Insights on governance, risk and compliance. September Strategy deployment through portfolio management. A risk-based approach

Transcription

1 Insights on governance, risk and compliance September 2012 Strategy deployment through portfolio A risk-based approach

2 Introduction Today s economy is increasingly competitive. Greater variation in market performance, sharper market volatility, ceaseless pressure on margins and demanding stakeholders have made for an increasingly interconnected, interdependent and unpredictable global economy. Many organizations are not yet optimized to this new state of the economic landscape, but there is a growing awareness within organizations that they need to adapt and that doing nothing is not an option. As a consequence, many organizations are transforming their businesses to strengthen their organization to save costs, create more client centricity, restore stakeholder confidence, enhance the use of ICT or embed new business models. For many organizations, their long-term success depends on the success of these transformation programs. And while the margin for error is small, the environment in which this needs to happen is becoming increasingly challenging. Businesses already disoriented by today s market turmoil need to execute numerous change programs and projects in parallel, while at the same time keep the business functioning. In many multinational organizations, hundreds of programs and projects are running in parallel across different functions and geographies. Such complexity causes organizations to struggle with doing the right things and doing things right. Many organizations are therefore getting a poor return from their investment in projects or programs. Doing things right: firstly, organizations may encounter issues with the delivery of their programs and projects. Although they may have selected the right project or program to invest in, it is the execution of the initiatives that causes issues resulting in benefits being delivered too late or the costs becoming excessive. As a result, programs and projects under perform and need attention just when organizations are seeking to spend their hard-earned capital wisely. Doing the right things: secondly, organizations may struggle with selecting the right programs and projects to invest in. The wrong projects or programs will not support the corporate strategy nor add sufficient value to the organization. This is within the scope of portfolio as it is very much concerned with the translation of the strategy into tangible programs and projects. Effective portfolio provides the organization with a mechanism to make sure the organization is doing the right things. In this paper we present a risk-based approach to high-performing portfolio. ii Insights on governance, risk and compliance September 2012 Insights on governance, risk and compliance September

3 Doing the right things while doing things right Organizations execute their transformation programs along three main levels: portfolio, program and project. These three levels have distinctly different objectives but should work coherently to deliver transformations effectively. While project is focused on delivering a tangible outcome, portfolio is focused on the decision-making process around which programs and projects should be executed based on their with the goals and objectives of the organization. Program is the intermediate layer that is focused on the delivery of business benefits. The objectives for portfolio, program and project are summarized below. Portfolio Key objective Doing the right things Key activities -fit and Governance Agility Funding (re)-allocation Level Definition Key objective Portfolio Program Project A group of programs and/ or projects managed in a coordinated way to support business strategy and to deliver benefits in line with strategic objectives. A set of interrelated projects, managed in a coordinated way to attain the business objectives and benefits. A project is a temporary endeavor to create a unique product, service or result. Portfolio is focused on doing the right things. Program is focused on realizing the benefits. Project is focused on doing the things right. Program Project Organizations have significantly invested in project over the past decade since the release of PRiNCE2 (1996, Office of Government Commerce), PMBoK (1996, Project Management Institute) and other more specialized methodologies such as Scrum. As a result, the project capabilities of organizations have been strengthened. And while some organizations may be excellent in the execution of project, they may not have a mature portfolio process in place, which causes issues with the strategy of programs and Realizing the benefits Doing things right Verification and validation Prioritization Resources Scope Quality Cost Time projects. The result is that organizations deliver projects on time and within budget, but the value delivered from those projects is not optimized or aligned to the organization s strategy. In times where investment resources are limited, organizations are keen to overcome such potential value leakage. Portfolio focused on preventing value leakage is therefore getting increasingly more attention with large organizations that have poor visibility and control over their project portfolio. 2 Insights on governance, risk and compliance September 2012 Insights on governance, risk and compliance September

