An EA Response to the Pandemic: What Enterprise Architects Can Do in This Time of Crisis
Apr 28, 2020
These are strange times and for many of us the world has been turned upside-down by the Covid-19 pandemic. Enterprise architects, used to a medium- and long-term focus, suddenly and urgently need to contribute to the very survival of their organizations in the immediate term. This requires a thorough rethink of what we do, but we won’t have time to sit back and contemplate the EA discipline. We need to take action now and with this blog post I want to give you some concrete ideas on this.
Clearly, the current situation requires a strong emphasis on business continuity and cost control.
Much of the benefit of EA is in cost avoided (by preventing the wrong decisions) but that doesn’t directly help you today. So as an EA team in an organization in existential crisis you have to show you respond directly to that crisis, and not just to some longer-term goals, since without short-term survival there won’t be a longer term. If you don’t show value now, your senior management might even be tempted to save cost by firing the EA team altogether, since it may appear in the short term they won’t need you.
Fortunately, our methods and models have much to offer in this context of crisis. Architects have a unique understanding of the connections and dependencies in their enterprises, both vertical (between strategy, operations, and implementation) and lateral (e.g. between stages in your value stream, dependencies between capabilities, or the flow of information through your application landscape). A few months ago you may have used that understanding to work on issues like the digital transformation of your organization, supporting your company strategy by improving business agility, streamlining operations in your supply chains, or rolling out new IT infrastructure to support the digital workplace. Today, you can use the same deep and broad knowledge of the inner workings of your enterprise to support urgent demands such as scaling down (or up) certain operations, enabling your digital workforce, mending broken supply chains, fixing logistic problems, et cetera.
In discussions with several of our customers and based on our own experience, we have identified a number of key questions that you as an architect can use to guide your response to this crisis and help your organization deal with it:
1. Which business capabilities are critical to your products and services?
Most organizations nowadays have some kind of capability map, linked to their value streams and business outcomes. Which of these capabilities are absolutely critical for your organization to survive? What do you need to fulfill your mission and produce the requisite outcomes (e.g. essential business services) for your customers and other stakeholders? And which capabilities are just nice-to-haves? For a bank, for instance, capabilities like payments, accounts management, ATM services, and risk management are absolutely critical, whereas perhaps loan and mortgage applications are important but not business-critical in the short term, and marketing or product development are less critical still. In such an analysis, you may also consider capabilities you possess but never actively used in this way before. For example, various manufacturing companies now pivot to producing medical devices like ventilators or personal protective equipment, because their manufacturing capabilities can be reconfigured for this purpose. Keep thinking outside the box, don’t let the crisis make you put the blinkers on. Your creativity is needed now more than ever.
2. What are the business impacts of disruption to these capabilities?
By analyzing the connections between capabilities and the value streams that rely on them, you can assess what would happen if, say, a certain capability is no longer available or has to be scaled down due to a shortage of resources. Which essential outcomes (e.g. critical services to key customers) cannot be guaranteed? Perhaps you need to reassign resources then, or scale of certain operations that can no longer be sustained.
3. What are the people, processes, applications and third party suppliers that these capabilities depend on?
Imagine, for example, that a substantial percentage of your workforce falls ill, or a key supplier goes out of business. What would be the impact on your key capabilities? Identifying what is absolutely business-critical helps management to focus their attention (and budget) and avoids them being swamped by less important day-to-day problems.
4. Where do we have risks identified for these people, processes, applications and third parties?
This is of course the next question. You may already have done such a risk analysis. If not, you may need to quickly fill in some of these gaps to have a sufficient understanding of the overall risk to your business-critical capabilities.
5. What is the aggregate risk for each capability?
The aggregate risk for each capability, based on the previous analysis, helps you focus your mitigation efforts. Combine this risk with the criticality of your capabilities mentioned above, and visualize this in the form of a capability heat map. This gives you a ‘battlefield plan’ that everyone can huddle around (in keeping with the requisite social distancing) and use as a common basis for understanding and planning further action. The example below, from an energy company, uses colors to show the operational risk of capabilities, and highlights those that are business-critical (in the short term). This immediately calls attention to capabilities such as Customer Service, which in this example turns out to be insufficiently dimensioned to deal with large numbers of customer calls in case of a major emergency.
6. Which risks are acceptable and which risks require mitigation or avoidance?
In particular for the business-critical, high-risk capabilities, you may need to take additional measures to deal with these risks. This will typically also include identifying and collaborating with responsible business owners who need to take action here.
7. What are our risk mitigation plans, business continuity plans and disaster recovery plans for these capabilities?
Of course we all have our plans in place, right? Well, some of us do, but are they really adapted to a situation where most of your staff works from home, key personnel falls ill, or key suppliers are no longer in business? You’d better check whether these plans are still current. And your architecture knowledge can be very helpful in all kinds of scenarios, for example to decide in which order to scale down, or recover, certain capabilities, based on the various dependencies in your architecture; you don’t want to inadvertently switch off something that takes down your entire operation or leads to damaging ripple effects in your supply chain.
8. What are the bottlenecks in our IT infrastructure to support remote work?
Zooming in on your business-critical IT resources, very practical and concrete questions come up. Many companies now have a general work-from-home policy, but their infrastructure may not always be prepared for that. Where are the bottlenecks and who should be prioritized, given e.g. their role in critical business processes?
9. Which business-critical applications are difficult or impossible to access remotely?
You may have applications running in environments that can only be accessed on-site. Or take the example I recently heard from one of our customers, a utility company: they have a set of highly business-critical applications that can only be accessed via a secure environment that allows just one remote login at the same time. The operators of these applications were inadvertently kicking each other off this environment when they tried to log on, greatly complicating their operations. Analyzing and fixing such bottlenecks is key.
10. What are our recovery time objectives (RTO) for these applications?
If such a business-critical application has a short RTO, you may need to ensure some form of on-site staff presence, despite a general work-from-home policy. If your organization runs critical infrastructure like the utilities company I mentioned, you will of course be well aware of this. Nevertheless, you may be caught unawares by limitations like this single login issue.
Of course, this is not intended as the one-and-all of EA in crisis mode, but to inspire you to define your own course of action as an architecture team. The above is an example of the short-term perspective that architects can assume.
Moreover, the economic impact of this crisis will reverberate for a long time to come. This will undoubtedly lead to new rounds of cost savings, reconfiguring supply chains, but also speeding up the digitization journey that many organizations had embarked upon anyway. Listen for example to the podcast by Kirk Keller about how the University of Missouri completely transitioned to an online environment, greatly speeding up their digital transformation.
Business as usual won’t return anytime soon and smart organizations are already planning for this ‘new abnormal’. We don’t know where this sea change will take us but by investigating possible scenarios we can try to be prepared for whatever may come. Architects are well-positioned to assess the impact of such scenarios and help build a resilient enterprise that knows how to respond.
