free counters

Friday, July 30, 2010

SecurityWeek.Com - Barnaby Jack Hacks ATM

*If you received this via email, click on the link at "Posted by ECGMA to ECBeez Blog" to view the blogpost"*

ATMs vulnerable to hacking attacks

, On Wednesday July 28, 2010, 10:35 pm EDT

LAS VEGAS (AP) -- A hacker has discovered a way to force ATMs to disgorge their cash by hijacking the computers inside them.

The attacks demonstrated Wednesday targeted standalone ATMs. But they could potentially be used against the ATMs operated by mainstream banks.

Criminals have long known that ATMs aren't tamperproof.

There are many types of attacks in use today, ranging from sophisticated to foolhardy: installing fake card readers to steal card numbers, hiding tiny surveillance cameras to capture PIN codes, covering the dispensing slot to intercept money and even hauling the ATMs away with trucks in hopes of cracking them open later.

Computer hacker Barnaby Jack spent two years tinkering in his Silicon Valley apartment with ATMs he bought online. These were standalone machines, the type seen in front of convenience stores, rather than the ones in bank branches.

His goal was to find ways to take control of ATMs by exploiting weaknesses in the computers that run the machines.

He showed off his results here at the Black Hat conference, an annual gathering devoted to exposing the latest computer-security vulnerabilities.

His attacks have wide implications because they affect multiple types of ATMs and exploit weaknesses in software and security measures that are used throughout the industry.

His talk was one of the conference's most widely anticipated, as it had been pulled a year ago over concerns that fixes for the ATMs wouldn't be in place in time. He used the extra year to craft more dangerous attacks.

Jack, who works as director of security research for Seattle-based IOActive Inc., showed in a theatrical demonstration two ways he can get ATMs to spit out money:

-- Jack found that the physical keys that came with his machines were the same for all ATMs of that type made by that manufacturer. He figured this out by ordering three ATMs from different manufacturers for a few thousand dollars each. Then he compared the keys he got to pictures of other keys, found on the Internet.
He used his key to unlock a compartment in the ATM that had standard USB slots. He then inserted a program he had written into one of them, commanding the ATM to dump its vaults.

-- Jack also hacked into ATMs by exploiting weaknesses in the way ATM makers communicate with the machines over the Internet. Jack said the problem is that outsiders are permitted to bypass the need for a password. He didn't go into much more detail because he said the goal of his talk "isn't to teach everybody how to hack ATMs. It's to raise the issue and have ATM manufacturers be proactive about implementing fixes."
The remote style of attack is more dangerous because an attacker doesn't need to open up the ATMs.

It allows an attacker to gain full control of the ATMs. Besides ordering it to spit out money, attackers can silently harvest account data from anyone who uses the machines. It also affects more than just the standalone ATMs vulnerable to the physical attack; the method could potentially be used against the kinds of ATMs used by mainstream banks.

Jack said he didn't think he'd be able to break the ATMs when he first started probing them.
"My reaction was, 'this is the game-over vulnerability right here,'" he said of the remote hack. "Every ATM I've looked at, I've been able to find a flaw in. It's a scary thing."

Kurt Baumgartner, a senior security researcher with antivirus software maker Kaspersky Lab, called the demonstration a "thrill" to watch and said it is important to improving the security of machines that can each hold tens of thousands of dollars in cash. However, he said he doesn't think it will result in widespread attacks because banks don't use the standalone systems and Jack didn't release his attack code.

Jack wouldn't identify the ATM makers. He put stickers over the ATM makers' names on the two machines used in his demonstration. But the audience, which burst into applause when he made the machines spit out money, could see from the screen prompts on the ATM that one of the machines was made by Tranax Technologies Inc., based in Hayward, Calif. Tranax did not immediately respond to e-mail messages from The Associated Press.

Triton Systems, of Long Beach, Miss., confirmed that one of its ATMs was used in the demonstration. It said Jack alerted the company to the problems and that Triton now has a software update in place that prevents unauthorized software from running on its ATMs.

Bob Douglas, Triton's vice president of engineering, said customers can buy ATMs with unique keys but generally don't, preferring to have a master key for cost and convenience.

"Imagine if you have an estate of several thousand ATMs and you want to access 20 or so of them in one day," he wrote in an e-mail to the AP. "It would be a logistical nightmare to have all the right keys at just the right place at just the right time."

Other ATM manufacturers contacted by the AP also did not immediately respond to messages.
Jack said the manufacturers whose machines he studied are deploying software fixes for both vulnerabilities, but added that the prevalence of remote-management software broadly opens up ATMs to hacker attacks.

Friday, July 23, 2010

John Kay - Obliquity - Parts 1 & 2

John Kay is one of Britain's leading economists. His new book 'Obliquity' shows how many goals are more likely to be achieved through indirect, rather than direct means. Kay applies his concept to everything from international business to town planning to show why the most profitable companies are not always the most profit-oriented; why the richest men and women are not the most materialistic; and why the happiest people are not necessarily those who focus on happiness.

John Kay - Obliquity: Why our goals are best achieved indirectly

Book Review:

Watch the near-1-hour clip below.

Leading economist John Kay applies his provocative universal theory to a variety of complex systems, including business and communities.

Review: Obliquity, By John Kay

Profile £10.99 210pp. £9.89 from the Independent Bookshop : 08430 600 030

Obliquity, By John Kay

Why an off-target life will hit the spot

Reviewed by Diane Coyle

Friday, 30 April 2010

This book by the distinguished economist and writer John Kay is an extended essay about an idea which is intuitively true: namely, that certain targets are achieved only as a side-effect of aiming for something else. For instance, happiness is attained when people are absorbed by a meaningful activity – psychologists call this state "flow". Trying to be happy is a recipe for misery.

High profits are the fruits of a passion for engineering or writing software, say, while it's usually commercial suicide to make profits the sole purpose of business. On a holiday many years ago I met a chocolate engineer who claimed to have designed the walnut whip, and held forth at length about the properties of melted chocolate. He seemed a very happy man but I doubt his job is so satisfying now our confectionery companies have been taken over by executives who think only of maximising shareholder value.

The first half of the book gives several other examples of the principle of "obliquity", or aiming off the true target. The wealthiest people don't obsess about making money. Forests are less vulnerable to destruction by fire when some fires are allowed to burn. Less intuitively, economies are more successful when markets operate rather than when central planners run them.

Why should obliquity operate so widely? "Our objectives are often necessarily loosely described, and frequently have elements that are not just incompatible but incommensurable. The consequences of our actions depend on the responses of other people... We deal with complex systems whose structure we can understand only imperfectly," Kay explains. Add to this the unknown unknowns so widespread in life and the ubiquity of uncertainty, and the failure of the direct approach to many problems is not surprising.

Oblique approaches – or lateral thinking – are much harder to devise than the direct alternatives. The later part offers some examples and advice. Kay is a firm opponent of targets and precise rules. All affect behaviour in ways that make the target meaningless. He points out that the Basel Accords regulating banking run to 400 pages of detailed rules. The banks obeyed the rules (on the whole) but worked around them so the upshot was a riskier rather than a safer industry. What's needed is a set of high-level objectives internalised by all concerned, combined with some intermediate goals adjusted from time to time, and everyday activities consistent with these because nobody can think about strategic objectives all the time.

