Enumerating the risks of reengineered processes

Reengineering, the redesign of work processes using information technology as an enabler, promises great gains in efficiency, organizational flexibility and responsiveness to customers. Rcengineering aims to eliminate excess work caused when processes involve multiple handoffs between functional departments and authorizations from multiple layers of management. Reengineering is being widely practiced, but with many reports of failures or undesired side effects. Reengineered processes typically require a much greater degree of information technology to support them. As computer based systems grow in size and cross organizational boundaries, they will became increasingly vulnerable to problems such as programming bugs, unauthorized users and inappropriate transactions. The increased complexity of these systems is likely to make these problems more difficult to detect. The realtime interaction of these processes across organizational units and with customers and suppliers increases the likelihood that a single problem will propagate into a large scale disaster that can threaten the organization's long term viability. A systematic examination of new risk vulnerabilities brought about by a proposed reengineered work process is required. -·18Reengineering and Information Technology In their 1993 bestseller, Reengineering the Corporation (Hammer and Champy, 1993, p. 32) Michael Hammer and James Champy defined reengineering as "the fundamental re-thinking and radical re-design of business processes. " Instead of applying information technology to existing processes and "paving the cow paths," (Hammer, 1990, p.l 04) reengineering designs new work processes using information technology as an enabler. Most current work processes pre-date the computer and are, therefore, paper based. The result of adhering to these outmoded processes, reengineering advocates claim, is that "about 80% of the administrative processes add no value to the business" (DeBoever, 1994, p. 3). The goal ofreengineering is to create streamlined, integrated work processes that eliminate the inefficiencies caused by handoffs between functional departments, multiple organizational layers to authorize each transaction, and excessive paperwork. Reengineered processes typically place a greater reliance on information technology. Hammer and Champy describe information technology as the essential enabler of reengineered processes (Hammer and Champy, 1993). One recent survey indicated that the information technology portion of a reengineering investment can reach about 80% (ScottMorgan, 1995). Hammer and Stanton state that, "Systems to support reengineered processes are typically five times the size and complexity of traditional information systems" (Hammer and Stanton, 1995, p. 248). Th ese systems can span organizational borders and can interact in real-time with suppliers and customers. The result of many reengineering efforts, therefore, are organizations that have moved toward "mission critical" -the failure of the system can impact the organization's survival -dependence on large complex information systems. A careful examination of the sources of risk exposure brought about by reliance on these systems is necessary to avoid creating new work processes based upon expensive, inappropriate and possibly dangerous systems. Challenges in Developing Complex Code. Statistics from Software Productivity Research indicate that as the size and complexity of a computing project grows, the likelihood of scheduling overruns and project cancellations increase significantly (Gibbs, 1994, p. 88). More seriously, the potential for software bugs also increases. "When a systems becomes so complex that no one manager can understand the entirety, traditional development processes break down" (Gibbs, 1994, p. 89). Development and testing techniques have been developed to help ensure that software is reliable in mission critical, and safety critical (failure would endanger human life) systems (Wiener, 1993, p. 113). These techniques, however, add significantly to the cost of software development and have not yet evolved to the point where they can be used with consistent success (see (Collins, Miller, Spielman, Wherry, 1994), (Norman, 1990), (Pamas, van Schouwen, Kwan, 1990)). For example, the new air-traffic control system commissioned by the FAA, and costing $700 to $900 per line of code due to extensive testing, is currently five years late, $1 billion over budget, and still "bug-infested" (Gibbs, p. 89). In most business applications, program reliability is considered ofless importance than in safety-critical applications like the air traffic control system. Software development is more likely to be subject to cost and deadline considerations (Costello, 1984). "The vast majority of computer code is still handcrafted from raw programming languages by artisans using techniques they neither measure nor are able to repeat consistently" (Gibbs, 1994, p. 87). Business software purchased in packages typically comes with disclaimers, "most producers of software explicitly deny accountability for harmful impacts -19of their products, even when they malfunction" (Nissenbaum, 1994, p. 79). As information technology is used to support more critical business functions, this approach becomes more and more inadequate, "Developing complex systems that must satisfy stringent requirements for reliability, security, human safety or other forms of application correctness, such as the ability to manage money, requires an extremely principled development well beyond what is traditionally experienced in general programming practice" (Neumann, 1995, p. 232). Critics call for making software developers strictly liable for defective software (as manufacturers of consumer goods are liable for their product) and for instituting licensing and performance testing for professional programmers (Neumann, 1991), (Nissenbaum, 1995). Modules of code in a computer program are tightly coupled to one another. They interact without human intervention. In tum, programs running in real-time are tightly coupled to the real world processes they are supporting. Incidents created by software bugs, unauthorized users and inappropriate transactions will propagate more quickly in processes performed by software than in a manual process and will propagate in ways that are more difficult to trace. Problems caused by software bugs in larger, real-time systems are more likely to propagate into disasters. Challenges in Building a Complex Infrastructure. Hardware needed to run the software and to provide the platform and infrastructure of the system is also likely to become more complex and expensive and may rely upon newly developed technologies with less of a proven track record. Reengineered processes crossing departmental lines and organizational boundaries are more likely to require extensive and complex telecommunication networks to support them. Telecommunication networks are by nature tightly coupled -incidents such as operator errors and hacker break-ins can have far reaching impacts before they are discovered. When telecommunication systems cross organizational boundaries, use common carriers, or access the Internet, they become open systems rather than closed ones. Opening a system to the outside environment gives rise to new sources of system vulnerabilities (Perrow, 1984), (Sagan, 1993). In the case of communications technology, hackers or competing firms may intiltrate an organization's information systems to steal or destroy information (Schwartau, 1994 ), (Lewis, 1995). Reenginccring favors distributed rather than centralized decision making to flatten organizational structures, to develop managerial talent and to take advantage of on-site expertise (Champy, 1995) (Longo, 1995). The information architecture to support this distributed decision making is likely to be distributed as well, involving client-server architecture rather than centralized mainframe processing. Although generally more economical than centralized systems, distributed computing systems tend to involve a greater range of hardware, software, and telecommunication devices and a greater range of configurations that these devices can take. "A distributed system is one in which the failure of a computer you didn't even know existed can render your own computer unusable" (Neumann, 1992b, p. 162). Management and control of these decentralized systems becomes a greater challenge, as does the problem of system security (Neumann, 1990, p. 154). "Distributed systems arc particularly vulnerable to users erroneously presumed to be trustworthy or infallible" (Neumann, 1995, p. 211 ). Challenges from Computer-Supported Work Employees performing reenginccrcd processes are often faced with more complex tasks and shorter cycle times to complete them. A common recommendation of reengineering advocates is to practice the "combination, not division, of labor" (Davenport and Nohria, 1994, p. II), by the creation of case manager positions. In these positions, "Individuals or small teams perform a series of tasks, such as the fulfillment of an order, from beginning to end, often with the help of information systems that reach through the organization" (Davenport and Nohria, 1994, p. II). Employees controlling these complex tasks must also assume greater accountability for their work (Caron, 1 arvenpaa, and Stoddard, 1994) (Longo, 1995) and often attain greater degrees of computer literacy in order to perform their new jobs. Organizations contemplating reengineering must be conce~ed whether, "current staff possess ' the expertise and credenti~ls to perform in an increasing technical environment" (Sears and Trotter, 1995, p. 16). Reengineering advocates admit that case manager jobs are far more stressful and demanding than their predecessors. The high degree of computer mediation involved in these tasks may diminish the quality of the work for employees, making the