Enterprise Architecture and Tech Debt

The year 2020 has presented significant challenges to businesses worldwide. Leaders in those businesses have had their lives turned upside down personally and professionally. Business plans have been blown apart. In some cases, the fundamental assumptions about products, customer’s supply chains and staff have been thrown into question. Enterprise architects, or EA’s charged with defining the technical strategies that have been supporting and transforming businesses find themselves in new and unfamiliar environments. Major paradigm shifts have taken place and EA’s are now responsible for rationalizing the technical architecture for a new environment.  

Disruption is unsettling but the same disruption contains opportunities as the landscape changes and customers, employees, and suppliers have new needs, expectations, and constraints. One constant in the pre and post pandemic environment that technology architects will recognize is Technical Debt. Experienced architects know their biggest challenge is not necessarily in deploying new applications, new platforms, or capabilities but managing investment in technology, balancing that investment with other business priorities. Striking that balance means recognizing and managing technical debt. The pandemic crisis presents EAs with new priorities and opportunities for managing that Technical Debt.

I recently published “Tech Debt 2.0® How to Future Proof Your Small Business and Improve Your Tech Bottom Line”. The timely release of that book is crucial to small and medium businesses. However, reaction from readers has shown that the book’s concepts and recommendations, especially now, are equally valuable to CIOs and technology architects in larger enterprises.

Let’s step back though and examine the concept of Tech Debt. Initially technical debt was defined as defective code released to rush a product to market. Today with technology permeating nearly every aspect of a business and in light of the realities of the new environment, it’s important to expand the definition of tech debt – Tech Debt 2.0 is any liability incurred in the development, acquisition, use and retirement of technology – i.e. hardware and software systems, or the skills set needed to support them. EAs must reevaluate the role of technology in their enterprise. This means reprioritizing investments in legacy systems, infrastructure and skill sets, be ready to abandon obsolete, dysfunctional systems, processes and methodologies.

Architects must assess the changed needs of the business, – customers, staff, supply chain and identify efficient technology to support those new requirements.

There is opportunity to walk away from legacy technology containing Unplanned Tech Debt that has never been corrected, the result of poor practices or poorly communicated requirements.

The move to remote workspace may present the option to discontinue the use of equipment or applications that have become instances of Creeping Tech Debt where features become obsolete, replaced by the better, faster more capable upgrades. Or, the applications and operating systems are no longer supported, causing security vulnerabilities.

Changes in market dynamics as the customer base struggles to understand their new needs, constraints and opportunities invite architects and product developers to consider incurring Intentional Tech Debt. By releasing prototypes and minimal viable products (MVPs) customers become partners in product development, helping to build the plane even as it reaches cruising altitude. Architects know this will entail false starts as perceived requirements morph or fade away and require rework as the product matures. But the approach may buy competitive advantage as all players scramble to find their way in the new market space.

Internally the pandemic disruption will raise the threat of Tech Debt in the form of shadow IT, as frustrated, impatient functional area leaders are tempted to deploy their own solutions outside the guidelines required by a coherent architecture.  Hmmm, let’s see will it be Zoom, or Skype, or Aircall, Slack, Microsoft Teams, GoToMeeting, Hopin and on and on. Unapproved, unmanaged tools can have cybersecurity issues or fracture data integrity by creating multiple versions of the truth.

This far into the Covid-19 crisis we have seen the very real existential threat as businesses in more vulnerable industry sectors are forced to permanently close.

As this continues there will be increased activity in mergers and acquisitions. Enterprise architects have an important role to play on both sides of an M&A transaction. Both involve the aggressive management of Tech Debt.

To maximize the benefit of selling a business or merging with another organization a company must recognize and eliminate excessive Tech Debt. Unsupported, dysfunctional legacy technology can represent major liability to a potential buyer or merger partner. Such a liability could significantly affect the value of the transaction. An EA needs to foresee and mitigate this by communicating effectively with stakeholders the consequences of Tech Debt.

The EA with the acquiring company is responsible for effective due diligence that uncovers instances of Tech Debt. These include, not just some of the obvious liabilities mentioned so far but also unsuspected instances such as software license stipulations where, for example, the sheer number of employees in a new organization can vastly increase the software maintenance costs even if the number of actual users doesn’t increase. Tech Debt can not only alter the price of a transaction but create an unsurmountable deal breaker.

Managing Tech Debt is an important part of an organization’s response to the pandemic crisis. Enterprise architects and leaders charged with IT governance have the opportunity and actions they can take on offense and defense to manage Tech Debt to protect their business.

 Top 10 Plays for EAs managing Tech Debt:

  • Stay healthy, your family and business need you.
  • Do a health check of your project portfolio and reprioritize any Tech Debt backlog.
  • Refocus IT governance to accelerate decision making and maintain goal alignment with the organization
  • Develop an “acute” action plan with intent and purpose for the next 30,60, 90 and 180 days and execute flawlessly.
  • Prioritize actions that focus on revenue preservation and customer experience.
  • Diagnose your Tech Debt and plan to address root causes.
  • Conduct a business impact analysis to prioritize your cyber risks.
  • Review and revise essential “pandemic” security policies and practices.
  • Engage your internal team and external partners to best utilize their resources and identify cost saving opportunities.
  • Protect core operations and monitor critical infrastructure services for internal users.

