Human Capital

My opinion on certification has changed. I am taking a journey towards a Certified Information Systems Auditor (CISA) designation and have joined Information Systems Audit and Control Association (ISACA.) I also plan to take at least one environment and sustainability certification in 2012. Professional development and self improvement are excellent goals. The personal networking opportunities are also incredible. I am not 100% convinced of the value of the various hurdles placed to maintain any certification, for example the thousands of dollars and a month of time on continuing education via conferences and what not. In my opinion, experience, aptitude and self-directed learning are still trumps in that game.

As I study up for the CISA exam using the CISA Study Guide by David Cannon (amongst other resource), I'm noting a lot of scrutiny in the realm of IT outsourcing that further validates some of my beliefs on the topic. I've seen some interesting notes and experiences, including:

• Outsourcing is done for a variety of reasons
  • scope of work is unknown (we can't afford to do it ourselves)
  • staff isn't competent or experienced (we don't know how to do it)
  • upper management thinks it is a good idea (not a core competency)
  • we're CMM level 5 and anyone could do our jobs (we've got it totally figured out)


• If a company and its outsource have not both performed an independent audit and/or shared those results before the contract is signed, there is only "hope and prayer" that the company's service requirements will be met. (p.150)


• Outsourcing must be based on facts and evidence. (p.337)


• If you're not CMM level 5, don't bother outsourcing.


• Many outsourcing initiatives are done for the wrong reasons and possibly half end up in "in-source return" situations (p.136-138)

I also continue re-reading Death March by Edward Yourdon. Everyone in IT should read this book as its almost as instructional as Scott Adam's Dilbert. (It is amazing how in over ten years since this book was written, nothing much has changed.) I've gone over the section on process dynamics a few times, and years ago I shrugged at the Abdel-Hamid software process model, but now it is meshing with my thoughts on effective staffing and building corporate value.

I've read that human capital brings three things to the table that can be abstracted; training, expertise, and awareness. Training is what you can be educated on, and in IT, it would be the technical aspects of a job (like a programming language.) Expertise is your exposure to business knowledge and how to apply your training (like building Health and Safety applications.) Awareness is knowing how your organization works and who to talk to overcome obstacles. The intuition that comes with that is incredibly valuable, as you may learn when to ask questions and learn from the experience of others, as opposed to re-inventing the wheel.

Outsourcing can be okay at the technical aspects, but expertise can be problematic (as stated in previous blogs) because to keep the cost down, an outsource tends to (attract and) hire less experienced workers that likely don't have direct domain (business) experience. They are even worse at awareness, because the outsource is not part of the company's business culture.

I think many in the business would agree that a good senior resource can accomplish work in half the time it would take a junior resource. The senior resource has probably solved the problem before, or has parallel knowledge. The senior resources should be the norm against which all work is measured. These are the folks that have been with a company long enough to know how to get things done within the organization's culture. There are also experts, or gurus, that ascending above the average senior resource and tend to move mountains with their thoughts.

Consider the following diagram, where the Y axis is cost per resource, and the X axis is time in months. The work is constant (as the functionality of an end product would be the same.) Let's assume the junior resource cost $50/hr (2/3 of the senior resource) and takes twice as long to do something as a senior resource at $100/hr. Let's also assume that the guru is being measured at $150/hr, and he can move about nine times faster than the junior resource.

It seems obvious to me that assigning senior staff to a key project is both cost and time effective. And the really important thing is these staff represent in-house resources. Outsources don't have the gurus because they can't afford or retain them, and they have fewer senior resources because that domain knowledge is missing and they're insulated from a client company's culture.

The other part of the junior resource problem, as I gleaned from the Yourdon notes, is the buffer time it takes to get junior or senior resources engaged on work. Some might call this the learning curve, but it is more than just a technical aspect as you learn the tech, the domain, and the environment. There are other buffers as well (that may be bureaucratic or resource scheduling in nature.)

Here is my extension of the resource process model, including the concept of buffers, and adding some feedback. For posterity, let's call it the Wieser model of Human Capital.

At the start of process, new hires come into the system. You can measure their rate of entry. Once in, they will be assigned work, and you can also measure the "Rookie Buffer", that is, how long it takes them to achieve baseline (senior) performance. This feeds the assimilation rate. Sooner or later the junior resources evolve into senior resources. An important thing implied by the diagram is training. You can infer the effectiveness of training by the same means (because it should decrease the time it takes to do the work, and also decrease the number of iterations and/or errors.)

