Wednesday 10 September 2014

Government ICT System Assurance Framework

I've just been browsing through the NZ Government ICT assurance site. The scope of the ICT assurance includes ACC, EQC, NZQA, NZTA, HNZC, NZTE, TEC and (of most interest to me)  from July 2015 will include the District Health Boards.

I'm reading the ICT Operations Assurance Framework (pdf) as that most affects me in a support role.

 Some Notes & Quotes:

 ---
 The Chief Executive remains accountable for the successful delivery of their ICT Operations and for ensuring risks are managed and
kept at an acceptable level.
Rob England would like this. Governors govern. The CIO might be responsible for getting stuff done - it's the CE that is accountable for ICT. The ISO standard for IT Governance is ISO38500 - it's actually titled "Governance of IT". Governance occurs outside of IT, and done to IT, it is not something that IT does. The CE can't abdicate accountability, putting everything on the CIO, any more than they can dodge unsafe working areas, blaming the facilities manager.
---

Seems very much focused on risk identification ... negative risks only (haven't seen anything regarding positive risks)
---
There is a diagram titled "Risk Universe" which is really a list of ITIL processes - this is noted as such - seems a little strange to list the processes as the embodiment of risk areas. I guess it's one way of compartmentalizing where risks occur. A problem remains with areas that are not covered by ITIL - which is quite considerable (Rob England again).

---
One of the key objectives of the ICT Assurance framework is to improve system-wide ICT risk management and assurance through lifting capability
 I like that - managing risk through improving capability.
---

A risk maturity model is due in 2014 sometime - will include a maturity assessment tool. That'll be interesting too.
 ---

General

I like the direction this is going. Identifying risk then managing that risk by improving capability is a good approach - sure beats improving capability in areas that don't matter to the organization. I'll try to keep an eye on this. Will ask our auditor about it when he's here next year.

Tuesday 9 September 2014

Coaching - essential for staff development, and its not about being a trainer.

Staff development is crucial. Sure we'd all like to hire the perfect staff, who were all able to do anything we needed, to perfection, every time. Instead we end up hiring humans, as imperfect as their manager.

Often development is seen as "training" - with staff being sent away somewhere to receive it, somehow. Sometimes this is almost a punishment (a last ditch attempt to get someone up to speed before getting shown the door), often its done as a reward or bonus - especially if the course is out of town.

Training is part of professional development, there's nothing wrong with it and it's essential for some things. Its a mistake to think that's the only way to develop staff though. Coaching can be very productive..


First let’s knock down one fear I've often heard - "I can't train my staff in all the things they need". Coaching isn't training. Say that again slowly - Coaching is not training. You don't have to be an expert in something to coach it. Think about elite athletes for a second. They all have excellent coaches - yet the athlete is more adept in their field than the coach. The coach guides - not by showing how excellent they themselves are - but by guiding the athelete  in areas which will lead to improvement.

I'm a big fan of Manager-Tools podcast. They have  an excellent coaching model (Start here: Part 1 & Part 2).

The thing I like about the model is the amount of discussion between the manager / coach and the direct - and that it is short. There are only 4 steps
1) Negotiate the goal
2) Negotiate the resources to be used
3) Negotiate the plan
4) Action the plan

I add a fifth - which is defined in the very first step of goal setting.
5) Validation/Verification

The goal should be something substantial with milestones set in the plan at roughly a fortnight intervals. Early milestones will be pretty firm - with more vauge ones in the distant. These get firmed up as the plan progresses. The goal should be measurable and time bound. Everyone needs to know what's defined as "achieving it" and the time-span. Without either of those - you don't have a goal, just a vague dream. Make it firm - an exact measurable achievement, by a point in time (there's a manager-tool cast for that too).

The first three steps are a discussion between manager & direct. Both need to have buy-in here. The staff member needs to participate, and be heard. Put yourself in their position - if you need to work on something that you're pressured into then you're not going to really put  as much effort in compared to something that you really do want to work on. As a manager use that. There's probably a dozen things that staff need to work on. Hook into the ones that they recognize. Its a negotiation, if they don't buy into the area that's your focus - don't worry - by discussing that option, and maybe putting it off, its been raised and worth coming back to in a later cycle.  If there's a serious performance issue going on  then the rules change.

The fourth step is performed by the direct. The manager teaches absolutely nothing - its all about guiding and holding the staff member to the plan they agreed on.

Then finally there's the validation. The end-point for the goal. Being able to show that you've achieved what you've set out to do by the time you set originally.

I've been doing this for quite a few years in various forms. From a management perspective it is remarkably effective and efficient. I have weekly 30min catch-up with each staff member. The coaching part normally takes about 5 minutes. Checking where they're up to, what was achieved last week (if not, why not), whats coming next. It really is incredibly short.