Michael C. Fillios is the Founder and CEO of IT Ally, LLC., a leading IT and Cyber Advisory firm for small and mid-size businesses. He is a four-time CIO, entrepreneur and senior global business and technology executive with over 25 years of experience in transformation, change leadership and operations management in the Pharmaceutical, Industrials, Automotive, Banking and Consulting Industries. His first book, Tech Debt 2.0®: How to Future Proof Your Small Business and Improve Your Tech Bottom Line, was published by the IT Ally Institute in April, 2020.

In 2020, he formed the IT Ally Institute, a non-profit organization that provides research, best practices, thought leadership and peer to peer programs specifically developed for small and mid-sized businesses. To learn more about the IT Ally Institute and register for our latest research, thought leadership and peer to peer round tables, please visit www.Itallyinstitute.org.

[This article was originally published on architectureandgovernance.com.]

[Interview] Michael C. Fillios, Author Of “Tech Debt 2.0®: How To Future Proof Your Small Business And Improve Your Tech Bottom Line”

To stay competitive in our digital world, small and medium-sized businesses need to be equipped with and proficient in the latest technologies. Yet, unlike large companies, most SMBs lack the resources to staff an IT department. Along with lack of oversight, outdated software or hardware, inadequate cybersecurity, or one bad tech investment could seal the demise of a small enterprise.

In his new book, “Tech Debt 2.0®: How to Future Proof Your Small Business and Improve Your Tech Bottom Line”, senior global business and technology executive Michael C. Fillios offers expert insights and practical strategies to help small business leaders managing evolving technology to their advantage and avoid racking up debt that could put their company in peril.     

Fillios recent sat down with Young Upstarts to share his insights about the role of technology-related debt to the future viability of small and medium-sized businesses.

Here is some of our conversation:

Most of us are familiar with the term technical debt. What exactly do you mean by “Tech Debt 2.0”?

In the software industry, the term “technical debt,” also known as design debt or code debt, is widely used as a catchall to cover everything from bugs to legacy code to missing documentation. That definition is nearly 30 years old, and hadn’t evolved with the pace of technology changes, from mainframe computers to the Internet to the cloud, and much more.

In “Tech Debt 2.0®, we offer an expanded definition that is more inclusive and contemporary with current technology, and shows the impact technical debt can have on an organization if it is not actively managed. My team and I felt it was important to revisit this definition, and in particular, with an emphasis on small to medium-sized businesses. For SMBs, tech debt is a potential existential threat that could impact their future viability and very survival.

Tech Debt 2.0 is any liability incurred in the development, acquisition, use, and retirement of technology — i.e. hardware and software systems, or the skills set needed to support them. And it’s something every business leader needs to be aware of.

How do small and medium-sized companies routinely accumulate tech debt, and often without realizing it? What are some common warning signs?

There are three types of tech debt: unplanned, creeping, and intentional. The first two can accrue undetected. Unplanned tech debt occurs because of an unplanned event, often caused by bad development practices, poor technique or poor communication of requirements. Creeping tech debt is caused by obsolescence of systems or equipment. Systems age because of improvements in upgrades or new products. Equipment ages over time or is obsoleted by new models with improved speed or functionality.

Right now, chances are tech debt is accruing in your business—and it is not showing up in your monthly variance reports or other accounting controls that your organization depends on for recognizing financial its well-being or warning signs of trouble. It is also likely that someone in your organization, without explicit or implicit authority or oversight, has taken action or made decisions that have added to the technical debt of your enterprise.

As it relates to symptoms, firstly, I would say a likely sign is that your underlying business could be underperforming, whether financially, servicing customers, or not being able to grow or expand. More specifically, tech debt can be detected internally before it escalates if leadership is paying attention to some of the early warning signs, such as:

  • The majority of IT investments are focused on keeping the lights on vs. helping to achieve business objectives.
  • Project are consistently delivered late and over budget.
  • Data is hard to access, its quality is poor, and it doesn’t drive decision-making.
  • Inability to attract and retain IT talent.

Rather than leave it up to leadership to connect these dots, my team and I wanted to develop a more intelligent way to uncover these underlying root causes. Therefore, we created the Tech Debt 2.0 Diagnostic to help organizations understand and measure their TD score.

We’re all familiar with high-profile cyberattacks on major business and government organizations. Why should small business leaders take cyber risks seriously? What are some simple ways to reduce them?

The reason cyber advisory is critical for every SMB is 60% of all targeted attacks are towards small to medium-sized organizations. And of those data breaches that are successful, 90% impact small to medium-sized companies. What explains the higher success rate? Research shows 82% of small to medium-sized businesses are not adequately protected from cyberattacks. And the data shows that most small business owners don’t have a plan for response if they’re hit. That’s a problem, because cyberattacks can range from the mildly annoying to the deeply destructive.

Here are a few ways SMBs can reduce cyber vulnerabilities:

– Outsource security monitoring and management to a dedicated resource or cloud provider with necessary resources.

– Establish, communicate, and enforce security policies governing passwords, policies, procedures, especially around physical access, network access, email policies, data security.

– Keep all systems and equipment patched and up to date on security upgrades, and discard equipment or systems that are no longer supported.

You mentioned intentional tech debt. When can tech debt be beneficial to a growing business?