Once the resources have been assimilated (and that means they have the technical skill, the business experience, and cultural awareness) you can again measure and define baseline performance and know the pulse. The next big thing is the exit rate, that is, assuming the junior resources become senior resources, watch what happens to them. There are some interesting metrics here, because it can guide your adjustments to the entry rate.

Lost	A resource may get redirected, that is, take a different career path within the organization.
Fired	A resource may get let go with cause.
Quit	A resource may leave for some reason (that is important to figure out. Did they get a better offer? Was there something negative about the working environment? Threats lurk in high exit rates.)
Retired	Resources retire (but tracking early retirement is an important indicator for culture.)
Died	Accidents happen, but work place accidents or related incidents need to be watched very carefully.
Discontinued	The resource, for whatever reason, was no longer required.

The big thing missing is exit rates at points of interest. For example, if you spend a lot of time and money training resources that balk during the training or shortly thereafter, that is a very alarming cultural indicator. Some put this into the retention rate and measure it over milestones like on-boarding completed, five, and ten year anniversary.

Now, if you look back at outsourcing, either as a company that is in transition to outsourcing and is having attrition issues, or as an outsource where you may have a culling of senior herd to keep profit margins high, you will see the model is front-end loaded. The true value and potential of developing the human capital will not get realized.

Top Ten Outsourcing Lies

Top ten lists are very popular, so after a recent meeting where I was hearing a few positives of IT outsourcing, I had a strange sense of Deja Vu.  Now the word lie is a bit strong because it implies a conscious, wilful deception.  I do not believe all folks that sing the praises of outsourcing suffer from some affliction.  I'd like to think the quote attributed to Napoleon Bonaparte is a better fit:  Do not ascribe to malice what can be easily explained by incompetence.  That said, this top ten list can also be used as a check list to ensure you have the right outsource and agreement in place.  It doesn't matter if it is a service, product, or project.  The proof is in the pudding as they say, and if you cannot evidence any of these items, you are not setting yourself up for success.

#10         An outsource improves business continuity.

It is naive to believe, unless it is in the contract, that an outsource has an Emergency Resource Plan or Disaster Recovery Plan that is as strong as your business requires.  Think of it this way, if you pass the treasure to someone else for safe keeping, are you sure you'll get it back?  Will it be there when you need it? Many outsource companies have in their contracts a limit on liability to the cost of their service and not the value of the treasure.

#9           An outsource has comparable or better security.

Is the outsource's perimeter security and information security policy as strong as yours?  This should absolutely be in the contract, but like point #10, the further away from you the break-point is, the harder it is for you to do something corrective quickly.  There is also the irony that by opening a conduit to the outsource you are actually adding another break-point (that is out of your control.)

#8           An outsource has better quality.

Quality is very subjective unless you try to quantify it through solid metrics.  At the end of the day service satisfaction, cost and timeliness are bottom line indicators.  Defining Quality can be a job in itself.

#7           An outsource is faster.

There may be a few reasons why folks think an outsource might be faster, but the reality is usually Mythical Man Month:  The more people there are involved in a process, the greater the logistics overhead, the more opportunity for iteration and clarification, and the longer it takes.

#6           Outsources execute better.

Does your outsource measure its execution?  Do they share that data?  Do they compare to peers?  Do they believe in management frameworks or systems to guide all aspects of their operation?  Do they have a Continuous Improvement program?  Are their resources experienced and happy?  An embeded resource has a face and a certain level of trust.  Many outsources are black boxes.

#5           Outsources are cheaper.

You can't add the logistical overhead without driving down the other labour costs, especially for near-sources.  The first TCO reduction comes from releasing your trench staff.  If you presume these workers were paid competitively and were skilled to start, and were also loaded up with appropriate work, how can it possibly be cheaper by adding more expensive resources (like project managers, case managers, client managers) and cheaper resources (that equates to less skilled or experienced)?  Many outsources after five years are more expensive than in-house teams.  Off-shoring does take advantage of disparity in cost of living and labour market, but it has the downside of cultural and work-hours disparity, lesser security, and risky continuity.

