人力资源模板之职业与雇佣关系（简洁、清爽）ppt课件

1、Michael zur Muehlen, Ph.D.Asst. Professor of Information SystemsStevens Institute of TechnologySessionTitle:Operational Risk Management and BPMWelcometo Transformation and Innovation 2007 The Business Transformation Conference22Stevens Institute of TechnologyPrivate university, founded 18701800 unde

2、rgraduate, 2600 graduate studentsLocated in Hoboken, NJ (across the Hudson from Manhattan)Three SchoolsTechnology ManagementEngineeringArts & SciencesRankings:Top 5 technology management program, on par with Stanford, MIT, CMU, Babson (Optimize Magazine)#1 for best distance learning program (Princet

3、on Review)Top 25 for most connected Campus (Sloan Foundation)33Howe School of Technology ManagementOffers MBA in Technology Management, Master of Science (IS, Telecom Mgmt, Mgmt, EMTM), Bachelors Degree (Business & Technology)Programs taught on campus and off-site in corporate locationsCl

4、ients: ADP, Avaya, BASF, Bristol-Myers Squibb, Chubb, Citigroup, Deutsche Bank, J&J, Lockheed, Merrill Lynch, PaineWebber, Pearson, Prudential, PSE&G, UBS, UPS, Verizon and othersResearch centers with focus onProcess ManagementProject ManagementProduct I 4May 22-24, 2007 Was

5、hington Dulles HiltonThe Business Transformation ConferenceWhat this Talk is AboutRisk: Driving Process ManagementWhat are operational risks in the context of BPM?How to identify operational risksHow to prioritize operational risksHow to make better decisions based on risk information4May 22-24, 200

6、7 Washington Dulles HiltonThe Business Transformation ConferenceMotivationDrivers for Business Process Management (BPM)PerformanceBusiness Process ImprovementEngineering of Process-aware IS ComplianceMandated compliance (e.g. SOX)Desired compliance (e.g. ISO, ITIL)May 22-24, 2007 Washington Dulles H

7、iltonThe Business Transformation ConferenceYoure HiredProcess: New Hire IntegrationBackground CheckAllocation of office spaceReservation of phone, pagerCreation of access rights in operational systemsProblem: Lost productivity due to late provisioning of work infrastructureAutomating the process coo

8、rdination reduced cycle time from 2 week average to 2 daysBPM Goal: PerformanceMay 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceYoure FiredProcess: Employee TerminationRemoval of computer access rightsCollection of company-issued phone, pager, access cardRemoval from emp

9、loyee directoryProblem: Not all equipment is collected, access rights remain after an employee leavesAutomating the process coordination ensures that no step is forgottenBPM Goal: Compliance8May 22-24, 2007 Washington Dulles HiltonThe Business Transformation Conference8Operational Process RiskOperat

10、ional Risk:Probability that a process will either fail to meet its objectives or make excessive use of resources to meet themA degradation in process output or process consistencyCan be valued financiallyRisk is an inherent property of any business processQuantifying operational risk exposure is dif

11、ficult9May 22-24, 2007 Washington Dulles HiltonThe Business Transformation Conference9Process and Risk ManagementProcessRiskProcess-orientedRisk ManagementRisk-orientedProcess Management10May 22-24, 2007 Washington Dulles HiltonThe Business Transformation Conference10Process-Risk ManagementHow can w

12、e systematically identify operational process risk?How can we represent risk in popular process modeling methods?How can we quantify the risk exposure of processes and portfolios?How can we determine the cost effectiveness of process controls?How can we support risk-aware process design?May 22-24, 2

13、007 Washington Dulles HiltonThe Business Transformation ConferenceRisk Management LifecycleMay 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferencePotential BenefitsSystematic measurement of Process Risk enables us to:Provide risk-adjusted process configurationsManage the risk

14、of process portfoliosDetermine the capital reserve necessary to cover operational risk contingenciesDesign fault-tolerant processesMay 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceRisk Management and BPMRisk ManagementBPMFocused on ensuring value for stakeholdersFocus on

