Risk Assessment: Business Activity Maps (BAMs)

1
Risk Assessment Business Activity Maps (BAMs)

• COMM80 Risk Assessment of Systems Change
• Unit 9

2
Objectives of Session Coverage

• To understand the use of RAMESES Business
  Activity Maps.
• To understand the purpose of RAMESES Business
  Activity Maps.
• To develop an ability to read, modify andcreate
  such maps.

3
Business Activity Maps (BAMs)

• Focus on perspective of fit of system to
  business.
• Layers of information,
• current,
• proposed system
• Tutorial consideration of usage, modification of
  existing maps.

4
Requirements for the Technique

• Evolved in response to three main requirements
  for a Small-Medium Enterprise (SME) environment
• effective acquisition (gathering the data),
  without disrupting the business,
• accessible presentation of findings, and
• analysis of the business process.

5
Mapping the Business Activity

• Mapping happens at two levels
• managerial (macro)
• This follows the reporting structures for the
  area of the business being examined.
• operational (micro)
• This follows the individual tasks in a process.

6
Mapping the macro (top) level

• To map the business activities at the macro
  (managerial/top) level reporting-to and
  responsibility for structures are used.
• A starting point for these can be organisational
  hierarchy charts.

7
Example starting at the top level
8
Mapping the macro level

• Then the boundary for the project is
  identified.
• only the relevant reporting-structures are
  tracked any further.
• To track this information from the senior
  managers worksheets (forms) are used.

9
Example starting at the top level
10
Example top-level Worksheets

• The top worksheet (form) collects the data from
  each senior manager within the areas of concern
  to the project.

11
Example top-level Worksheets

• The second worksheet (form) typically records
• the managerial/supervisory structure below this
  particular senior manager
• the related responsibilities, and
• any software that is believed to be used within
  their area of influence.

12
Constructing the top-level Business Activity Map

• This mechanism of gathering the necessary data
  using worksheets (forms).
• avoids the need for specialist training of the
  staff.
• reveals the senior managers perceptions of what
  is happening within the organisation.

13
Macro Level Example
14
Mapping the micro level

• To map the activities within a business process
  at the micro level individual task inputs and
  outputs are tracked.

15
Task Trailing
16
Task Trailing
17
Purpose of the Micro (bottom/operation level)

• Gathers the detailed data required.
• Identifies Staff within the Business Processes.
• Documents the Task Trail for the Business
  Processes within the boundary, including
• Identification of IT usage.
• Audit Staff IT Profile .
• Audit Staff IT-Satisfaction.

18
Micro-level Worksheets
These sheets are for individual sets of
input-task-output.
19
Micro-level Work sheet (for details of IT-usage
etc.)
20
Construction of the Business Activity Map

• The operational-level task trail data is gathered
  from individuals at their work areas using a set
  of worksheets (forms).
• Again this approach avoids the need for
  specialist training of the staff.
• The data from each individual is used to
  construct the complete business process (detailed
  business activity map).

21
Micro Level Example
22
Presenting the Maps Hierarchies and Layers.

• Hierarchies are traditionally used in process
  modelling to drill down into the detail of a
  process.
• In this approach comparisons can be made between
  the activities perceived by management levels and
  the operationalised activies.
• Layers allow additional features to be added
  to/removed from a map. E.g
• IT support is superimposed onto the maps.
• Staff skill can also be added.

23
Presenting the MapsIT Usage

• Maps with IT usage added provide richer data
  sets.
• They also enable comparisons (managerial v.
  operational).

24
Systems Usage Layer Added
Colour is used to represent different software
solutions detected as in use.
25
Presenting the Maps Current and Planned IT
Usage.

• Maps with IT usage added provide richer data
  sets.
• They enable comparisons between the current usage
  of IT and the planned usage.

26
Proposed System Layer Added
27
How is this Risk Analysis?

• The sets of maps highlight
• Inconsistencies between the managerial views of
  the business activities and their actual
  operation.
• The usage of IT in the organisation (official and
  un-official) and the level of reliance on these
  solutions.
• The extent of change from the current state of IT
  usage to the proposed IT solution.
• The staff competency and confidence in using
  current IT solutions.
• In all cases the bigger the gap between the
  comparisons the greater the risk in a change
  management project.
• Without the maps decisions would have been based
  on inaccurate managerial knowledge/data.
• With the maps the risks accompanying the change
  are made explicit and can be dealt with.

28
Summary

• You have been introduced to RAMESES Business
  Activity Maps.
• The concept of mapping at the macro (managerial)
  and micro (operational) level has been
  discussed.
• The process used to gather the data and construct
  the maps has been defined.
• Some ways in which the maps can be use for
  analysis have been highlighted.
• The link with Risk Analysis has been made
  explicit.