ISACA summit 'Thriving in tough times' Sydney 31 March 2009

1. Preparing for the governance
backlash
Presented by:
Dr Raymond Young
raymond.young@e8consulting.com
1.0 | 31 Mar 2009 | ISACA Summit, Sydney © e8 Consulting 2009 | 1

2. Tough questions will soon be asked.
•The financial crisis has regulators, governments, and the media
focused on economic stimulus.
•However tough questions will soon be asked about what went wrong.
•Ineffective governance will be one of the first targets, and it won’t be
just the financial sector that faces increased scrutiny.
2009 Corporate Governance Conference. Toronto 6- 7 May
1.0 | 31 Mar 2009 | Preparing for the governance backlash © e8 Consulting 2009 | 2

3. A brief history of corporate governance
Greed is
Good Reactive – to reassure public
• Sarbanes-Oxley (2002)
• Hampel (1998),Turnbull (1999)
2001  Directors should have responsibility
Enron, for all aspects of control and a duty to
Worldcom, Adelphia, establish a robust system of risk
Tyco, Qwest, Parmalat, management
HIH, One.Tel,
Ansett
• COSO, COCO, King,
Bosch (1995)
Rothwells(1986)
 tough penalties against directors
Elders, Bond, Zeebrugge Ferry (1987), who breach their duties of care,
Tricontinental, Kings Cross Fire(1987), diligence or do not comply with the
Pyramid, Quintex, Lockerbie air disaster (1988) legislation
State Bank of VIC/SA,
AWA (1992) • Cadbury (1992)
1991  “Directors responsibilities include
BCCI, safeguarding the assets of the company
Maxwell, and preventing and detecting fraud
Polly Peck, and other irregularities”
1980’s
1.0 | 31 Mar 2009 | Preparing for the governance backlash © e8 Consulting 2009 | 3

4. Tough questions will soon be asked
What’s wrong with our governance regimes?
•No one doubts effective governance has value
 10-12% higher share price (McKinsey 2002)
 EPS, ROA, one year sales growth
http://www.treasury.gov.au/contentitem.asp?NavId=035&ContentID=1495
•but to paraphrase Warren Buffet “the tide has gone out,
and Sarbanes-Oxley for example, looks like it was
swimming naked”.
 Investor confidence has not increased, management accountability is
being called into question and the tens of billions spent by boards for
compliance has not stopped or prevented the crisis.
Young (2009) Preparing directors for the governance backlash.
•few governance prescriptions actually improve
performance or reduce risk
1.0 | 31 Mar 2009 | Preparing for the governance backlash © e8 Consulting 2009 | 4

5. After GFC: New levels of scrutiny expected
Real Project Failure Rate Exposed
1:5 projects
perceived to fail
Level of scrutiny
(benign economy) • Management of large-scale
expenditures is a fiduciary duty
requiring careful oversight.
• ¾ of mergers Oversight
and acquisitions
never pay off blind (29%)
The results were “tantamount to
or nil (16%)
• 2/3 of IT projects deliver no benefits negligence”.
whatsoever
• most large capital projects fail to Deloitte( 2007) What the Board Needs
2:3 projects fail
live up to expectations
to Know About IT: Phase II Findings
• majority of efforts to enter new
markets are abandoned in a few
years New levels • “A pay structure that rewards origination
Increasing
• 70% of new manufacturing plants of scrutiny without regard to investment outcomes is
are closed in degrees of
their first decade not appropriate”
negligence
Michael Larkin, CEO Babcock and Brown
(AFR 11 Nov 2008, p 84)
1.0 | 31 Mar 2009 | Preparing for the governance backlash © e8 Consulting 2009 | 5

6. How does that affect me?
Governance must add value
• Value post GFC:
 Reduce cost,
 Improve customer service,
 Increase revenue
• An example of not adding value: audits of system X at a major bank
• Steering through major global trends
 Shakeout, survival of the fittest (The great depression ahead 2009)
 second industrial revolution
 new organisational and business models to create the next leap in innovation …
elimination of waste through real time production (Natural Capitalism 1999)
 Alternative model of production
 that can harness human skill, ingenuity, and intelligence more efficiently and
effectively than traditional firms Wikinomics (2006)
1.0 | 31 Mar 2009 | Preparing for the governance backlash © e8 Consulting 2009 | 6

7. The value of Project Governance
86m-124m
47.6m
Improve customer service
ROI
Increase revenue ROI 135%
30%
OK
Some OK Current Better
Performance Performance
Some
(68% under) (43% under)
Fail
No
Reduce cost
Fail
36.6m
1.0 | 31 Mar 2009 | Preparing for the governance backlash © e8 Consulting 2009 | 7

