Monday, May 30, 2016

Understanding risk

Throughout my career, I have tried to take a risk-based approach to actions and decision-making. This has become more important to me as a CIO. Understanding risk is an important part of driving change. If you understand the risks, you can decide which risks you can accept and which you cannot. In doing so, you avoid "analysis paralysis" where you continually evaluate options without actually choosing a direction. By taking a risk-based approach, some options become obvious.

I find I turn to a few simple models to understand and evaluate risk. My standard model is based on Likelihood and Impact. I often go to this model when considering system risk. Which are your riskiest systems? Consider these dimensions:

How likely will this system experience a problem?

As an example, consider a computer system that is supported by only one server, under someone's desk, running on building power, and without a backup—that system has a High Likelihood for failure. If you find a server like this in your organization, you should be very nervous about when it will fall over, because its failure is a matter of when, not if.

In contrast, if you have a computer system that is supported by multiple servers in parallel, running in different data centers, using redundant power and cooling, with multiple levels of backups—that system has a Low Likelihood of failure. I usually don't worry about these systems.
If the system does fail, what's the impact to the organization? This might depend on what the system does, taking into account exposed private data or the reputation of the organization.

Let's say you had a database that tracked when public benches were last repainted. Maybe your facilities department uses this information to know when to schedule a touch-up job or a complete repaint of the bench. If you lost this data, the organization isn't impacted that much. The facilities folks would have to re-evaluate the benches. For many benches, this will take a while, but the organization will continue otherwise uninterrupted from this failure.

On the other hand, if your HR database of employees and salaries was irretrievably lost, your organization would be severely impacted. Someone in HR might be able to reconstitute the data from other sources, but it wouldn't be perfect. And depending on your industry, this is probably private data. Your organization could face damages and fines for the loss of salary information.

The Likelihood and Impact feed into a risk matrix. I prefer to color code the matrix with red as the highest risk, yellow as moderate risk, and green as the lowest risk:


For other risk scenarios, you might also include a "critical" risk, such as when loss of life is possible:

I use a similar risk matrix when I need to understand the risk of making a change. Not all changes carry the same risk. I know from my early career as a systems administrator that you can make certain changes to a running system without worrying too much. But other changes require more attention. Again, consider the Likelihood that a system change will result in a problem, and the Impact that problem would have to the business.

Have a backout plan
Consider timing
Remediation plan
Consider carefully
Have management support!
Probably a standard change
Just do it
Lowest risk
Talk to others
Evaluate the timing
Consider knockdown effects

But when considering the risk of business applications, you might need a different risk matrix. Should you continue to run that business application? Does it really provide value? Is it reliable? These questions feed into a different matrix that helps you decide what to do with business systems.

Business value

At every level in an organization, you need to understand risk. Without a method to evaluate risk and make risk-based decisions, you can quickly move to a decision. Some options are obvious, others will require careful consideration and coordination with others.

Consider leading an exercise to explore the risk in your organization. I find it is helpful to start with common definitions. Jot down some examples of what defines high/moderate/low Impact, and high/moderate/low Likelihood. Define what you mean by "high business value" or "low stability." Get buy-in on these definitions from the key stakeholders, then work with them to place applications or systems in each box. Don't worry about relative placement within the box. If you find yourself saying "This is a Moderate Likelihood, but it's on the high end of Moderate," then just put it in "Moderate" and move on. The most important factor isn't that the Likelihood is "Moderate" but what you do afterwards to reduce the risk.

What can you do to reduce the risk of your systems? Technologists usually start with Likelihood. What can you do at a system level to reduce the Likelihood of a failure? Moving systems into a data center is one way to do this. Also add redundancy where possible, such as redundant power supplies on different power feeds backed by different uninterruptible power supplies, or move important data off single disks to a RAID or a SAN.

At the same time that you address Likelihood, also consider the Impact. How can you reduce the impact of a failure? For example, do you really need to store all that data on that system? Is the extra data increasing your risk unnecessarily? If you can remove unneeded data from a system, you might reduce your Impact.

