Business Process Governance

Transcription

1 Business Process Governance Orchestrating the Management of BPM White Paper - August 2005 By Dr. Mathias Kirchmer CEO, IDS Scheer Americas and Japan Affiliated Faculty, Center for Organized Dynamics, University of Pennsylvania 1055 Westlakes Drive Berwyn, PA (phone) (fax) m.kirchmer@ids-scheer.com Business Process Excellence

2 Table of Contents Summary and Key Words Business Process Governance (BPG) What is Business Process Governance Design of PBG Implementation and Execution of BPG Abbreviations References Index of Figures Figure 0: ARIS House of Business Process Excellence Figure 1: Figure 2: Figure 3: Figure 4: Figure 5: Process Governance: Managing Process Management Process Governance: Examples of Governance Processes for a Restaurant Process Management: Examples of Restaurant Processes Process Execution: Examples of a Restaurant Process Governance: Guidelines for Process Lifecycle Management Figure 6: Drivers for Process Governance Figure 7: Figure 8: Figure 9: Enterprise Architecture Can Enforce Process Governance ARIS Architecture Visualizes the Architecture Application Architecture Driven by Process Governance Figure 10: Process Governance Drives the Process Factory

3 Business Process Governance Summary Business Process Governance (BPG) stands for the processes and guidelines focused on the management of Business Process Management (BPM). Business trends, strategies, legal requirements and other aspects, like the use of standard software, drive the design of Process Governance. Enterprise Architectures are used to apply and enforce the requirements of Process Governance. Governance Applications enable the implementation and execution of Process Governance. BPG is a precondition for the use of next generation process automation environments and facilitates change management. Key Words ARIS, Business Process Factory, Business Process Management, Chief Process Officer (CPO), Compliance Management, Enterprise Architecture. 2

4 Today, most enterprises use the concept of business process management (BPM) for not only projects and short term initiatives, but as a general approach to achieve their goals, stay competitive, fulfill legal compliance requirements and maintain long-term survival. Concepts such as "the agile organization" or "the real-time enterprise" can only be implemented based on BPM principles. Therefore, enterprises must firmly establish BPM as a permanent mainstay in their organization. For BPM to work effectively, organizations must orchestrate the "management" of BPM on a daily basis. Hence, a new term has emerged to address this orchestration - Business Process Governance. What is Business Process Governance? Business Process Governance (BPG) is a set of guidelines and processes focused on organizing all BPM activities and initiatives of an organization in order to manage the "BPM processes." BPM refers here to the management of the entire business process lifecycle, including design, implementation, execution and continuous improvement of an organization's processes. The resulting governance processes provide the framework and reference point to guide organizational units of an enterprise and ensure responsibility and accountability for adhering to the BPM approach. In its simplest terms, BPG can be considered the "definition" layer of BPM. BPG ensures and guides the enterprise-specific execution of BPM. Therefore, general principles for execution of strategies and management tasks must be considered when defining BPG for an organization [31]: Know your people and your business Insist on realism Set clear goals and priorities Follow through Reward the doers Expand the capabilities of your employees In order to develop BPG for an organization, it is crucial that the team in charge knows the people and the business of an enterprise. It would not make sense to define requests that do not meet the maturity level of the involved people and would therefore not be executed. One must focus on realism when developing BPG guidelines and processes; otherwise, the guidelines are worthless. Within BPG, clear goals and priorities must be set so that people involved in executing BPM activities are as effective and efficient as possible. 3

5 Business Process Governance BPG ensures that BPM activities are completed and the "doers," or people who get their BPM jobs done, are rewarded. This really makes BPM a living part of the organization. In order to ensure the necessary qualification of people involved in BPM, BPG should include guidelines for training and education to expand the capabilities of employees. Governance processes are also business processes. Therefore, these processes can be managed using the same frameworks (e.g., the ARIS House of Business Process Excellence - see Figure 0: ARIS House of Business Process Excellence) [2][3][8] and principles. General approaches of BPM are applied to the BPG process. The Strategy Layer of the ARIS House of Business Process Excellence identifies and defines BPG processes on a high level, including the architecture and strategic direction of BPG. Additionally, the areas in which BPG drives process innovation are identified. Based on those definitions, the governance processes are detailed in the Process Specification layer. The result is a blueprint for the governance processes and guidelines of the Execution Layer. In the Controlling Layer, key performance indicators (KPIs) of the BPG processes are measured, enabling a continuous process improvement effort based on the comparison of as-is and to-be KPI values. KPIs for BPG could be the results of process audits or the efficiency of BPM activities. Figure 0: ARIS House of Business Process Excellence 4

