Audit professionals must keep up with new IT practices within their organizations. One practice gaining momentum is innovation or the formation of innovation teams. So, what is innovation?
Innovation is simply creating better solutions to meet new or currently unmet needs that exist in the marketplace. Within IT/IS audit, these needs may be regulatory or industry-standard requirements for which controls do not currently exist and mechanisms are not easily found in off-the-shelf software or well-defined processes. It could also be finding ways of meeting a need with a new and more cost-effective or less time-consuming solution.
Can You Plan for Innovation?
Because innovation is a specific type of focused research, it is something that cannot be completely planned. However, there are approaches that an organization can take to be more successful at innovation.
Start Small—Kaize
Kaizen, Japanese for good change or improvement, is the idea of identifying and taking small steps to improve efficiency and performance. The idea behind kaizen is that small steps for improvement can add up to large-scale changes for the better.
Toyota is well known for its kaizen efforts1 and serves as a good example of how to start with innovation. Toyota developed a culture where anyone could spot and suggest small changes for improvement. What the organization realized is that usually those closest to the problem can develop small-scale improvements to solve it. After all, they are facing the work and the pain points. Therefore, Toyota developed a feedback mechanism where these small improvement suggestions could be forwarded up the management hierarchy. The suggestions were then put through a methodology to determine whether to test them and see if they helped with the identified issue. Validated suggestions were then implemented. Individuals and teams who submitted successful suggestions were duly rewarded.
Any organization can build a similar culture that encourages everyone to recommend suggestions for improvement. This allows for an increased flow of ideas, often from those who have a critical view of the issues. By having a methodology to consider, test and then act, these small suggestions can result in a system of continuous improvement. Small steps can lead to an overall big change.
Focused Effort—Innovation Teams
One of the issues with kaizen, though, is that it does not tend to be disruptive. Disruptive means the change is immediate or happens quickly. Kaizen focuses on continual improvement. However, market conditions, new regulatory requirements or a sudden challenge to the organization may mean that the solution must come about in a short amount of time. Or, in the case of unidentified needs in the marketplace, a new idea/approach/solution will have to be created and then presented. Continuous improvement of a product that meets an existing need does not tend to lead to a solution for a currently unidentified one.
Therefore, some organizations put together teams that are charged with innovation efforts. These team members often represent interested and invested staff from different disciplines2 who have the time and resources to look at problems, or the market, and attempt to build prototypes and solutions that can then be evaluated quickly. The ideal is for a team to be able to work on a rapid solution, get immediate feedback and then roll that feedback into its efforts. This is how Corning’s Gorilla Glass came to be chosen to solve the keys-in-the-same-pocket-as-an-iPhone problem, which Steve Jobs discovered.3
Is Innovation Just Thinking Outside of the Box?
In a word, no. Innovation teams need to be grounded in the organization. After all, a group of folks spinning new ideas with no ties back to existing teams and with no real understanding of how to apply these ideas to the purpose and goals of the organization are not likely to get very far.4 At that point, the innovation effort is just wasted effort. Anything developed in an innovation effort must be potentially useful and implementable.
However, there must also be room for new ideas and new approaches. Often, though, this comes about by bringing people from different disciplines together who can share knowledge. Multiple people may have different views of the same issue and, separately, they do not each individually understand enough of the problem to come up with a workable solution. Together, though, they fill in each other’s gaps and can come up with something that is testable and can be refined based on the results of that testing.
Getting Started With Innovation
If an organization is interested in building an innovation team or an innovation culture, how does it get started? There are three key steps.
Define the Goals
If there are not clear goals, there is nothing to determine or measure success. The M in the SMART (specific, measurable, assignable, realistic, time-related) goal system is measurable. This applies to an innovation team, too. While innovation is about research and developing new solutions, it is not unmeasurable. Different metrics can be tracked, but they should be relevant to the industry of the organization. For instance, a sales organization may look at research and development budget vs. conversion to new sales, as suggested by researchers.5
From an audit perspective, these metrics will not tend to have a great deal of meaning except when considering whether the organization is using resources effectively. Auditors are more interested in whether or not an innovation team is following appropriate processes. Getting involved early with an innovation team or innovation efforts is akin to engaging early in the project management cycle. While innovation is designed to be fast and, in some cases, a nontraditional means for coming up with solutions and potential products, auditors must still ensure that any such efforts fit within the overall governance and audit frameworks.