15、 providing value for stakeholdersRisk is an inherent property of business processesPerformance depends on effectiveness of business processesRisk is mitigated by process designPerformance is influenced by process designFeedback is obtained through Risk Indicators assigned to systems and processesFee

16、dback is obtained through Performance Indicators assigned to systems and processesRisk is mitigated through optimized processesPerformance objectives are achieved through optimized processesFrew (2006)Compare Frew (2006)14May 22-24, 2007 Washington Dulles HiltonThe Business Transformation Conference

17、Case Study: Wheres the Money?14May 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceCase StudyPayroll process at Australian universityFailed in June 20052000+ employees not paid in timeExpensive mediation procedureReasonsData entry mistakeEstablished mitigation procedure (do

18、uble sign-off) failedLack of risk awarenessPayroll ProcessMay 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceProcess without Control ActivitiesMay 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceCommon Risk Modeling19May 22-24, 2007 Washington Dul

19、les HiltonThe Business Transformation Conference19Risk PropertiesRisk ownerRisk category (e.g. Financial, Operational, Market, Strategic)Last risk evaluationReview periodRisk occurrence historyQuantitative & Qualitative evaluation:Amount of damagesOccurrence frequency20May 22-24, 2007 Washington Dul

20、les HiltonThe Business Transformation Conference20Control Activity PropertiesKey Control Activity (Yes/No)Control type, e.g. preventive, reactiveControl category, e.g. audit, passwordDesign effectivenessOperating effectivenessManual / AutomatedMay 22-24, 2007 Washington Dulles HiltonThe Business Tra

21、nsformation ConferenceCloser Look At The ProcessMay 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceComponent Risk23May 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceA Closer Look: Faults, Errors, Failures2324May 22-24, 2007 Washington Dulles Hil

22、tonThe Business Transformation Conference24Risk = Faults, Errors, and FailuresFaultVulnerability of a process that may lead to process failureError-enabling contextCan be active or dormantExample: Unavailability of a database serverErrorAction that may lead to failureExample: Attempt to retrieve dat

23、a from the unavailable DBFailureEvent, when process output deviates from correct outputExample: Process aborts due to lack of necessary data25May 22-24, 2007 Washington Dulles HiltonThe Business Transformation Conference25Chain of ThreatsFaults enable ErrorsBut errors might not happen for a long tim

24、eProcess design should strive to minimize faultsIf faults cannot be avoided we need error detection26May 22-24, 2007 Washington Dulles HiltonThe Business Transformation Conference26Chain of ThreatsErrors may lead to FailuresOptions: prevention, detection, or mitigationIf faults are known, we can min

25、imize errors: poka-yokeCost, effort play a role27May 22-24, 2007 Washington Dulles HiltonThe Business Transformation Conference27Chain of ThreatsFailures become visible at InterfacesNoticeable once the process result leaves your handsService interfaces can be described in a hierarchical fashionInter

26、faces are unsuitable for error mitigation:Point of No Return = time of hand-over recovery time28May 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceFault/Error/Failure in Context28May 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceFault LatencyFau

27、ltInexperienced Staff Member on DutyErrorFailureData Entry MistakeFaulty Payroll Run ApprovedComplacent StaffFaulty Payroll Run Transmitted30May 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceWhere to Look First: Priorities30May 22-24, 2007 Washington Dulles HiltonThe Busi

28、ness Transformation ConferencePrioritize: Not All Failures are EqualLikelihoodEffectUnlikelySeldomOccasionalLikelyFrequentLoss of Process CapabilityLoss of Process InstanceCompromise of Process Instance GoalMinor effect or obstructionMay 22-24, 2007 Washington Dulles HiltonThe Business Transformatio

29、n ConferenceProcess ObjectivesMay 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceRisk/Goal MatrixMay 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceUnderstand Risks Then Manage ThemSource: zur Muehlen, Rosemann (2005)Matching Mitigation?May 22-24

