The technology is usually fine. The gaps are in the layers of IT that have no owner and no metric, and you find them by interviewing five people with the same four questions.
Ask the CEO who is responsible for IT. The answer comes fast: “Mikko handles it, and then we have a partner.” The next question is slower: who decides who gets to see payroll data? Then one more: if web shop orders stop flowing into the ERP, who notices first?
For the last question, the honest answer is often the customer.
The usual sequence starts with something not working smoothly. The cause looks technical, and a new system is bought in the hope that it fixes the problem. Usually the problem is in the processes and working habits, which nobody has updated since the previous system was bought. The new system inherits them. What is missing is a picture of what the whole is made of and who is responsible for each part.
Here is the picture I draw myself when I arrive in a new environment. It has five layers.
Five layers and the same questions for each
An organisation's IT divides into five layers, whatever the size of the organisation:
- Identity: who is allowed to do what.
- Devices: what the work is done on.
- Applications: where the work happens.
- Data: what the work produces and where it is true.
- Integrations: how the other layers talk to each other.
I ask the same thing of every layer: what typically belongs to it, who owns it, and how you can tell it works without an engineer.
The owner is a named role in the business. “IT” or the partner's name will not do: a partner can run the technology superbly, but the decision about what belongs in the layer is the company's to make. The same person can own several layers, as long as the name is written down and the person knows they are the owner.
A layer has one owner who answers for the whole. Inside it there can be many owners: every application and every integration has its own. The layer owner does not do that work themselves. They know who does, and they notice when someone does not.
The metric is a question that management can get answered once a month by asking the right person. The answer is a number, a name, or a yes or no. Some of the numbers come straight from the systems' own reports.
Security is not a layer of its own. It runs through every layer, and it weighs most on identity. It still needs a named owner and its own question: who decides what is done when something goes wrong? The same goes for backups and recovery. The picture covers day-to-day running, and recovery is a question of its own, asked in the same interview: when was a recovery last actually tested?
Identity: who is allowed to do what
This layer holds user accounts, groups and permissions, multi-factor authentication and single sign-on. The account is now the checkpoint most attacks pass through, because people work from anywhere and both the applications and their users have moved to the cloud.
The process for people who join, change role or leave is usually owned by whoever is responsible for HR, because they are the first to know when someone starts, changes role or leaves. The identity platform and its policies, such as multi-factor authentication, are owned by the IT manager or whoever is responsible for security. The line manager decides what permissions a role needs.
Metric: the number of active accounts compared with the headcount on the payroll. The difference must be explainable line by line. If there is no explanation, somewhere there is an account that can get in and that nobody is watching. I have written about how people joining and leaving are handled in the article on the self-healing IT environment.
Devices: what the work is done on
Laptops, phones, printers, the office network with its firewalls, servers and computing capacity rented from a cloud provider. Often also a server standing in a corner whose job nobody remembers exactly. The owner decides the device standard and when a machine is replaced. Depending on the company, that is the office manager, the finance manager or the IT manager. Technical upkeep can be bought from a partner, but the standard is decided in-house.
Metric: the device inventory has as many rows as there are machines on desks and servers in the server room, and each one has a user or a job and an age.
The device layer starts with a software inventory and user feedback. When I was project manager for a 220-workstation refresh, those were the first tasks. After that, the department's software installed itself at first login, because someone knew what belonged on the machine.
Applications: where the work happens
Email and files in the cloud environment, ERP, payroll, CRM and the ticketing system. Plus the spreadsheets that have grown into applications without anyone deciding so. If three people update the same spreadsheet every day and orders depend on it, it is an application. Many of them were born from a decision nobody recognised as a decision.
The owner is the role whose work the application carries: for the ERP the finance director or the operations director, for the CRM the head of sales.
Metric: the last three months of software invoices and company card lines match the application list, and every line has an owner's name. The company card is often the most complete application list the company has.
