Keystones and Rivets

Auditing IT systems

“Yip, I’ve been promoted and I’m off to New York in a few weeks”, said Big D.

The other day I was chatting online with a former colleague who now works for a business process outsourcing company specialising in corporate information solutions.  He told me he is going to be a new Director for the US, focussing on Strategic Solutions for the Americas.

I made the critical mistake of shouting this news down the corridor to my business partner Fergus.

“Start spreeeeading the nyoooosss, Haaam leevin’ tooodaaaaaayyy...”, he wailed.

Throughout my career, in each office or location, there has always been at least one person who was convinced, despite the reactions of their ‘audience’, that they are a good singer.

Fergus is very convinced.  And very loud. 

The window in my office was open.  Outside, I could see squirrels throwing themselves off the oak trees.

The Pebble grimaced, and, above the racket, cried that it sounded like, “someone smothering a crow with a whoopee cushion.”  Mercifully, he forced shut a couple of doors and calm was restored.

“The guys say ‘well done Big D’”, I typed back.  Our chat continued.

“Thanks to all...what are you up to today...when’s the next blog coming out, what’s it going to be about?”

“I’m working on it now.  It’s about systems... how traditional functional systems don’t fit with the business process view of an organisation.”

“Really?  I was just in a meeting about that very subject.  We take a look from the business process perspective, and it always spans lots of IT systems. The boundaries round processes are completely different to the demarcation between IT Systems...So why are you doing that one?”

I went on to explain that I’d been following a series of posts by bloggers Dennis Howlett and Francine McKenna about IT systems, auditing and the Big Four…

Understanding and Valuing Data Flow

My business partner, Fergus, and I were on our travels last week around the UK.

We used a couple of planes, a few trains and an automobile.

For a change, the journeys on the trains and the planes were smooth and on-time.

The car was a different matter though.

We hit a number of traffic jams that delayed us quite a bit.  The worst was on a motorway near Leeds where we sat without moving for well over an hour.  A truck had over-turned and stopped the flow of traffic.

During our fifth game of “I Spy” we got a call from The Pebble, and explained our situation.

“You know what?  That reminds me of our discussion the other day about network routing”, he said.

“The motorway is just like a cable and you are sitting there like little packets of data when a server goes down.”

I could tell he was taking a little pleasure in our predicament.

“Well, networks don’t quite work like that...”, I began to reply.  Mercifully, another call came to my rescue before I had to go into the intricacies of communication protocols between hosts.

Eventually we got going again and during the next couple of days met a few companies, each working in different industrial sectors.  A regular topic in our discussions was how data flows through and across an organisation – and more importantly, how it is documented and portrayed to non-technical stakeholders of that data.

To investigate, analyse and communicate the data flows, some of the companies had Systems Analysts who used formal Data Flow methodologies such as Yourdon/DeMarco, SSADM and Gane-Sardon.  Others had only basic Visio diagrams to try to document how applications and functions within those applications interfaced with other applications.  Some companies, however, had no documentation at all.

Governance and Government

We weren’t sure whose chin hit the floor first.

“He did say 25 million, didn’t he?” asked The Pebble.

“Yip”, I replied.

We had just begun watching a news broadcast about the latest data security breach by a British government department, Her Majesty’s Revenue and Customs (HMRC).

25 million personal records, including the banking information for every family in the UK with a child under the age of 16, had been written with only password protection onto two CDs which were subsequently “lost in transit”.

The UK Prime Minister, Gordon Brown, said that the security breach was down to “Failure in implementing the proper procedures.”

He went on to explain that:

1. “Only authorised staff should have access to protectively marked information”
2. “Information must not be removed without appropriate authorisation”
3. “Encryption should be used whenever information is being sent”

Enterprise Applications and User Interfaces

Nick Carr recently made reference to an article by Khoi Vinh, Design Director at the New York Times, about “the user-unfriendliness of enterprise apps”.

Khoi made an interesting point, that “...enterprise software rarely gets critiqued the way even a US$30 piece of shareware will.”  His basic premise is that the $30 software reaches a larger audience than an enterprise application, an audience which is more vocal and that helps shape the User Interface (UI) and software’s future development.  In contrast, an enterprise application doesn’t receive the same level of feedback therefore it remains an unfriendly application.

But to me that’s like saying that because the affordable Volkswagon Golf is the most used car in Europe, with lots of feedback through the dealer network, it is easier to drive than a 6.6L V12 660bhp Lamborghini Reventón.

Understanding Enterprise Architecture complexity

Nick Malik of Microsoft posted recently that

“For years, we've been living with Zachman and now TOGAF as commercially available EA frameworks, but honestly, they don't address the problems faced by large organizations with respect to complexity.”

This got me thinking about some of the pros, cons and limitations of the traditional frameworks used in Enterprise Architecture (EA).

This isn’t a comprehensive review but I’m going to briefly discuss three frameworks and their limitations in this blog, before I talk a little about OBASHI™ - my company’s own framework for capturing Business and IT related information.  Each framework details how information can be categorised, organised and presented to form the basis for governance and change.  The three traditional frameworks have some key differences which I’ll highlight below.