The Unified Performance, Risk, and Compliance Process Model

Recently, Nenshad Bardoliwalla wrote a nice series of 4 posts, entitled The Unified Performance, Risk, and Compliance Process Model, published in his blog and also in the Enterprise Irregulars website. The series of posts were excerpted from his excellent book Driven to Perform: Risk-Aware Performance Management From Strategy Through Execution, written with Stephanie Buscemi and Denise Broady, where they describe how they unified performance, risk, and compliance into a coherent strategic management process framework.


He wrote one post for each phase of the classic performance management lifecycle: Part I - Strategize and Prioritize, Part II - Plan and Execute, Part III - Monitor and Analyze, and Part IV - Model and Optimize. The posts are well detailed and illustrated graphically, and provide prescriptive guidance in how to put all the pieces together in their model. Below is a summary of his posts:


Part I - Strategize and Prioritize:

Understand the Corporate and Departmental Contexts

Review the corporate strategic goals, strategic plans, initiatives, and metrics. Contextualize them to the implications they have for the departments and use this context to drive the PM lifecycle.

Develop and Set the Strategy

First, review the environment. To get a holistic picture of risk, understand where you currently stand and assess the internal environment and properly define and prioritize the most important risks with the greatest impact and likelihood of occurrence (risk type, impact, probability, timeframe, and mitigation strategy/costs).

Next, get a holistic picture of the full set of compliance initiatives you will intersect with, such as SOX, OSHA, data privacy laws, and global trade regulations.

The next step is to set the mission, values, and vision:
- Define mission (the fundamental purpose of the entity, especially what it provides to customers and clients).
- Define core values (the attitude, behavior, and character of the organization).
- Define the vision. A vision is a concise statement that defines the 3- to 5-year goals of the organization.

Next, set the goals. Define a strategy and set business objectives using risks as a key variable for deciding which strategies to pursue.

Assign KPIs to Goals and Set the Right Targets

Define KPIs and targets that translate strategy into performance expectations.

Perform Additional Risk Analysis and Set KRIs

Now look again at risks to see what could keep you from meeting your goals.

Set a response strategy for the risk (treat, tolerate, transfer, or terminate).

Define KRIs and risk thresholds and tolerances for those risks.

Perform Additional Compliance Analysis

Define your compliance requirements. Define policies, procedures, and controls that must be in place to ensure that you can meet the compliance requirements.

Work on the Strategic Action Plan and Initiatives

The strategic initiatives help define the exact methodology (the roadmap) for achieving the various goals. The results of this planning may require revisiting the strategy.

First, develop the roadmap (sequence of actions) for achieving performance, risk, and compliance expectations.

Next, define critical success and failure factors for all initiatives. Every project or investment must, in addition to defining the critical factors for its success, also define its critical “failure factors,” that is, those circumstances under which the project or investment is no longer likely to be successful.

Finally, develop different risk-adjusted scenarios with contingency plans should risks to achieving plans materialize.

Cascade Accountability

Cascade accountability of KPIs, KRIs, and controls throughout the organization and ultimately into individual MBOs for alignment.

Part II - Plan and Execute

The planning and execution gets into the details of planning the strategic initiatives both from a financial and operational standpoint.

Align Corporate Budget to Departmental Budget and Link Corporate and Departmental Initiatives

The budgeting process takes each of the outcomes or actions from the planning process and aligns revenues and expenses against them. Decisions regarding investment priorities and resource allocations define how the company will operate and set the bar for measuring performance.

To create risk-adjusted budgets, incorporate the range of possible revenues and costs of each action into the budget at the appropriate organizational level. Align risk adjusted budgets with contingency plans should risk events occur, or if risks exceed the acceptable threshold to achieving budgets.

Align Departmental Budget to Departmental Operational Plans

The operational planning process links the financial budget to specific operational factors. Plan out each step of each initiative. Consider what risks you have in each area of the operational plan. If the risk materializes, you would want a contingency plan in place that showed the performance and risk implications if we moved the budget from one initiative to another.

Forecast Performance and Risks

Create rolling, risk-adjusted forecasts of the budget (revenues and costs) and operational plan (including number, capacity, and cost of resources necessary to achieve plan) so that you can see trends over a rolling time horizon for those risks whose probability, consequence, and resiliency over time.

Execute Plans

This step is essential but obvious; put the plan into action. Be prepared to execute on the type of risk associated with the plan once the threshold or tolerance is exceeded.

Part III - Monitor and Analyze

In the monitor and analyze phase of the risk-adjusted PM lifecycle, you monitor to understand what is happening in the business, analyze to understand why it is happening, and for those things not on track, adjust to improve the situation relative to your goals.

