HelpSource Q&A

Author: Sunil Bakshi, CISA, CRISC, CISM, CGEIT, CDPSE, AMIIB, MCA
Date Published: 1 September 2019

  A speaker at a conference I recently attended stated that “Organizations must adopt digital transformation to stay ahead in business.” My question is what does the term “digital transformation” mean? How can organizations successfully implement these initiatives?

  The term “digital transformation” has been used for many years. Initially, it merely meant to use more IT-based solutions to automate business processes. According to some experts, it means moving from paper-based organizations to paperless organizations. Evolving new technologies have redefined digital transformation to mean end-to-end automation leveraging advances in artificial intelligence (AI), the Internet of Things (IoT), blockchain technologies, big data and analytics, and the cloud. Thus, the new definition of digital transformation, essentially, is enabling organizations to achieve business growth thereby increasing revenues and profits. Since digital transformation involves adopting new ways of working, digital transformation implies inherent positive and negative risk that organizations must deftly manage.

When planning for digital transformation, organizations must factor in risk associated with:

  • Cultural changes—Digital transformation demands that leaders and employees adopt and rely on unfamiliar technologies.
  • Competition—Organizations may adopt these technologies to face the challenges of competition, either because a competitor is introducing new technology-based products or enterprise leaders feel that these technologies are required to stay ahead of the competition.
  • Security—Digital transformation technologies are still new and carry yet unidentified security-related threats and vulnerabilities.
  • Failure of adoption—Being new, the probability of technology failure can be higher than with already-established technologies.
  • Project-related risk—Adoption of new technology is generally initiated as a project.
  • Hurried implementation—Leaders often rush the implementation of new technologies. This dynamic can result in underperforming organizations and unsatisfied customers. It can also result in unhappy board members who are not willing to reinvest further in technology.

Many times, when it comes to new technology, people try to jump on the band-wagon instead of implementing well-designed plans for business imperatives such as improvements in business operations, profitability, customer experience, security and efficiency. Digital transformation efforts also may fail when enterprise leaders focus on technology rather than its use for business. To reduce the possibility of the failure of digital transformation implementation, organizations need to focus on governance. When business is strategically dependent on IT to deliver, in a digital transformation context, then management and the board must:

  • Evaluate performance of IT in the context of the organizational strategy
  • Direct IT if its performance compromises the organization’s strategy
  • Monitor performance of IT to ensure that the organization’s strategy will be delivered
  • Support business and IT owners to identify and manage risk associated with new technology
  • Provide appropriate resources, including budget, after considering the risk appetite1

Digital transformation is a business-critical issue and may take more time to realize benefits, which makes the need for effective governance imperative. Some digital transformation technologies (e.g., blockchain) are still being explored for business use and use-case developments are in the experimental stage. Some organizations have initiated support groups and support mechanisms for start-up enterprises that are experimenting with new technologies by providing incubation and mentoring facilities to explore digital transformation technologies. This approach helps organizations manage investments in new technologies within their risk appetite.

Endnotes

1 Pearce, G.; “Digital Transformation? Boards Are Not Ready for It,” ISACA Journal, vol. 5, 2018, https://www.isaca.org/archives

Sunil Bakshi, CISA, CRISC, CISM, CGEIT, ABCI, AMIIB, BS 25999LI, CEH, CISSP, ISO 27001 LA, MCA, PMP
Has worked in IT, IT governance, IS audit, information security and IT risk management. He has 40 years of experience in various positions in different industries. Currently, he is a freelance consultant in India.