This seems utterly sensible advice – certainly to anyone who has noted the counter-productive effects of the Labour government's mania for targets in public services. There's one example of these in the book – an eight-minute response target for ambulances which led to the vast majority of emergency calls getting just that, and almost none recorded as longer. The target changed the way the dispatchers allocated vehicles, presumably trumping the prioritisation of patient need. We can all think of many other examples of counter-productive targets.

The most novel and interesting part of the book concerns the implications of obliquity for how we assess decision-making: an important point when voters are judging the record of the current government and the promises of those who want to take its place. All too often we make what Kay terms "the teleological fallacy". That is, we assume that good or bad outcomes are the result of good or bad policies or decisions. Usually luck plays a greater part. Enron was believed to be run by geniuses when doing well and by crooks when it failed, but the general movement of the stockmarket had more impact on its results. Successful investors almost always have Lady Luck rather than their skills to thank.

One alarming consequence of this fallacy is that people who claim to have direct answers are much more likely to be acclaimed for their wisdom than the oblique thinkers likely to get better results. Kay concludes that decision makers can choose between being effective and being popular. Voters reward those who are least likely to be good problem solvers: a sobering thought for the election campaign, from one of our cleverest thinkers.

Diane Coyle's latest book is 'The Soulful Science' (Princeton)


'Read this book for pleasure, and indirectly - obliquely - you will gain invaluable insights into how successful decisions are made.'
    — Mervyn King, Governor of the Bank of England

'A very timely and clever book'
    — Anthony Seldon

'Kay is persuasive, rigorous, creative and wise. Brilliant.'
    — Tim Harford, author of "The Undercover Economist" and "The Logic of Life"

'Kay is an admirable debunker of myths and false beliefs - he can see substantial things others don't. Read this book.'
    — Nassim N Taleb, author of "The Black Swan"

'Obliquity is a characteristic John Kay production. It is a pleasure to read'
    — Howard Davies, Financial Times

'One of our cleverest thinkers.'
    — Diana Coyle, Independent

Wednesday, July 21, 2010

Business & Technology Crack - Does Business Drives Technology or Technology Drives Business?

Posted: Feb 11, 2009

Information Technology and the move to a computerized infrastructure model are bringing great changes to many industries. Often it is the CIO of the company who escort this fundamental shift in the business revenue stream. Leading others through modernization, revolutionize and transformation means you must be able to make changes yourself.

Forget about asking whether technology drives business or business drives technology. Stop perturbing about whether or not technology is strategic. Silence all the confusions about how advance this technology is to that technology. In technology, there are numerous questions that if you have to ask, you probably already know and don't like the answer. A more satisfying line of inquiry is how much of your technological horsepower is actually being used to turn the wheels of innovation.

Some people says that Technology drives business modernization, novelty, success & Innovations that opens up new doors of opportunities, improves the company's performance on the whole, sharpens the company's market intelligence, and makes new things possible for the clients. Another school of thought is that the Business Drives Technology, as such integration is about assisting business to facilitate their profitability by utilizing technology and other resources available to the enterprise. But realistically speaking, the driving force comes from the CEO and CIO of the company, who both endeavor to leverage technology to its fullest potential.

In a society that has become entirely dependent on computers and immediate communications, technology is becoming the heartbeat in the process of office design as decisions on layout and services. Some aspects of technology, like the computer animation & communication, are highly visible demonstration devices. But more of it is in the largely unseen infrastructure, with the emphasis on sophisticated wiring and smart communication devices to provide for an ever greater flow, and on communications and power facilities to keep operations running through almost any anticipated calamity.

In the modernization of the today's businesses, Common business drivers include; Mergers and Acquisitions, Internal Reorganizations, Application and System Consolidation, Inconsistent/Duplicated/Fragmented Data, New Business Strategies, Compliance with Government Regulations, Streamlining Business Processes. To achieve the success in the accommodation of these business drivers, the sturdy and smart input would be required from both the parties i.e. the business as well as the technology.

In a company, you could cover every surface in your office with how to manage change. But one aspect of change management that often dodges IT Managers is how to better influence corporate colleagues. If information technology drives business decisions, the IT executives must communicate and be persuasive with other department heads on key project management issues.

Strategic planning for Information Technology is one component of an overall company vision for success. This psychoanalysis facilitates IT professionals to successfully define short and long-term goals and ascertain the resources necessary to apprehend such goals. To ensure success, the strategic plan should be developed in a thorough but rapid manner, consist of a brief, succinct compilation of analyzed data, and provide opportunities by which additional planning and analysis can occur.

Several important benefits occur as the result of a successful strategic IT plan. First, employees are provided with an understanding of how their role fits in with the overall company structure. Also, this planning allows managers to realize additional opportunities for growth and success. Finally, important relationships between technology investment and positive outcomes, such as increased market share, are revealed.

It's now become the industry dilemma that IT people need to know more about business. They need to understand the disciplines and the lingo of business process management, business performance management, customer relationship management, supply chain management, financial management, human resources management, operations management, etc. Lacking that knowledge, communication with business people and understanding of business requirements will forever be troubled.

On the other hand the Business people should also drive their efforts to know more about information technology. As with all communication and relationship issues, this is not a prejudiced problem. Just as IT people need to become more business-oriented, business people need to be more IT-oriented. They need to understand the roles and relationships among the many different kinds of technology upon which their information systems depend, and they need to understand the dependencies among those technologies. Business people need to have a working knowledge of the technology stack as it affects their capability to get information, perform business analysis, and make informed business decisions.

Beyond the relatively straight-forward needs of business becoming IT-oriented and technologists becoming business-oriented, there lies a new challenge. We must develop common understanding and shared perspective of value, an issue that is both a business concern and a technology consideration. When business and IT have different meaning and outlook for value, conflicts are certain to arise.

Business and IT organizations often have two evidently different perspectives of value. IT expert generally take a data-to-value approach. Where Data produces information, information enhances knowledge, knowledge drives action, action produces outcomes, and favorable outcomes deliver value. Business management typically uses a goals-to-value system. Business drivers and goals determine strategies, strategies drive tactics, which in turn produce results, and positive results produce value.

Effective business/IT relationships are ultimately a question of alignment. New IT skills, new business skills, and new perspectives that sets the stage for business/IT alignment. But it doesn't assure alignment. To achieve genuine association there are several things that must be done; some by IT, some by the business, and some collectively.

Conflicts between business and IT organizations have existed from the very beginning of automated Information Systems. We have accelerated in so many ways both in business and in technology. However, the problem still pestilences most of the businesses. The Business/IT crack must go away. The cost is high; the value is null; and the barriers that it crafts grow bigger each moment. The problem can be fixed, and the time to fix it is now!

(ArticlesBase SC #765394)

What Drives Your Business?

Process vs. Technology:
What Drives Your Business?