6 The main goal of BPG is to ensure that BPM delivers consistent business results to satisfy and exceed the expectations of an organization. Thus, BPG "governs" BPM. The interactions between BPG, BPM and Process Execution are visualized in Figure 1: Process Governance: Managing Process Management. Figure 1: Process Governance: Managing Process Management An example of governance processes (in the format of event-driven process chains (EPC) [27]) is shown in Figure 2: Process Governance: Examples of Governance Processes for a Restaurant. We have used a restaurant example because it is relatable and easy to understand for most people. In this illustration, two governance processes are depicted. The first process requests the automation of a business process, but also requires the definition of a manual backup process in order to reduce or eliminate the risk of process automation. The second process presents the scenario for the manual process should the automation technology malfunction and the backup process need to be executed to ensure the delivery of the process result. These governance processes encourage efficient, automated processes, while simultaneously mitigating the risk of process automation. These are just simple examples of BPG processes. Comprehensive procedural models for BPM, such as ARIS Value Engineering (AVE), are examples of more sophisticated BPG processes [23]. 5

7 Business Process Governance Figure 2: Process Governance: Examples of Goverance Processes for a Restaurant On the Process Design level, those BPG processes lead to the design of process models for efficient automation while manually backing up the processes. Examples are shown in Figure 3: Process Management: Example of Restaurant Processes. In this example, a waiter takes orders from patrons and transfers them through a PDA directly to the bar and the kitchen for preparation. If the PDA malfunctions, the waiter executes the process manually with pen and paper. In both scenarios, the customer receives the ordered products. However, the manual processes are more time-consuming, inefficient, susceptible to human error, and thus hamper productivity. In reality, if a patron visits our restaurant, the processes are executed based on the designed processes. The models developed in our BPM design and implementation activities are carried out. This is visualized in Figure 4: Process Execution: Examples of a Restaurant. Figure 3: Process Management: Example of Restaurant Processes 6

8 Figure 4: Process Execution: Examples of a Restaurant BPG is relevant for all phases of the business process lifecycle management: Business Process Design Business Process Implementation Business Process Execution Continuous Business Process Improvement Each phase of the lifecycle management is guided by BPG, leading to an overall orchestration of BPM. These guidelines may target the content of process models (e.g., identifying and mitigating risks) or purely formal aspects of BPM (e.g., each function of a process model must be assigned to the responsible and accountable organizational unit or "rules" must be documented separately from the process models [28]). This is visualized in Figure 5: Process Governance - Guidelines for Process Lifecycle Management. Figure 5: Process Governance - Guidelines for Process Lifecycle Management 7

9 Business Process Governance An example of a BPG guideline for process design is "identify operational risk in process models." A process implementation example is "deploy the related business application software (ERP, SCM, CRM, etc.) to support the business processes" [16]. "Any change in the process workflow has to be approved by the managers of the involved departments" is an example of a guideline for process execution. "Benchmarks for process KPIs must be checked and updated every six months if necessary" guides the continuous process improvement. The definition of BPG processes and guidelines for each phase of the process lifecycle can be used to drive an "execution-oriented" culture of an enterprise [31]. BPG can set the stage for getting things done, as described previously. An enterprise must define how BPG affects the organizational structure. BPG-related activities may be centralized for the entire organization or decentralized (e.g., in business units). Alternatively, a combination of both extreme approaches can be applied. The decision about the centralization or decentralization of BPG activities can be made based on the same principles used in BPM [16]: Coordination requirements Relevant time periods Actuality of data (yearly, monthly, etc.) Data volume In the case of a heavily decentralized BPM organization with decentralized BPG, it generally makes sense to define a minimum number of BPG guidelines and processes that are applied across the entire organization. This ensures compliance with general legal requirements avoids inconsistencies between business units and encourages the achievement of companywide synergies. BPG for emergent processes is especially important. Emergent processes are business processes for which the outcomes are not obvious, so that participants must continuously assess their situation and make real-time decisions about next steps. As a result BPM and Process Execution occur in a very short time frame. BPG ensures that the emergent process stays on track, consistent with the traditional business processes. 8

