IS Rating Tool Training

1. You can use this document for your own needs and publications under the condition to quote the source “Sustainable IT Architecture” This document is protected by a Creative Commons This material provides you with a course to learn the key concepts of the IS Rating Tool IS Rating Tool Training This material is freely available on http://www.sustainableitarchitecture.com By Pierre Bonnet - 2010, June Creative Commons www.sustainableitarchitecture.com

2. Agenda • Introduction in relation to IS/IT changes • Terms and definitions • The IS/IT foundation to enforce a progressive reshaping • Rules of thumb • Data Assessment part • Rules Assessment part • Processes Assessment part Note: You can download freely the IS Rating Tool (spreadsheets open office) via our web site http://www.sustainableitarchitecture.com

3. 1. Introduction in relation to IS/IT changes

4. IS IT At the inception of IT: 1960-2000 relies on supports • No real overlap between IS and IT systems • Systems were pretty easy to understand and manage • Systems were rigid because of the gap between IS and IT

5. Current position of IT: 2000-2010 IS IT What target? • A world where • no work without a PC • IT systems are everywhere • Too many overlaps between IS and IT systems • IT systems are opaque, rigid and hard-coded which generate significant difficulties to distinguish IS from its IT systems • This situation is a blind alley

6. Near future of IT: Today -> Real IS Governance MDM BRMS BPM IS + IT • IT systems rely on a new foundation to carry out IS Assets based on Ref/Master Data (MDM), Business Rules (BRMS) and Processes (BPM) • IS/IT alignment is achieved following a natural path as IT systems are no longer opaque and hard-coded but implemented within business repositories (MDM, BRMS, BPM)

7. In short 1960-2000 2000-2010 Today

8. BOOM in the data management field Black box Don’t worry… be happy! 1960-2000 => under control

9. Black box Black box Black box BOOM in the data management field Black box 1960-2000 => under control 2000-2010 => a nightmare What a mess!

10. Black box Black box Black box Black box Black box Black box BOOM in the data management field Black box 1960-2000 => under control 2000-2010 => a nightmare After 2010 => BOOM in the data management field Black box Internet of Objects Cloud Computing Rising of IS/IT growth Collapse! RFID object

11. A new IS/IT charter is necessary IS Assets IT black-box Company’s stakeholders Shareholders Executive Management Auditors Governments Employees Clients Suppliers Partners MDM BRMS IT Internal zone IS Governance BPM • This is the sole approach to enforce traceability and auditability of Information (Data, Rules, Processes) • The holistic use of MDM, BRMS and BPM provide stakeholders with a high level of confidence in their Information System • Reporting • Risks management • Facing the boom in data management including the Internet of objects (RFID, intelligent sensors, water meter…)

12. 2. Terms and definitions

13. Which terms do we use? • IS Assets • Linking value • Enterprise Architecture • IS Value (use value, business value, intrinsic value) • Performance level and rating

14. IS Assets: what we own, not what we do Assets Intangible assets no physical existence ------ brands Intellectual properties patents knowledge – working procedures HR - Organizations Customer relationships - Partners Software (ERP, Legacy, SOA…) Information System Tangible assets physical existence ------ machines tools real estates cash hardware ../.. IS Assets Ref/Master Data Business Rules Processes Accounting, Chart of accounts Innovative accounting approaches like IAS/IFRS and assets classifications such as Edvinsson & Malone, ARC IC reporting, The Danish Guidelines, Meritum, IC-Rating, Wissensbilanz, the METI model, the IC-dVAL method, etc.

15. Linking Value • Creation of additional added-value stemming from a mix of several resources Example The linking-value of Data + Rules Data Data validation rules Rules Rules execution Value 1 Value 2

16. Enterprise Architecture: state-of-art • Wikipedia: “An enterprise architecture (EA) is a rigorous description of the structure of an enterprise, its decomposition into subsystems, the relationships between the subsystems, the relationships with the external environment, the terminology to use, and the guiding principles for the design and evolution of an enterprise. This description is comprehensive, including enterprise goals, business functions, business process, roles, organizational structures, business information, software applications and computer systems.” strategy, business rules, business processes, organizations, functional decomposition, etc. standard four layers in EA Business Information flow within organization, data models, etc. Information To get more information see: Zachman (1987), Togaf, Dodaf, Modaf, Agate, FEA, NIH, the enterprise framework, etc. applications software, interfaces, etc. Application IT infrastructure, databases, programming languages, EAI, etc. Technology

17. Enterprise Architecture: pitfalls Pitfalls of Enterprise Architecture Frameworks when there is a misunderstanding EA Frameworks don’t guarantee a good or bad final IS/IT Architecture Zachman is just a taxonomy of concepts and models TOGAF is architecture agnostic Therefore you need an IS/IT Architecture target It means A VISION TO RESHAPE YOUR IS/IT To describe your vision you must take into account your real IS Assets