Business process reengineering. Three of the most terrifying words in the modern manager's vocabulary.

Business process improvement. Not quite as scary, but still enough to cause chills to dance up and down the spines of beleaguered workers everywhere.

Any mention of either BPR or BPI in many organizations will start rumors flying and cause the anxiety level to rise. The only people who don't get nervous are usually the ones who aren't familiar with the terms.

Add in office automation, and you can inspire full-scale panic.

Why do BPR and BPI have such frightening reputations in certain circles? We're only trying to make things better. We need better processes to gain greater control over our environment. We need new technology to stay competitive. We need to bring in new knowledge and techniques.

Resistance is futile. You will be assimilated.

Oops, I got a little carried away there. Yes, I am a fan of BPR and BPI in principle, as they can be of great benefit, but I'm also wary. If we're careless in our implementation, we can do great harm.

Think of it this way: Let's say we all cut wood for a living. We've used axes and hand saws all our lives. Then someone hands us a chainsaw, telling us that this new technology will let us cut four times as much wood in half the time.

Are we more likely to cut more wood, or severely injure ourselves? Some people will read the instructions, take the proper precautions and training and realize some kind of productivity gain.

Others may fear this new toy, as it involves leaving familiar, comfortable ways of doing business. They'll just let it sit in the corner and continue working as they always have. At least until the early successful implementers take all their business because they can fill orders faster.

And then, there will be those like Zippy's granddad, who finally admitted last summer at age 71 that he just wasn't up to cutting 16 cords of wood by hand. Zippy bought him a new chainsaw, which the elderly gent brought back the next day, mangled beyond belief. Granddad wasn't afraid to try a new tool, but he just kept chopping and hacking at the wood the only way he knew. When Zippy got him a second one, gassed it up and pulled the cord, poor Granddad almost had a heart attack.

As with any new technology, what you get out of it depends on how you handle it.

What is BPR?
According to Dr. Michael Hammer, the man who claims credit for coining the term, business process reengineering is:

"The fundamental rethinking and radical redesign of business processes to achieve dramatic improvements in critical measures of performance (cost, quality, capital, service and speed)."

There are three key words in the definition:

Process: A collection of activities that create value. Process is not structure, people and tasks. Processes involve either transformation or transaction.

Transformational processes take inputs and turn them into outputs, hopefully increasing the value of whatever you're working with. Assembling a car is a transformational process. You take your inputs, unassembled parts, and transform them into a single vehicle. An air strike is also a transformational process. Your input is a munition of some type, which transforms something that was bothering you into something that isn't bothering you any more.

Transactional processes exchange inputs for outputs. With cars, this involves the exchange of money for parts on one hand and the exchange of a complete car for money on the other. If your transformation added value, you will take in more money than you spent to acquire the parts and build the car. With the air strike, everyone who contributed to the operation is compensated in some way, usually through a combination of personal satisfaction for a job well done, payment of some kind and maybe even personal survival. Not all transactions involve money.

Radical: BPR is a rip it out by the roots process. You don't do as-is modeling with BPR, because you really don't care what your current process is. Start from scratch. If your business didn't exist today, how would you create it?

Dramatic: We want a quantum leap, not incremental improvement. BPR involves considerable storm and stress. You may find that you have to redesign the entire business from the ground up, fire everyone and then see who's still qualified when you rehire. With that kind of organizational stress, a 10 percent return on investment isn't worth it.

Fire everyone? "But wait!" some say. "I have all these people with all these skills in all these offices doing all these jobs on all this equipment. I can't just abandon all that!"

In BPR, nothing is sacred. According to Hammer, one of the hallmarks of BPR is a focus on business processes, not artifacts (including people or equipment) or organizational boundaries. With BPR, we're looking for dramatic results: 80 percent reductions in costs or a tenfold increase in productivity, for example, and preferably both at once. If you want those types of improvements, Hammer maintains that you must be willing to identify and recast fundamental assumptions and associated beliefs.

In short, if you really want to reengineer your processes, don't hesitate to shoot some sacred cows. This is why most people really don't do BPR. It's really one of those jump or die processes, like the guy who leapt from a North Sea oil rig during a fire about 10 years ago. When interviewed afterward, he was asked if he knew how cold the water was and that he'd only live 10 minutes, at most, in the bone-chilling cold of the North Sea.

"Yes," he replied. "But if I'd stayed on the rig, I'd have been dead for sure."

And that sums up for me why we might decide to try BPR: if we don't, our organizations will literally die. Whether we see the fatal blow coming in 10 minutes or 10 years, the organizational stress involved in true BPR should make it a means of last resort for most of us. It is a high risk endeavor that can generate a correspondingly high return. However, if we don't do it correctly, we can wipe ourselves out that much faster.

Hammer estimates that over 70 percent of all projects undertaken as BPRs have failed. There are a few common reasons for the majority of the failures:

Lack of support from top management is probably the number one killer of BPR. Start the project, hand it off to a team, and go back to executive concerns. Certain death for anything remotely controversial. In some cases, management seems to be following an approach to BPR lampooned by Scott Adams in the popular Dilbert comic strip. They put in charge of the project the people most likely to be displaced if the project succeeds. This guarantees no substantive change, despite whatever lip service anyone pays.

A method more likely to succeed is to make the project team responsible for operating the new process once they've finished. People who have to live with the results of their own work are more likely to turn out a good product. Change all the reporting officials so the project manager becomes the new division chief. Back them from the executive level so they can extract and collect, forcibly if necessary, all the threads of their particular process from the various nooks and crannies in the organization. Yes, it may make some people mad. But what would be worse, a few bruised egos or the death of your organization?

A second way to commit suicide by BPR is to pick the wrong process. Some people loathe tinkering with anything critical, so they squander precious resources on a peripheral project that doesn't threaten anyone powerful or have any significant impact on the organizational bottom line. This simply drains productivity from more important areas and hastens whatever collapse was already coming.

A third problem is uninformed optimism. Many people, at least over the past 10 years of rapid growth in computing, have clung to the childlike belief that if we buy enough technology we can solve any problem.

Unfortunately, computers and modeling techniques only act as extensions of our own, often imperfect understanding. If we can't accurately diagram a process using a pencil and paper, a computer modeling program won't help. In fact, computer modeling will allow us to make even more mistakes as our models can become infinitely more intricate at the push of a button.

Finally, don't let the techies hijack the BPR. BPR is a business operation first, a technical implementation second. Just because a project involves an infusion of computer technology doesn't mean the programmers should be making business decisions. If I'm trying to reengineer my business, the last thing I want to be told by the network administrator is that he understands what I need better than I do.

A Kinder, Gentler Way
As I mentioned before, BPR is not for the faint of heart. While it can pay big dividends, there are less extreme ways of improving how you do business.

Business process improvement is the gentler of the two methodologies. It involves small, incremental improvements to existing processes over time that may result in a significant overall improvement.

With BPI, you will need both an as-is and a to-be model of the process. The trick is to then map a route from one to the other. BPI makes evolutionary, rather than revolutionary, changes to processes. However, the goal is the same as with BPR. The end result should still be a revolutionary improvement in product.