Monitor

The presentation of information to be monitored is crucial in order to facilitate decision-making. Risk monitoring is aligned directly to KRIs across the source systems that provide transactional data for the KRI. Dashboards linked with risks should help identify and manage key risks versus overall risks that are being prioritized based on exposure through quantitative/qualitative assessment

Monitor performance. You can evaluate the KPIs you’ve set to identify progress made toward achievement of objectives and trends.
Monitor initiatives. You can also evaluate which initiatives are failing or behind schedule.
Monitor risk. You can then evaluate important key risk indicators to identify:
. What and where are our top risks?
. What are the changes to the risk levels for key activities and opportunities?
. Are risks being assessed in accordance with company policy or according to industry best practices?
. Are our mitigation strategies effective in reducing the likelihood or impact of a risk?
Monitor internal controls. Report key control deficiencies, approvals, verifications, and reconciliations to mitigate risk.
Monitor any incidents and losses. What incidents or losses have occurred? If risks or losses have occurred, or external events are affecting the department, document this information, even if you haven’t been tracking it in the system yet.

Analyze

Analysis is a key step in which you not only look at where you are, but what is happening (or what has happened) and why.

Analyze performance. For KPIs, perform analysis to understand why they are increasing or decreasing.
Analyze initiatives. To evaluate initiatives, perform analysis on the initiative to understand why it is succeeding or failing.
Analyze risk. For KRIs, perform analysis to understand why they are increasing or decreasing.
Analyze controls. When analyzing internal controls, you perform analysis on their effectiveness.
Analyze root causes of incidents or losses. If incidents or losses occur, perform analysis on the root causes and trends.

Adjust

After monitoring to know what has happened and analyzing to understand why it happened, for those things not going according to plan, it is time to set the business back on course by taking what you’ve learned and using that information to adjust the settings across the enterprise.

Adjust performance. If you see KPIs trending in the wrong direction, once you have analyzed the root causes, it should be clear what actions to take to set things back on course.
Adjust initiatives. For initiatives that are not going as planned, it becomes essential to rapidly take remedial action or cancel them.
Adjust risk. For KRIs trending in the wrong direction, once you have analyzed the root causes, it should be clear what actions to take to set things back on course, often by putting the appropriate mitigating controls in place to stabilize them.
Adjust controls. For controls violations, adjustment takes the form of remediation and certification.
Adjust after incidents or losses. For incidents and losses, the correct adjustments typically involve reexamining if we are tracking the right risks and have put the appropriate controls in place to mitigate them.

Part IV - Model and Optimize

In the model and optimize, we strive to assess the drivers of performance and risk at a deep level to understand the various alternatives we can pursue with the goal of making the best decision given a certain set of constraints.

Model

Modeling falls into three categories.

Revenue, Cost, and Profitability Modeling. Modeling the costs, revenue, and profitability implications of performance management, risk management, and compliance management activities and their drivers can be achieved at a very detailed level using activity-based costing and associated methodologies.

Scenario Modeling. Scenario modeling can be applied to financial and operational modeling and focuses on creating different business scenarios.

Simulation Modeling. More advanced modeling including Monte Carlo simulation supports creating a broad range of scenarios based on multiple iterations of input assumptions and combinations.

Optimize

The goal at this phase of the PM lifecycle is to determine the optimal way to achieve objectives by taking into account the entire context of the problem, including all relevant constraints and assessments (costs, benefits, risk, labor and time).

Wrapping Up

From a process unification perspective, risk and compliance management operating in tandem with performance management will become differentiating capabilities in the management of an organization.

From a technology unification perspective, business intelligence can be conceptualized as the base of the pyramid upon which performance management and governance, risk, and compliance are built, since it provides the basic technology capabilities and infrastructure that serve as a foundation for the higher layers of the pyramid. Connecting governance, risk and compliance capabilities with performance management capabilities through a common business intelligence platform establishes a single, unified, cleansed repository of information and common semantics on top of that information, which is critical to enabling risk-aware performance management business processes. Without this common foundation, it is impossible to obtain any synergies that extend beyond deploying any one of these capabilities in isolation.

Predictions and Trends for 2010

Every new year the people make their predictions for the future and also comment on trends. I've read many posts and articles about predictions and trends for 2010 on business intelligence and performance management. Below is a summary of some that I found most interesting:

Early december Nenshad Bardoliwalla published in Enterprise Irregulars and in his personal blog, a very good and well detailed post entitled The Top 10 Trends for 2010 in Analytics, Business Intelligence, and Performance Management, where he described his trends:

1 - We will witness the emergence of packaged strategy-driven execution applications. As we discussed in Driven to Perform: Risk-Aware Performance Management From Strategy Through Execution (Nenshad Bardoliwalla, Stephanie Buscemi, and Denise Broady, New York, NY, Evolved Technologist Press, 2009), the end state for next-generation business applications is not merely to align the transactional execution processes contained in applications like ERP, CRM, and SCM with the strategic analytics of performance and risk management of the organization, but for those strategic analytics to literally drive execution. We called this "Strategy-Driven Execution", the complete fusion of goals, initiatives, plans, forecasts, risks, controls, performance monitoring, and optimization with transactional processes.