#4           Outsources have better people.

The best people tend to be paid well and like being taken care of.  Many outsources do not hire the best people because those folks would make the labour cost go up.  Who makes a better burger?  The burger assembler at [fast food restaurant of choice], or James Beard?  (Beard is a renown chef and uses cream in his tasty burgers.)

#3           Outsources know the business.

An outsource might know their business, but do they know your business?  This is somewhat counter to core competency think.  To assume an outsource has the business knowledge in your field assumes that they also work for your competitors and/or have worked for you long enough to pick up your corporate knowledge.  Is every service desk or call center the same?  Not every application you use or product you produce is.   There needs to be a competitive differentiator somewhere.

#2           Outsources have deep benches.

It has been my experience that many outsources replace two-with-one, and not charge two-for-one.  Unless you offshore, the outsource is drawing from the same resource pool as your competition.  Why would you expect them to have better success at attracting and retaining resources given the cost pressure?  Benches get voided when there is a lack of work.

#1           Outsources follow best practices.

Outsources tend to do what they're contracted to do.  This is because most work needs to be billable, and strangely many best practices are not directly billable.  Take documentation for example.  It makes sense that an outsource would develop its own documentation and process models to help them service you better.  The reality is, it is not in their best interest, and they're not likely to share this learning with you anyway.  Best practices take time, even if the ultimate goal is eventually driving down the learning curve for the bench.  But figuring stuff out is directly billable.  A Tom DeMarco quote comes to mind: Crazy is repeatedly doing the same thing and expecting different results.

It comes down to core competency.  Does it apply?  It is rational to want to choose an expert to outsource work to that is their core.  At the same time, it is not rational to increase complexity in any system and expect a decrease in entropy.  Restated, you can't throw more uncertainty into the mix and still expect the whole thing to be predictable.  Predictable really means low risk.

Outsourcing is stupid.

A bold headline, isn't it?  If you define stupid as an act or behaviour lacking sense, then there needs to be a bit of context around this statement and justification to "Why outsource?"  "Outsourcing is Stupid" via CIOUpdate suggests why would anyone want to outsource IT when defects increase 35-to-40%?  For us old software engineering types, we were taught that defects found in the delivery phase of a project are 70-to-80% more costly to fix than those found in the specification and design phases.  That, and outsource projects tend to see project management and controls expand 25-to-30% that is a more expensive exercise.  The article goes on to state that the only effective reason to outsource IT is when a company cannot afford to do the work themselves.  To summarize the article, It is cheaper and better when you can do the work at home, especially when modern tools automate so much.

If you look at large companies, in particular resource companies, you can see a connection between the commitment of management to outsource, and the growth of the project management office.  With outsourcing, you tend to have management on both sides of engagement.  It seems like a lot of duplicated effort, logistical disconnects, and sacrificed quality for software and service provision that is 900% more ineffective.  These companies, like many large companies, have the resources to do the work themselves.

"When Outsourcing Goes Bad" from InformationWeek is a brilliant bit with more useful nuggets of information.  Of a survey of about 420 companies, only half ranked their outsourcing endeavours as successful.  One in six claimed their outsourcing was a disaster.  It makes sense though.   Many CIOs outsource for the wrong reason, and usually its not for increased efficiency (because how can you make that claim with all the evidence against it), but for that easy money reduction of operating cost.  This article mentions when IT is outsourced, the event itself requires board level scrutiny and continual review.   Many failures end up in costly litigations.  When the horses are out of the gate, the further they run, the harder they are to round up.

So again, why is it that companies that can afford to do it right, still pick the wrong path?   It can't be the core competency argument, because what large company would claim that their information systems do not present a material risk to their continuous operation?  So it must be ignorance, or skill-full politic in the deferring of blame.

And this reflects so poorly on the IT industry in general.  To reduce costs, you still need to go after the biggest spend that is your human capital.  When you outsource, the outsource absolutely will go for the cheap, warm body on the bench.  This continues to depress the job market and make IT an unattractive career.  And this in turn also drives the lack of credentials and experience in IT.

It would be so much better if continuous improvement, process efficiency, and quality control were the focus of solution delivery.  Execution excellence... how many companies have that sound bite in their mission or value statement?