Tech debt can be beneficial when it is deliberatively incurred with a specific goal in mind, such as speed to market for competitive advantage or release of prototypes to clarify customer requirements. It is essential that intentional tech debt incorporate a plan for remediation at some time in the future and that the organization has rationalized the consequences of performing that remediation.

In addition, tech debt can play a critical role if a business is in the process of being bought or sold. This can be a double-edged sword depending on whether you are buying or selling a company.  For an investor or PE firm looking to purchase a company, it is very typical to review the amount of financial debt that you will be purchasing as part of the transaction. Tech debt is similar to financial debt, but you aren’t necessarily paying back someone other than yourself.

Conversely, if you are selling a company, and have managed your tech debt such that your liability or debt rating is low, this could create an advantage for you in negotiating a potential premium, as you have built tech equity rather than accrued debt.

How can small businesses stay up to speed on evolving technology and compete with large companies with IT staffs and state-of-the-art resources?

Staying on top of tech debt is especially difficult for SMBs that might not have the technology departments, CIOs, and CTOs of larger organizations. However, independent, experienced firms and individuals with no interest in promoting any one solution are poised to provide their expertise to help SMBs differentiate real technology advances from technology-of-the day solutions. They provide not only fractional services as traditional consultants but also often as virtual CIOs or CTOs, available on-demand to fill these roles for SMBs and help manage technology investment and technology strategies for the future.

Another path open to SMBs dealing with tech debt is collaboration. There can be substantial value in a collective approach to addressing shared issues. Collaboration opportunities come in a variety of forms and have different advantages. Vendor user groups, Chambers of Commerce, Roundtable Programs, and others, foster collaboration among similar organizations and peers sharing a particular technology, brand, or product, and in some cases, provide technology agnostic advice from peers.

For leaders of small and medium-sized businesses, it is crucial to both invest in consultants and seek out collaborators in successfully managing and leveraging tech debt 2.0.

[This article was originally published on youngupstarts.com.]

How Technical Debt Opens the Door to Cyber Attacks— and Steps to Protect Your Small Business

The virus pandemic of 2020 is severely disrupting the economy and the large and small businesses that drive it. Poor practices such as ignoring safe distancing, insufficient sanitation, and not mandating mask-wearing open the door to infection of customers and staff and threaten the viability of a business.

Similarly, poor practices that allow a business to incur technical debt open the door to cybersecurity exploits that can bankrupt a business financially or through loss of trust and reputation in the eyes of its customers. Leaders of small and medium size businesses (SMBs) often think their size lets them operate under the radar, as less attractive targets to bad guys. But, actually, their lack of robust security strategy and resources make them easier to penetrate. And, sadly, the National Cyber Security Alliance (NCSA) reports that 60 percent of small companies are unable to sustain their business more than six months following a cyberattack.

Years of experience working and advising businesses domestically and internationally has shown that business leaders find it difficult to recognize tech debt and how it exposes cyber vulnerability. As technology has evolved over time from main frame to client server to the Internet and now the cloud, the impact of a new Tech Debt 2.0® has grown stealthier and more sinister. This is especially true for SMBs that lack the resources to apply to cybersecurity. CEOs and CFOs managing technology may not recognize tech debt building up in their SMBs—because it is not revealed in monthly variance reports or other accounting controls. Someone in their organization, without explicit or implicit authority or oversight, may be making decisions adding to the Tech Debt 2.0 load and increasing exposure to cyberattacks. Let’s look at how that might happen and how to prevent it.

Old and Obsolete Infrastructure:

Azeotrope, an aerospace firm in the Southeast, realized they were compromised when a number of clients complained of receiving invoices from Azeotrope that contained confidential information about their client’s orders and projects. Months of investigation by a cyber consulting firm finally determined the source of the vulnerability to Azotrope’s network: a combination printer/fax machine in their testing and QA area that engineers regularly used to fax lunch orders to a local Chinese restaurant. Because the device was connected to the company’s network for printing purposes, it provided network access using out-of-date insecure facsimile protocols. This gave the bad actors access to the company’s customer accounts and valuable data.

“Fax is an ancient technology; the protocols we use today haven’t been changed for the past 30 years,” notes Yaniv Balmas of Check Point Software, a leading provider of cyber threat intelligence. “Fax data is sent with no cryptographic protections; anyone who can tap a phone line can instantly intercept all data transmitted across it. Fax is always sent unauthenticated. There are absolutely no protections over fax.” Balmas advises: “If you can’t stop using fax, segregate the printers, put them on a separate network.”

The Tech-away: Identify and remove obsolete components from your network. Not just equipment with obvious vulnerabilities like fax, but all equipment no longer supported and updated by the manufacturer for cybersecurity risk.

A Stitch in Time . . .

Patches are often created after a software or hardware company has experienced a data breach or recognized a vulnerability that might allow one. The patch is issued to ensure other businesses’ data remains safe. Applying a patch as quickly as possible lessens the risk of your business becoming affected. But it is each business’s responsibility to know a patch has been issued and to apply it promptly. That is patch management—a relatively straightforward process, 10 or 20 years ago. Today, however, the vast proliferation of software and hardware components in our business environment have made patch management a complex, time- and resource- consuming necessity, critical to the cybersecurity of a business’s network. Failure to effectively manage patching is a main cause of accumulating excessive Tech Debt 2.0 and security penetration.