18. Enterprise Architecture: our contribution Architecture viewpoint Intrinsic value Business value Use value Quality of: the Knowledge, the governance functions and the IT Integration Business goals, alignment business/IT, IS accounting Working procedures, how people work together IS Assets viewpoint Enterprise Architecture and IS Assets Data Rules IS Assets value Processes FIRST TRUTH SECOND TRUTH Regardless of any EA framework, every IS/IT relies on Data, Rules and Processes and their linking value Regardless of any EA Framework, every IS/IT is measured through its intrinsic value (IS Assets), business value (alignment and ROI), and use value (working procedures)

19. IS Value Intrinsic Value Intrinsic Value is the actual value of IS Assets regardless of its Use Value and its Business Value. In other words, when a rating is established to measure the Intrinsic Value, then the quality of working procedures, modeling procedures and financial considerations are ignored. IS Assets are based on Data (ref/master data), Business Rules and Processes IS Rating Tool

20. IS Value Intrinsic Value Use Value Intrinsic Value is the actual value of IS Assets regardless of its Use Value and its Business Value. In other words, when a rating is established to measure the Intrinsic Value, then the quality of working procedures, modeling procedures and financial considerations are ignored. IS Assets are based on Data (ref/master data), Business Rules and Processes The Use Value of IS deals with an assessment of company’s working procedures used by IS stakeholders to communicate, build, maintain and run their Information Systems. When Use Value is studied, specialists in charge of the assessment admit that the IS value is related mainly to its mode of use not to its intrinsic value IS Rating Tool ISO900x, CobiT, CMMI, PRINCE2, TOGAF, ITIL, etc.

21. IS Value Intrinsic Value Use Value Business Value Intrinsic Value is the actual value of IS Assets regardless of its Use Value and its Business Value. In other words, when a rating is established to measure the Intrinsic Value, then the quality of working procedures, modeling procedures and financial considerations are ignored. IS Assets are based on Data (ref/master data), Business Rules and Processes The Use Value of IS deals with an assessment of company’s working procedures used by IS stakeholders to communicate, build, maintain and run their Information Systems. When Use Value is studied, specialists in charge of the assessment admit that the IS value is related mainly to its mode of use not to its intrinsic value Regardless of working procedures, the Business Value of IS tackles the Information Systems quality to align them with business strategy and operational requirements. One significant aspect is the responsiveness, in other words the IS ability to react quickly to change. The Business Value also encompasses the computation of market values, including financial measurement IS Rating Tool ISO900x, CobiT, CMMI, PRINCE2, TOGAF, ITIL, etc. IAS-IFRS, financial method to compute ROI

22. IS Value: holistic point of view

23. Performance level and rating • Before establishing a financial assessment of IS Assets it is necessary to measure their performance level i.e. their quality Data Performance level Rating Financial assessment Rating Rules Performance level Rating Financial assessment Rating Processes Performance level Rating Financial assessment Rating IS/IT point of view Accounting point of view

24. 3. The IS/IT foundation to enforcea progressive reshaping

25. What goals do we have? • Transparency • Allowing a better understanding of IS Assets by all company’s stakeholders • Auditability • Guaranteeing a full and detailed auditability of IS Assets used in the past, present and future (version management) • Mastering the complexity • Keeping a stable level of IS/IT complexity regardless of the business changes and growth • Agility • Allowing rapid and secure changes in data, business rules and processes

26. Key principles to achieve the goals The more the IS/IT is hard-coded the more the transparency is bad • Duplication of data in rigid and scattered databases • Spreadsheets effects • Programming languages used by IT specialists (Cobol, Java…) • Lack of up-to-date documentation

27. Key principles to achieve the goals The more the IS/IT is hard-coded the more the transparency is bad • Duplication of data in rigid and scattered databases • Spreadsheets effects • Programming languages used by IT specialists (Cobol, Java…) • Lack of up-to-date documentation The more the IS/IT is opaque the more the auditability is bad • IT audit trails available to IT specialists mainly • Tunnel effect when using IT programming languages (Cobol, Java…) • Lack of traceability between data, business rules and processes

28. Key principles to achieve the goals The more the IS/IT is hard-coded the more the transparency is bad • Duplication of data in rigid and scattered databases • Spreadsheets effects • Programming languages used by IT specialists (Cobol, Java…) • Lack of up-to-date documentation The more the IS/IT is opaque the more the auditability is bad • IT audit trails available to IT specialists mainly • Tunnel effect when using IT programming languages (Cobol, Java…) • Lack of traceability between data, business rules and processes Reshaping the whole existing IS/IT in one step is impossible • A natural path to reshape IS/IT must be enforced with an iterative lifecycle implementation: first ref/master data, second business rules and then business processes

29. Step 1 – Regaining the data control The MDM approach is deployed with no impact on what already exists, without modifying the data repositories which are already in place in any historical databases

30. Step 2 – Regaining the rules control Business Rules Management System (BRMS) approach is established to get certain business logics out of the existing hard-coded software and have them translated into a rules language before being placed in the rules repository

31. Step 3 – Regaining the processes control New developments benefit from the ref/master data and business rules that have already been capitalized. At this stage, Business Process Management (BPM) enters into play The circle is thus closed: the processes, the business rules and the ref/master data are under control. A new IT system is born: an open IT system for business, more open to evolution and more sustainable