There are two levels of implementation with BPI: focused and institutional. With a focused approach, you apply BPI to processes selectively and as needed. It's not something you try to do every day. You conserve your resources by focusing them on only the most pressing problems or areas of greatest opportunity. You have greater control over the amount of change in the organization; if your plate is full, you may choose not to add new projects.

Institutionalizing BPI, on the other hand, is more complex. When everyone in the organization practices process improvement every day, your organization goes into a continuous improvement mode. This has both advantages and disadvantages.

An organization that continually improves will never be caught by a competitor trying to copy them. By the time a competitor has copied your style, product, process, or any other aspect of your business, you've already improved beyond that point.

Another advantage is that if the change mentality is now ingrained in your organization, you will suffer a lot less change related dysfunction. People will not only expect change, they may even look forward to instigating it.

This attitude doesn't work for everyone, though. Many people prefer more traditional approaches to dealing with change, including periods of relative stability where they have a chance to recover. People can only assimilate so much change at one time. Once you exceed that limit, additional attempts to change things will usually fail simply because people just don't have any more capacity.

Dealing With Change
If an organization isn't capable of dealing with constant change, any attempt to institutionalize BPI as continuous improvement right from the start will probably backfire. It will take years for most organizations to assimilate the cultural changes necessary to embrace continuous improvement.

An estimate that I've heard, and have generally observed to be true, states that for any major, organization-wide change to become part of organizational culture will take a number of years equal to the number of levels in the organization's hierarchy from top to bottom. By this yardstick, most military services should expect a 10-12 year cycle for full assimilation of properly managed process change.

This is, of course, a rough estimate that will vary depending on the degree of change, the amount of resistance and numerous other factors. Did we plan for this length of time when we first tried implementing TQM or TQL? When we tried changing the Air Force uniform in controversial ways? How successful were those first attempts? Did they happen quickly or easily? Or at all?

And, more importantly from our standpoint, did we have any kind of business process improvement/reengineering plan when we started tinkering with PCs and networks?

Technology and Change
The relationship between technology and desire for change is a push/pull one. Emerging technologies push people to find uses for them, enabling radical process improvements. The desire for new capabilities is the pull in the equation. People want to do things that current technology won't support, so they look for new tools.

The telegraph was the first big breakthrough in communications, followed shortly by the telephone. Both shrunk the world of business. Did these emerging technologies simply enable better business communications, or did the desire for better ways to communicate inspire their inventors to respond to the need? My bet is on the latter.

The radio was next. World-wide voice communications without wires. Then came the ability to project both pictures and sound via television. However, the only way to store audio and video was on tape or film, both fairly fixed, static media. All these means of communication, but little potential for other integration.

Enter the computer. Over time, computers have evolved to the point where they can facilitate the communications of all the previous media simultaneously: sound, pictures, video, text, numbers. In addition, computers give us new abilities to share, integrate, correlate, manipulate, replicate and disseminate data on a scale we've never known before.

Computers could, today, take the place of telephones, fax machines, calculators, televisions and most of the other electronic devices we use to communicate. They can be connected through land lines, satellite transmission, radio waves and any other conduits we use for electronic communication.

The question is: Why haven't we all done this yet?

The answer is that change takes time and effort, even though all the tools are already here. We've already installed much of the technology we need. However, what really must change are our work habits. Given that we in DoD first got semi-useful PCs in the early '90s, I expect the full impact of the technology won't be felt in our organizations until the next century.

What Works
All organizations are systems with similar fundamental characteristics: people, processes and technology. You cannot improve/reengineer one successfully or use it to the maximum of its potential capability without considering all three interrelated and interdependent. Re-engineered systems or business processes mostly result from people not having equal knowledge or awareness of these three aspects (especially the people aspect), and generally not having the skills to deal with the barriers to change that result within each aspect of the business.

Projects driven by information systems departments tend to have a high technology focus. And systems people tend to be perennial optimists with an eye firmly on the technology of the future. The danger is that a technology-driven BRP/I will tend to ignore the people impacts of systems changes and the impacts on the interfaces between systems and the world outside the front door of the business.

Business people, on the other hand, have in many cases held uneducated and unimaginative views of the use of technology, and usually view people issues from the context of the current corporate climate or one they have experienced in a previous place of employment.

Fortunately, the two communities have been moving close together over the last few years. Business people have been exposed to more sophisticated levels of technology and are starting to get more comfortable with it. Technical experts, particularly in the commercial world, are starting to specialize in supporting particular lines of business, and are building a better sense of the overall business operation in addition to their understanding of technology.

These are good first steps. In addition, there are three things you must have to effect successful process change:

1. Commitment to change from the very top. Any lower and results will not achieve full capability.

2. A team of champions and leaders who have the skills and knowledge in the areas of people, process and technology management to identify, direct and implement changes.

3. A vision of the business that is understood by everyone affected by the proposed changes. Without this vision there is no direction or goal. Without goals there is indecision. With indecision comes uncertainty and with uncertainty comes fear and BANG! Your project is dead before is gets started.

Recommended Reading
There are a number of good books on this subject. However, the only reference I'm going to give you here is, of course, one from the Internet. The BPR-L newsgroup, sponsored by Delft University in the Netherlands is an outstanding source of information on BPR, BPI, and virtually any related topic. The following is an excerpt from the BPR-L introductory information:

BPR-L tries to facilitate the development of a human network consisting of members with shared interests and skills in the field. Its purpose is to promote a constructive dialogue about BPR, both theory and practice, and to provide the opportunity for sharing all kinds of useful, BPR-related information.

BPR-L is an electronic mail group which can serve as a communication channel for researchers AND practitioners in the field of BPR. It can serve as an electronic device for meeting other people who are working on this topic.

The principle of BPR-L is simple: each message sent to BPR-L is automatically distributed to the mail addresses of all other BPR-L members. Types of messages that can be sent are:

  • Announcements (Call for papers, conferences, tools, symposia, etc.)
  • Questions and answers (Requests for information or references, debates on specific topics)
  • Discussions of new software tools and platforms
  • Discussion of empirical evidence within BPR
  • Book and article reviews
  • Abstracts and short working papers (Requests for comments and suggestions)
The newsgroup BPR-L has been created on the Internet, accessible through regular e-mail from ANY platform. To subscribe, send an e-mail message to or listserv@duticai.twi. with ONE line of text that has the following format:

SUB BPR-L Yourfirstname Yourlastname

After confirming your subscription, you will start receiving BPR-L messages through e-mail. I strongly suggest you activate the digest option at the earliest opportunity. That way, you will only receive one message from the list per day containing a collection of messages instead of all the individual messages as they are posted. On busy days for the list, this will save you a lot of lines in your incoming e-mail box.

Last Words
A few thoughts in closing. First, change is inevitable. It will happen whether you want it to or not. If you wait to react, it may control you instead of the other way around. Hammer thinks Bert Lance, our Secretary of State 20 years ago, was wrong. Lance said, "If it ain't broke, don't fix it."