NETGEAR, a highly respected manufacturer of network equipment in data centers, offices, and the homes of hundreds of thousands of people working from home now, and, possibly, far into the future, recently sent an email alert to its customers. An excerpt is below. How would your CFO or CIO handle this?

Hello.

We have become aware of vulnerabilities involving certain NETGEAR products and have issued a security advisory.

We have released hotfixes addressing some of the vulnerabilities for certain impacted models and continue to work on hotfixes for the remaining vulnerabilities and models, which we will release on a rolling basis as they become available. We strongly recommend that you download the latest firmware containing the hotfixes as instructed in the security advisory. We plan to release firmware updates that fix all vulnerabilities for all affected products that are within the security support period.

Until a hotfix or firmware fix is available for your product, we strongly recommend turning off Remote Management in your product. Please follow the steps below to turn off Remote Management immediately. . .

The Tech-away: Take steps to reduce the burden and complexity of patch management. Adopt software and hardware that automatically detect and apply patches. Look for opportunities to shed responsibility for patch management through outsourcing cybersecurity responsibility or utilizing cloud services that provide monitoring and patch management services. Tech Debt accrued through failure to manage patching effectively can fatally compromise your network and business.

People, Policies and Processes

Of greater consequence than obsolescence and patch management to Tech Debt 2.0 and cybersecurity are the people, policies, and processes that make up the culture and collective mindset of a business organization. Properly patched, up-to-date infrastructure is not going to stand in the way of the accounts payable clerk or chief marketing officer who clicks on the attachment to an email from some bad actor posing as a trusted vendor or prospective customer. Equally dangerous is the computer operator who props open the data center door to make it easier to allow the guy who says he’s the A/C maintenance engineer get in and out. Or the CEO who shares her password with her husband and children so they can access her mail and messaging accounts.

Establishing a data security mindset from the bottom to the very top of an organization is a basic essential to safeguarding a business from cyberattacks. Policies and processes must instill in all the company’s people an always-on awareness of their responsibility to protect the physical and digital assets of the enterprise. That mindset needs to be reinforced frequently and backed up by actions that demonstrate commitment and consequence behind company policies and processes.

The Tech-away: Formulate and clearly communicate policies and processes governing any actions that involve cybersecurity. Visibly demonstrate across the organization the commitment to security.

Make cybersecurity awareness a visible priority for every person in the organization.

[This article was originally published on strategydriven.com.]

Leveraging Technology to Protect Your Small Business During the COVID-19 Crisis—and Beyond

Whether it’s the cool craft brew pub on the corner or the hottest new app, it’s clear that Americans love the excitement, risk, and reward of creating the next big thing in a small package. What also is clear: the US economy loves small and medium-sized businesses because their innovations propel economic resilience, allow us to compete more successfully overseas, and create opportunities for diverse and inclusive business ownership. While many assume huge multinational corporations motor the marketplace, the truth is local SMBs do.

Until very recently, SMBs comprised 99.9 percent of businesses and 47.5 percent of private sector employment in the US. Sadly, SMBs have taken a tremendous hit in 2020, with the COVID-19 outbreak presenting unexpected obstacles to their success and survival. How SMB owners and C-suite leaders have deployed technology is turning out to be a major factor in how, or if, their company will survive those challenges.

Like large companies, SMBs have become dependent on technologies to support critical functions such as marketing, sales, manufacturing, and customer experience, in addition to traditional back office. Those SMBs that have managed their technology with oversight and efficiency are realizing opportunities for competitive advantage. Of those that haven’t, many are struggling to overcome the effects of technical debt—specifically, what I call “Tech Debt 2.0®.”

The concept of technical debt has been around for nearly three decades. Howard G. “Ward” Cunningham, a programmer known for developing the first wiki, is credited with coining the term. “Shipping first-time code is like going into debt,” according to Cunningham. “Every minute spent on not-quite-right code counts as interest on that debt.” In other words, a little debt speeds development, as long as it is paid back promptly with a rewrite. This description makes the trade-off clear: Speedier development time and the ability to rush to market is leveraged against future work to improve and support the first version’s imperfections. The “interest” is a stand-in for future development costs, increased support headaches, and potential hits on credibility.

In my book Tech Debt 2.0®, I compare the concept of technical debt to financial debt. One way in which the analogy doesn’t work quite as neatly is that financial debt is typically owed to someone else, usually a bank, credit union, or rich uncle. Tech Debt 2.0, however, is something your small business owes to itself.

Similar to the original definition, Tech Debt 2.0 refers to an imperfection in the state of technology that a business should rectify in the near future, causing interest to accrue that is either financial or non-financial in nature. But, the definition is not simply limited to software development—because the problem isn’t simple at all.

For example, Tech Debt 2.0 can be attributed to the version of software and operating systems, the level of security capabilities employed on systems, the age of networking equipment in the data center, or the compatibility of existing solutions with new, cutting edge technologies. If you know where to look, the effects of Tech Debt 2.0 can also be found in data quality, business processes, and even among IT talent. The effects can be compared to accrued interest and directly impact, or irrevocably threaten, the bottom line.

Tech Debt 2.0 can translate into excessive costs for businesses, whether from rectifying security breaches, recouping lost revenue, or increasing expenditures. It also comes with a significant non-financial price tag. Tech Debt 2.0 can drive down employee morale, inhibit the recruitment and retention of good talent, and negatively affect the merger and acquisition process. And, it can have disastrous effects on a company’s reputation.