2 - The holy grail of the predictive, real-time enterprise will start to deliver on its promises. While classic analytic tools and applications have always done a good job of helping users understand what has happened and then analyze the root causes behind this performance, the value of this information is often stale before it reaches its intended audience.

3 - The industry will put reporting and slice-and-dice capabilities in their appropriate places and return to its decision-centric roots with a healthy dose of Web 2.0 style collaboration.

4 - Performance, risk, and compliance management will continue to become unified in a process-based framework and make the leap out of the CFO’s office. The disciplines of performance, risk, and compliance management have been considered separate for a long time, but the walls are breaking down.

5 - SaaS / Cloud BI Tools will steal significant revenue from on-premise vendors but also fight for limited oxygen amongst themselves.

6 - The undeniable arrival of the era of big data will lead to further proliferation in data management alternatives.

7 - Advanced Visualization will continue to increase in depth and relevance to broader audiences.

8 - Open Source offerings will continue to make in-roads against on-premise offerings. Much as Saas BI offerings are doing, Open Source offerings in the larger BI market are disrupting the incumbent, closed-source, on-premise vendors.

9 - Data Quality, Data Integration, and Data Virtualization will merge with Master Data Management to form a unified Information Management Platform for structured and unstructured data.

10 - Excel will continue to provide the dominant paradigm for end-user BI consumption. For Excel specifically, the number one analytic tool by far with a home on hundreds of millions of personal desktops, Microsoft has invested significantly in ensuring its continued viability as we move past its second decade of existence, and its adoption shows absolutely no sign of abating any time soon.


James Kobielus published his thought-provoking post Advanced Analytics Predictions For 2010 in the Forrester's blog:

- Self-service operational BI puts information workers in driver’s seat: Enterprises have begun to adopt self-service BI to cut costs, unclog the analytics development backlog, and improve the velocity of practical insights. Users are demanding tools to do interactive, deeply dimensional exploration of information pulled from enterprise data warehouses, data marts, transactional applications, and other systems. In 2010, users will flock to self-service BI offerings as the soft economy keeps pressure on IT budgets. In the coming year, BI software as a service (SaaS) subscription offerings will be particularly popular, in a market that has already become fiercely competitive. So will the new generation of BI mashup offerings for premises-based deployment.

- User-friendly predictive modeling comes to the information workplace: Predictive analytics can play a pivotal role in day-to-day business operations. If available to information workers—not just to Ph.D. statisticians and professional data miners—predictive modeling tools can help business people continually tweak their plans based on flexible what-if analyses and forecasts that leverage both deep historical data as well as fresh streams of current event data. In 2010, user-friendly predictive modeling tools will increasingly come to market, either as stand-alone offerings or as embedded features of companies’ BI environments.

- Advanced analytics sinks deep roots in the data warehouse: Advanced analytics demands a high-performance data management infrastructure to handle data integration, statistical analysis, and other compute-intensive functions. In 2010, in-database analytics will become a new best practice for data mining and content analytics, in which the enterprise data warehousing professionals must now collaborate closely with the subject matter experts who build and maintain predictive models. To support heterogeneous interoperability for in-database and in-cloud analytics, open development frameworks-- especially MapReduce and Hadoop—will be adopted broadly by data warehousing and analytics tools vendors. In the coming year, we’ll also see the beginning of an industry push toward an open development framework for inline predictive models that can be deployed to CEP environments. Clearly, in-CEP predictive analytics will be a critical component of truly adaptive BAM for process analytics.

- Social network analysis bring powerful predictive analysis to the online economy: Social network analysis thrives on the deepening streams of information—structured and unstructured, user-generated and automated—that emanate from Facebook, Twitter, and other new Web 2.0 communities. In the coming year, many vendors of predictive modeling tools will enhance their social network analysis features to support real-time customer segmentation, target marketing, churn analysis, and anti-fraud.

- Low-cost data warehousing delivers fast analytics to the midmarket: Though enterprises can certainly do BI without a data warehouse, this critical infrastructure platform is essential for high-performance reporting, query, and analytics against large data sets. In 2010, many data warehousing vendors will lower the price of their basic appliance products to less than $20,000 per usable terabyte.At the same time, enterprises will see a growing range of cost-effective solution appliances in 2010, combined DW appliances with preconfigured BI, advanced analytics, data cleansing, industry information models, and other data management applications and tools.

