Sarbanes Oxley : Email : Process Management
What You Don’t Know CAN Hurt You
April 23, 2009 12:00 PM
Tracking the undefined, unstructured, ad-hoc human processes in your organization
Undefined, unstructured ad-hoc processes – sounds a bit like an oxymoron. How can a “process” be unstructured? Well it seems like any time you get humans into the loop, especially smart humans, unstructured processes are the norm. Just think about how much of your organizations work (and process) is actually handled by email. Just take a look at your own email inbox. For most of us it contains some spam, personal items, one-off correspondence – and a number of ongoing business processes that you actively participate in, or need to know about.
Chief Technology Officer
The email chain of these “long running” business processes are scattered throughout your inbox (and the inboxes of other participants) making them easy to overlook, hard to manage and almost impossible to audit. Some may have critical actions that you need to take, while others are on hold while some aspect is being handled by others. Some of the processes you own, while in others you are just a participant. Depending on whom you ask, experts claim that between 60% and 80% of all processes in an organization are these unstructured, ad-hoc processes. So no matter how hard you try, until you gain visibility into these unstructured processes – you really can’t manage most of your business processes. If these processes should be tracked for compliance reasons, or are part of some larger compliance process, then this lack of visibility can cause real problems.
Since these unstructured, ad-hoc processes are mainly about people interacting, human processes is one of the terms used to describe them (people also use unstructured processes, ad-hoc processes, office work and knowledge work). Most of the work involved in executing these human processes is in managing the inter-personal communication, coordination and data collection in order to complete the process. Knowledge workers everywhere execute these human processes using standard productivity tools (e.g. Microsoft Office) and email (e.g. Microsoft Outlook) – excellent tools in themselves, but sorely lacking in the basics needed for actually managing these processes - causing missed deadlines, incomplete follow-up, lost opportunities and general feelings of email overload.
Even with all its drawbacks, email is still the preferred tool for executing these processes, since it is the only readily available tool under user control that supports the basic interactive structure of human processes - the back and forth of human communication and coordination. This is where Human Process Management Systems (HPMS) come into play as systems for managing this interplay between people, giving just enough structure and management so the process can be managed, but not so much as to strangle it. HPMS are complementary to Business Process Management and Workflow Management systems that focus on predefined flows and system tasks, and do not really support the communication, coordination and negotiation components that are so critical in human processes.
Human Process Management focuses on processes that are:
• Unstructured – There may be a standard framework for the process and how to achieve the intended result, but each case is handled separately and requires human understanding (for both decisions and flow) as part of the process. There isn’t enough standardization between instances of the process that allows for a formal, complete and rigorous description of the process end-to-end.
• Dynamic – The flow of the process changes on a case by case basis, based on available information and human decisions. A flow can also change while the process is being executed based on new information, or a changing environment.
• Interdependent – The activities of the humans in the process are interdependent and cannot be done completely in parallel.
• Extended – Require more than a single interaction between humans to be completed.
• Borderless - Human processes can involve anyone that is relevant – be it within or outside the group/team/project or even organizational borders.
Tools for Managing Human Processes
There are two main types of HPMS. One type is client-server tools, based on email and documents, which allow users to remain in their familiar office environment and leverage existing investments in productivity and document management tools. These HPM systems integrate with email, but also include a server which provides a system-of-record that contains all of the information on how the process was executed and links to the documents involved.
Another type of HPMS are wiki based systems, which enable delivery as a software service and browser based universal access, but require a larger investment in user and process adaptation.
HPMS’ support a wide variety of different types of human process use cases (e.g. case management, audits). As there are so many different human processes, and since human process workflow is inherently unstructured and ad-hoc, the fundamental requirements from any HPMS are:
• Allow the definition of a flexible process framework that can leverage known best practices and existing procedures without IT support.
• Users must be able to leverage their existing knowledge and skills used to execute existing human processes, and should require a minimum of training. The process should be at least minimally accessible to anyone involved, even if they do not use an HPMS.
• Keep a complete record of the user and information context associated with the execution of the human processes being managed – in essence the entire relevant context associated with process execution, becoming the “system of record” for the human processes in the organization.