SMBs may not recognize IT as the key strategic asset it is, and, therefore, may wind up underutilizing IT for competitive advantage. Another distinct challenge for SMBs is their ability to minimize the impact of Tech Debt 2.0. The challenges of proactively managing their company’s technology investments are aggravated as SMB leaders confront the challenges of COVID-19.

The first step for leaders is getting a firm grasp of tech debt, the intersection of technology and economics, and how to recognize the different types: unplanned, creeping, and intentional. With an understanding of tech debt, SMB leaders can then take steps to avoid it, eliminate, or use it to their advantage. In Tech Debt 2.0®, I offer SMB leaders a tool to measure their company’s tech debt to help guide the future direction of their business.

Every SMB leader has an opportunity to positively impact their organization during this time of crisis and throughout the uncertainty ahead. Following are offensive and defensive actions you can take today:

On Offense:

  • Do a health check of your project portfolio and reprioritize backlog.
  • Refocus IT governance to accelerate decision-making and maintain alignment.
  • Develop an “acute” action plan with intent and purpose for the next 30, 60, 90, and 180 days.
  • Prioritize actions that focus on revenue preservation and customer experience.

On Defense:

  • Diagnose your tech debt and plan to address root causes.
  • Conduct a business impact analysis to prioritize your cyber risks.
  • Review and revise essential “pandemic” security policies and practices.
  • Engage your team and external partners to identify cost-saving opportunities.
  • Protect core operations and monitor critical infrastructure services of internal users.

Above all, stay healthy and stay positive—for the sake of your family as well as your business.

[This article was originally published on ceoworld.biz.]

Covid-19 IT Playbook for SMBs

By Michael C. Fillios
Author, Tech Debt 2.0®: How to Future Proof Your Small Business and Improve Your Tech Bottom Line. 

The impact of Covid-19 has had unprecedented implications on a global scale in both our personal and professional lives. Much of which today is blurred as we all adapt to changing behaviors such as working from home and being surrogate teachers for our children. Needless to say, we have all had to change in one way or another.

Covid-19 wasn’t on the radar when I was researching and writing my book, Tech Debt 2.0®, How to Future Proof Your Small Business and Improve Your Tech Bottom Line. However, now that it is so much a part of our daily lives, I wanted to share my thoughts on the parallels between Tech Debt 2.0® and in what ways the pandemic creates a unique paradox that every IT leader is facing during this crisis and for the years ahead.

I believe that every IT leader has a unique opportunity to positively impact their organization during this crisis and in many ways, they have already. The rapid movement to supporting the huge shift of employees to work remotely is just one small example that perhaps has elevated your IT reputation to your business counterparts to bask in a moment of unexpected glory.  In other cases, perhaps you were caught flat footed and had to scramble to purchase laptops at your local Best Buy or stock up on peripherals to support your end users. Perhaps your company already had a stockpile of Microsoft Teams licenses, but it was not being leveraged and users needed to be trained.   

These are just a few examples of paradoxes that either shine the light on you as an IT leader positively or perhaps expose some of your functional warts.  As I speak with dozens of IT and business leaders at small and mid sized businesses, I would say that the results are somewhat mixed.  However, as we learn more about the economic implications of the virus on businesses and individuals, we are just scratching the surface of challenges that lie ahead. 

I believe that this is a watershed moment for IT leaders to lean in, be proactive, and utilize this opportunity to redefine your individual and your functional brand reputation and to extend the short term accolades you might have received into a sustainable and earned seat at the board room table!

As far as dealing with the reputational paradox, I offer some suggestions in the form of a “top 10” list of offensive and defensive plays to consider as you navigate the challenges and opportunities ahead.   

Offensive Plays:

  1. Stay healthy, your family and business needs you
  2. Conduct a health check of your project portfolio and reprioritize backlog
  3. Establish or refocus IT governance processes to accelerate decision making and keep alignment with business priorities
  4. Develop and “acute” action plan with intention and purpose for the next 30, 60, 90, 120 days and execute flawlessly
  5. Prioritize areas that focus on revenue preservation and the external customer experience

Defensive Plays:

  1. Diagnose your Tech Debt 2.0® and set a plan to improve underlying root causes
  2. Prioritize your cyber risks by conducting a business impact analysis with targeted penetration tests
  3. Review and revise essential “pandemic” security policies and practices
  4. Investigate and engage your internal team and external partners to identify potential cost savings opportunities
  5. Protect core operations and monitor critical infrastructure services for internal end users

 

About the author

Michael C. Fillios is the founder and CEO of IT Ally, LLC., a C-Suite IT and Cyber Advisory firm for small and mid-size businesses. He is a four-time CIO and senior global business and technology executive with 25 years of experience in transformation, change leadership and operations management in the Pharmaceutical, Industrials, Automotive, Banking and Consulting Industries. His first book, Tech Debt 2.0®: How to Future Proof Your Small Business and Improve Your Tech Bottom Line, was published in April 2020.

In 2020, he formed the IT Ally Institute to provide research, best practices, thought leadership and peer to peer programs for business and IT leaders at small and mid-sized businesses.