Over time, you should repeat this exercise, and you should be able to demonstrate your organization reducing its risks. In the Likelihood-Impact chart, your applications and systems should move from red to yellow, and from yellow to green.
image: "decisions" Impact Hub/Flickr (cc by-sa)

Monday, May 23, 2016

Five phrases

A great article at Fast Company discusses the words we use at work, and how those words impact our influence and relationships.

You've probably experienced poor word choice by others. In a meeting or in a discussion, you may have observed someone really flub a point by using wrong language. Maybe it comes off as too forceful, or too autocratic. And that changes the tone of the discussion. Poor word choice can turn a conversation's focus from "collaborate" to "dictate."

In the Fast Company article, Bernard Roth of Stanford University's discusses the 5 Words And Phrases That Can Transform Your Work Life. Quoting from the article:

"But" is probably the most limiting word in our vocabulary. The use of "but" closes off the conversation space, while ‘and’ opens it up. When you open up the dialogue with "and," your brain gets to consider how it can deal with both parts of the sentence.
Needing to complete work is one of the most common situations in which we say we "have to" do something. By saying you "have to" take it, you set up a situation as a burden. By simply swapping out "have to" with "want to," you will more readily make it seem like less of a burden, and indeed, more of something to look forward to.
When we say we "can’t" do something, that is almost always not actually the case. By exchanging "can’t" for "won’t," we realize that an inability to currently do something is a choice, not a physical impossibility. The simple change of ‘can’t’ to ‘won’t’ is often empowering. "Can’t" implies helplessness; "won’t" signifies volition and choice.
"I’m afraid to" is about the most blocking phrase there is. It acknowledges the person’s fear instead of their desire. Phrasing your want as "I’d like to" acknowledges your desire, and desire is usually associated with positive, pleasant thoughts.
The word "help" is often associated with "helplessness" in our minds. Helplessness implies someone is incapable of achieving something without someone else stepping in to do it for them. However, when we swap "help" with "assist," we set ourselves up to see that we are an important and capable part of the solution.

Monday, May 16, 2016

Meeting with customers

Relationships are an important part of getting things done in any organization. Whether you work in IT or some other unit, who you know can sometimes be just as important as what you are trying to accomplish. If you have connections with business partners inside the organization, you can leverage these relationships to help you meet goals and drive innovation.

But relationships aren't just for getting things done. You can't just build relationships for the sake of driving work. You also need to have business relationships with your customers.

IDG Enterprise discussed this topic in their editorial article Why it pays to meet your customers. They identify the benefits through numbers:

You could argue that, outside of sales and marketing, IT is the business division for which it is most important to meet with external customers. To further put some numbers around why it is so beneficial for IT to meet with customers, consider this: Of the 2016 State of the CIO survey respondents who said that they regularly meet with customers, 57% report directly to the CEO, versus 46% of all survey respondents. Additionally, 41% of CIOs who have regular contact with customers spend their time on highly strategic activities, such as driving innovation, developing new go-to-market strategies and technologies, and studying market trends for commercial opportunities. In contrast, just 19% of CIOs who seldom or never meet with customers engage in strategic activities such as those.

In IDG's view, meeting with customers is the best way for CIOs to stay focused on strategic needs of the organization.

I agree. The CIO needs to stay connected with the organization and its customers. The IDG article makes the case that the CIO should meet with the external customers—the people paying for services. But what if your organization is like higher ed or government, where you don't have "paying customers" in the traditional sense? In my view, it doesn't matter.

It's still important for the CIO to meet with the units served directly by the IT department. In higher ed, I regularly set aside time to meet with division chairs and unit directors. Twice each year, I also arranged formal IT input cycles, where I led discussions around the future IT needs of the institution.