10 Design of Business Process Governance BPG is relevant on a strategic, tactical and operational management level. The design of BPG is driven through the following aspects: General Trends, or "Mega Trends," such as globalization, mobility, or inter-enterprise processes in enterprise networks Legal Requirements, such as Sarbanes-Oxley (SOX), Basel II or FDA regulations Enterprise Strategies, e.g., customer centric organization, real-time business, cost reduction, highest quality standards or innovation Other Corporate Factors, e.g., existing ERP systems, enterprise culture or regional locations These BPG drivers are shown in Figure 6: Drivers for Process Governance. Figure 6: Drivers for Process Governance Once the general drivers for BPG are identified, concrete requirements for the governance processes must be defined. The BPG drivers lead to guidelines that are the basis for the definition of the governance processes. Some of those governance processes can be used in all organizations within an industry sector or even across industry boundaries - others are company-specific. Therefore, it is essential for each enterprise to develop a specific BPG, suited to their specific culture and business situation. 9

11 Business Process Governance For example, a global organization must deal with cultural differences and other country variants in terms of business processes. The use of mobile devices may request additional data consistency checks in processes. SOX or Basel II requires a certain risk management within an organization's business processes. Real-time business requires a flexible process design environment. A specific ERP system can lead to the use of appropriate best practice reference models for process design within BPM activities. Formally, BPG can be applied and enforced through Enterprise Architectures (EA), such as the ARIS Architecture, the Zachman Framework or the Department of Defense Architecture Framework (DoDAF) [10][25][26]. These architectures ensure that all relevant aspects of a business process are addressed though BPG. The use of those architectures is enabled by special enterprise architecture software tools. BPG delivers the guidelines for filling the architecture framework with business, Information technology (IT) or other content. Consequently, the application of such a "governed" EA leads to the application of BPG in the BPM of an organization. This approach is visualized in Figure 7: Enterprise Architecture can be used to enforce Process Governance. Figure 7: Enterprise Architecture Can Enforce Process Governance 10

12 To build an EA in an organization, the following activities must be completed: Define architecture requirements (e.g., Which aspects of a process should be included: business, IT, legal, etc.?). Select the right existing EA framework (ARIS, DoDAF, Zachman, etc.). Tailor the selected architecture (Which information is needed in what level of detail?). Chose the suitable methods/notations (methods that deliver the necessary information, ease-of-use, etc.). Select the appropriate architecture software tool to implement the framework. BPG delivers not only the input to all of the aforementioned steps, but also the results of the activities, which lead to additional governance guidelines and processes. The ARIS Architecture is a widely used example of an EA [1][27]. BPG can be applied to the various ARIS views of business processes: Organization View: Who (e.g., people, departments, different enterprises) is involved in the process? Function View: What activities are carried out in the process? Data View: What data is necessary for or produced in the process? Deliverable View: Which deliverables are produced from the process? Control View: How do all of the other views fit together? Here are some examples for BPG guidelines targeting the various ARIS views: Organization: "Organizational structures must be defined based on process principles, not on single functions." Function: "Each function of a process model must be detailed in a description that will be part of a job description." Data: "Data structures must be defined in the IDS Scheer ERM Format." Deliverable: "The deliverable of a process must provide inherent value for an internal or external client; these benefits must be fully described." Control: "The process models must be defined so job descriptions can be created automatically based on the interactions between organizational units and functions." 11

13 Business Process Governance Each view of the ARIS Architecture can be described (and guided by BPG) on the following levels: Business IT specification Implementation Company management Sales Sales employee Production Production planner Organization Sales data Order data Customer data Order data Customer order Customer confirmation order confirmation Customer order received Order Order confirmation Order Order confirmation generated Sales Sales employee Sales process Order confirmation Order tracking Data Process Function Sales services Customer order order Customer Customer order confirmation confirmation Customer order Product/service Figure 8: ARIS Architecture Visualizes the Architecture The use of those architectures is enabled by special enterprise architecture software tools, such as the ARIS Toolset [17][29], as mention previously. In general, these tools can be further used for resulting BPM tasks [30]. The types of information models used within such an EA are generally defined in an enterprise-specific way in a "Method Handbook." This is part of BPG and ensures the consistent use of modeling methods across an organization. 12