To learn more about IT Ally, please visit www.itallyllc.com.

To learn more about the IT Ally Institute and to take our Covid-19 SMB Survey, please visit www.itallyinstitute.org.

To start reading Tech Debt 2.0® for free, please visit https://a.co/9Y8f3Cx.

IT Financial Management: Master it to create endurance for your small or mid-size business.

Does your small or mid-size business have the endurance and discipline to create long-lasting value for your customers and stakeholders? Are your technology investments solely focused on cost reduction and efficiency? Do any of the following statements resonate with you?

  • IT initiatives and the business are often misaligned because what the business values is not well defined or communicated.
  • Decisions are made without a shared perspective of value.
  • IT is perceived as a deep cost center that does not deliver value.
  • The budgeting process is difficult because finance executives have a limited understanding of information technology and use a different vocabulary.
  • Common “quick-win” cost-cutting initiatives do not satisfy the organization’s financial objectives.
  • Cost-optimization projects often have unanticipated consequences that offset potential cost savings and result in business dissatisfaction.

A constant cycle in large and small companies, no matter the economic environment, has business leaders demanding IT departments to do more with less. Leaders of small-enterprise IT departments feel constantly constrained and pressured to reduce cost. Care must be taken for without informed discipline, cuts to the budget may create bigger shockwaves than the business is ready or willing to handle.

In our previous blog post introducing the IT Fitness Program, we proposed that leaders master the management of technology versus a focus on the technology itself when seeking leverage for strategic advantage. To assist SMB’s we recommended establishing an IT fitness program aligned with your business objectives. Whether your goal is to build muscle, become leaner or agile, you will use a combination of strategies (think – diet, nutrition, exercise) to achieve your objectives.

As with physical fitness, when it comes to IT financial management, you should avoid those trendy cost-cutting programs that may come with some serious side effects that could put your business at risk. Rather, adopt a more balanced and thoughtful approach that builds the endurance needed to thrive in today’s competitive environment. The conversation should start with “What are the goals you are trying to accomplish?” to help you align your financial management strategy for IT and to increase the chance of achieving those goals versus meeting short-term objectives.

You Can’t Shrink to Greatness

“Cost control is a necessary part of effective IT governance. It can help IT position itself well with an organization’s executive management”. Info Tech Research Group Director of Small Enterprise Research, states that in cases where cost containment is an enterprise-wide initiative, every department will likely need to pitch in, and it’s important for IT to play its part. Treat cost-cutting measures as an opportunity to create a more efficient and smarter department and demonstrate that throughout the enterprise.

Having led IT in large global Fortune 500 organizations as well as at smaller companies, one thing I know for sure is that “you can’t shrink yourself to greatness.” Historically, IT departments have been mandated to optimize resources and mitigate risks. Organizational priorities should drive IT priorities, but there is often misalignment. When CEO’s are asked about their priorities, they often cite “maximizing shareholder value” as a top goal. However, heads of IT typically state “improving operational efficiency” as their top priority. To exacerbate this disconnect, IT leaders can misestimate the size of their next IT budget, overestimating or underestimating, which can create issues of credibility in the budgeting process. My experience given this situation almost always leads to IT being asked to reduce their budget resulting in a focus exclusively on efficiency and cost “take outs” versus value creation.

The IT Fitness Program for the SMB

Our IT Fitness Program identifies nine sections that are based on the COBiT Framework and best practices research from Info-Tech Research Group. They are:

  • Strategy and Governance
  • Financial Management
  • People and Resources
  • Service Planning and Architecture
  • Infrastructure and Operations
  • Security and Risk
  • Applications
  • Data and Business Intelligence
  • Portfolio and Project Management

Adopting the IT Management capabilities in this framework will enable your organization to reach the full potential of your IT investments. In this blog, we will cover Financial Management and explore several capabilities including Business Value, Cost and Budget Management, Vendor Management and Cost Optimization.

IT Financial Management

Business Value:

  • Everything IT provides must have real business value. IT provides value by maintaining the benefit of existing services and functions it provides, eliminating services that no longer provide benefit, and by creating new value. This is true whether IT operates as a background utility, a broad enabler of business value closer to the user experience, or incorporating the entire chain of value from end to end.
  • Therefore, it is critical to ensure a common understanding of what is valuable for the organization to drive growth and consistent strategic decision-making. Then, equip IT to evaluate, direct, and monitor investments to support the achievement of the organization’s values and business benefits. Finally, align IT spend with business value through an enhanced governance structure to achieve cost optimization and ensure IT provides a visible contribution to the creation and maintenance of value.
  • With the above in mind, here are three steps to get your organization on the path to benefits realization:
  1. Understand business value; ensure there is a common understanding of what is valuable for the organization to drive growth and consistent strategic decision making.
  2. Incorporate benefits realization into governance; align IT spend with business value through an enhanced governance structure to achieve cost optimization
  3. Ensure an accurate reference of value; IT provides a visible contribution to the creation and maintenance of value.