Data: what is true and where
Customer data, orders, invoices, contracts and files are almost always in several places, so I ask where they are true. When a customer's address is in three systems, one is correct and two are copies. Someone has to decide which.
The owner is the person who has to explain when a number is wrong, and that is why they decide which source is correct. The source of customer data is usually the system where the data is born, and the definition of who counts as a customer is owned by the finance director or the CEO.
The metric for whether the truth has a home: ask two people for last month's sales. If you get the same number from the same place, the layer works. If you get two numbers and two explanations, the data exists but the truth has no home.
In this layer, transferring ownership often yields more than transferring files. I was project manager when more than 60,000 files were moved out of a vendor-managed environment. The hardest part was getting people to work differently. The changes themselves were small. System documentation got its own channel in the messaging tool the users were already in. Managing permissions moved from the vendor to the company's own system administrators. The layer got an owner from inside the company.
Integrations: how the layers talk to each other
Web shop orders flow into the ERP, hours into payroll, a new employee's details from the HR system into accounts, and the multifunction printer's scans into email. Some of it runs automatically between systems, and some of it happens when someone copies the numbers by hand every Friday. Copying by hand is an integration too. It is just the integration that goes on holiday.
This is the layer most often missing an owner, because an integration always sits between two layers and each owner assumes the other one handles it. The owner is the owner of the process that crosses the boundary: the transfer from order to delivery is owned by the operations director. Every transfer has its own owner, and the layer owner keeps the list.
Metric: who notices first when a transfer stops. If the answer is the customer or an employee, the layer has no owner, even if the technology is fine. The hard part of an integration is usually the decisions around the transfer that nobody has made.
A layer without an owner is an architecture gap
The picture almost always ends up with layers that have no owner or no metric. They are the most important information in it. A layer without an owner gives no error message, and the technology inside it can work for years. The gap shows only when something changes: a key person leaves or the partner changes. Then someone asks who decides, and nobody knows.
Naming the missing owner is usually one uncomfortable decision. Someone says out loud that this is now yours, and someone else gives up something they have handled informally for years. It is a leadership decision, and it needs no budget. The technology often already exists and has been paid for: for one customer I built an ERP and ticketing solution using only the licences the customer was already paying for.
A layer without an owner is not evidence of neglect. It tells you a decision has been left unmade. It can be made, usually in less time than it has been postponed.
How to draw the picture yourself
Interview five people, one for each layer. For each, pick the person who does the layer's work day to day, even if they are not the one who should own it.
- Identity: the person who handled the most recent leaver's accounts.
- Devices: the person who ordered the most recent laptop.
- Applications: the person who pays the software invoices.
- Data: the person who compiles the monthly report.
- Integrations: the person who copies data from one system to another by hand. This interview is often the most useful one.
Ask each of them four things: what is in the layer, who decides on changes, how you would notice it is not working, and what they assume someone else is taking care of. The last question finds the gaps. A document tells you what exists. A person tells you what they think someone else is taking care of.
Give each interview time and let it run over. The first answer is what the interviewee thinks you want to hear. The gaps come out only when you ask what they assume someone else is taking care of. When the interviews are done, draw the five layers and write the contents, the owner and the metric into each. If a layer has two owners, write down both. That tells you something too. Then take only the layers with no owner, or with two, to the management team. Name an owner for each, or a date by which an owner will be named.
When the picture does not fill in on its own
Many companies can draw the picture themselves. It is worth asking for help in two situations. First: there is nobody in-house who can judge what the partner does or what flows through the integration layer. Second: the uncomfortable decision has to be said out loud. From inside the company, “this is now yours” easily sounds like an accusation. Said by an outsider, it is an observation.
If all five layers have a name and a metric, you do not need me. Draw the picture again in a year, or whenever a key person changes.
If a layer without an owner has already stalled a project, see The project that won't finish. If some part stayed unclear and you cannot get clarity on your own because the question keeps being passed from one person to the next, send me a message. I bring clarity: we draw the picture together and name an owner for every layer.