32. Applied to software packages If the MDM were locked within the Software Package scope, then it would mean risks of maintaining or reinforcing the silo effect This is the same concern with BRMS and BPM

33. Business triggers to start and lifecycle Case 1 Business Trigger: ref/master data rationalization 1 which ref/master data? MDM 2 which data validation rules? 3 BRMS which business rules? Requirements Implementation • In this project lifecycle, the company needs to regain the control of its ref/master data first • When needed, data validation rules are implemented within the BRMS to guarantee a full transparency and auditability of the data management

34. 3 which ref/master data? MDM 2 4 which business rules? BRMS Requirements Implementation 1 5 which processes? BPM Business triggers to start and lifecycle Case 1 Business Trigger: ref/master data rationalization Case 2 Business Trigger: processes/rules rationalization 1 which ref/master data? MDM 2 which data validation rules? 3 BRMS which business rules? Requirements Implementation • In this project lifecycle, the company needs to regain the control of its processes • To achieve this goal, business rules used by these processes are identified and then ref/master data which are consumed (data scope) • The implementation lifecycle starts with the MDM applied to the required data scope, following by the BRMS and then the BPM • In this project lifecycle, the company needs to regain the control of its ref/master data first • When needed, data validation rules are implemented within the BRMS to guarantee a full transparency and auditability of the data management

35. Lifecycle: top down + bottom up Enterprise Data Architecture Domains of business objects Data Category Business Objects Top Down Enterprise Rules Architecture Enterprise Architecture Rules classification Bottom Up Rules naming Enterprise Processes Architecture Processes classification Processes naming

36. 4. Rules of thumb

37. Rules of thumb • We want to measure the Intrinsic Value of IS • It is based on real IS Assets, it means data, rules and processes Data Rules Processes • Ref/master (shared data) • Transaction • Decisional • Flow • business rules • organization rules • security policies • workflows • uses cases Out of the scope of IS Assets because they all rely on Data, Rules and Processes Applications Services portfolio IT infrastructure Software packages Networks ../..

38. Rules of thumb • We take into account the linking value between MDM+BRMS+BPM Linking value Linking value

39. Rules of thumb • We take into account the linking value between MDM+BRMS+BPM Linking value Linking value • We focus on the IS Intrinsic Value only IS Intrinsic Value IS Use Value IS Business Value What we own What we do What we win IS Rating Tool CobiT, ITIL ISOxxxx, etc. Financial assessment, IAS-IFRS, etc.

40. 3 domains of assessment Quick illustrations Knowledge management • How data, rules and processes are documented? • What are the modeling procedures used? “You own a data model… but is it a low-level description or a semantic model?” Quick example in the next slides

41. This is not a semantic data model • Lack of referential integrity constraints • No business lifecycle, i.e. no state attribute whereas this is an important ref/master data attribute • Very poor expressivity as this data model is a flat point of view (data flows) Figure from OASIS

42. Semantic modeling – Address stage 1

43. Semantic modeling – Address stage 2

44. Semantic modeling – Address stage 3 Business lifecycle (state machine)

45. Decision table applied to Address Stored into the MDM Carried out by the MDM automatically when checking data modifications of Address. It means less approach of hard-coding software and more auditability and traceability of integrity constraints applied to ref/master data MDM

46. 3 domains of assessment Quick illustrations Knowledge management • How data, rules and processes are documented? • What are the modeling procedures used? “You own a data model… but is it a low-level description or a semantic model?” Governance features • What are governance features available to usersto manage their IS Assets (data, rules, processes)? “Do you manage you ref/master data with spreadsheets or with a more robust solution bringing real governance features?” This part doesn’t deal with the quality of the organization but the quality of the governance features like: version management, permission management, authoring, etc.

47. 3 domains of assessment Quick illustrations Knowledge management • How data, rules and processes are documented? • What are the modeling procedures used? “You own a data model… but is it a low-level description or a semantic model?” Governance features • What are governance features available to usersto manage their IS Assets (data, rules, processes)? “Do you manage you ref/master data with spreadsheets or with a more robust solution bringing real governance features?” This part doesn’t deal with the quality of the organization but the quality of the governance features like: version management, permission management, authoring, etc. IT management • How data, rules and processes are implemented? Are they based on MDM, BRMS and BPM? “Are your IS Assets hard-coded or managed through business repositories such as MDM, BRMS and BPM?”

48. 3 domains x 3 types of IS Assets • This is the IS “Rating Tool matrix” • It provides nine points of assessments • Every case of this matrix holds a set of questions to conduct the rating • Enterprise Architecture is employed at the level of the knowledge management • MDM, BRMS and BPM tools are employed at the level of the IT infrastructure

49. Set of questions for every case • About 100 questions to cover the whole matrix • Each answer is ranked with help from 5 levels • low • basic • medium • advanced • optimized • Therefore about 500 points of measure

50. At the highest level of the consolidation • Each letter gives a consolidated rank (performance level) for Data, Business Rules and Processes Letter #1 Letter #2 Letter #3