Cost and Budget Management:

  • An IT budgeting process must contain adequate measures to capture and communicate the benefit of IT investments. This begins with the collection of data and ends with effectively presenting the benefits IT investments will have for the business. IT cost pressure is fueled by negative sentiment and IT can be perceived as a high cost that does not deliver value. Budgetary approval is difficult because finance executives have a limited understanding of IT and use a different vocabulary. Detailed budgets must be constructed in a way that clearly highlights benefits but avoids technical detail that is complex and confusing.
  • Therefore it is important to build an IT Budget that demonstrates value delivery. However, according to a research survey conducted by Grant Thornton, only 40% of CFOs describe their current financial planning and analysis system as effective. 62% of CFOs claim their staffs were too busy with daily tasks to make the changes needed to keep their budgets up to date. Clearly, the IT budget process and subsequent maintenance extends beyond IT and can be widespread throughout the organization.
  • With the above in mind, here are three steps to reduce IT Budgeting frustration in your organization:
  1. Plan the budget with ample time for collaboration; for example, have preliminary talks with business units to understand their plans for the fiscal year.
  2. Build the budget; for example start budgeting early, with a sound forecasting methodology.
  3. Sell the budget and its benefits; for example presell ideas, making business stakeholders into advocates for the budget

Vendor Management

  • As IT services and products continue to become outsourced, IT is becoming increasingly dependent on external vendors and a transaction-based approach becomes insufficient to guarantee continued value. Vendor management often focuses on procurement, which can reduce the value of the vendor to that of the transaction itself. When IT does not manage vendors properly, performance levels can drop and fail to deliver essential services – and IT is left accountable.
  • IT often has so many vendors that it is impossible to provide the same level of attention to each vendor. Even if there are a few vendors that are clearly the most important, it’s not clear how to monitor relationships with the rest of IT’s vendors. According to a Deloitte Outsourcing Survey, more than 76% of organizations outsource core applications, services, and functions with the primary goal of reducing and controlling operating costs, yet less than 24% of organizations clearly define requirements of outsourced initiatives and have the tools and processes to adequately manage their vendor portfolios
  • With the above in mind, here are three steps to get some order to your vendor management process:
  1. Prioritize and classify your vendors with quantifiable, standardized rankings.
  2. Focus on your strategic vendors first, then, year over year, work through every classification of vendor.
  3. Standardize your processes for transitioning in new vendors, maintaining communications, monitoring performance and contingency plans for addressing vendor underperformance.

Cost Optimization:

  • IT organizations are being asked to do more with less and just because your budget is being cut, doesn’t mean that the organization’s expectations of IT are any lower.  IT cost cuts are everyone’s cost cuts. When IT’s budget is slashed, everyone feels it and fiscally prudent IT leaders need to do their part, working collaboratively with the business to convey the full implications of IT cost cuts, to help mitigate risk and preserve IT’s fundamental capabilities. Operating with a cut budget is no time to just put your head down and soldier on. Broadcast the impact of your reduced spending.
  • Whether it is just IT, or the entire organization, when the ax falls, it is critical to be able to absorb the blow. Proactively cutting costs and demonstrating continuous pursuit of efficiencies helps build a strong relationship with the CFO and increases the business’ confidence in IT. Cost optimization gives you an opportunity to realistically trim the fat and the flaws of the IT organization and increase efficiency and performance.  Don’t try to cut everything all at once or your actions may have unintended consequences for the business. Understand the magnitude and urgency of your cost-cutting mandate before taking action.
  • With the above in mind, here are three steps to get some order to your cost management process:
  1. Know your mandate; Don’t start identifying potential cuts before truly understanding the external and internal drivers that are dictating the urgency and magnitude of the mandate.
  2. Build momentum with quick wins; Low-risk, quick-to-implement initiatives that enhance your reputation as a fiscally prudent IT leader – even if initial savings are small.
  3. Identify initiatives that will save your organization money; Conduct a high-level brainstorming session, harnessing the collective knowledge of the IT leadership team.

We Can Help

Our comprehensive selection of IT Effectiveness Assessments combined with our Assess, Measure, and Improve approach, enables tailored improvement plans to be established and implemented.  Given the importance of IT Financial Management as part of the IT Fitness Program, we recommend the following assessments:

  • CEO – CIO Alignment is designed to identify and close the gaps between your vision for IT and the business, and ensure alignment of goals and objectives.
  • CIO Business Vision is designed to assess the level of satisfaction across core IT services, support and relationships with key stakeholders to identify and better understand areas in need of improvement.
  • IT Management and Governance is designed to assess the importance and effectiveness of your core IT processes and to identify and better understand areas in need of improvement.

IT Ally™ has the experience and expertise to help small and medium-size businesses succeed in establishing and improving your IT Fitness Program. To get started, check out our IT Fitness Test to get a customized report or call us at 844-4ITALLY (844-448-2559) to continue this discussion and see how we can improve your IT fitness!

In our next blog, we will cover People and Resources and explore several capabilities including Human Resources Management, IT Organizational Design, Leadership Culture and Values and Knowledge Management.

[This article was originally published on itallyllc.com.]

Software Licensing

SMBs face many, if not more challenges than enterprise size businesses and have less resources to take on these challenges. As SMBs take greater advantage of technology to transform and grow their businesses they often incur another challenge that provides opportunity but is often fraught with peril. That challenge is the complex world of software licensing.

Over the years as technology has evolved from big mainframe computers to client server and network-based applications and today to cloud based applications software companies have evolved their pricing and licensing policies.

Making assumptions about how software licensing works or far worse ignoring software licensing can destroy an SMB, sucking up financial resources in fines, penalties, and unplanned licensing costs. Just as bad it can damage a company’s reputation exposing illegal license use or piracy.