Hammer says, "If it ain't broke, you've still got time to fix it." I tend to agree. Waiting for something to break puts you in crisis mode. I prefer a more deliberate approach when I'm tinkering with anything really important. Be proactive.

A gentleman by the name of Ian E. Wilson offered this thought: "No amount of sophistication is going to allay the fact that all your knowledge is about the past and all your decisions are about the future." This is particularly relevant to BPR/I, given our penchant for reinventing the wheel every few years. Don't be afraid to try something no one's ever done before, but be careful when you do it.

And finally, a quote from almost 2,000 years ago that confirms my belief that some things never change. In the first century A.D., Gaius Petronius Arbiter made the following observation about change:

"I was to learn later in life that we tend to meet any new situation by reorganizing. And what a wonderful method it can be for creating the illusion of progress while producing confusion, inefficiency and demoralization."

He must have been a government employee. ;-)

About the Author: Major Dale Long, USAF

Friday, July 16, 2010

Seven key ideas for managing distributed teams

  • Date: June 16th, 2010
  • Author: Rick Freedman

Project managers who lead distributed teams should look to Charles Handy's key concepts about trust and the virtual organization.


There's no shortage of advice on managing distributed teams, much of it focusing on the importance of communication and on the use of the array of available technical tools, such as WebEx, Skype, SharePoint, to aid in that process. Every distributed team must use some combination of these technologies to stay in contact and to make sure that the entire team is working from the same playbook. Teams that use these tools to communicate frequently and to overcome the obstacles of time and distance to stay on track and manage project progress and issues remove some of the risk from the distributed, or virtual, team model.

However, my experience teaches me that while these tools and practices are facilitators for good team interactions the real success factor is human: It's the element of trust.

Charles Handy's seven key ideas

The importance of trust in the success of virtual teams was noted as far back as 1995, when these trends were just beginning, in a famous Harvard Business Review article by Charles Handy titled "Trust and the Virtual Organization." Handy's article was one of the first explorations of the human factors associated with the migration toward distributed teams, and it laid out a foundation of concepts that project managers must consider when managing global teams. As he noted, all managers manage people they aren't in daily contact with, from networks of salespeople to external vendors, and so the skills required for virtual team management are actually core management requirements. Handy sets forth a set of seven key ideas, and these ideas are as pertinent to today's project managers as they were to the general management audience to whom they were originally addressed.

1. Trust is not blind.
There's no substitute for simple interaction and observation to build trust, so project managers should use every opportunity to interact, either in person or using the communication tools we outlined, and simply get to know their teams and demonstrate their trustworthiness. Trust is earned in every interaction, and every opportunity a project manager uses to demonstrate that he's a "stand-up guy (or gal)," willing to use some personal capital to protect and defend the team, earns a kernel of trust that can be taken forward in the relationship.

2. Trust needs boundaries.
Trust team members to deliver their commitments in their own style and manner illustrates that you trust them, and they are likely to reciprocate. This concept of self-directness fits in nicely with some of the key ideas of agile development.

3. Trust demands learning.
Project managers earn trust by continuously educating their teams about the project objectives, the strategy, their teammates, and the overall progress of the effort. Project managers also earn trust by trusting their teams to grasp the strategic context of the engagement, not just their individual tasks.

4. Trust is tough.
Trust also means accountability. Nothing corrodes trust in the team more than the observation that other team members aren't performing as expected and are seeing no consequences for that lapse.

5. Trust needs bonding.
The team must feel that it's on a journey together toward a clear and defined goal, and that goal must be reiterated and reinforced consistently. Again, this fits in closely with the envisioning exercises that are an integral element of the agile approach.

6. Trust needs touch.
The best virtual teams I've experienced make extraordinary efforts to meet as frequently as possible. I've seen distributed teams, working in an agile framework, that met daily using remote communication tools, even though they were scattered around the globe and had to bridge huge time differences. By alternating times to accommodate (and inconvenience) team members equally and by remaining in touch even in times of high stress and time pressure, teams stay connected and keep the spirit of teamwork healthy.

7. Trust requires leaders.
Teams, virtual or not, look for and expect leadership. The ability to help the team keep its "eyes on the prize" to facilitate the team through conflict and pressure, and to remain true to the guiding vision while business and technical circumstances evolve, is the sign of a true leader, and it becomes even more critical when the team is distributed.

In a 2003 study of global IT teams performed by Dr. Niki Panteli of the University of Bath, UK, the key differences between high-performing distributed teams and those that did not perform successfully were explored. According to the results of this study, high-performers shared these characteristics:

  • Awareness of shared goals
  • Time given to build shared goals
  • Early and open debate of goals
  • Primacy of team-based goals over individual goals
  • PMs or leaders as facilitators
  • Focus on win-win outcomes
  • Face-to-face communication where possible
  • Use of computer-mediated communication to enable regular team communication
  • Social interaction where possible

These findings reinforce the commonsense ideas that Handy outlined in his original article.


By building a set of common goals, allowing the team to debate and participate in the setting and achievement of those goals, building human interaction into the effort, and acting as a win-win facilitator, project managers can apply these lessons to their virtual team assignments and increase the likelihood of a successful outcome.

Rick  FreedmanRick Freedman is the author of three books on IT consulting, including "The IT Consultant." Rick is the Founder and Principal Consultant for Consulting Strategies Inc. He trains and coaches agile teams worldwide, and provides project management and IT strategic consulting for Fortune 500 companies and IT services firms.

Responsiveness and service delivery: A terrible example

  • Date: June 21st, 2010
  • Author: Marc Schiller

OK everybody, this simply blew me away. I just received an e-mail, and I can't believe the words on the screen in front of me. My immediate thought: I have to share this with my colleagues on TechRepublic. But before I say another word, read the e-mail below and we'll pick up our discussion in a moment.

[A quick note of context: This e-mail was sent in response to a request my client made of its business partner to learn if they could get information about whether a certain project could be done and, if so, by what date. Except for masking the names of the people and the company to protect the innocent (as well as the guilty) I have reproduced the e-mail verbatim.]

Dear Jack:

After some discussions with our IT department, it has been decided that I need to submit a formal "Business Request" (BR).

What this means to us is that IT will need to size the change and submit a price and time estimate. It also means that the process has been taken out of my control and therefore I can no longer guarantee that I can get as timely a response.

The normal process for our IT department is to meet once per month and gather the BRs they have received and talk through the pricing estimate. If the business decides that they are willing to pay the price IT has given us, then the work goes into the queue to be scheduled.

The project is placed in the queue based on a point system, which weighs importance, level of complexity, and the resources required to work on the project and their availability.

At this time I cannot guarantee that I can meet your timeline.

Tim Braverman

Director - Customer Analytics and Reporting

XYZ Corp.

A missed opportunity

Clearly this company and its IT group are at least 20 years behind the rest of the world in terms of IT responsiveness and service delivery. What makes this e-mail even more troubling is that it was sent from a company (the vendor) that makes tens of millions of dollars a year from the relationship with the requesting company (the customer). In other words, the internal IT group at the vendor company is negatively impacting a multimillion-dollar customer relationship. Bad news!

