Translating Good Governance into Operational Excellence: Does your Organization have the Capability to Execute its Stra

1. Translating Good Governance into Operational Excellence: Does your Organization have the Capability to Execute its Strategy? Do Directors have visibility to operational weaknesses that elevate risk, sometimes to disastrous levels? Dr. John W. Alden 10-09-2007

2. Recent Headlines • Washington Post: • “The Saga of a Bent Spear” • “On Hill, Toy Firm Officials Apologize and Promise Changes” • “Fixing the Smithsonian” • USA Today: “Lead in Mattel toys was 180 times the limit” • Business Week: “Not So Smart” • Wall Street Journal: • “ Most Science Studies Appear to be Tainted by Sloppy Analysis” • At Ford, CEO “Mulally is Optimistic”

3. Top management may not know • WSJ: So your strategy is allowing people to tell you bad news without coming down to hard on them? • Mr. Mulally: Absolutely. One of the first meetings we had, I asked how it’s going and most of it was all green and a little yellow. I said, “Hey, we lost like $12 billion, it can’t be all green.”

4. Open Standards Frameworks Focus • Does your Organization have the Capability to Execute its Strategy?

5. Improving process capability benefits Technology Deployment Speed Improved margin High Maturity Capability Organization-wide Outcomes Improved Enterprise Risk Management Leaner Ops Agility Improved Compliance Culture based on trust and facts This set of complex interactions is measurable!

6. Operational challenges • Enterprise strategy risks* • External • Customers don’t like the offering • Competitor actions • Game changing technology • Internal to the organization • People: • Knowledge and skills • HC process management • Technology integration • Business Process: • Variation in work group activities • Cascading rework C-suite Measurement *Source: The Halo Effect

7. Risk & Capability: a core relationship Low High Best Operational Risk Operational Capability Worst 11 % Completed ERM Low High These relationships are not new!

8. The Five Capability Levels Capability Maturity Model: A Framework for Measuring Organizational Capability Level 5 Innovating Change management Level 4 Predictable Capability management Continuously improving practices Level 3 Standardized Business line management Quantitatively managed practices Level 2 Managed Work unit management Standardized best practices Level 1 Initial Inconsistent management Repeatable practices

9. Low Maturity Organizations Firefighting Heroes Rework People capability variation Transaction workers: +/- 100% Knowledge workers: +/- 1000%

10. Management Visibility Level 5 Out In Level 4 In Out Level 3 In Out Exception(s) Level 2 In Out In Out Level 1

11. How the MM’s Works-General • Level 1 • Initial • Motivate people to overcome problems and just “get the job done” • Mistakes, bottlenecks • Ad hoc methods • Hero worship Level 5 Innovating Implement continual proactive improvements to achieve business targets • Capable processes • Perpetual innovation • Change management Level 4 Predictable Manage process and results quantitatively and exploit benefits of standardization • Predictable results • Reuse/knowledge mgt. • Reduced variation Level 3 Standardized Develop standard processes, measures, and training for product & service offerings • Productivity growth • Effective automation • Economies of scale Level 2 Managed Build disciplined work unit management to stabilize work and control commitments • Reduced rework Repeatable practices • Satisfied schedules

12. How the MM’s Work-Measurement • Level 1 • Initial • Motivate people to overcome problems and just “get the job done” • Ad hoc methods • No data standards • No aggregation Level 5 Innovating Implement continual proactive improvements to achieve business targets • Deep/unique process insight supported by numbers/analytics Level 4 Predictable Manage process and results quantitatively and exploit benefits of standardization • Manage by the numbers/analytics • Level 3 • Standardized • Develop standard processes, measures, and training for product & service offerings • Process and data standards • Aggregation possible • Level 2 • Managed • Work group/project quality • Aggregation difficult/costly • Build disciplined work unit management to stabilize work and control commitments

13. Case Study: $2B Software/FS Services Technology Solutions Sales IT Client Services Technology Services Vague Requirements Increased Rework Fixed Date, Budget Increased Service Calls Deferred Items In Out Liquidated Damages Defects Ineffective Execution of Product Strategy Customer Dissatisfaction Immature Products Without end to end process visibility, the hidden costs grow down stream

14. Summary:Capability Building Yield Dramatic Benefits *Based on Bill Curtis extrapolations published research

15. Measurement + + - +

16. Operational Risk +

17. Organizational Capability + + +

18. People Processes + + +

19. Panel & Discussion

20. Summary Questions: Process Operations • What level of visibility do you have to operations? What’s the correct level? • How do you gain an understanding of operations? • How robust are your processes for managing/tracking operational risk? • What is your role in surfacing issues where you lack detailed understanding of operations? • What level of “evidence based management” is practiced in your organization?

