8.5 Business Transformation Readiness Assessment and Risk Management
Key Takeaways
Business Transformation Readiness Assessment determines readiness factors, presents them with maturity models, rates them, assesses their risks, and works the actions into the Phase E and F Implementation and Migration Plan.
TOGAF's example readiness factors include Vision; Desire, Willingness, and Resolve; Need; Business Case; Funding; Sponsorship and Leadership; Governance; and IT and Enterprise Capacity to Execute.
Each readiness factor is rated for Urgency, Readiness Status (Low, Fair, Acceptable, Good, High), and Degree of Difficulty to Fix (No Action Needed, Easy, Moderate, Difficult).
TOGAF's Risk Management technique assesses risks by effect (Catastrophic, Critical, Marginal, Negligible) and frequency, at an initial level before mitigation and a residual level after it.
Residual risks must be accepted through the governance framework and are monitored in Phase G; moving a frequent/catastrophic risk to frequent/critical still leaves an extremely high risk.
8.5 Business Transformation Readiness Assessment and Risk Management
Two ADM Techniques decide whether a technically sound architecture can actually be implemented: Business Transformation Readiness Assessment and Risk Management. Both start in Phase A, are confirmed in Phase E, shape the Implementation and Migration Plan in Phases E and F, and are monitored in Phase G. The Level 2 learning outcomes ask you to apply the risk and security considerations of Phases E, F, and G and to create an environment in which the uncertainty of change can be managed. Part 2 scenarios therefore often hinge on recognizing a readiness gap or an unmitigated risk.
Business Transformation Readiness Assessment
TOGAF observes that an innovative Architecture Vision and Architecture Definition usually mean considerable change, and that the human element is by far the most important dimension of change. A change-averse culture or a narrowly skilled workforce can stop even the soundest architecture. The technique builds on the Canadian Government's Business Transformation Enablement Program (BTEP).
The Recommended Activities
- Determine the readiness factors that will affect the organization, ideally in a facilitated workshop with people from across the organization.
- Present the readiness factors using maturity models.
- Assess the readiness factors, including readiness factor ratings.
- Assess the risks for each readiness factor and identify improvement actions to mitigate them.
- Work these actions into the Phase E and F Implementation and Migration Plan.
The BTEP Readiness Factors
TOGAF's example set of factors is:
| Factor | What it asks |
|---|---|
| Vision | Can management clearly define and communicate what is to be achieved? |
| Desire, Willingness, and Resolve | Is there a desire for the results, willingness to accept the impact, and resolve to follow through? |
| Need | Is there a compelling need to execute the endeavor? |
| Business Case | Is there a business case with concrete benefits the organization is committed to deliver? |
| Funding | Is there a clear source of funds to meet the expected expenditure? |
| Sponsorship and Leadership | Is sponsorship broadly shared but not so broad that accountability is diffused? |
| Governance | Can the organization engage everyone with an interest so that corporate interests are served? |
| Accountability | Is responsibility assigned and aligned with where benefits and consequences will be felt? |
| Workable Approach and Execution Model | Is the approach sensible, proven, and supported, with clear roles and a communication plan? |
| IT Capacity to Execute | Does IT have the skills, tools, processes, and management capability, ideally proven on a similar endeavor? |
| Enterprise Capacity to Execute | Can the business outside IT perform its tasks and make timely decisions? |
| Enterprise Ability to Implement and Operate | Can the enterprise absorb the changes and operate in the new environment? |
Rating the Factors
Each factor is assessed for its vision (where it must evolve to, with an intermediate target if useful), its rating, and its risks and actions. The BTEP rating scheme rates each factor on:
- Urgency: an urgent factor needs action before the transformation can begin.
- Readiness Status: Low (substantial work needed before proceeding), Fair (some work needed), Acceptable (some issues, no showstoppers), Good (relatively minor issues), or High (no readiness issues).
- Degree of Difficulty to Fix: No Action Needed, Easy, Moderate, or Difficult.
Readiness and Migration Planning
The assessment is a key input to migration planning, which starts in Phase E and is completed in Phase F. Note whether business transformation actions sit on the critical path: there is no point deploying new IT capability without trained employees and ready support staff. The readiness factors are monitored in Phase G, and the assessment is a living document.
TOGAF also advises that the Architecture Definition should not be widely circulated until business transformation issues are identified and mitigated. For example, a consolidation that could cost jobs should not be announced before a supporting human resources plan exists. The readiness workshops then become part of the Communications Plan.
Risk Management
TOGAF states that there will always be risk in any architecture or business transformation effort. Risks should be identified, classified, and mitigated before starting, then tracked throughout. The Enterprise Architect may identify risks and mitigate some of them, but risks have to be accepted and managed within the governance framework.