The upside opportunities in software licensing are in taking advantage of software companies’ options for volume licensing, enterprise licensing and the world of open source. SMBs should make sure their CIO understands software licensing as it applies to your business and take all necessary steps to stay in compliance. Many 3rd party firms can provide guidance here including the software companies themselves. IT Ally™ is ready to assist you getting and staying on top of software licensing compliance.

Here are five key points about software licensing:

1. Look into volume licenses or site licenses whenever possible. These arrangements offer lower prices and often make administration tasks easier.

2. Know what “free” means. In the context of software licensing, free doesn’t refer to price. It means free in the sense of “free speech” and refers to the rights and restrictions imposed on using software.

3. Free or open-source software has fewer restrictions. If a program is released under a free software license or an open-source license, you generally don’t have to ask anyone’s permission to use it.

4. Read the End User License Agreement (EULA). It’s always a good idea to review these agreements, but it’s especially important to do so for one-off or small software purchases from less well-known companies. The EULA spells out what you can and can’t do with software. It covers everything from how many copies you can install to what the software company can do with your data and what additional software the company can install on your computer.

5. You may get secondary or home use rights. You may be able to install copies of the software on more than one computer, with certain restrictions. For example, you may be able to install a copy of the software on a home or portable computer, as long as it is not used at the same time as the software is used on your primary computer.

[This article was originally published on itallyllc.com.]

Human Resource Management

A major challenge for businesses today is human resource management. In other words, actually acquiring and retaining employees with the technical skills and ability needed to transform an organization and prepare it for a digital future isn’t happening. This is particularly challenging for small to medium sized businesses at a time when unemployment is the lowest in decades.

CIOs in the greater Cincinnati area say the unemployment rate for technical skills is actually negative. McKinsey says, The first imperative in winning the war for technical talent is developing and retaining the team you have.” Beyond the traditional levers for human resource management, (competitive compensation, bonuses, coaching etc.) there are a range of other approaches to consider. Here are five that might be right for your business.

  1. Rotate high performers. This builds depth in your IT team and provides staff the opportunity to learn new skills, enhance resumes and add value to their career and your business.
  2. Train outside technology. Train technology staff on other aspects of your business. Invest in their knowledge and understanding of your customers, products, strategies, market position and operations.
  3. Provide exposure to the company’s most senior leaders. An irreplaceable motivator for the right, high performing technology staff.
  4. Support and foster technology passions. Encourage experimentation and innovation, make time for prototypes and proof-of-concept projects.
  5. Facilitate outside exposure. Encourage participation in industry and functional groups (standard setting boards, user groups) let your staff feel connection to the larger technology community.

IT Ally™ can help you develop an active plan for technology talent retention.

[This article was originally published on itallyllc.com.]

8 Techniques To Identify Requirements For Your Projects

Establishing a successful business today involves undertaking projects to introduce innovation and achieve competitive advantage and differentiation. The Standish Group, a primary research advisory group reports that less than a third of IT projects were completed on time and on budget last year. For SMBs delivering successful projects is a major challenge. Wrike, the collaborative work management company says barely half IT project managers have any certification. That is quite often the case for small and medium size businesses. One key to meeting this challenge is to begin projects with a robust requirements gathering plan and process. Time spent gathering requirements can pay major dividends through the life cycle of the project. A multi-track approach to gathering requirements helps unearth hidden and hard to identify needs.

Here are eight techniques to use to identify requirements for your projects.

1 – Interviews – with a broad spectrum of stakeholders
2 – Questionnaires – carefully chosen, probing questions that allow respondents to reflect and put their thoughts in writing.
3 – Workshops – that will surface divergent opinions and contrasting views.
4 – User observation – ideally record the actions and activities that really take place during a process, look for artifacts posted in cubicles, keyboards, etc.
5 – Brainstorming – surface “what if” and blue-sky ideas that help break out of the current state context and consider new visionary ideas.
6 – Role playing – have people play different roles to understand how different parts of the system will need to work to support the integrated process.
7 – Use cases and scenarios – can be used to validate the envisioned process and identify exceptions and boundary cases that need to be considered.
8 – Prototyping – helps reverse engineer the requirements by identifying “I don’t know what I want but I don’t what that” features.

IT Ally™ has the resources and methodologies to help with requirement gathering and other critical phases of your IT project.

[This article was originally published on itallyllc.com.]

Data Quality For SMBs

Business owners are hearing a lot today about the benefits that high-end data analysis and data mining hold for their companies. That might be true, but those benefits depend entirely on the quality of data that the business has collected. Unfortunately, this data is often not suitable to deliver those benefits. Data preparation is a process businesses need to adopt to bring value to their data. There is a whole array of tools and methods that can be employed for data preparation everything from Excel spread sheets to sophisticated data warehouses and dedicated data preparation tools. These tools can be used by a company’s IT department, business users or a combination of both.

Studies show that companies using technology for data preparation achieve the following benefits:
Improved data driven decision making – 60%
• Easier data access – 56%
• Improved analytic efficiency and flexibility – 54%
• Improved time-to-insight – 50%
• Gaining a single complete view of relevant data – 48%
• Improved operational efficiency – 44%

[This article was originally published on itallyllc.com.]