4 Portfolio challenges Many organizations struggle with keeping their project portfolio under control. Typical issues faced by organizations include: Too many projects running at the same time that ultimately do not deliver because of a lack of focus objectives that are not supported by a project or program Investments in a project or program that are not supported by a strategic objective (i.e., are not aligned to the enterprise strategy). A more comprehensive overview of portfolio challenges is provided below. To overcome these challenges, portfolio needs to be embraced by organizations to achieve three main objectives: 1. Strengthen the strategic of programs and projects to prevent initiatives being undertaken that do not support the enterprise strategy 2. Enhance the overall economic value of the portfolio in order to get the optimal return on investment. This step is focused on the tangible business benefits of programs and projects. 3. Enhance executive decision making on programs and projects based on company-specific criteria. These criteria may include: how does the initiative fit in the defined enterprise architecture, how do risks and interdependencies come into play, how does the organization deal with compliance initiatives, etc.? Such a triangulated approach, detailed in the graphic below, enables organizations to ensure optimal value creation from their investments in programs and projects Portfolio challenges Connected risks Strategy Alignment of the portfolio to the corporate strategy is not understood Too many, often overlapping, projects aligned to one strategic driver (e.g., regulation or cost reduction) Too many must have projects Ineffective prioritization of projects across the organization Fail to achieve the business objectives Delayed or reduced benefits Opportunity cost of doing the wrong projects Portfolio objectives -fit: Are portfolios aligned to strategic business objectives? : How does the organization ensure consistent top-down (ability to drill down to the lower level)? Governance Management and capabilities No effective approach to stopping poor-performing projects Business cases not subject to effective scrutiny; benefits are unrealistic Business-as-usual projects being managed outside the portfolio Sequencing of projects is ineffective, creating problems in delivery Lack of sufficient experience and capability within portfolio functions Project skills and experience are not seen as critical to the organization s success Organization s capacity to absorb change Inefficient resource allocation Extended timelines and missed deadlines Inconsistent decision-making and issues resolution Ineffective deployment of strategy Inefficient delivery and execution Inconsistent portfolio Poor quality skills impacting deliverables Delays in the delivery and increased costs Economic value Economic value Governance: How does the organization ensure that project and program benefits and risks are being managed to optimize the overall value creation from the portfolio? Agility: How do organizations to re-align their portfolio when strategic objectives change? Resources: How do organizations ensure that supply and demand are matched? What is the basis (e.g., business case) for funding decisions and how is excess program budget identified and reapplied to other programs? Interdependencies: How are interdependecies managed? Risk and issues: How are project/program risks and issues such as budget overruns factored into the decion-making process? Data and tools Portfolio data is inconsistent across projects, functions and business units Lack of effective reporting and aggregation tools Reporting considered ineffective in the eyes of senior Reporting seen as burdensome by project teams Poor visibility of the programs and projects in the portfolio Ineffective monitoring and reporting Poor data quality Slow identification of key issues 4 Insights on governance, risk and compliance September 2012 Insights on governance, risk and compliance September

5 Portfolio in practice The portfolio process itself is a process that is typically executed a couple of times a year. Although it is usually tailored to match the organization s type of business, culture and company size, the steps outlined below are usually identified as the key steps. These steps include: 1. A translation of the strategy into initiative The portfolio process Translate strategy into initiatives Identify programs and projects Optimize portfolio Approve portfolio Portfolio risk review and remediation 2. The identification of programs and projects 3. The optimization of the portfolio 4. The approval of the portfolio 5. Identification of risks and associated remediation strategies. Although the last step is closely related to the execution of programs and projects and hence to doing things right it s closely related to portfolio. It is the linchpin between the two. Key activities Analyze strategy and confirm objectives Optimize existing initiatives to deliver objectives not met by current portfolio Define new strategic initiatives Strategy Translate new initiatives into defined programs and projects Prepare charters that define scope, high-level plans and realistic business cases Evaluate current portfolio Select the optimal portfolio based on the agreed decision (through adding and removing programs and projects) Match supply and demand Establish enterprise architecture control Prioritize portfolio based on the agreed decision Current portfolio Updated portfolio Approve the optimized portfolio for deployment Consolidate outputs from prioritization Senior review and approval Evaluates interdependency risk between program governance, project and solution factors Assess current state Identify program and project improvement opportunities Identify portfolio optimization opportunities Sequential remediation plan Approach goal goal New initiative Defined program Project Optimizes initiatives Defined project Project Project Economic value A B C Monitor E F G H Stop K Evaluate J L Accelerate P Q X Must do Y Current state Future state Project Economic value Economic value Economic value Economic value Economic value Economic value Economic value 6 Insights on governance, risk and compliance September 2012 Insights on governance, risk and compliance September