What a sad case of an absolute golden opportunity missed, i.e., IT had the opportunity to play a truly significant role in delivering on a customer's request. Instead, they escorted the customer into the 1970's black hole of IT development.

What's really wrong here?

I'm sure none of the TechRepublic readers would defend this practice. But at the same time we all realize that there needs to be an orderly and sensible process for dealing with IT service requests. And the fact that it happens to be for a customer doesn't really change things a whole lot. There still needs to be a structured approach and method for moving a request through the development process.

So what is it about this e-mail that instinctively rubs us all the wrong way? I suppose it's the fact that while we all know there needs to be a controlled development process, all the customer was really asking for was a time and cost estimate for the project. And the long, drawn-out process described in the e-mail to get to this simple answer just doesn't cut it anymore.

Is this really such an unreasonable request?

What would you do?

I'm sure that nearly everyone on this site has to contend with this very question on a regular basis. And so, rather than tell all of you what changes I think this particular company should make, I'd like to take an opportunity to learn from your collective experience.

How would you advise this company to change its process in order to be more responsive to critical customer requests? Would you:

  • Make the IT meetings more frequent?
  • Make those meetings collaborative with the business?
  • Eliminate the company's point system?
  • Have the business submit a request with certain date and budget parameters from the start?

I think the value in hearing from everyone on this topic is not so much in finding THE answer, but in generating some conversation and in exposing a variety of possible answers, each of which has its place, depending on the organization and the specific situation involved.

So let's hear from you … tell me what you would advise this company to do in order to establish a more customer-responsive approach to work order management.

Once I have a good number of answers, I promise to write up a synthesis of the best ideas (with a few ideas of my own, of course) so that you can use them in your ongoing challenges in this arena.

Marc J. Schiller is a leading IT thinker, speaker, and author of the upcoming book The Eleven Secrets of Highly Influential IT Leaders. Over the last 20 years he has helped IT leaders and their teams dramatically increase their influence in their organization and reap the associated personal and professional rewards. More info at

The 10 most cryptic project management expressions

  • Date: July 7th, 2010
  • Author: John Sullivan

Project success requires clear communication among managers, team members, and stakeholders. Be sure you really know what's being said when you hear the terms on this list.

Employers continue to cite communications skills as one of the traits they value most in their employees. But that trait may be less sought in managers, who (in my experience) use a lot of slang terms and catchy phrases that can result in trouble if misinterpreted.

Knowing the difference between what is being said and what is really meant is critical. Based on my research and experiences, here are the 10 most cryptic project management terms and phrases and how to interpret them.

Note: This article is also available as a PDF download.

1: Manage the white space

The term "white space," first used in 1849 to mean "the areas of a page without print or pictures," has come to mean "an area between the work." That translates to vague or undefined responsibility and requires negotiating with another entity — a department, division, vendor, or strategic partner — to persuade them that they do indeed have ownership of a task or process that affects your project.

2: One-off

Webster defines this term as something "limited to a single time, occasion, or instance." That agrees with Wiktionary's explanation that it likely came into use from foundry work, when making reusable molds was costly.

Created to fill a need quickly and cheaply, one-offs can still last for years. Modern one-offs are programs, processes, or manual efforts that usually go well until the resignation of the owner or discovery by an overseer, like information security. When that happens, you'll need to find a way to formally and legally bridge the gap covered by the one-off or deliver the message to its users that they'll no longer have it.

3: Think outside the box

The origins of this phrase point to the traditional "nine-dot puzzle," which requires all nine dots to be connected by just four lines without lifting the pen. The solution (shown below) requires an extension of an implied boundary.

This phrase implies that some thinking has occurred but not the right kind of thinking. It really means finding a way to do something faster, better, or cheaper without the benefit of more time, tools, or money. That requires a solid explanation of all your alternatives because you may need to show that your solution — if you can find one — is the best, given the real-world constraint this phrase often represents: that no realistic options exist.

4: Workaround

Webster defines this as a "plan or method to circumvent a problem without eliminating it." The danger lies in the circumvention. How far, how deep, how wide you go to implement your "alternative solution" could be the difference between innovation and incarceration. Obey company policy and the law when creating a workaround. Remember that workarounds become one-offs, so if you end up creating one, suggest a time limit for it or even a future project to address the need for a legitimate solution.

5: Leverage

Defined as "the power to act effectively," this term has come to mean "using the results of someone else's work." That work could come from another person, project, or even another company (when it's another company, it's called "best practices"). That's great when it easily transfers to your project, your culture, and your customers. When it doesn't, be prepared to defend the modifications or rejections because the implied expectation with "leverage" is that it will be a complete, effortless, and free solution.

6: Facilitate

This literally means "to make easier." If you are asked to facilitate something, it likely means it is high time for progress or that what has been done to date isn't working as well as your boss expected.

Make sure the request to facilitate comes with the time and resources you need. If your intended audience emerges from your facilitation without the expected product (solid requirements) knowledge (how to gather requirements), or changed behavior (using the new requirements tool), you could be in trouble.

7: Take it offline

This generally means "don't discuss it here," which is a positive thing if the topic is important but is not on the agenda. But it can also mean "I don't want to hear about it." The only way I've ever been able to determine the difference is by later bringing it back "online" and being told again to forget about it.

8: It is what it is

This one was USA Today's Sports Quote of 2004. Writer Gary Mihoces called it "the all-purpose alternative to the long-winded explanation" for any coach or athlete. In the project world, it generally means "done" — which really means any incomplete, incorrect, or inept result is to be left alone. Attempts to fix it, even if it is blatantly wrong, are forbidden, probably due to some political consequence unknown to you.

9: Do the right thing

Because "the right thing" can vary by person, corporation, or culture, this can be a dangerous directive. The manager or executive saying this often knows what the "right thing" is, either from past experience or directly from his or her manager. Make sure you know what it is by asking open-ended and nonjudgmental questions. Better yet, put it in writing as part of a project or process document so your immediate manager can refer to it before — and after — you do it.

10: Anything from the latest business bestseller

Moving the cheese, driving the hedgehog, and reaching the tipping point sell books but don't help complete projects. If you work with someone who seizes the latest phrase from the bestseller list, I suggest you do what a co-worker of mine once did: He asked a person who had access to the boss to check and see what business book he was currently reading. That way, they could understand what the boss was thinking and what he expected to hear. There's another phrase you may need to start saying yourself: "If you can't beat 'em, join 'em."


John Sullivan is a working project manager who writes and speaks on project and career issues.

The 10 Rules for Staying Positive

From: Simple Truths
The 10 Rules for Staying Positive
Dear EC,
I've been in business for over 30 years, and I've come to realize the difference in success, or failure, is not how you look, not how you dress and not even how you're educated.

It's how you think. I can't overstate the importance of being able to maintain a positive attitude but I'm the first one to's not easy. That's why I love our new book,

Attitude is Everything...10 Rules for Staying Positive. It breaks down the #1 key to success in a simple, but unforgettable way. The bottom line is that no matter what you do in life, the wisdom in this little book will help you succeed!