14 Implementation and Execution of Business Process Governance The implementation and execution of BPG is enabled by governance applications (e.g., SOX Audit Management Systems), similar to how BPM is supported by BPM applications (e.g., Process Design Tools or Rules Engines) and how actual processes are executed by business application software (e.g., ERP, SCM or CRM systems and other automation technologies). An example of application architecture driven by BPG is demonstrated in Figure 9: Application architecture driven by "Process Governance." BPG applications require specific implementation approaches. While the general concepts of a process-oriented implementation of standard software can be utilized [16], the following specific aspects should be included in the BPG application approach: Close integration with BPM tools (e.g., A BPG application could be a module of a BPM tool carrying out a consistency check of process models.) Documentation requirements to proof the compliance with BPG processes and guidelines (e.g., Executing SOX relevant checks is not enough; these requirements must be documented and managed.) Change Management to make BPG part of the overall enterprise culture (e.g., BPG guidelines may also need to be applied "manually" by employ ees working on BPM initiatives; thus, BPG tools simply deliver the necessary information.) Other aspects (e.g., the requirement to use formal methods and tools) Figure 9: Application Architecture Driven by Process Governance 13

15 Business Process Governance Current BPG applications on the market focus on various aspects of legal compliance management (e.g., ensuring SOX compliance). Since the management of legal compliance is independent of specific laws, a general compliance management system may be applied and configured according to specific legal requirements. This further increases the efficiency of the implementation of BPG applications for legal requirements. BPG serves at the foundation for building and running a Business Process Factory [7][8]. This "factory" is visualized in Figure 10: Process Governance drives the Process Factory. The Business Process Factory ensures an efficient and effective use of business process orientation as general management paradigm. Figure 10: Process Governance Drives the Process Factory BPG delivers the following major input to the process factory: Governance processes and guidelines (including procedural reference models [24]) Process Reference models that reflect standards or best practices to be applied [15] Enterprise architecture and structural framework for all process models and related information models 14

16 The reference models delivered by BPG are stored in the Business Process Warehouse, the repository containing all process information. Governance processes and guidelines can also be stored in the process warehouse. The EA and related documents (e.g., the method handbook) guide the structure and use of the warehouse. This ensures that all process models in the process warehouse are consistently defined and can be used to achieve overall enterprise goals. Based on the content of the process warehouse (e.g., software reference models), enterprise-specific process models are developed. If no suitable content is available in the warehouse (for "new" processes, reflecting "next business practices"[8]), process models are created and guided by BPG. In any case, the enterprise-specific processes are also stored in the process warehouse for re-use in future initiatives. Enterprise-specific processes may be developed within a process improvement initiative, and reused for the selection and implementation of appropriate application software. In the future, these same models may be used for risk management, quality assurance or enterprise integration projects. A business process factory can evolve over time and be deployed with every new process initiative. It is imperative that those initiatives are driven by the defined BPG, which can be fluid and modified as necessary. The enterprise-specific business process models developed in the process factory enable both the process automation technologies [7][8], as well as the necessary change management [5][6]. BPG is an important pre-condition for the use of next generation process automation environments, based on enterprise service architectures (ESA) [4][18][19]. BPG ensures that business process models developed in BPM activities drive the configuration of such automation tools (e.g., using BPML/BPMN [11][12] or BPEL[13]). This makes BPG ideal for inter-enterprise collaboration projects for ensuring business and technical communication standards [9][20]. BPG also defines the modeling standards and optimizes the BPM characteristics for change management (including information, communication and training for employees [6]). BPG can enhance the positive reception and acceptance of change management for specific organizational target audiences by ensuring that BPM delivers easy-to-understand process models that can be used in information, communication and training activities. BPG can ensure the use of a common "language of change" in the form of information models. 15