6 Portfolio in practice Step 1: Translate strategy into initiatives This first step is focused on achieving strategic. Here the strategic objectives are confirmed and linked to the existing initiatives. initiatives collections of programs and projects that are designed to help the organization achieve its targeted performance are the means through which a vision is translated into practice. initiatives are not the same thing as strategic objectives or strategic goals. They are the vehicle for achieving a strategic goal; it is focused on the how rather than the what. initiatives are typically a corporate endeavor that activates cross-functional competencies. Although a strategic initiative may coincide with a program, it is possible that it comprises several programs or projects. For example, a strategic objective may be to grow in emerging markets, the initiative defined is to strengthen account and distribution channels in these geographies. The related programs and projects may be the rollout of a local supply chain planning organization including the rollout of the supporting ICT. So, the purpose of this step is to make sure strategic objectives are properly supported by the strategic initiatives. The mapping will reveal unsupported or poorly supported strategic objectives, which are objectives that do not have, or have an ill-defined, initiative to support it. For these objectives, a new initiative is defined or the initiative is optimized. This step will also detect existing initiatives within the organization that are not aligned to any strategic objectives. Step 2: Identify programs and projects This step is focused on optimizing economic value for new or optimized initiatives. These will now need to be defined into tangible programs and projects. For this purpose, initiatives, defined at a high level, are translated into project charters that should include action plans, a defined scope, a business case and a risk assessment. Risk plays an important role in this step. Too often, organizations define the scope of their programs and projects too broadly. As a consequence, organizations may set the parameters too wide and miss their objectives, resulting in a high likelihood of failure. A critical success factor in this step is therefore not to take on programs and projects that are too large, but to take a phased approach by cutting strategic initiatives into small manageable programs that deliver specific, measurable business benefits. Step 3: Optimize portfolio In the third step, the decision and the preparation of the executive decision-making in the subsequent step come into play. To enable this, the optimized portfolio is prepared including a proposal to stop, start, accelerate and slow down programs and projects. The organization should use a decision with organization-specific factors to prepare the optimized portfolio proposal. In each case, the organization should use the optimize economic value creation and strategy. The specifics of value creation differ per sector, organization and geography. Key input for portfolio optimization is a consolidated overview of all of the organization s programs and projects, including the proper intelligence to facilitate this process. Such an overview would typically contain information about performance to budget, resource requirements, risks, business benefits, links to strategic objectives and interdependencies. Based on the organizations defined decision, the organization is now able to select and prioritize programs and projects optimized for the organization. The first key criterion in the organization s decision is the amount of resources required. In order to make the portfolio executable, an organization needs to make sure that enough resources are available to deliver the programs and projects. In most situations, organizations have a tendency to push more projects into the organization than the organization is able to handle, resulting in project gridlock, which is usually referred to as a state of the organization that faces many escalations of project or program delivery issues and a lack of progress. To overcome this issue, organizations put a mechanism in place to match supply and demand. Another common criterion in use by organizations is the of interdependencies. Organizations use controls such as enterprise architecture to define the current state and the desired future state in terms of ICT systems, business processes and organizational aspects. This allows them to assess whether the programs and projects fit into the vision and to detect and manage interdependencies. While portfolio is focused on the process and governance, enterprise architecture provides the required content. Another key criterion is risk. Firstly, an organization s portfolio should be aligned to the organization s risk appetite to prevent the organization from implementing projects or programs that would impose too much (top-down) risk. Secondly, risks and issues detected (bottom-up) within the programs and projects may be taken into account in starting, stopping, accelerating programs and projects; see also step 5 for further detail. 8 Insights on governance, risk and compliance September 2012 Insights on governance, risk and compliance September

