach’ combining audit and coaching.

This approach identified key risk areas and provided support where needed while ensuring the full ownership by the Agility team for the execution of the whole project.

Assurance program activities included regular ‘health checks’, support and coaching of project manager and key staff, and a comprehensive ‘go-live’ readiness review providing assurance that the project was prepared for the critical data conversion and cut-over activities.

Ensuring successful project delivery and increasing business benefit

Confidence levels within the executive team rose quickly and regular reviews provided a clear picture of key risk areas and mitigating actions. PA assisted Agility to change direction faster and with more confidence to achieve successful delivery. The high level of alignment of the system with the strategic intent has already delivered a substantial business benefit to the organization.

The ongoing assurance and coaching role also prevented the project and leadership team from getting too close to the detail of day-to-day issues and activities. This ‘non-executive director role’ not only created external pressure to keep up the fast pace required to bring the project to a successful conclusion, but also provided the required support when issues were encountered.

The long-term nature of the engagement over the full project lifecycle meant that the consulting team gained a detailed understanding of the issues at hand and could provide realistic and balanced recommendations. Agility achieved a successful delivery of a critical project that has acted as one of the key enablers for Agility’s strategic transformation initiatives.

. . . there is no doubt that bringing in PA Consulting Group was a good decision. It provided the independent project assurance that we needed to ensure the project was kept focused and on track.

(Norm Pack, Chief Financial Officer)

Printed with permission of PA Consulting Group and Agility

5 IT services

Under fire . . .

In February 2004 the SCO Group was the target of a denial of service attack linked to Mydoom, one of the fastest spreading email worms in history. The SCO website was rendered inaccessible and the site taken down. The company changed its domain name and moved to a new IP address. (AFR, 2004b)

On fire . . .

Bankstown City Council’s Civic Centre was devastated by fire, the General Manager Mark Fitzgibbon completed an assessment of the damage, the response and the lessons. We extract the IT-related elements of the story:

For us the problem was that although we had the physical data files, we had nothing on which to run the data. Our mainframe was destroyed during the fire by smoke and water and there simply wasn’t another machine like it in the country to read or convert the data. In fact we ended up having to import a second hand machine from France! Similarly we had to procure new file servers to recover a mountain of data contained on our office network such as all word processed documents.

(Fitzgibbon, 1998)

Closed for business . . .

Trading on the London Stock Exchange was disrupted for nearly eight hours by computer problems on Wednesday on what should have been one its busiest days of the year . . .

The tax year expired on Wednesday and it is usually one of the exchange’s heaviest days as thousands of retail investors buy and sell shares for capital gains tax purposes. But the Inland Revenue said it

would not extend the tax year by a day to compensate for the exchange’s problems . . .

The breakdown coincided with news that the exchange had re-opened talks with Deutsche Börse, operator of the Frankfurt financial markets, on a possible merger of their operations. (Financial Times, 2000)

. . . and powerless

The central business district of Auckland, New Zealand, was paralysed for a period of six weeks when the power supply was broken (NZ Commerce, 1998). An overload and breakdown on one cable caused another to break down, to the extent that all of the lines eventually collapsed. In the short term, businesses were able to survive only if they had generating capacity immediately available. With the entire central business district without electrical power supply, there was an immediate shortage of supply of generators. For the financial institutions in the business district, this translated into a dramatic performance differential between the one organization that continued to deliver services to their clients, and the rest who were completely shut down.

The long-term impact was quite a different story. As the period of alternative service provision continued for many weeks, it became increasingly difficult to provide those services from a remote location. The New Zealand staff were accommodated in Sydney, Australia, and so had to work New Zealand business hours when living in a different time zone. Routine matters such as hours of work, rates of pay and leave arrangements became increasingly fraught and challenging.

Initially the problem of lack of electricity meant that the issues of lighting, air conditioning and the operation of lifts were those that affected staff safety, but as soon as standby facilities were arranged the critical business issues of delivering service to customers became paramount. At this point staff discovered which computers have uninterruptible power supplies (UPS), which servers were unaffected, and which of their external critical business connections were still operational. After a short period of time, generators needed to be started so that continuing operations could be established. So very quickly there was a transition from issues of safety to service delivery.

In the development of IT strategic plans it is common to take the major activities of the firm and to consider the degree to which IT supports or enables the business process, to look for opportunities where IT could better support or enable the delivery of that process and the process outcomes.

Where IT makes a strong contribution to the critical business processes this is considered a ‘good thing’ from an IT strategy point of view. IT is relevant to the firm because it supports the central activities and core functions.

However, from a business continuity point of view, the greater the degree of reliance on IT the greater the degree of vulnerability that business process has on failures in IT.

any action, even to be able to enter the buildings. When emergency services withdraw, business continuity plans can be put into operation to restore the business to full functioning in as short time as possible, with the previously established priorities.

