Program assurance Managing risk to enhance value delivery

Transcription

1 Program assurance Managing risk to enhance value delivery January 2016

2 Today companies continue their struggle to successfully deploy enterprise transformation and enterprise resource planning (ERP) solutions. Complexity driven by industry and technology trends and poorly designed or executed program governance are at the root of many failed implementations. Based on our experience, many of these issues can be mitigated by an effective program assurance function that equips decision makers with an unbiased, forward-looking view of program risks focused on business outcomes.

3 Industry trends Technology trends across industries are improving collaboration, integration, and agility but also introducing new complexities and risks in business and technology programs. Technology transformation agendas that fail to keep up with the ever-changing needs of business and customer bases have long been sources of frustration. But significant advantage can be gained by building a technology organization that moves at the speed of business. To address these issues, enterprise software vendors are evolving to become more agile and responsive, and their changes are in turn driving changes in the ERP landscape as follows. 1. Loosely coupled ERP environments that mix cloud services with on-premises core ERP functions and extended ERP functionality and that often span across multiple vendors. 2. Advanced data analytics that evaluate business performance and drive improvement. Improved performance driven by such advancements as in-memory analytics and the maturity of available data tools is enabling companies to implement solutions more affordably. 3. Application rationalization and ERP instance consolidation driven primarily by the desire to reduce complexity and costs and enhance the ability to take advantage of available data analytics tools. These mechanisms contribute to efforts to keep things simple and use new tools. This situation brings both opportunities and risks, requiring the development of new governance models, new capabilities, and new delivery methods for delivering these hybrid ERP solutions and driving complex consolidation and rationalization projects such as: Integrity of third-party environments. The introduction of off-premises solutions shifts the responsibility for maintaining a secure infrastructure to third-parties that are often new or unfamiliar. Careful consideration is required to assess the security and control of such environments and integrations with company infrastructure. Integration across platforms. Increasingly, the footprint of an ERP solution includes modules that extend beyond on-premises ERP. In addition to integrations with legacy systems, today s ERP solutions often include other platforms within the company s network or certain cloud-based solutions that reside outside the company network. Managing integration across those platforms introduces complexities at each stage of the project life cycle. Data management. Increased throughput and analytics capabilities are encouraging companies to maintain significant volumes of data, which requires new protocols for managing and monitoring data integrity and retention. These trends only add to an already complex environment wherein companies continue struggling with ways to efficiently and effectively implement ERP systems. Our experience has shown that the key to avoiding common ERP implementation mistakes and to anticipating the impact of emerging ERP trends lies in establishing robust program governance protocols that incorporate proactive risk management mechanisms including an effective unbiased program assurance program. Vendor management. Existing vendor management capabilities must be enhanced to proactively manage contracts, relationships, risks, and quality with an increasing number of vendors supporting the enterprise system footprint. 2 Program assurance

4 Managing the risks ERP projects aren t simply technical endeavors. They re also political, strategic, financial, structural, process, and people-centric initiatives. They also demand discipline across processes and data that extends beyond traditional department boundaries. To successfully deploy an ERP, companies must make fundamental changes to the ways they govern projects and operate. We have seen many examples of companies that have failed to embrace those necessary changes and that have ultimately abandoned their programs or that have deployed tailored or incomplete solutions at twice the budget and yielding half the benefits. Security and controls. The complex and integrated nature of transactions and data requires early and close attention to the design of security and controls. Seemingly minor issues with data or transaction integrity caused by poorly designed controls can seriously delay transactions and disrupt business operations. Common implementation challenges include: Enterprise alignment. Successful deployments often require the coordination and alignment of decentralized business units that may have little incentive to align with enterprise business strategies and that hold widely divergent views of project success and the expected benefits. An end-to-end view of business processes. The design of an effective ERP business process requires an understanding of end-to-end business processes that often does not exist in functionally focused organizations and legacy systems. An operating and support model. The support and management of an ERP environment require unique skill sets and specific operating structures. Teams must begin to consider those requirements early in the program so as to allow sufficient time for identifying the new support structures and educating the organization on them. Cloud architectures and hybrid environments provide both new support opportunities and additional risk variables that need to be managed. Data quality and consistency. ERP integration requires standard master data definitions across modules and systems. Legacy systems are unlikely to offer the levels of discipline required. Each data element requires a clear understanding of where data resides, of the controls the data will be subject to, and of the decisions to be made about source systems. Managing the risks Many of the challenges can be anticipated and dealt with early in the program by establishing an effective governance structure that includes robust, impartial program assurance and risk management functions. Program assurance may help programs avoid these and other typical pitfalls by: Providing a concise and current view of project risks for executive business sponsors and other stakeholders Identifying pragmatic recommendations for remediation of risks before the risks materialize into significant issues Assigning to project team members and stakeholders a clear accountability for addressing risks Actively engaging stakeholders across geographies, business units, functions, and programs Providing perspective by comparing project team processes with leading practices in major areas such as benefit management, vendor management, and quality management Reviewing the design and effectiveness of decision authorities and escalation paths that enable timely decision making PwC 3