Outsourcing Blame

Many of my blogs of late have been about outsourcing. True, as I continue to watch several companies about me drive for ISLite, I can only shake my head and "pity the fool" that works in IS's trenches. Over lunch a few weeks ago, one colleague mentioned that Outsourcing really allows a company to shift blame from the employees to some vendor. He coined the phrase: Outsourcing Blame.

I don't think any other two words sum it up as succinctly. If IT/IS isn't a core competency, and your company isn't willing to invest the dollars to make it so, then the leadership really needs to point a finger somewhere because it is a guaranteed fail. I wonder, what is the one thing, regardless of industry, that every company needs on a daily basis? Information services and support. So why is this part of industry considered low hanging, repetitive, outsourceable work when without it, most industries would come to screeching stop? This, in my definition, is a critical service.

The same colleague forwarded me a blog entry, just days before he was laid-off, about how your average IT worker must plan to enter into management or entrepreneurship as they get older because over time you become unemployable. This is interesting because most folks in an IT department are young and inexperienced. It strikes me as a self-fulfilling prophecy that attrition and loss of knowledge makes most IT departments inept. There is an undersupply of wundergrads and oversupply of old hacks. What is worse is that a company that cannot hire that new grad with 20 years experience somehow thinks an outsource will have an easier time. If you can't staff a position, why would an outsource (that likely pays less with fewer benefits) be in a better position to hire someone?

Another colleague forwarded me a blog entry about why outsourcing other parts of business is a bad idea. This time the outsourced work was Risk Mitigation Planning, and the company was (drum roll) British Petroleum. Isn't it crazy, on many levels, to outsource Emergency Response Planning, Disaster Recovery, or anything about corporate risk to anyone that doesn't have that intimate, day-to-day, detailed, operating knowledge? Sure, hire a consultant to help, but outsourcing for such planning seems like, well, outsourcing blame when the inevitable happens. That finger pointing didn't work so well when BP was called to defend itself on Capitol Hill.

Recently I had a brush with outsourced service and support first hand. Several months ago my oven broke so I called the only recommended service provider by the manufacturer. A glow igniter was replaced and shorted out several weeks later. Then it was the logic board. Then it wasn't, it was a valve. First delay was they couldn't service my unit because of a big recall (by said manufacturer.) Then the only tech in our area went on vacation. He never had any parts in his van, so we always had to wait. The guy continually left garbage after his visits and he creeped my wife out so much I had to stay home from work for several of the visits. Never once did I see him perform something like a systemic diagnostic (that I found on the internet, and I could perform myself with a volt meter.) So, we were complaining to the service desk since visit one. It went to their escalations group, and we got the personal treatment. That treatment was a young fellow trying his best, with no knowledge of the industry, and a huge gap in communication between his group and the field service office. We asked several times for a call from the field manager. We didn't get a call. We wanted a different tech. We were told our remote area only had the one tech (and our area was 15 minutes from a city of over One Million People, that we pointed out.) We got calls saying we had to pay for all the so-called parts and service. We responded we're not disputing any charge for time or materials - what we are calling about is the quality of service and not having a working oven. The icing on the cake was when I wanted further communication in writing. Only then, when I received an email, did I learn that the whole communication with the service provider was going through an outsource. Every patronizing apology was meaningless as the person apologizing didn't really work for the company I was having issue with. I wonder, why wouldn't a service company at least, at a minimum, own its own escalation department?

I'm not sure I have a conclusion at the end of this writ, except that maybe in the days of corporate accountability and sustainability, maybe companies shouldn't try lowball their responsibility by shedding knowledgeable employees.

Outsourcing Failure Timeline

I'm baffled that CIO magazine continues to tout outsourcing as a good idea. The article I just read offers how to save outsourcing costs after year one. It suggests IT leadership renegotiate their service contract if they see the costs exceed industry benchmarks. Nothing wastes time like attempting to renegotiate a contract shortly after it has been signed. It doesn't bother to peek a little into the future; five years.