8. What is governance?
The real role of the board is to ask the right questions
To ensure management
is focussed on above average returns
taking account of risk (Hilmer)
#1 Performance
#2 Conformance ValIT
More strategic value has been destroyed in
In 2003:
Accounting
the past five years as a result of strategic
Fraud cost companies over $300 billion but
Sarbox, ASX
mismanagement and poor execution…
performance failures cost companies over $3 trillion
COBIT
than was lost in all of the recent Bain & Co
CEO of compliance
scandals combined Booz Allen 2004
1.0 | 31 Mar 2009 | Preparing for the governance backlash © e8 Consulting 2009 | 8

9. The right questions
HB280, AS8016 Investment & Strategy:
Strategy/capability:
Benefits / alignment? how much change is required?
67%->40% 40%
Evaluate
Initiate
5-23% Governance Direct &
Support
Responsibility: Monitor
Project Sponsor? 0-13%
Investment:
Performance & Behaviour: benefits or terminate?
measures and motivation?
33-67% PMBOK, PRINCE2, etc
ITIL, COBIT
ICT Projects Changed
Operations ICT Operations
Conformance & Behaviour:
??%
Changed
Business processes culture for issues to Business Processes
be raised?
1.0 | 31 Mar 2009 | Preparing for the governance backlash © e8 Consulting 2009 | 9

10. Preparing for the governance backlash
have the right information ready before you are asked
Exercise 5: Evaluate Your Own Project – Governance Checklist (AS8016/HB280) Supporting Tools and Processes
Examples from
1. Benefits: “keep the end defined”  Project Proposal and/or Charter
• NSW Agency 1-2-3 Are we clear on our outcomes? (or have we lost sight of them?)  Outcomes logic map
1-2-3 Is there a consistent understanding of the outcomes?
• VIC Agency 1-2-3 If our outcomes have evolved since initiation, has there been a formal acknowledgement of changes?
 Effective project chartering
 Change of Scope
1-2-3 Are our project/program priorities consistent with our corporate objectives?
 Charter and Board ToR
2. Change & Other Risks: “they are all change projects”
 Project Profile Rating Tool
1-2-3 Are we sure we understand how much change is required to realise the outcomes?
 Risk Register
1-2-3 Have we planned for the entire program of work needed to realise our outcomes?
 Effective change mgmt,
1-2-3 Have we got the support of all the key stakeholders? stakeholder mgmt and risk
1-2-3 Are we adequately addressing all the other major risks that you are aware of? mgmt
3. Sponsor: “the key to success”  Sponsor ToR
1-2-3 Does the Sponsor believe in the outcome and are they committed and passionate about driving through the change?  Project Profile Rating Tool
1-2-3 Does the Sponsor have the necessary authority/influence to drive the change?
1-2-3 Does the Sponsor have the competence/experience to drive the change?
 Outcomes Logic Map and/or
4. Measures: “motivate key stakeholders to focus on outcomes” Project Evaluation Strategy
1-2-3 Are measures in place to evaluate whether the outcomes (vs outputs) are achieved?  Effective stakeholder
1-2-3 Are the measures sufficiently motivating for the key stakeholders? management
 Project Status Report
5. Culture: “are there any warning signs?”
 Reporting to DLT
1-2-3 Is there a culture that encourages issues/risks to be raised?
 Open, honest Project
1-2-3 Are decision-makers giving priority to issues/risks that may affect the outcomes? Sponsor/Board meetings and
(1 = lower priority issues (i.e. on time and on budget) get more attention and/or stated objectives are undermined) informal discussions
 Project Status Report
6. Monitor: “active or passive”
 Open, honest Project
1-2-3 Are questions being asked to ensure the right information is being provided? Sponsor/Board meetings and
1-2-3 Is monitoring independent of the Sponsor and Project Team? informal discussions
1-2-3 Are projects cancelled or re-scoped when outcomes cannot be realised?  Effective project monitoring
and evaluation processes
1.0 | 31 Mar 2009 | Preparing for the governance backlash © e8 Consulting 2009 | 10

11. Conclusion
Preparing for the governance backlash
•Current governance practices will almost certainly be questioned
•New governance requirements are likely to be introduced
 Historically new requirements are introduced reactively
 There is a risk new requirements will not add value
•We should anticipate these developments
 It takes longer for management to respond than for the board to
ask
 Project governance is one area worthy of attention
 We should identify the key areas that need to be governed (eg.
HB280, AS8016)
 We should check we have effective systems to monitor the key
areas, and introduce new mechanisms where necessary
1.0 | 31 Mar 2009 | Preparing for the governance backlash © e8 Consulting 2009 | 11

12. Questions & Discussion
Join blog at www.6QGovernance.com to discuss further
Governance
harmonisation
map
1.0 | 31 Mar 2009 | Preparing for the governance backlash © e8 Consulting 2009 | 12

13. Governance vs Management
The ITG Harmonisation Map
The 6
Principles
ISO38015
A
C.M.
u
Val IT t
CMM o
CMMI m
a
CobiT CobiT t
Spice PMBOK
i
PRINCE2
Etc. o
Etc.
n
ITIL
ISO20000
1.0 | 31 Mar 2009 | Preparing for the governance backlash © e8 Consulting 2009 | 13
© Brian O. Cusack