The terms ‘emergency’, ‘crisis’ and ‘disaster’ are defined precisely by some organizations but weakly by others. Typically a crisis is defined as having an acute impact on the financial stability of the organization or on the lives of personnel, and will require an immediate, formal and public response by management.36 Usually, such a public response will come from the public relations (PR) or marketing teams, even though the crisis may have originated in IT, finance, product quality or staff misbehaviour. Emergencies involve public emergency response services and will likely have a declaration by an outside organization. If IT service failure is causing serious public brand damage or shareholder losses, PR, the CEO and the board may well be involved.

Information asset impacts

There is a natural connection between information asset management and IT service delivery. All kinds of IT services are delivered using information assets whether these are the computer databases or systems and applications. Requirements for confidentiality, integrity, availability and compliance can be determined by examining the information assets as well as the IT service. Some business users may be able to determine the needs for service delivery or the protection of the assets that are fundamental to their business unit’s success.

In many cases a loss of connection is not damaging the asset; however, the asset achieves its value by being available, and it is the availability that is now lost.37

Managing system failures

It is typically at the system level that service failures are detected. The helpdesk staff gets a call that the customer quotation system is down. The included services are not apparent to the helpdesk person and so system level procedures will be used. Every failure must be treated as an incident. Formal incident recording, tracking, management and monitoring will be needed if an organization is to be

36The US General Accounting Office review of continuity of operations efforts focus on human capital considerations (GAO, 2004b) in terms of employee welfare in a time of crisis and employee contribution to continuity efforts.

37Besnard and Arief (2004, p. 258) describe a potential security measure for a server: ‘Not plugging it into a network is a relatively secure condition but the service will not be delivered.’

able to understand its current performance level and also develop the potential for long-term improvement of its incident management. Only in the case of life-threatening, hazardous situations should incident recording not be commenced immediately.

Historically IT staff have been disproportionately involved in service continuity as they were the suppliers of IT services that were particularly unreliable. Now that IT hardware is much more reliable, the emphasis has changed to focus on the complexity of the IT installations and the dependence for these services within the organization.

The majority of incidents will have an established recovery approach that has been pre-designed, pre-planned and pre-approved. Staff will have been trained in the appropriate recovery actions and will then complete the incident record. In large installations any incident that exceeds the defined specifications that have been part of the standard training is then quickly escalated to a specialist team that is able to investigate, request additional facilities, and work towards developing a solution.

All the defined incidents will have an incident level that establishes communication channels and priority. Incident notification can be generated by all members of the organization directly through the IT helpdesk. Additional incident notifications will be generated by the IT staff themselves.

Higher levels of criticality will invoke the business continuity plan or the crisis management plan. IT staff will need to know the escalation plan, contacts and urgent actions that they must carry out. The complementary situation arises when a business continuity failure in another part of the organization leads to special, additional requirements on the IT facilities in this location.

With critical incidents the focus is on restoration – the challenge of finding the root cause of the problem will have to wait until appropriate resources can be brought to bear and priorities determined.

Complex scenarios

There are myriad things that can go wrong. Compiling an exhaustive ‘laundry list’ of components, facilities, systems and utilities that can fail in different ways only creates a very long list. This is not very effective for training or planning purposes. It is simpler to envisage four or five comprehensively described scenarios where several contingencies occur at the same time. In the training setting, teams of staff can read the whole scenario and determine what actions they would need to take. The necessary actions can then be compared with those that are incorporated in whatever plan is currently existing.

Scenarios can range in severity from minor to extreme, with impacts on different business units, and involving different facilities. The business continuity team and IT continuity team can creatively invent new scenarios for testing, as

can crisis management team members. Of course, it is not anticipated that a particular disaster will match any of the prepared scenarios, but simply that we are prepared for the complexity of interacting demands and follow-on impacts.

Planning and preparation

Given that planning and preparing comprise the dominant activity for continuity assurance, how do we start? The challenge for most organizations is the first step. Too often there is an attempt to work out all the threats and risks – but this detracts from the driving issue, which is the business impact. The approach that follows works in three stages:

1.Carry out business impact analysis.

2.Set disaster avoidance–disaster recovery objectives.

3.Match the disaster avoidance–disaster recovery activities to the objectives.

Business impact analysis

If the achievement of your organization’s business objectives can be impacted by the failure of IT services to deliver as and when required, then there is a clear business impact and service continuity is an important undertaking. As more organizations link their systems to their customers and suppliers, the IT service continuity priority increases. When using a third party provider, the service levels become explicit but when these services are provided in-house too often there are no such definitions.

Starting from scratch on IT service continuity requires the definition of the services that are provided. In some organizations this will be more clearly indicated through business processes, rather than IT services. For each service or process, the consequences to the business need to be worked out. What is the significance of not being able to process an inventory receipt for one hour, four hours, 12 hours, etc.? What if we can’t update a customer’s service requirement record within a day? The business impacts don’t have to be worked out in money terms if this is not obvious, but qualitative assessments are sufficient.

The critical issue is to work out which services or processes have what impacts on the business performance so that they can be given the proper level of attention. The important processes or services need to be examined carefully to determine their component activities and the resources that they draw upon, because it is disruption in the supply of resources that eventuates in a discontinuity.