Year 1	The client realizes the 10% reduction from elimination of workforce. Executive is pleased from initial results. IT leadership gets a bonus.
Year 2	Client project team for the outsource is likely gone. The client struggles with increased service times. Co-source attributes delays to "working out the kinks." Executive is consoled. Health checks and look backs may occur to identify gaps. Co-source starts to own more "domain" projects (without having domain knowledge.)
Year 3	Further attrition due to staff/consultants frustration. Loss of domain knowledge. Health checks likely have been sanitized for executive consumption. Executive mindshare is moving on to the next initiative. IT leadership is convinced more resources are required to fill the gaps.
Year 4	Outsource is entrenched. Client continues experience service delays due to disconnects in domain knowledge, communications, and/or culture clash. Executive may question IT leadership re service levels. IT leadership blames project group for not having appropriately risked and/or defined business processes. Outsource may start "optimization" initiatives at client's expense.
Year 5	Outsource cost is now greater than initial TCO reduction. Client has added 5% to its IT management resources to facilitate better communication and coordination with outsource. Business units start to do their own "shadow IT." Executive may start to realize that IT is a competitive differentiator; but no one wants to admit failure, and more money is invested because so much has already been invested.

I strongly recommend anyone considering outsourcing make 100% sure you've got your own house in order before you try. Document in detail all your work processes, do a risk analysis, and an impact analysis. Gather performance benchmarks and get a service baseline. Do it in the name of Continuous Improvement because the learnings will be valuable for improving efficiency. The best cost saving may be not outsourcing.

Outsourcing Often Fails

Outsourcing has been around for years. Over ten years ago, the think tanks were promoting off-shoring as an excellent way to reduce total cost of ownership (TCO). This co-evolved with a business strategy known as core competency, that promoted the farming out of low value, low skill, or redundant work if it wasn't related to your core business. Other doctrines emerged, like LEAN, that promotes complete elimination of low-value and redundant work. The think tanks re-oriented their strategies to use co-sourcing for several reasons. But in the end, IT analysts believe that half of all outsourcing fails.

These IT analysts also believe that the failures are not widely publicized. Of course failure is not documented as much as success because it makes people look bad. But why does outsourcing fail? TCO reduction is a myth. Sure you might be promised a 10% TCO cut off the start, but when you look at the details, some analysts believe you need to increase your management and logistical cost by 5%. (And what happens if your biggest disconnect is your middle management?)

And other analysts have written that if engagement is broken at either end, the outsourcing is a guaranteed fail. What does this mean? If the company doesn't have its IT house in order, that is, you don't have defined, mature processes, and/or the co-source is in the same boat, the overages are huge. And look at the risk. You might have just eliminated a large part of your business knowledge, and handed ownership and the ability to act over to someone else. Once it's been given away, it's almost impossible to get back. Not to mention some outsources count on the fact the initial employee/contractor count reduction (that yields the 10% TCO decrease) will often exceed the baseline by 20% in five years. By then the outsource is so entrenched, the company is truly at the outsource's mercy.

Core competency advocates say the best way to mitigate this is to invest in your people. IT folks should share the business knowledge with those domain experts. But this is a tough one. If you look at the credentials of many IT folks above the trenches, you'll find a melange of expertise that just might not understand the domain. So a lot of training and cross pollenation needs to be done. And this takes time.

The premise of Gartner's "IS Lite" is to outsource everything in IT, but retain five roles so your IT is a glue layer to your co-source(s):

1. leadership;
   
2. architecture development;
   
3. business enhancement (which involves business process analysis), project management and business relationship management;
   
4. technology advancement; and
   
5. vendor management.

This is great if everything fits nicely into a defined package. But what if it doesn't? Most organically grown IT processes don't have well defined roles and responsibilities. Though that is a best practice (as promoted by ITIL), you can see folks getting territorial
when things don't fit the model, and people saying "Work the Role" instead of "Work the Problem". So high maintenance systems, where you need lots of expertise just to keep the thing running, break the mould. Couple this with a bench and co-source strategy, and you have IT that works Projects at the expense of efficient operations. You need to know how your business works first, and characterize the needs of the systems and processes, before trying to paint it all with one brush. (There will always be exceptions, and always quirks specific to a companies business. Without those quirks, what differentiates you from your competitors?)

And that is where the real solution is: efficiency. If TCO reduction is a myth, then process optimization is hard fact. It truly increases the value per dollar spent. The unfortunate catch .22 is that to do process improvement, you need to consider IT a core competency. It doesn't mean you can't outsource; just be careful what you do. Know your enemy and know yourself...