Today, I'm thrilled to share an excerpt from a chapter titled: "Wait to Worry," which is great advice for everyone I know! Enjoy.

An excerpt from Attitude is Everything

by Vicki Hitzges

I used to worry. A lot. The more I fretted, the more proficient I became at it. Anxiety begets anxiety. I even worried that I worried too much! Ulcers might develop. My health could fail. My finances could deplete to pay the hospital bills.

A comedian once said, "I tried to drown my worries with gin, but my worries are equipped with flotation devices." While not a drinker, I certainly could identify! My worries could swim, jump and pole vault!

To get some perspective, I visited a well known, Dallas businessman, Fred Smith. Fred mentored such luminaries as motivational whiz Zig Ziglar, business guru Ken Blanchard and leadership expert John Maxwell. Fred listened as I poured out my concerns and then said,

"Vicki, you need to learn to wait to worry."As the words sank in, I asked Fred if he ever spent time fretting. (I was quite certain he wouldn't admit it if he did. He was pretty full of testosterone-even at age 90.) To my surprise, he confessed that in years gone by he had been a top-notch worrier!

"I decided that I would wait to worry!" he explained. "

I decided that I'd wait until I actually had a reason to worry-something that was happening, not just something that might happen-before I worried."When I'm tempted to get alarmed," he confided, "I tell myself, 'Fred, you've got to wait to worry! Until you know differently, don't worry.' And I don't. Waiting to worry helps me develop the habit of not worrying and that helps me not be tempted to worry."

Fred possessed a quick mind and a gift for gab. As such, he became a captivating public speaker. "I frequently ask audiences what they were worried about this time last year. I get a lot of laughs," he said, "because most people can't remember. Then I ask if they have a current worry - you see nods from everybody. Then I remind them that the average worrier is 92% inefficient - only 8% of what we worry about ever comes true."

Charles Spurgeon said it best. "Anxiety does not empty tomorrow of its sorrow, but only empties today of its strength."

Monday, July 12, 2010

Up close & personal with Roshan Thiran

Saturday August 22, 2009

Up close & personal with Roshan Thiran


The CEO of Leaderonomics calls his company a social enterprise focused on inspiring people to leadership greatness.

ROSHAN Thiran comes across as very driven. Pulling out a chart which traces his career milestones, beginning with his job at General Electric Co (GE), he rattles off for the next 30 minutes or so about his time with the US conglomerate with nary a pause in between.

He spent about 10 years working abroad, moving to different companies and positions within the group.

There have been times when he failed and he speaks of this candidly.

"Failure is the mother of success. It's okay to fail, but make sure you learn something from that trip," says Roshan, who is now the CEO of Leaderonomics Sdn Bhd, a company he set up about a year ago.

He calls it a social enterprise focused on inspiring people to leadership greatness. "There is a shortage of leadership role models in this country. When we think of role models, we think of politicians," he points out.

The company offers leadership programmes to young teens right up to entrepreneurs. Star Publications (M) Bhd has a 51% stake in Leaderonomics.

As the interview moves along, it is obvious that he is a great fan of Jack Welch, the GE chairman and CEO between 1981 and 2001. Roshan joined the company as an intern at 20, after graduating with a degree in international business in 1995.

Roshan and his team offer leadership programmes to teens right up to entrepreneurs.

Welch gained a reputation for his uncanny business acumen and unique leadership strategies. Today, he remains a highly regarded figure in business circles due to his management strategies and leadership style.

Roshan wants to lead, hence the setting up of Leaderonomics. Drawing qualities from a diverse range of people, from Mother Teresa to Welch, from Thomas Edison (who invented the light bulb) to Sir Winston Churchill, Roshan emphasises the importance of leading and learning.

"All of us are leaders in our different fields and roles. There comes a time when one has to lead. It has something to do with giving back to society. The Western world is familiar with this. Seldom is this trait displayed in Asians," he says.

"Every one of us has the same amount of time. What we do with that time is up to us. The trouble is, when you don't learn or don't accept the opportunities that come your way, you are essentially allowing opportunities to pass you by. When you don't learn, you don't grow and you stop living."

He adds that he formed Leaderonomics because he wants to lead as many young Malaysians as he can.

"They need some road signs to guide them. When I first returned to Malaysia, I realised that the mindset here is rather hierarchical. A lot of people had low self-confidence, absolutely no exposure and were unable to think strategically," he explains.

"Technically, they were sound. But they were unable to perform or communicate the same way as talents from the US or Europe, who had global experience. It is these qualities – self-confidence and a deep belief in oneself and one's abilities – that I am trying to imbue in the young people, from teenagers to young adults.

"We want to give kids and young people opportunities to have access to leadership. This is how they learn to lead. They have to do it, not just read or listen about it."

With the technologies available today, he tries to keep in touch with the participants to check on their progress.

He adds, "Most of us have heard of empowerment, but it is something that is difficult to do unless there is constant reinforcement and affirmation."

As Roshan verbalises his thoughts, one of his staff pops into the meeting room. "I'd like to hear this. It is good for me," he says and plonks himself in a chair.

Roshan lets him be and continues: "I could have stayed on with healthcare group Johnson & Johnson. I've asked myself why I'm plodding along here? I've looked back the past one year and I asked myself, what have I learned the past one year?

"I have learned to run a business, balance profit and pull together 25 people of diverse backgrounds. I'm tailoring programmes for young people and working adults.

"The other thing that has changed was the arrival of my son. I've always been passionate about helping kids. And this is one very important kid. I was travelling nearly every week during my last posting and I wanted to be in Kuala Lumpur."

At 35, Roshan has done things and has been to many places those double his years have not. He is still raring to go. Roshan is not going after Utopia. He is after challenges and the bigger, the better.

At the end of it all, the one single thing which drives him is his desire to learn.

He is one who likes to vacuum everything in the brains of those he finds worthy. His definition of worthiness is intelligence, foresight and vision.

There are a number of times where he has failed and he has no qualms telling his listener where he failed.

Much of the work he does today is drawn from his experiences at GE, his first employer after completing his university education.

He has obviously familiarised himself with the conglomerate's various businesses. He's also been tasked with different responsibilities – business development, finance, IT and sourcing. And when he was at Johnson & Johnson, he handled its human resources on a global scale.

The sentence "I want to learn new things and to grow" peppers the interview.

"There have been times when I have fallen flat on my face. I have failed but I have also learned from my failures. I have come out of my comfort zone, to take on something way bigger than myself. I have stretched myself," he says.

"The worst thing is to fail and never learn." And he pauses.

That few moments of silence is heavy. He's been rattling on about the different milestones in his life at about 100 words a minute. The photographer lets out a little sigh. It is not easy trying to keep up with his every word.

Roshan then talks about the challenges he has encountered since graduating from University of Bridgeport, Connecticut, where he won a football scholarship. The first flop happened just after he joined the finance department of GE Investments. He accidentally left the staff payroll on the photocopier.

