A Point of View Successful Change Management for Successful Banks Abstract IT is undergoing a rapid transformation in the banking industry. No longer independent, IT must play an increasingly greater role in helping banks carry out marketing, sales, and channel integration initiatives, and in ensuring that banks comply with various regulatory requirements. To this end, IT in banking needs to adopt a strategic approach to managing change. This paper looks at what Information Technology Infrastructure Library (ITIL) offers to manage these industry challenges and whether ITIL practices are sufficient to improve performance. The paper presents the view that many of the commonly recommended ITIL best practices are necessary to manage risk but not sufficient to drive top levels of performance. It also looks at emerging trends in banking that IT must keep a close eye on, for managing changes. Introduction The scope of IT in the banking and financial services industry is undergoing a transformation. IT is playing a greater role in helping banks carry out core functions like marketing and sales, as well as channel integration initiatives besides meeting emerging non-discretionary regulatory requirements - some of which are data, operations and IT driven. The criticality and the impact of regulatory changes mandated by the Dodd-Frank Act, Consumer Financial Protection Bureau and Basel III, to name a few, are such that banks have to continuously change their systems. In fact, at Sibos 2012, Francesco Vanni d Archirafi, CEO of Transaction Services at Citibank, said that on an average Citi has to add 6,000 lines of code to its core banking systems every weekend to cope with ever-shifting regulatory targets. Banks also need to handle big changes caused by innovations and disruptions in social communication, mobile banking and internet technologies. As customer self-service options increase, escalating the need for always-on banking, IT in banking is expected to deliver compliance, consistency, continuity and security while changing the way banking is done. With rapid change becoming the norm, it is a difficult balancing act to be agile and flexible while ensuring process discipline. However, it is precisely because there are so many changes that everyone in the bank must understand the impact of introducing even a minor one. Consider a scenario where there is business pressure to roll out a minor change to a back-end application. IT deploys the change as soon as it can, which happens to be a weekday. The change fails; the application is not accessible to customers and banking transactions are suspended. The change was minor but the impact is major. There is no roll-back plan to reverse the change and IT struggles to make the application available. The change failed because of many reasons: change roll-out policies were either not defined or not adhered to; the risk was not accurately assessed and there was no roll-back plan. A costly lesson: both business and IT have learned that a small change can bring a big bank down. What does ITIL say? ITIL Change Management Change Management aims to manage and minimize business risk while ensuring that all authorized changes align with business plans. It enables the management of risks associated with changes to the IT environment by reducing the incidents, disruption and rework caused by these changes. It also enables swift handling and efficient
management of all changes by applying standard processes and procedures. Almost every organization has a Change Management process in place - whether it aligns with ITIL best practices or not. All these processes follow the same basic flow at the highest level. A change request is raised, documented and evaluated. Once approved or authorized, it is scheduled and implemented followed by a review to check the quality, effectiveness and efficiency of the change. ITIL Release and Deployment Management ITIL defines a release as a set of changes to an IT service that is built, tested and deployed together. Release and Deployment Management is responsible for planning, scheduling and controlling the build, test and deployment of releases. The release aims to deliver new functionality while protecting the integrity of existing systems by taking a 3600 view when implementing new projects and service changes. Recommendations for success ITIL is a comprehensive and sizeable framework and it can be daunting to identify the right practices to adopt to realize maximum benefits. Given below a list of practices grouped into three buckets: Foundational, Enhancing, and Emerging. The Foundational practices are the basic building blocks while Enhancing ones lead to realization of benefits such as significant reduction in downtime, number of failed / emergency / unauthorized changes and SLA breaches. Emerging practices can help banks stay ahead in the game of successfully managing changes. Foundational practices from ITIL These practices are taken from ITIL Change Management and optimize the way changes are assessed and implemented. 1. Change models Define separate Change Management workflows for different categories of changes. Generally organizations will set up change models for major-minor change, standard-regular change. However, the following categories lead to better design of workflow and are sufficient for most organizations: data center, desktops and work stations, data, and document changes 2. Emergency changes Define a workflow for emergency changes and then ensure that everyone involved in the process understands what to do and when to do it. Closely monitor the number of emergency changes to ensure this process is not a substitute for poor planning. 3. Change approval and authorization Categorize all changes by the potential risk level and have them evaluated by a Change Advisory Board (CAB) and a Change Manager. The CAB should typically spend about 80% of its time reviewing datacenter changes. Institute cross-functional CABs to review medium to high risks. Define and publish low risk, pre-authorized changes that can be implemented by the service desk. 4. Impact analysis Conduct proper due-diligence in assessing the impact of each change for its effect on infrastructure, customer service (as defined in the SLA), capacity and performance, reliability and resilience, contingency planning and security. The impact on other services that run on the same infrastructure, projects in queue and existing vendors contracts also need to be analyzed. It is important to assess the impact of the change on regulatory compliance and the bank s reputation loss. Enable and improve impact analysis by identifying relations between configuration items in a Configuration Management Database. Enhancing Practices Most organizations remain at the Foundational level and do not actively seek to adopt the Enhancing practices. Enhancing practices are rather simple, but when enforced in the true spirit, can yield dramatic improvements in performance. However, it is not easy to implement these practices and it takes ongoing sustained effort and commitment until they are seen as this is how we work here. 2
