Communicating Technology Risk To " The Board"

Last week I was invited to speak at a meeting of the Technology stream of Chartered Institute for Securities & Investment ( CISI ). Well actually it was to lead a table discussion rather than straight up speaking, but followed my membership of a Panel tackling the same topic towards the back end of last year.

The contention was  technology risk is increasingly important (and potentially damaging) to a company, yet "Boards" do not understandand the subject. The initial brief was to explore why with this follow-on session looking at what attendees could do to improve matters.

While other tables looked at demographics, strategy and regulation, my table looked at the practical human elements of how we communicate.

In chairing the table I needed to seed the discussion so I (pr)offered the "4 P's". They are

• Parlance(*)
• Persective
• Precipice
• Partnership?

* I actually used Presentation on the day, but Parlance is better.

I wanted the first to be "Jaragon", but without a silent "P" it didn't fit with the plan so Parlance works. Essentially it was the point that technology professionals talk in some much jargon and "tech" speak that most business people glaze over and stop listening. A colleague made the point that if, in making an IT point, one has to use the system name or a TLA (work it out! :) ) then you have failed to communicate clearly. It is much better to describe the purpose or function of the technology than give it some brand name. For example, "the data base holding our client information has an increasing number of inaccuracies and errors" is better than "the integrity of the XYZbase is intermittently compromised". OK I exaggereate for effect but you get the idea.

Check: This point received unanimous nods of recognition from the attendees.

The second point was that the Perspective of technology is often different to the business, and the Board is heavily weighted to the business. For the business the loss of a website of a client facing system for 5 minutes could be more concerning than the fact that a backup data centre is doubling its prices. Again exaggeration, but illustrative.

Check: This again was recognised by everyone

The third term Precipice was about the number of times that IT items are presented as if the business is standing on a precipice, ie unless it does what is asked disaster awaits. The sub-text being that they have no choice. I know if I try and communicate this way with my teenage daughter it is more than likely that she will dig her heels in and do nothing. Every time I end up in that position makes the next subject even harder to tackle. Now far be it from me to suggest that Boards could act like petulant teenagers, but I do think there are some useful parallels.

Check: The table members acknowledged the issue too.

The last item intentionally has a question mark. The way I presented it was that one often hears about there being a partnership between business and IT, but in my opinion this is not the case. While IT want a partnership, the business generally doesn't it wants a service. This leads to each party having different expecations.

Check: Again more nods.

Subsequent discussion supported these points and brought out a few more. Notably a number of members talked about the gap between IT and business and that greater integration is needed One observation was that it is rare for IT middle management to attend internal business meetings; meetings that would help their understanding of the business perspective and aid the building of relationships that will make communication easier.

It was also observed that the term "partner" has two parties built into it, not one integrated body. In a related observation some attendees reported how much better things were when IT was co-located with the business and not in a separate building or even continent.

A slightly tangential comment made at the table was a sceptical observation on the value of CPD of "continuing professional development" as a worthless box-ticking exercise.

The group acknowledged that the onus was on changing oneself rather than demanding changes in others so when we came to thoughts in what could be done to improve matters the following points were raised:-

• Endeavour to co-locate IT and the business where possible.
• Encourage IT leaders to attend and mingle with the business at different levels
• Develop some of the softer, relationship skills of those representing IT
• Have a non-IT person read any important paper/presentation BEFORE it is given out
• Can we include business knowledge and softer skills in the CPD framework for IT professionals, a double whammy if you like?

A common excuse of for makingchanges such as these is that they need permission/agreement from the business, but is that really true? Can we not all make sensible, if small, steps in the right direction.

Do you recognise the issue(s)? Do you have any other suggestions that we should share?