7 Portfolio in practice Step 4: Approve portfolio Organizations typically invest a material percentage of their revenue in programs and projects. For this reason, the organization s executive should formally approve the optimized portfolio beforehand. In the previous step, an optimized portfolio is prepared in order to make this happen. The diagram below shows an optimized portfolio including a proposal for those projects that should be stopped (low economic value and low strategic ), those to accelerate (high economic value and high strategic ), those that the organization must do (low economic value and high strategic ), those that need to be monitored (high economic value and low strategic ), and those to evaluate (medium strategic and low economic value). The bubble size typically represents risk or budget to provide executives with the additional intelligence needed to support their decision making. Economic value G A B C Monitor E F H Stop Evaluate J K L Accelerate P Q X Must do Y Step 5: Portfolio risk review and remediation This last step provides the link with the execution of projects and programs. In this step, the programs and projects are reviewed in accordance with their risks and issues, which enables enhanced insight and decision-making. In practice, these are the programs with the highest economic value or the greatest level of risk to the organization. The information retrieved from such risk reviews allows an organization to feed this into their portfolio optimization process (step 3) and take corrective actions on troubled programs. Organizations need to focus their risk efforts on the risks that matter. Large, complex and risky programs should therefore receive the most attention in an organization s efforts to control their enterprise transformation. A holistic portfolio approach enables an organization to do exactly this: by having a centralized overview of all ongoing initiatives, executives will be able install monitoring of the key risks and take that into account in their decision-making. We distinguish between bottom-up- and top-down-driven risk activities. Top-down-driven risk activities include: the (risk) monitoring of programs and projects that impose the largest risk to the enterprise. Portfolio risk provides a similar approach to risk as is commonly done in enterprise risk used by organizations to integrally manage operational, legal, compliance and financial risks. The output of this activity could, for instance, be an internal or external audit plan for monitoring the programs and projects contained in the portfolio. Bottom-up-driven risk activities are focused on taking relevant risk information into account in executive decision-making. Such risk intelligence is achieved by having a consolidated overview Bottom-up-driven risk activities Take project and program risk into consideration in portfolio decision making (risk intelligence) Portfolio Project and program of classified risks, issues and interdependencies within the most important programs and projects. Armed with this knowledge, executives are able to take this into account into the decisionmaking. This integrated approach to managing portfolio risk provides executives with a powerful asset they will now be able to take project and program risk into account when optimizing their portfolio (step 3). The key to this step is that executives can proactively take action on key risks. Top-down-driven risk activities Risk review and monitoring of highrisk programs and projects Selection of portfolio with low-risk in line with corporate risk appetite Set risk language, policies and standards 10 Insights on governance, risk and compliance September 2012 Insights on governance, risk and compliance September

8 Taking action In this paper, we present an innovative risk-based portfolio approach that helps enable organizations to manage the risk of their transformation in an integral way. The implementation will enhance the organization s chance of success in their transformation efforts because it will force the organization to focus on the risks that matter. In addition, the approach will help enable a common risk language within programs and projects, thereby strengthening the organization s risk culture. The key steps organizations should take to the make this happen are outlined below. Key steps to strengthening risk culture 1. Review the corporate strategy and transformation objectives. 2. Translate the strategic objectives into initiatives. 3. Optimize strategic initiatives to enhance strategic. 4. Translate strategic initiatives into programs and projects by means of project charters. 5. Evaluate current project and program portfolio. 6. Optimize portfolio by adding new programs and projects based on enterprise architecture, risks, business case and other criteria. 7. Balance demand and supply and potentially stop programs and projects that may cause project gridlock to the organization. 8. Prepare a consolidated overview of projects to monitor, evaluate, accelerate, stop and must do to support executive decision-making. 9. Perform risk reviews of high-risk and must-do programs and projects. 10. Use risk and issue information to support executive decision and portfolio optimization. 12 Insights on governance, risk and compliance September 2012