1. Change provides oversight but Release Management builds quality- Most organizations may not have a specific defined process for managing releases, especially if they are not in the business of software development. However, managing releases is just as important as managing changes, if not more. Rigorous Release Management builds quality during the development, build and test phases, whereas Change Management provides oversight of the implementation when it is too late in the development lifecycle to significantly influence quality. Organizations must: Ensure both Change and Release Management practices are integrated in a lifecycle view starting from project request, through development, test, CAB approval, release into the production environment and ending with a post implementation review. Not compromise testing needs. Maintain a test environment that is close to the production environment to identify defects triggered by the environment. Invest resources and time to investigate every release exception and to identify and implement systemic fixes. 2. No process culture, no benefits- No ITIL process can deliver benefits to an organization that does not have a culture of process discipline. The mantra to achieve this is to: Build organization-wide appreciation for following defined processes, from senior IT management to operational support staff levels. Everyone should be made aware that a small change in the production environment can have a major impact. Be stringent with requests for exceptions. For example, a request to release outside a scheduled change window must be accompanied by a strong business case and senior level business approval. Or if you have agreed certain online hours of a global business application so as to run batch jobs and downstream applications, then an exception request for application access outside the agreed hours must come from senior management, for example, a country level business manager. Measure process performance based on outcomes. Focus on identifying and fixing process exceptions. Enforce consequences for process indiscipline. 3. Unprotected production systems can bring an organization down -Recognize that every change to production is a security and availability risk. Limit access to authorized users only. Ensure that every release and back-out plan is tested before deploying the release in production. Define the roles and responsibilities of development and production staff. Limit access of development teams to the extent necessary to help production support teams. Development teams should not be given the access required to promote new versions. The emerging trend of DevOps turns this Enhancing practice on its head and is covered in the next section. Limit the number of unique approved configurations in the production environment. This reduces the complexity of the infrastructure, and directly improves service levels, and the efficiency of development, testing and therefore, of change and release management processes. Use detection tools to monitor configuration deviations and drifts of production systems. Investigate the cause which is quite likely to be an unauthorized change or an incomplete change assessment. Fix all such causes. 4. Automate the actual change, not just the change workflow - The market has many Change Management tools that automate the process flows. But the actual execution of changes still remains manual in most organizations. Automate as many tasks as possible. Examples of this include password resets, virtual server provisioning and patch distribution. 3
Emerging Practices Rapid technology advances, economic pressures, changing customer loyalties and aggressive competition are some of the reasons for banks to innovate and keep an eye on emerging practices to both prepare for change and make change. 1. DevOps Traditionally, organizational functions for development, quality assurance and operations have worked in silos. In an extreme case, these functions may be geographically separated, work for different organizations or be under different management structures. Communication overheads and misaligned objectives and incentives of these functions lead to slow and inefficient delivery. Development to operations or DevOps is not a framework but the willingness of an organization to break down the silos through shared ownership, communication and collaboration across functions. DevOps is viewed as an end to end lifecycle, with unified processes, tools and metrics. Developers are given more environment control and Operations are empowered with more application-centric understanding. 2. Social Media Social media has so far been used more as a marketing tool than for customer engagement. A few banks now leverage Twitter to receive customer service requests. One bank allows users to check their bank balance via Facebook. This impacts the way some change requests may be processed and internal IT functions will have to revamp processes for integration with digital channels. Do-it-Yourself (DIY) is an increasing trend and this can be applied to Change Management wherein individuals will manage change through smart phones apps and on-demand video from corporate channels. A growing number of banks are now focusing on communities of practice as a key to improving their performance. Customer communities of practice, in specific, are important to the introduction of innovative products and services. These communities may be on discussion boards, newsgroups, webinars or Second Life and Change Managers may need to acquire mastery of these virtual tools. 3. Online, mobile, and tablet banking Online, mobile and tablet banking is at the top of the agenda for many banks as they work on enhancing self-service capabilities. A bank in Australia reported that currently, the number of daily mobile transactions equates to the number of transactions executed by their top forty branches. The market has non-banking players such as Google and Square dominating mobile payments and contactless point of sales with the Google Wallet, Square Register and Square Wallet apps. Banks will have to strategize and plan how to integrate these disruptive ways of doing business with their existing systems and processes. Smart phone apps and internet applications, used directly by customers, will need robust change and release management practices to be put in place as the impact of a failed change can almost instantly ruin the bank s reputation and credibility. 