Build the Right Culture
The first thing to build is the acceptance that it is okay to fail. Actually, it is better to develop the mind-set that a failure is just a result from which valuable data can be obtained. Most people are familiar with Thomas Edison’s quote about not failing 1,000 times to make a light bulb, but of learning of ways not to make one. Edison’s failure was not just on the attempts to develop a successful product. Edison’s labs also developed products that, ultimately, did not work in the market, which would be classified as business failures.6
Keep in mind that when talking about failure here, it is being looked at in the same way as Agile looks at failure: small, quick efforts that are basically running experiments to determine what works and what does not. It is better to “fail fast” or “fail small,” meaning quickly with relatively low cost, but gaining knowledge in the attempt. This allows stakeholders to use the information gained from that attempt immediately and avoid “failing big” after a greater length of time and in a more costly way.7 With that said, “failure” cannot permit anything that would result in a regulatory issue, cause a data breach, or in any way cause a significant issue for the organization. Certainly, an auditor is invaluable here to ensure that the innovation team has a clear understanding of what failures can happen and which ones absolutely must not.
The second thing, especially with an innovation team, is that it truly must be a team. Lone wolves do not result in sustained innovation. People who do not work well within a team are not a good fit for an innovation team because it is often the shared knowledge, expertise and effort that results in successful innovation.
Third, the team must be diverse. Keep in mind that part of solving issues and developing new solutions and products is bringing as much knowledge and experience to bear as possible. Therefore, grabbing team members from one department (such as just IT, or worse, just development within IT) means points of view that could be critical will not be present.
Finally, there must be a focus on delivering solutions. Complaining about existing problems and all the limitations that are in place is an easy trap to fall into. It is what causes stagnation. An innovation team has to be able to accept those limitations and still strive to move forward. Three centuries ago, Yamamoto Tsunetomo wrote, “Throughout your life, advance daily, becoming more skillful than yesterday, more skillful than today. This is never-ending.”8
Make Time for Creative Thinking/Experimenting
It is easy to designate a group of individuals as the organization’s innovation team. However, innovation is research. Research takes time and dedicated effort. Therefore, for an innovation team to be successful, its members must have time to work together to generate ideas, implement them at small scale or prototype them, generate data, and refine/refute those ideas. If members of the team are unable to allocate adequate time for innovation work, then it is unlikely the team will be successful.
Embracing Innovation
Understanding what innovation is with respect to business is important in order to make the most of such efforts and ensure that they are successful. Innovation is not just about the team, but it is also about the culture and embracing the research and findings such a team generates. It is not just the idea that people have to “think outside of the box,” but rather that innovation is built upon the expertise and knowledge of people within the organization who are given the time and opportunity to develop and suggest ways to improve, or new products or solutions to deliver. Therefore, innovation is something most organizations should embrace to improve how they operate to be more competitive.
Endnotes
1 Surowiecki, J.; “The Open Secret of Success,” The New Yorker, 12 May 2008, https://www.newyorker.com/magazine/2008/05/12/the-open-secret-of-success
2 Satell, G.; “Four Ways to Build an Innovative Team,” Harvard Business Review, 13 February 2018, https://hbr.org/2018/02/4-ways-to-build-an-innovative-team
3 Bajarin, T.; “How Corning’s Crash Project for Steve Jobs Helped Define the iPhone,” Fast Company, 10 November 2017, https://www.fastcompany.com/40493737/how-cornings-crash-project-for-steve-jobs-helped-define-the-iphone
4 Fudge, C.; J. Roca; “Ten Tips for Successful Innovation Teams,” InnovationManagement.se, 12 April 2012, www.innovationmanagement.se/2012/04/12/10-tips-for-successful-innovation-teams/
5 Aase, G.; E. Ruth; S. Swaminathan; “How to Take Measure of Innovation,” McKinsey & Company Podcast transcript, October 2018, https://www.mckinsey.com/business-functions/strategy-and-corporate-finance/our-insights/how-to-take-the-measure-of-innovation
6 Hendry, E. R.; “Seven Epic Fails Brought to You by the Genius Mind of Thomas Edison,” Smithsonian.com, 20 November 2013, https://www.smithsonianmag.com/innovation/7-epic-fails-brought-to-you-by-the-genius-mind-of-thomas-edison-180947786/
7 Will, S.; “Fail Fast–Succeed Sooner!” IBM Community Being Agile blog, 30 May 2017, https://www.ibm.com/developerworks/community/blogs/beingagile/entry/Fail_Fast_Succeed_Sooner?lang=en
8 Tsunetomo, Y.; Hagakure: The Book of the Samurai, Japan, circa 1716
K. Brian Kelley, CISA, CSPO, MCSE, Security+
Is an author and columnist focusing primarily on Microsoft SQL Server and Windows security. He currently serves as a data architect and an independent infrastructure/security architect concentrating on Active Directory, SQL Server and Windows Server. He has served in a myriad of other positions including senior database administrator, data warehouse architect, web developer, incident response team lead and project manager. Kelley has spoken at 24 Hours of PASS, IT/Dev Connections, SQLConnections, the TechnoSecurity and Forensics Investigation Conference, the IT GRC Forum, SyntaxCon, and at various SQL Saturdays, Code Camps, and user groups.