- Data warehousing virtualizing into the cloud: The data warehouse, like all other components of the BI and data management infrastructure, is entering the cloud. In 2010, we’ll see vendors continue to introduce cloud, SaaS, and virtualized deployments of their core analytic databases.


Howard Dresner wrote a nice and interesting post in his blog, called A thought (or two) for the New Year. He asked a question: why do we (still) struggle to effectively use information to make better decisions and what can we do to improve?, and told about five ideas that might help:

1 - Get the culture right: If a culture is not receptive to BI and EPM, those efforts will have limited impact. This is the basis for my latest book, Profiles in performance – Business Intelligence Journeys and the Roadmap for Change. In it I assert that organizations need to establish a “performance-directed culture” first – as a context or rationale for these solutions. To this end, I developed the Performance Culture Maturity Model (Patent Pending) and related methodologies for assessing an organization’s culture and offering a path to becoming more “performance-directed”.

2 - Don’t get overly enamored with technology: This is not to say that technology isn’t important. You certainly will want to have appropriate technology once you have the right environment in place to use it. However, it’s a means to an end, not an end in itself and large sums of money can be wasted with a “technology-led” strategy.

3 - Get strategic: There was a time when many/most organizations had “strategic planning” functions. They were chartered to think and plan for the future – developing multiple scenarios and associated action plans. Today, few organizations have this sort of a function and it shows. Most organizations have allowed themselves to become overwhelmingly tactical and reactive in nature.

4 - Get the metrics right: Assuming we have a well defined and communicated mission and strategy, we can use metrics as a means of measuring and managing execution. This is where things get complex and there’s a real risk of providing large quantities of information with little impact. Here’s where “less is more”. Metrics need to be focused upon alignment with the strategy in a way that they’re actionable.

5 - Take action: Many of us either engage in “analysis paralysis” or rely upon intuition when faced with a critical decision. Instead, we should view Business Intelligence and associated analyses as part of a learning process – which uses information to inform our decision-making, but doesn’t make the decision for us. This requires taking calculated risks, since information will typically be incomplete. However, the former two scenarios expose the organization to completely unknown risks. So, frame the decision to be made. Collect and analyze enough information/facts to build workable assumptions. Assess the benefits, risks, and alternatives and make your decision. Finally, monitor the impact and adjust if possible and as needed.


Cindi Howson published in Intelligent Enterprise a good post entitled Predicting BI Highlights for 2010, where she mentioned her thoughts:

- In-memory will be a key theme this year as Microsoft will ship Gemini, SAP opens up BW Accelerator, IBM Cognos increasingly leverages TM1, and MicroStrategy 9 OLAP Services gains traction. In-memory approaches are not only key to BI platforms but also to any analysis that involves both speed and analytic complexity (Spotfire, SAS JMP, QlikView). The winners in this are the customers; the losers will be the vendors who have no strategy in this space or where in-memory is their only differentiator.

- Cloud computing and SaaS will become less niche as both BI heavy weights and vertically-focused vendors recognize that the infrastructure side of BI offers little competitive advantage; instead, it's the time-to-value and agility. IT owners who don't want to give up any control are in for a bruising.

- SMBs will embrace BI but, faced with a myriad of good BI tool choices, these customers will choose products from vendors who offer better service, clarity of value, a partnership mentality, and at the least cost.

- The enterprise vs. departmental BI debate will continue but will be tempered with the reality of "best" and "right" doesn't matter if you get outsourced, laid off, or go bankrupt. Those burned by over spending on software will look for IT to offer some enterprise restraint. The wiser of the industry will find an ideal balance of having an enterprise focus on those items that bring economies of scale and synergies, while departmentalizing those aspects in which differentiation and time to value matter more.

- Got dashboards? This category of tools only keeps getting better. Dashboards will become as commonplace as reporting and ad hoc query capabilities; but in 2010, they will be more animated, better integrated, packing more effective insights, on whatever device users prefer (including the iPhone and Droid).

- Good data, bad decisions remain BI's biggest problem. I'd like to be optimistic and think that we will rid the BI industry of all that ails it, but the world economy, corruption in politics, the epidemic of overweight people while others starve -- you name it -- tell me that human nature will continue to sabotage even the best of BI deployments.

- Social networking and sentiment analysis should be on everyone's radar. Now that it seems every company has a Facebook presence (maybe for marketing, maybe for customer support), the need for sentiment analysis grows. So all those tweets, blogs, and social network updates only add to the data explosion and sense of information overload.