21. Discussion Questions-McKinsey • Are major trends and changes in your business unit’s environment affecting your strategic plan? Specifically, what potential developments in customer demand, technology, or the regulatory environment could have enough impact on the industry to change the entire plan? • How and why is this plan different from last year’s? • What were your forecasts for market growth, sales, and profitability last year, two years ago, and three years ago? How right or wrong were they? What did the business unit learn from those experiences? • What would it take to double your business unit’s growth rate and profits? Where will growth come from: expansion or gains in market share? • If your business unit plans to take market share from competitors, how will it do so, and how will they respond? Are you counting on a strategic advantage or superior execution? • What are your business unit’s distinctive competitive strengths, and how does the plan build on them? • How different is the strategy from those of competitors, and why? Is that a good or a bad thing? • Beyond the immediate planning cycle, what are the key issues, risks, and opportunities that we should discuss today? • What would a private-equity owner do with this business? • How will the business unit monitor the execution of this strategy?

22. Discussion Questions-Deloitte • Do we know the overall risk profile of the company’s assets—i.e. people, products, processes, and facilities—as well as the interrelationships among these risk? • Have we integrated risk management processes throughout the enterprise? • Are we constantly reviewing and tweaking our business continuity plans? • Can security processes be improved so the company enjoys fallout benefits—like increased efficiency and improvement customer services? • What technologies and metrics are available to evaluate and improve risk management processes? • Is adequate security training in place? • Do we have an environment where employees feel free to speak out about potential problems to upper- level managers.

23. Dealing with operational complexity links to profit • 4% of global CEO says they are very good at measuring complexity. And only 5% say they have a corporate-wide framework for managing complexity. (PWC Global Report on Complexity) • 7 of 10 directors are satisfied with their access to financial information but “their satisfaction tails off noticeably when the subject turns to strategic and operational information.” Not surprisingly, internal board members are more satisfied than external directors. (McKinsey Quarterly, 07) • Management focused improvement initiatives appear “soft” to some executives and board members. However, McKinsey and Accenture research links profit and operational performance. (McKinsey Quarterly, 07 and Accenture Outlook, 07)

24. IT Risk is not well understood IEEE Spectrum-Compilation by Robert Charette

25. Institute of Internal Auditors • Boards, in particular, non-executive directors, simply don’t have the inherent practical experience of IT risk, as one of our internal audit heads reminds us and this means that they are unlikely to understand the full extent of the risks and opportunities that technology presents to their companies”. • “Over a third of senior management respondents and almost half of the internal audit heads feel that IT professionals lack the ability to communicate IT risk and its potential business impact in a way that the board understands.” • Source: UK PWC, LLP and Institute of Internal Auditors

26. Mercedes: near the bottom of the JD Power reliability survey • Mercedes is still reeling from a series of embarrassing recalls of its prestige sedan, the E-Class, which starts at $50,000. In May, 2004, the company suffered a spate of problems with its electronic brake control system, and it recalled 680,000 cars for inspections. This year, in late March, Mercedes announced the biggest recall in its history -- 1.3 million cars with faulty fuel pumps made by supplier Robert Bosch. Software bugs and the complex interfaces that allow the myriad electronics systems to talk to each other are to blame for many Mercedes defects. Getting such bugs out is a fiendishly hard job and can often take years. The problems have also pushed up costs and hurt profits. Last year Mercedes spent some $600 million to cover warranty costs, analysts say. • Worse, the quality fiasco has taken a heavy toll both in Europe, which accounts for 76% of sales, and in the U.S., where the auto maker sells 21% of its vehicles. Mercedes' European market share slipped to 4.2% in the first half of 2005, down from 4.5% for the same period in 2004. And last year, BMW (BMW ) overtook Mercedes as the world's No. 1 luxury carmaker. Source:  Business Week 8-15, Cover Story, Dark Days At Daimler, p. 31-38