5 What is program assurance? Program assurance is an essential component of an effective program governance structure, which can provide unbiased, forward-looking and early warnings of issues and risks to help the program stay on track and deliver the expected business benefits. Program assurance is an objective perspective on the risks that a program faces. It promotes transparency and encourages accountability from both project team members and business stakeholders. The outcome of program assurance is unbiased information that can help the executive owners of a change program get answers to the following questions. Will we realize the benefits? Are we on time, on budget, and on scope? Are we getting the best out of our third parties? Do we have the right governance to drive positive project outcomes? Are our people engaged, and is the business ready to change? Have we considered the potential impact and effectiveness on existing controls and our day-to-day operations? Have we performed the required process reengineering to get the most out of the investment? What are the attributes of effective program assurance? Poorly executed program assurance functions add overhead without delivering value. By contrast, leading-practice program assurance functions focus on business outcomes in order to identify the risks that matter most throughout the life cycle. These risks get dealt with objectively by way of deep industry and technical experience in coordination with other program risk management activities. Early and consistent application throughout the life cycle. Program assurance can be its most effectual when initiated in the early stages of the life cycle and when applied consistently throughout. An initial assessment of risks during the preparation phase of the program supports the setup of an effective program foundation and leads to early recognition of inherent risk areas that will set the focus of future assurance activities. Focus on strategic business outcomes and risks. Effective program assurance first seeks to understand management s goals for strategic business outcomes, including reduced selling, general, and administrative expenses; improved inventory management; or increased reporting capabilities. Program assurance activities are designed to focus on risks that pose the greatest threat to those outcomes. And that focus enables the team to communicate risks in terms of impact on delivery of the stipulated business outcomes. Regular refreshment of strategic outcomes and anticipated risks enables the team to modify its approach throughout the program based on emerging risks. Unbiased perspective. Many systems integrators assert they have an unbiased program assurance work stream but it is actually part of the delivery team. Leading program assurance functions operate outside the project team, reporting directly to sponsors and giving a true and unbiased view of risk factors and actions. Such a structure helps insulate teams from the influence of various stakeholder groups and sometimes competing agendas for the program. Experience. For a clear point of view on the myriad industry, technical, program, and control risks and for relevant, pragmatic recommendations, the program assurance team should be staffed with members who offer a mix of deep experience in each of those areas. Considerations for other risk management functions. Significant programs often have existing risk management functions so as to avoid duplication of effort or redundancies, and effective assurance programs consider and integrate those efforts. 4 Program assurance

6 Making the case for program assurance What are the real impacts of poor project performance? Many high-profile ERP initiatives have failed to meet expectations, and, worse, too many initiatives have resulted in black swan events. Leading analysts recently published data shows the average performance by information technology (IT) projects exceeded their budgets by 27% and extended their schedules by 20%. 1 For a subset of IT projects with budgets greater than $15, performance gets worse, with average overruns in budget and schedule climbing to 66% and 33%, respectively. 2 Programs with extremely poor performance are referred to as black swans, and such programs experience, on average, cost overruns of 200% and schedule extensions of 70%. 3 Back-of-the-envelope calculations reveal that poor project performance at those rates can easily result in the loss of s of dollars per week. The following figure illustrates cumulative impacts to cost and schedule when each of the three poor-performance statistics is applied to a 24-month, $50- project. In the example, when the average performance for IT projects is applied, the project is likely to overrun by 4 months and $13.5, and when largeproject (>$15 ) performance rates are applied, the likely overrun is 8 months and $33. Finally, and most alarming, the data tells us our example 24-month, $50- project has an almost 20% likelihood of developing into a black swan, wherein poor performance can result in as much as a $100- budget increase and add as much as 16 months to the schedule. Project example Average overrun of all IT projects 1 Average overrun of large IT projects Average overrun of black swan projects > months $100 Cumulative project performance with average cost and schedule overruns $140,000,000 $120,000,000 IT projects have an 18% chance of growing into black swans. $150 $100,000,000 $80,000,000 $60,000,000 $40,000,000 $63.5 $50 $83 $20,000,000 $- Project Start 12 Months 24 Months 28 Months 32 Months 40 Months Planned performance Average IT project overrun Large IT project overrun Black swan project overrun Average overrun of all IT projects: Cost 27%, Schedule 20% Average overrun of large IT projects(>15 $USD): Cost 66%, Schedule 33% Average overrun of black swan projects (>15 $USD): Cost 200%, Schedule 70% 1 Alexander Budzier and Bent Flyvbjerg. Overspend? Late? Failure? What the Data Say about IT Project Risk in the Public Sector. Commonwealth Governance Handbook 2012/13. 2,3 Bent Flyvbjerg and Alexander Budzier. Why Your IT Project May Be Riskier Than You Think. Harvard Business Review, September PwC 5

7 Making the case for program assurance What s the real value of program assurance? The foregoing impacts do not occur at one single discernible event. Poor performance accumulates and compounds over the life of a program. In the example, the stakeholders failed to sense the incremental changes and then identify the small deviations the project underwent that caused it to result in catastrophic failure. Program Assurance offers embedded and unbiased assurance to equip stakeholders with the transparency to know the true status of their projects. Moreover, project assurance helps organizations understand when to take action, providing the tools to know what to do well before a project turns into a black swan. A complex program needs neutral experts who specialize in strategy, delivery, enterprise change management, and governance. This experience helps identify the strategic, operating, and program-level risks, as well as most importantly, formulate options and recommendations for action. The expectation is that a holistic view of program risks allows appropriate responses to be matched to specific risk areas. Program assurance helps mitigate risk, while protecting the value and benefits realization of the original business case by saving time and money. Contacts For a deeper discussion about program assurance, please contact: David Tilk david.tilk@pwc.com Matt Bonser matthew.p.bonser@pwc.com Antwon Hardwick antwon.l.hardwick@pwc.com Gary Harvett gary.harvett@pwc.com Michael Shipham michael.a.shipham@pwc.com James Willis james.w.willis@pwc.com This publication has been prepared for general guidance on matters of interest only, and does not constitute professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is given as to the accuracy or completeness of the information contained in this publication, and, to the extent permitted by law, PricewaterhouseCoopers LLP, its members, employees and agents do not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it PwC. All rights reserved. PwC refers to the US member firm or one of its subsidiaries or affiliates, and may sometimes refer to the PwC network. Each member firm is a separate legal entity. Please see for further details.