• Provide both personal reporting mechanisms (where do I stand with respect to the processes I participate in) and organizational overview mechanisms (where does my department stand with respect to its processes – both on-going and historically)
Email and Document based Human Processes Management
Enhancing email for handling processes allows users to remain in their familiar email environment, but providing some additional tools to make the environment more compatible with human processes and action management, rather than just general correspondence. I’ll call these action oriented, process emails ActionMail. By using an ActionMail email plug-in, a user can decide to use ActionMail to kick-off a process, rather than a regular email. ActionMail resides side-by-side with regular email, allowing the user the ability to decide which type of email to use. Just like regular email, ActionMail allows the end-to-end flow to be defined incrementally, by the users themselves, rather than requiring a rigorous definition of the complete process flow from the start. Also, like email, users are free to add participants, add attachments, add content or kick off sub-processes as needed. The difference is that as tasks flow back and forth as part of the process, each step executed is summarized as part of the audit trail of the ActionMail itself, and the status of an ActionMail reflects the current status of the process. The flurry of emails that would usually be associated with a process becomes a single ActionMail entry in each participant’s mailbox that is continually updated with the current status of the process.
Documents are also an important part of human processes. For example, meetings often end in an agreed upon and documented set of decisions and action items. In many cases these actions items are like a guideline - a way to kick-off a set of human processes with the goal of gathering more information, or implementing the meeting’s decisions. Process guidelines and best practices are also often described in standard documents that are shared in the organization. These guidelines often grow stale quickly, since there is no incentive to keep them up to date.
Rather than let these action items just wither away from lack of attention, an HPMS gives users the ability to link an ActionMail to each action item described in any document. Each ActionMail is linked and related to a specific section of the document. This allows action oriented documents to become living documents, monitoring and tracking the implementation of the action items described in the document. Examples of appropriate documents are guidelines, review documents, audit findings and recommendations, work plans, 1:1 sessions and of course meeting minutes.
The third component of the HPMS is a system-of-record repository. Once executed through an HPMS the organization has a complete system of record containing the human-to-human interactions and documents involved in every instance of process execution. This enables visibility into the status of any specific executing process and a way to analyze historical process execution.
This repository is the basis of the HPMS’ personal and organizational reporting mechanisms
Benefits of Using of a Human Processes Management System
From a compliance standpoint the greatest benefit of adopting an HPMS is that it becomes the system of record for the organization’s human processes, ensuring compliance with regulations and best practices. This system of record contains an audit trail of how human processes are executed in the organization, including the hand-offs, context and exceptions.
But that is not the only reason for using an HPMS, another is operational excellence and cost savings. For human processes, an HPMS lowers the elapsed start-to-finish time per process by up to 80 percent and drastically lowers the number of uncompleted (or lost) processes. Also, when processes are marked as complete, they actually are, and there is no need to revisit them later.
For example, an HPMS can be used to handle the tracking of internal control processes as required by SOX Section 404. By using an HPMS, the owner of the internal control process (or the SOX project office) can know at anytime where the process stands, along with a complete audit trail of the process itself. Essentially, any type of audit and compliance processes are good examples of processes that benefit from an HPMS. An HPMS can manage and track the activities and actions of an audit or compliance process through all of its stages, providing benefits to both the auditor and auditee by establishing the completeness and correctness of the audit process.
Another use for an HPMS is iterative, bottom-up discovery and analysis of an organization’s human processes and how they are executed. By using an HPMS for human process management, not only do users gain control over their processes, they are providing the organization with important information on the actual flow and use of processes. Over time, certain processes may be found to be structured enough to be optimized and implemented via a structured process management system (e.g. Business Process Management System).
A Human Process Management System is a way to start managing the undefined, ad-hoc human processes in day-to-day business while maintaining compliance with Sarbanes-Oxley and other regulations. Email based HPM systems allow you to start quickly, enabling users to stay in their familiar email environment while giving just enough structure and management so the process can be managed, but not so much as to strangle it
Chief Technology Officer
Jacob has a proven track record in discovering and developing innovative solutions to real-world customer problems, and then developing them into products. Jacob has fostered innovation in many different environments, including both research and business settings. Until recently Jacob served as CTO of Itemfield, the leader in next-generation data transformation, where Jacob oversaw Itemfield's innovation, vision and strategy until its acquisition by Informatica.
Previously, Jacob was CTO and Business Development Executive for IBM's Global Technology Unit. Prior to that role, he was a department general manager at the IBM Thomas J. Watson Research Lab, managing a group of 130 cross-disciplinary researchers. Jacob received his Doctorate of Science in computer science from the Technion University in Israel. Jacob has been published in many technical journals and has spoken at conferences worldwide. In 1997 he received the Alexander C. Williams Ergonomics and Human Factors Award from the Human Factors Society.