27. Business performance expectations • Even good managers can be notoriously bad when it comes to projecting the future performance of their companies. Many outstanding executives at large companies routinely promise to double their share prices in, say, five years or to beat market returns by margins that even upstart competitors would envy. Others focus on sustaining top- or bottom-line growth and profitability over long periods of time, seemingly heedless of the cyclical ups and downs in their industries. • The intentions of these executives—to set high aspirations that encourage growth, innovation, and efficiency—are good. Lofty goals, however, pose special challenges, even for companies that already have strong market positions. Furthermore, they can tempt executives to make risky bets and demoralize employees charged with hitting unrealistic targets. • Yet many senior executives, try as they might, still find it hard to shift their attention away from today’s stock price and the next set of interim results. The forbidding presence of hedge fund and private-equity investors on corporate share registers and the increasingly short tenure of CEOs have only intensified the obsession with short-term performance. Source: The Halo Effect

28. Estimation accuracy lacking • Only 9 of 1,077 large global companies outperformed their competitors on both revenue growth and profitability over a decade, a study finds—confirming that such strong performance is rare and that many executives impose unrealistic expectations on their organizations. • If past is prologue, managers and boards won’t forecast with any precision the timing of the next recession. But they should be asking themselves today whether they are building the financial, operating, and product flexibility to make the most of the next downturn. Source: The Halo Effect

29. Type: Mergers and acquisitions Implementing new enterprise software Switching to better HR practices Quality Improvement efforts Business process reengineering (BPR) Layoffs Launching a new product Starting a new organization Evidence of Success/Failure: Mostly negative results, sell quickly > 50% fail Startups fail more often Talk but not much walk ~30% achieve stated goals Create lasting problems Extremely high failure rates Death rates for new ventures is high Dangerous Organizational Changes: Look Before Your Leap* *Source: Hard Facts, Dangerous Half-Truths & Total Nonsense: Profiting Form Evidence-Based Management, Table 7-1

30. Evolving capability and maturity frameworks • Brief history: • 50’s, 60’s • Crosby--manufacturing process waste • Deming—statistical process control • Mid 80’s to mid 90’s • DOD recognition of software development crisis • SEI publishes the Capability Maturity Model for software (CMM) • Late 90’s to early 2000’s • PCMM V1, V2 • CMMI V1 • October 2007: Business Process Maturity Model

31. References & Sources • Books: • Competing on Analytics-HBS Press • The Halo Effect-Free Press • Hard Facts, Dangerous Half-Truths and Total Nonsense-HBS Press • Your Gut is Still Not Smarter Than Your Head-Wiley • CFO Insights: Delivering High Performance-Wiley • Business Journals and Reports: • Harvard Business Review, “Managing Human Sigma” and 2005; “Toward a Theory of High Performance, 2005 • PWC CEO Complexity Study, 2006 • PWC and UK Institute of Internal Auditors, 2007 • Accenture Outlook, 2003-2007 • Bain, Annual “Management Tools Survey”, 2007 • IBM CEO Expanding the Innovation Horizon, 2006 • The McKinsey Quarterly: • “The halo effect, and other managerial delusions”. 2007 Number 1 • “Cracking the complexity code”, 2007 Number 2 • “The link between profits and organizational performance”, 2007 Number 3 • “Managing for quality: An interview with Armand Feigenbaum • “Managing your organization by the evidence”, 2006 Number 3 • “The state of the corporate board- A McKinsey Global Survey 2007”, Web-exclusive June 2007 • “Anatomy of a healthy corporation”, Web-exclusive 5-2007 • New Sources: • Washington Post-various • Wall Street Journal-various • Fortune-various • Business Week 2007 Advertising citing “The New Risk Environment”, Conference Board Study on Enterprise Risk Management, 2007 • Experts: Dr. Bill Curtis (Process) and Dr. Robert Charette (Enterprise Risk Management) • Bio’s available on www.capabilitymeasurement.com