He was fired. For the next two weeks, he was utterly miserable. His former boss called him and asked him why he was not at work.

"He said he deliberately did not call me because he wanted me to learn the importance of data integrity. Today, every time I send out an email, I check it three to four times," he says.

There were other challenges but the next big one was in Dallas, Texas, also with GE. He was tasked with implementing a system that nobody used. "I learned the important lesson of engaging people and getting them to commit to change.

"Today, that is called the soft side of things. It is pointless to implement change without first of all taking into consideration the people who will be using this system. When you try to change something, you cannot put in the processes and make things happen. You need to engage and empower, and get people to come along and drive the changes."

As Roshan traces his different stops and the lessons he picked up from his time with GE and Johnson & Johnson, it becomes clear that the pace he wants to keep is almost relentless.

The desire to learn every moment, to be on top of things every hour, to know where he is going every morning he wakes up, fills his spirit and soul. He rises every day and asks himself what he wants to achieve that day. Every hour, he refocuses on what he's going to do.

"It's easy to lose sight of my purpose. My weakness is I cannot say no. I am trying to build a team in order to delegate. Every one of us is given the same amount of time. And the better I develop my team, the sooner I'll be able to celebrate," he says.

Why campaigns and initiatives fail

The STAR - Business
Saturday August 8, 2009

Why campaigns and initiatives fail


IN 2005, the Government embarked on a National Clean Toilet campaign to ensure clean public toilets everywhere.

The Housing and Local Government deputy minister then outlined his strategy on how this was to be achieved: introduce toilet education, implement good toilet design, and instill good maintenance with mandatory inspection and rating.

Four years on, we can hardly say the campaign was a "flushing" success. Why did that campaign fail? In fact, a few years earlier, the state of Johor tried fining people RM1,000 for failure to flush public toilets in a drive for cleaner toilets.

We have all witnessed leaders introducing new initiatives ever so often. After the initial sizzle and sparks, these initiatives usually never materialise into anything remotely successful. Yet companies ritually set up yearly initiatives or campaigns much to the dismay of their employees.

Much effort is spent in coming up with great slogans – "Bersih, Cekap, Amanah" "Cinta IT, Sayang IT" – and the list goes on. Yet, they do not have much effect in achieving the goals of the initiative.

For example, investment in customer relationship management (CRM) initiatives is US$1.5bil per quarter. Yet most CEOs claim there is no improvement in customer service.

Gartner's research found that 42% of the companies that purchased CRM technology were not even using the applications.

Huge efforts and investments are thrown into information technology initiatives, change programmes and productivity campaigns. Yet we see relatively low success. A Concours Group study had the failure rate of business initiatives at 85%. Why is this so?

Campaign slogans and programme investments are not enough. From my research, the key to driving successful initiatives is to build a supporting eco-system by focusing on four key areas equally: programmes, systems and structures, leadership engagement and culture.

Each element is to be addressed if you are serious about sustainable initiative success. Much of my time is spent helping multinationals drive talent management initiatives.

Most talent programmes fail due to leadership focus only on talent initiatives, and foregoing the other three important areas. Equal focus is needed.

Leadership engagement

Steve Job's personal commitment ensured the success of various campaigns at Apple. Richard Branson gets involved in all Virgin's key initiatives from day one.

Datuk Seri Idris Jala spends significant amount of time with his talent, teaching and developing them which becomes contagious and is role modeled by others at Malaysia Airlines. Jack Welch spent at least 20 days a year teaching initiatives he was championing.

If you ask any key business leader in Asia if they could dedicate time to communicate and role-model key initiatives they are championing, the most likely response would be a friendly stare.

How could a busy CEO spend time on initiatives – there are deals to close and operations to run!

But without your leaders' championing the cause, you are just wasting your time. Many leaders mouth words of change, but are never committed to the change themselves. Lip service from your leaders, when they call for behavior change but don't walk the talk, is a sure way to fail.

Systems and structure

Even with leaders rallying behind your cause, without proper systems and structures, these initiatives won't fly. I remember Jack Welch yelling and commanding everyone to drive Six Sigma into every part GE at every opportunity.

I was at NBC, its media arm, and Six Sigma had no relevance to these media folks who looked at it as a manufacturing process.

But to calm Welch down, the NBC team launched a big grand all-employee Six Sigma party with Jay Leno and other stars cracking jokes and with t-shirts and caps given out.

After the party, there was limited mention of Six Sigma at NBC for the rest of the year. Six Sigma failed to initially take off at NBC even with an enraged Welch championing it.

Welch quickly learnt and announced a new process change in GE where no one could be promoted unless they had Green Belt certification.

Immediately, lots of people signed up for Six Sigma. Welch cleverly leveraged the new policy to support Six Sigma. When you drive an initiative, you need to revise processes and structures to be consistently aligned with your initiative and to measure and monitor progress and effectiveness.


The hardest part in ensuring your initiative does not become a fad or a "flavour of the month" is to ensure that it becomes part of the organisational DNA. It requires cultural alignment.

According to Schwartz and Davis: "Organisational culture is capable of blunting or significantly altering the intended impact of even well-thought-out initiatives in an organisation." People and organisations are creatures of habit, and changing habits is harder than changing structures or systems.

Organisations, like people, have personalities, and to ignore it will be fatal to your efforts. You need to be aware of your cultural impediments and address them. Among them may include:

·Lack of trust or accountability between groups, including turf issues or internal competitiveness;

·An "observer-critic" culture that kills new ideas or a culture reluctant to accept new ideas; and

·Groups formed under the protection of a politically connected individual which distances themselves from your initiative.

A few years ago, I was leading a global initiative to drive e-learning usage. We built programmes, got leaders championing the cause and built processes to support e-learning.

Yet, the take-up rate of e-learning was abysmal. Until we realised that culturally e-learning was not the accepted norm.

People preferred to go for actual training classes where they got away from their offices, had coffee breaks and lunches provided and even got a certificate which they could showcase on their desk.

When on e-learning programmes, participants were often disturbed mid-session by operational issues and never got about completing the learning.

To counter and address these cultural issues, we issued Starbuck's coffee vouchers for e-learning classes (in lieu of coffee breaks), we built big signboards which hung by participants desk reading "Student on e-learning – do not disturb me", and we even started issuing e-learning certificates and special gifts for those with high e-learning usage.

Within months, e-learning took off in a big way. A corporation's culture can be its greatest strength or its greatest enemy. Harness the power of culture for your initiative.


Finally, programmes. This is the easy stuff as there are thousands of programmes for any given initiative. "Copy and paste" works fine for programmes. But not with culture, systems and leadership. Having the best programmes in the world do not necessarily mean you will have the best result.

Instead of just focusing on programmes, spend equal time on all elements, and your chances of seeing your initiative being successful goes up significantly. Who knows, we may just have clean toilets in Malaysia one day.

Roshan Thiran is CEO of Leaderonomics, a social enterprise focused on inspiring people to leadership greatness. He is passionate about driving change in Malaysia. Join his journey and become a fan of Leaderonomics and DIODE Camps at