I've only been in local government for a short time (three and a half months, if you're counting) but even so, I recognize the need to meet with the units I serve so I can stay connected. I've arranged meet-and-greets with several groups within the County, and I look forward to meeting more of my colleagues. By staying connected and building these relationships, IT will be a partner to our customers, rather than a mere service provider.

I believe so strongly in the need to stay connected with customers that I am creating a new, expanded "IS Liaison" position. We are a large county—at over half a million people, we are the second most-populous county in the state. So it's not feasible for me to meet individually with each of my customers. I need some help to get that done. The Liaison position will become the primary contact point for our customers.

The Liaison won't replace my need to meet with customers, but the position will allow me to stay connected while focusing on the strategic needs of the county. The Liaison will meet with our customers in an ongoing basis, likely twice each year, to discuss IT needs and to preview what's coming up with each of our customers. Let's set the clock ahead by six months or twelve months, and ask "What's happening in your unit over that time?"

I hope the Liaison will hear about projects with IT needs: "We're looking to purchase X system, and we'll need IT to help us with that." But the Liaison will also look for projects that have hidden or unrecognized IT roles: "We're going to be moving to a new building in ten months, but we don't think IT will need to do anything with that." (What about network, phones, computer moves? Let's partner with you on your move so the IT stuff gets dealt with.)

Over time, I hope the Liaison will become an integrated partner with our customers, providing a focus point for questions and issues, and serving as a mechanism to get "stuck" items moving again.
image: reynermedia/Flickr (cc-by)

Monday, May 9, 2016

Politely bringing someone down

Last week, I mentioned the five levels of performance:

  1. Unconsciously under-performing
  2. Consciously under-performing
  3. Consciously performing
  4. Unconsciously performing
  5. Super-performing

That's an important scale to use to help your team members—and your organization as a whole—to improve. But just as we can use the five levels of performance to help an organization or a team member to improve, to raise their game, you can just as easily (perhaps mistakenly) bring someone down.

So yes, you can also use this for eeevil. I don't espouse this kind of behavior, but I think it's important to remember that the five levels of performance might (sometimes) have a negative impact:
Someone who is unconsciously performing is doing an excellent job without realizing that they are at a higher levels than others. Someone who is super-performing is "in the zone," like a baseball pitcher throwing a no-hit game.

And that's where eeevil people can do harm. When a pitcher is throwing that no-hit game, taunting them won't impact the pitcher's performance. Professional sports players ignore that kind of thing. And it's rude, anyway. But if you politely recognize recognize the pitcher for the great game, talk specifically about their unhittable slider, how their curve ball really does seem to move on its own, how every third pitch is a fastball … Whether or not it's true, be specific and be polite. The goal here is to raise self-awareness of performance and knock the pitcher "out of the zone."

The pitcher is still throwing a good game, but now the pitcher is thinking about what they are doing, how they are selecting their pitches, how they are throwing the ball. The pitcher becomes consciously aware of their performance, and shifts from "Super-performing" or "Unconsciously performing" to "Consciously performing." That's a lower performance level. And at this lower performance level, the pitcher is more likely to over-think their performance and make mistakes. Maybe the pitcher will start to second guess themselves, wondering "Am I doing this right?" This can shift the pitcher further from "Consciously performing" to "Consciously under-performing."

So simply by politely calling out all the great things the pitcher is doing in that no-hit game, you have changed the behavior. Just don't use this to help your kid win their little league game. That would be using this knowledge for eeevil.

Instead, take this as a warning for how you apply the five levels of performance. When you have someone on your team who is at "Unconsciously performing" or "Super-performing," be careful about how and when you recognize them. With the "baseball pitcher" scenario in mind, do you really want to interrupt your star performer who is "in the zone" to tell them what a great job they are doing? Will your well-intentioned on-the-spot recognition take that person out of the moment, so they start to think about what they are doing and how they are doing it?