4. Virtual CABs Traditional infrequent CAB meetings cannot support the accelerated pace of change. Some organizations are setting up virtual CABs wherein the CAB members evaluate and take action on changes without a full meeting. Traditional meetings may be needed in some cases, but an increasing percentage of changes can be governed by the virtual CAB. 5. IT Analytics Due to the increased complexity of the IT landscape, it is difficult to make well-informed decisions such as the ones made by the CAB. Take advantage of innovations in analytics relating to event correlation, topological relationship, statistical pattern and con figuration to automate some CAB decisions. 4
Conclusion Banks today need to meet the increasing demands of business and comply with new non-discretionary regulations while driving operational efficiency, and staying ahead of competition through innovation and new technologies. This leads to ever increasing pressure for changes to be made to IT infrastructure, application and data. It is clear that banks must adopt a strategic approach to manage changes to IT. Most banks do manage changes as recommended by ITIL. These recommendations are: Standard flows for different types of changes Categorization of changes by the level of risks associated Assessment of change impact However, to realize significant performance benefits in terms of increased uptime, SLA compliance and successful changes, banks should consider adopting the Enhancing practices, recommended in this paper. Start with Change Management, but do not stop there. Implement Release Management practices to complete the lifecycle. Build a process focused culture and manage process exceptions. Protect your production system with effective access control and standardized configuration management practices. Automate tasks that implement the change Even as Enhancing practices improve performance levels, it is important to monitor emerging practices in DevOps, social media, online and mobile banking and IT analytics, which render the necessary foresight to manage and drive future changes. About the author Anju Saxena Business Development Head (UK & Ireland), IT Strategy and IT Process & Service Management Consulting Anju has over 20 years of experience working with clients around the globe on projects related to service design and delivery, planning and running service improvement initiatives, setting up service delivery for new joint ventures and integrating services in multi-vendor environments. She was a leading member of the project that delivered savings of up to 4.8 million Euros to the production management of a leading global bank. This project won TCS the Association of Management Consulting Firms (AMCF) award for operational performance. Anju has presented papers at forums such as SEPG North America, European Lean Council Summit, Paris and ITSM International Colloquium, Bangalore. Acknowledged as a reviewer in the ITIL Service Design 2011 book, she has also reviewed the initial CMMI-SVC draft model from the Software Engineering Institute. 5
About TCS Banking and Finance Solutions Over the past four decades, TCS has partnered with multiple clients in the BFS world and has executed a number of complex and time critical assignments under challenging business and operating environments. The BFS world sees TCS as an organization with strong foundation and superior understanding of the Financial Services market. This paved the way for creation of unparalleled vertical expertise. Our end to end offerings, comprehensive product suite, scalable processes and innovative frameworks have enabled significant strategic value creation for our clients by helping them optimize their IT investments, enhancing operational efficiencies, minimizing risk, and acquire sustained cost leadership. In the BFS industry, TCS is ranked high, at No. 2 in the FinTech 100 ranking, and has been among the top 10 companies for the last five years. With 12 out of top 20 global FIs as customers, the clientele include big and small banks, development institutions, regulatory institutions and diversified & specialty finance institutions. The BFS ISU works closely with Financial Services institutions across the Think, Build & Operate space to fulfill their strategic & tactical objectives. The sub practices include Retail banking, commercial / corporate banking, Capital Markets (Investment, Wealth Management and Securities), Market Infrastructure, Cards (Credit, Debit, Loyalty), Risk Management and Treasury. The TCS risk management framework has been rated as a leader by the financial research firm, Tower Group. Everest Research has also ranked TCS as the leader in the banking application outsourcing space. Contact To know more about TCS Banking and Finance Solutions, bfs.marketing@tcs.com About Tata Consultancy Services Ltd (TCS) Tata Consultancy Services is an IT services, consulting and business solutions organization that delivers real results to global business, ensuring a level of certainty no other firm can match. TCS offers a consulting-led, integrated portfolio of IT and IT-enabled infrastructure, engineering and assurance services. This is delivered through its unique Global Network Delivery ModelTM, recognized as the benchmark of excellence in software development. A part of the Tata Group, India s largest industrial conglomerate, TCS has a global footprint and is listed on the National Stock Exchange and Bombay Stock Exchange in India. IT Services Business Solutions Consulting All content / information present here is the exclusive property of Tata Consultancy Services Limited (TCS). The content / information contained here is correct at the time of publishing. No material from here may be copied, modified, reproduced, republished, uploaded, transmitted, posted or distributed in any form without prior written permission from TCS. Unauthorized use of the content / information appearing here may violate copyright, trademark and other applicable laws, and could result in criminal or civil penalties. Copyright 2013 Tata Consultancy Services Limited TCS Design Services I M I 12 I 13 For more information, visit us at www.tcs.com