9 Ernst & Young Assurance Tax Transactions Advisory About Ernst & Young Ernst & Young is a global leader in assurance, tax, transaction and advisory services. Worldwide, our 152,000 people are united by our shared values and an unwavering commitment to quality. We make a difference by helping our people, our clients and our wider communities achieve their potential. Ernst & Young refers to the global organization of member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit About Ernst & Young s Advisory Services The relationship between risk and performance improvement is an increasingly complex and central business challenge, with business performance directly connected to the recognition and effective of risk. Whether your focus is on business transformation or sustaining achievement, having the right advisors on your side can make all the difference. Our 25,000 advisory professionals form one of the broadest global advisory networks of any professional organization, delivering seasoned multidisciplinary teams that work with our clients to deliver a powerful and superior client experience. We use proven, integrated methodologies to help you achieve your strategic priorities and make improvements that are sustainable for the longer term. We understand that to achieve your potential as an organization you require services that respond to your specific issues, so we bring our broad sector experience and deep subject-matter knowledge to bear in a proactive and objective way. Above all, we are committed to measuring the gains and identifying where the strategy is delivering the value your business needs. It s how Ernst & Young makes a difference EYGM Limited. All Rights Reserved. EYG no. AU1275 In line with Ernst & Young s commitment to minimize its impact on the environment, this document has been printed on paper with a high recycled content. This publication contains information in summary form and is therefore intended for general guidance only. It is not intended to be a substitute for detailed research or the exercise of professional judgment. Neither EYGM Limited nor any other member of the global Ernst & Young organization can accept any responsibility for loss occasioned to any person acting or refraining from action as a result of any material in this publication. On any specific matter, reference should be made to the appropriate advisor. How Ernst & Young makes a difference At Ernst & Young, our services focus on our individual clients specific business needs and issues because we recognize that each is unique to that business. IT is a key to allowing modern organizations to compete. It offers the opportunity to become closer to customers and more focused and faster in responses, and it can redefine the effectiveness and efficiency of operations. But as opportunity grows, so does risk. Effective ITRM helps you to improve the competitive advantage of your IT operations by making these operations more cost-efficient and managing down the risks related to running your systems. Our 6,000 IT risk professionals draw on extensive personal experience to give you fresh perspectives and open, objective advice wherever you are in the world. We work with you to develop an integrated, holistic approach to your IT risk or to deal with a specific risk and information security issue. We understand that to achieve your potential, you need tailored services as much as consistent methodologies. We work to give you the benefit of our broad sector experience, our deep subject-matter knowledge and the latest insights from our work worldwide. It s how Ernst & Young makes a difference. For more information on how we can make a difference in your organization, contact your local Ernst & Young professional or a member of our team listed below. Contact details of our leaders Global Paul van Kessel Randall J Miller Area Americas Michael L Herrinton Bernard R Wedge EMEIA Jonathan Blackmore Manuel Giralt Herrero Asia-Pacific Jenny S Chan Rob Perry Japan Yoshihiro Azuma Haruyoshi Yokokawa paul.van.kessel@nl.ey.com randall.miller@ey.com michael.herrinton@ey.com bernard.wedge@ey.com jblackmore@uk.ey.com manuel.giraltherrero@es.ey.com jenny.s.chan@cn.ey.com rob.perry@au.ey.com azuma-yshhr@shinnihon.or.jp yokokawa-hrysh@shinnihon.or.jp ED None