Two Levels of Risk
- Initial level of risk: the risk categorization before mitigating actions are determined and implemented.
- Residual level of risk: the risk categorization after mitigating actions are implemented, if any.
The Risk Management Activities
- Risk classification: commonly by time (schedule), cost (budget), and scope. Risks can also be client transformation relationship, contractual, technological, scope and complexity, environmental (corporate), personnel, or client acceptance risks, and they can be classified by architecture domain. EA risks are ultimately corporate risks.
- Risk identification: maturity and readiness assessments generate many risks, documented in a Risk Management Plan.
- Initial risk assessment: classify each risk by effect and frequency using scales the organization already uses.
- Risk mitigation and residual risk assessment: plan actions that reduce risk to an acceptable level, from simple monitoring or acceptance to full contingency plans.
- Risk monitoring: in Phase G, the risk worksheets are maintained as governance artifacts.
Effect, Frequency, and Impact
TOGAF's example scales are:
| Effect | Meaning |
|---|---|
| Catastrophic | Critical financial loss that could bankrupt the organization |
| Critical | Serious loss in more than one line of business; no return on the IT investment |
| Marginal | Minor loss in a line of business; reduced return on the IT investment |
| Negligible | Minimal impact on a line of business's ability to deliver |
Frequency runs from Frequent and Likely through Occasional and Seldom to Unlikely. Combining effect and frequency gives a corporate impact of Extremely High (E), High (H), Moderate (M), or Low (L).
Judging Mitigation
After mitigation, re-assess effect and frequency to check whether the effort made an acceptable difference. TOGAF warns that mitigation must reduce the corporate impact, not just move the risk to another similarly high category: changing a risk from frequent/catastrophic to frequent/critical still leaves an extremely high risk. Large outlays for little residual benefit should also be challenged.
Residual risks must be approved through the IT governance framework, and potentially corporate governance where business acceptance is needed. Phase G implementation governance may uncover critical risks that are not being mitigated, which can require another full or partial ADM cycle.
How the Techniques Appear in the ADM
| Phase | Readiness and risk activity |
|---|---|
| A | Step 5 assesses readiness for business transformation; step 10 identifies business transformation risks with initial and residual levels, and mitigation activities go into the Statement of Architecture Work |
| E | Step 7 confirms readiness and risk, reviewing the Phase A assessment; risks are recorded in the Consolidated Gaps, Solutions, and Dependencies matrix |
| F | Readiness actions and risk validation shape prioritization and the Implementation and Migration Plan |
| G | Readiness factors and residual risks are monitored; risk worksheets are maintained as governance artifacts |
| H | The "Manage risks" step continues risk management after deployment |
Many Part 2 scenarios describe a sponsor who wants to announce or deploy a change quickly while readiness is rated low. The best answers address the readiness gap in the plan, or the residual risk in governance, rather than ignoring it or cancelling the work.
In a Business Transformation Readiness Assessment, the factor "IT Capacity to Execute" is rated Low, urgent, and Difficult to fix. What does this rating mean for the plan?
Low readiness can be noted and then set aside if the business case is strong, because readiness ratings are advisory and are not part of migration planning
Substantial work is needed first; since it is urgent, action must precede the transformation, and the actions go into the Implementation and Migration Plan
The architecture work should be cancelled, because a Low rating on any readiness factor is a showstopper that the sponsor cannot override
The rating only matters in Phase H, when deployed solutions are monitored, since readiness affects benefits realization rather than the migration plan itself
A risk is assessed as frequent and catastrophic. The proposed mitigation would make it frequent and critical. According to TOGAF's Risk Management technique, how should the architect judge this mitigation?
As successful, because the effect has dropped by one category, and any reduction in effect counts as an acceptable mitigation
As acceptable, because residual risk is the architect's call and never needs review or approval through governance
As inadequate, because frequent/critical is still an extremely high risk, so the mitigation must be reconsidered
As irrelevant, because only the initial level of risk is recorded, and residual risk is assessed later in Phase G
An executive wants to announce a target architecture that will consolidate regional offices and eliminate several hundred roles, before any plan for the affected staff exists. What does TOGAF's Business Transformation Readiness guidance recommend?
Hold back wide circulation until the issues are identified and mitigated with an HR plan, and make the readiness work part of the Communications Plan
Announce immediately, because transparency always outweighs readiness, and early notice gives the affected staff the most time to look for other roles
Remove the consolidation from the architecture to avoid resistance, and pursue it later as a separate initiative managed outside the ADM by human resources
Delegate the announcement to the implementation vendor in Phase G, so the architecture team stays neutral during the consolidation
Sections you finish are checked off in the contents.