17 Business Process Governance Therefore, BPG is a key element of operational and tactical enterprise management. It ensures the appropriate and targeted use of BPM throughout the entire business process lifecycle. The design and implementation of BPG may be assigned to one or several specialized organizational units of an enterprise, such as a center of process excellence. These units gather and structure the strategic requirements for the BPM of an organization. The resulting BPG guidelines and processes are then rolled out and assigned to the appropriate departments that potentially own specific components. The overall responsibility for BPG could be in hands of a "Chief Process Officer" (CPO) [24]. The quality and effectiveness of BPG can be controlled through the measurement of KPIs, as explained previously. The KPIs can be specific audit results (e.g., certifications) from external or internal auditors or they can be results from measuring BPM processes (e.g., the cycle time from the request for a new process design until its implementation). In that case the KPIs may even be measured automatically through tools like the ARIS Process Performance Manager [17]. BPG ensures consistent and focused BPM across the entire enterprise and the ultimate result is long-term business success. 16

18 Abbreviations ARIS - Architecture of Integrated Information Systems AVE - ARIS Value Engineering BPEL - Business Process Execution Language BPM - Business Process Management BPML - Business Process Modeling Language BPMN - Business Process Modeling Notation BPG - Business Process Governance CPO - Chief Process Officer CRM - Customer Relationship Management DoDAF - Department of Defense Architecture Framework EA - Enterprise Architecture EPC - Event Driven Process Chain ERP - Enterprise Resource Planning FDA - Food and Drug Administration IT - Information Technology KPI - Key Performance Indicator PDA - Personal Digital Assistant SCM - Supply Chain Management SOX - Sarbanes-Oxley 17

19 Business Process Governance References [1] Scheer, A.-W.: ARIS - Business Process Frameworks. 2nd edition, Berlin, New York, and others [2] Scheer, A.-W., Abolhassan, F., Jost, W., Kirchmer, M.: Business Process Excellence - ARIS in Practice. Berlin, New York, and others [3] Jost, W., Scheer, A.-W.: Business Process Management: A Core Task for any Company Organization. In: Scheer, A.-W., Abolhassan, F., Jost, W., Kirchmer, M.: Business Process Excellence - ARIS in Practice. Berlin, New York, and others 2002, p [4] Kalakotta, R., Robinson, M.: Service Blueprints - Roadmap for Execution. Boston, New York, and others [5] Scheer, A.-W., Abolhassan, F., Jost, W., Kirchmer, M.(editors): Business Process Change Management - ARIS in Practice. Berlin, New York, and others [6] Kirchmer, M., Scheer, A.-W.: Change Management - Key for Business Process Excellence. In: Scheer, A.-W., Abolhassan, F., Jost, W., Kirchmer, M..(editors): Business Process Change Management - ARIS in Practice. Berlin, New York, and others 2003, p [7] Scheer, A.-W., Abolhassan, F., Jost, W., Kirchmer, M..(editors): Business Process Automation - ARIS in Practice. Berlin, New York, and others [8] Kirchmer, M., Scheer, A.-W.: Business Process Automation: Combining Best and Next Practices. In: Scheer, A.-W., Abolhassan, F., Jost, W., Kirchmer, M..(editors): Business Process Automation - ARIS in Practice. Berlin, New York, and others 2004, p [9] Kirchmer, M.: e-business Process Improvement (ebpi): Building and Managing Collaborative e-business Scenarios. In: Callaos, N., Loutfi, M., Justan, M.: Proceedings of the 6th World Multiconference on Systemics, Cybernetics and Informatics. Orlando 2002, Volume VIII, p [10] O'Rourke, C., Fishman, N., Selkow, W.: Enterprise Architecture using the Zachman Framework. Boston [11] cf. BPMI (Ed.): Business Process Modeling Language - BPML 1.0 Specification In: BPMI.org [12] cf. BPMI (Ed.): Business Process Modeling Notation - BPMN 1.0 Specification In: BPMI.org [13] cf. Thatte, S. (Ed.): Business Process Execution Language for Web Services [BPEL4WS] 05/05/2003. In: XML.coverpages.org [14] cf. Kirchmer, M.: Market- and Product-Oriented Definition of Business Processes. In: Elzina, D.J., Gulledge, T.R., Lee, C.-Y. (Ed.): Business Engineering. Norwell 1999, p [15] cf. Kirchmer, M., Brown, G., Heinzel, H.: Using SCOR and Other Reference Models for E-Business Process Networks. In: Scheer, A.-W., Abolhassan, F., Jost, W., Kirchmer, M. (ed.): Business Process Excellence - ARIS in Practice. Berlin, New York, and others 2002, p [16] cf. Kirchmer, M.: Business Process Oriented Implementation of Standard Software - How to Achieve Competitive Advantage Efficiently and Effectively. 2nd edition, Berlin, New York and others [17] cf. IDS Scheer AG (ed.): The ARIS Process Platform. In: ids-scheer.com, 11/2003. [18] cf. Woods, Dan: Enterprise Service Architectures. Beijing, Cambridge, Koeln, and others [19] cf. Bruckert, S., Grasman, D.: The Benefits of SAP Net Weaver. In: SAP AG (ed.): SAP Info - Quick Guide: SAP NetWeaver - The Power of Lower TCO, 4/2003, p [20] cf. Kirchmer, M.: E-business process networks - successful value chains through standards. In: Journal of Enterprise Management, Vol. 17 No. 1, [21[ cf. Scheer, A.-W., Kirchmer, M.: Business Process Excellence and OR. In OR/MS Today, Volume 31, Number 2, 4/2004. [22] cf. Crosman, P.L.: Repeat to succeed. In: transformmag.com, 12/1/2004. [23[ cf. IDS Scheer AG (ed.): ARIS Value Engineering - Ansatz. Whitepaper, Saarbruecken 4/2004. [24] cf. Jost, W.: Vom CIO zum CPO. In: Harvard Business Manager, 9/2004. [25] cf. Lapkin, A.: The seven fatal mistakes of Enterprise Architecture. In: Gartner Research publication, ID-Number: G , 2/22/2005. [26] cf. McGovern, J., Ambler, S.W., Stevens, M.E., Linn, J., Sharan, V., Jo, E.K.: A Practical Guide to Enterprise Architecture. Upper Saddle River, [27] Scheer, A.-W.: ARIS - Business Process Modeling. 2nd edition, Berlin, New York, and others [28] Scheer, A.-W.: Orchestrating Business Process Excellence. In: IDS Scheer North America (ed.): Documentation of ProcessWorld 2005, Berwyn [29] James, G.: Magic Quadrant for Enterprise Architecture Tools. Gartner Research 12/04. [30] Sinur, J.: The Magic Quadrant for BPA. Gartner Research [31] Bossidy, L., Charan, R.: Execution: The discipline of getting things done. New York, NY,