Choose your moment carefully so you don't accidentally take your super-performer down to a lower performance level simply by telling them what a great job they are doing. Find a way to thank them indirectly, then wait until they don't need to be "in the zone" to properly recognize them and highlight their superlative performance. You don't always need to recognize excellent performance when you see it. Instead, say "thank you" then circle back at the end of the day for a more specific appreciation of their work.
image: Bryce Edwards/Flickr (cc-by)

Friday, May 6, 2016

Five levels of performance

At what level is your organization performing? Are you exceeding expectations? Falling below expectations? Or just meeting the expectations?

Some experts refer to four levels of performance, originally credited as the "Four stages of competence." Others refer to five levels, with the fifth level indicating either an ability to instill performance in others, or a "super-performance" level. I prefer the latter.

These five levels of performance apply to both individuals and organizations. They are:

Unconsciously under-performing
The organization is not meeting the needs of their customers and is not performing at an acceptable level. At the same time, there is no awareness in the organization that they are not meeting expectations. They don't know that they aren't doing well.
Consciously under-performing
The organization is not meeting the needs of customers and is not performing well. But the organization is aware of the problem. They know they aren't doing well, but don't know how to fix it.
Consciously performing
The organization is performing at an acceptable level and meeting goals and addressing customer needs. They are doing well and they know it.
Unconsciously performing
The organization is meeting customer needs and accomplishing goals, but is doing so without a general awareness of their superior performance level. They are working well, yet no one really realizes it.
The organization is performing at the highest level, constantly and consistently delivering their "A" game. They are "in the zone."

Where does your organization fit on this performance model? Consider that different parts of your organization might be at different levels. Is your unit doing well, and they know it? Or is your unit not doing well, and they are blissfully unaware?

I use this same model when I evaluate the performance of team members. I might have one person who is doing very well, delivering great work products, meeting expectations. Are they having to stop to make a plan of what to do, and how to do it, in order to reach this performance level? (Consciously performing.) Or is this a "star performer" who seems to have an innate ability to do an excellent job all the time? (Unconsciously performing.)

I've had team members at every level on this performance model. It's been a true pleasure to have someone who is at the "super-performing" level. And I have had a few in my career, although it's rare. These people always do a great job, always outperform everyone around them. But they do this not because they are trying to show anyone up, and not because they are bucking for a raise or a promotion. They do a superlative job because they get "in the zone" and do their job at an excellent level.

Whether I have someone who is super-performing or unconsciously performing, I am careful to avoid knocking them out of that top level. They are doing a great job without having to stop and think about it. The moment you cause them to reflect on what they are doing that's helping them to outperform, you immediately bring them to the "consciously performing" level. And while that's still a great place to be, you have also taken them "out of the zone" to perform at a lower level.

So if I have someone who is super-performing, I might recognize them in different or indirect ways. Stopping to say "thanks!" or "good job!" is positive recognition without bringing them to that lower performance level. Bringing in food (pizza!) can be enough. When they no longer need to be "in the zone," I'll call out the great work they are doing and specifically recognize their efforts.

At the other end of the scale, if you have someone who is unconsciously under-performing, the you must recognize that they have been doing their job without realizing that they aren't meeting expectations. At this level, they need help to realize their sub-par performance, that they need to raise the bar and meet a higher level. Find a way to have that conversation and raise awareness. This brings them into the "consciously under-performing zone, which you can leverage for further improvement.

Those who are consciously under-performing are generally aware that they aren't doing the best job they can, but they don't understand how to reach the next level. A constructive performance plan can help. As their manager, you will need to work with them to identify how they can do their job better. Be specific about how they can improve. If you only highlight the deficiencies, you aren't helping; they need your help to reach the next level. Map out a plan for these team members, and identify specific things they might do differently to improve efficiency and increase their productivity. It might be as simple as rearranging their work area, or moving their work space to somewhere with less distracting foot traffic.

Understanding how your organization is doing is critical to performance management. You want to do well so you can better serve the entire organization.
image: Clip Art Best (free)