20 About IDS Scheer North America IDS Scheer is the leading provider of solutions for business process excellence. The company's ARIS-based solutions offer a complete portfolio for "Business Process Excellence," including the services, software and methods to address all phases of the business process lifecycle: design, implementation, execution and continuous improvement. From small/medium enterprises to Global 1000 organizations, IDS Scheer provides a wide array of solutions to help customers optimize, and profit from, their investments in Supply Chain Management (SCM), Customer Relationship Management (CRM), Enterprise Resource Planning (ERP), and Next Generation Business Process Automation solutions. As an SAP Global Partner and a Microsoft Gold Certified Partner, IDS Scheer enables customers to maximize their ERP investment and build winning businesses. As part of an organization of more than 2000 employees worldwide and over 250 in North America, IDS Scheer is built upon a foundation of business process excellence that began when the company was founded in 1984 by August-Wilhelm Scheer, widely recognized as a founding father of Business Process Management. For more nformation on IDS Scheer North America, visit IDS Scheer North America 1055 Westlakes Drive Suite 100 Berwyn, PA Phone: Fax: info@ids-scheer.com Glenridge Connector Suite 650 Atlanta, GA Phone: Fax: arissmartpath@ids-scheer.com Yonge Street Suite 505 Toronto, ON M2P 2B5 Phone: Fax: info@ids-scheer.ca Germany IDS Scheer AG Corporate Headquarters Altenkesseler Straße Saarbrücken Phone: +49 (0) Fax: +49 (0) info@ids-scheer.de IDS Scheer Worldwide Austria Luxemburg Belgium Netherlands Brazil Poland Canada Singapore China Slovakia Czech Slovenia Republic Sweden France Switzerland Hungary UK Japan