30、, 2007 Washington Dulles HiltonThe Business Transformation ConferenceEvaluation of Process Design AlternativesAlternativeEntry costApproval costProbabilityRectific. costUtilityIncorrect data entryError missed during approval processComb. risk1. single entry, single approval$1,000$5000.050.30.015$250

31、,000-$5,2502. double entry, single approval$2,000$5000.00250.30.00075$250,000-$2,6883. single entry, double approval$1,000$1,0000.050.090.0045$250,000-$3,1254. double entry, double approval$2,000$1,0000.00250.090.000225$250,000-$3,056May 22-24, 2007 Washington Dulles HiltonThe Business Transformatio

32、n ConferenceSensitivity AnalysisAlternative with the best utilityProbability of error being missed during the approval processProbability of data entry error0.01alt 1alt 1alt 3alt 3alt 2alt 2alt 2alt 2alt 20.05alt 3alt 3alt 2alt 2alt 2alt 2alt 2alt 2alt 20.1alt 3alt 2alt 4

33、alt 4alt 4alt 4alt 4alt 2alt 20.15alt 3alt 4alt 4alt 4alt 4alt 4alt 4alt 4alt 40.2alt 3alt 4alt 4alt 4alt 4alt 4alt 4alt 4alt 40.25alt 3alt 4alt 4alt 4alt 4alt 4alt 4alt 4alt 40.3alt 3alt 4alt 4alt 4alt 4alt 4alt 4alt 4alt 40.35alt 3alt 4alt 4alt 4alt 4alt 4alt 4alt 4alt 40.4alt 3alt 4alt 4alt 4alt

34、4alt 4alt 4alt 4alt 40.45alt 3alt 4alt 4alt 4alt 4alt 4alt 4alt 4alt 40.5alt 3alt 4alt 4alt 4alt 4alt 4alt 4alt 4alt 40.7alt 3alt 4alt 4alt 4alt 4alt 4alt 4alt 4alt 40.9alt 3alt 3alt 4alt 4alt 4alt 4alt 4alt 4alt 437May 22-24, 2007 Washington Dulles HiltonThe Business Transformation Conference37From

35、 Control Activities to Control Patterns38May 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceManaging Risks3839May 22-24, 2007 Washington Dulles HiltonThe Business Transformation Conference39Risk Management StrategiesRisk Mgmt. StrategyDescriptionExamplesMitigationReduces t

36、he probability of a risk and/or the impact that results from the occurrence of a risk. Aims at the implementation of controls that dampen the effects of risk occurrences, while not completely alleviating them.Standardized process routingFormalized exception handling Complete kit processingCollaborat

37、ion, checks & balancesAvoidanceEliminates the probability of a specific risk before it materializes. Normally realized by trading the risk for other risks that are less threatening or easier to deal with.Process redesignTransferShifts risk or the consequences caused by risk from one party to another

38、. Also called “risk sharing”. May involve the purchase of an insurance policy, or the outsourcing of risky project parts.Process OutsourcingPurchase of Insurance PoliciesAcceptance/AssumptionAdapts to the unavoidability of the risk. A risk contingency plan is required in this strategy.Adaptation to

39、regulatory requirementsMay 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceComplianceCompliance means adherence to rules and regulationsProcess models provide execution rulesControl flow: What happens when?Task allocation: Who is involved?Role models: Who may do what?But wh

40、at about context?Business object dependencies: Value/Customer TypeEnvironmental dependecies: Season/Off-season processingRegulatory compliance: Documentation/AuditCorrelation of multiple processes4141Distinguish between Soft and Hard ConstraintsHard Constraints: Process RulesData dependenciesResourc

41、e dependenciesMust not be violatedFailure can lead to process breakageSoft Constraints: Business RulesRisk mitigation activitiesDocumentationChecks and BalancesCan be worked aroundFailure can lead to non-complianceMay 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceManaging

42、 Risk with BPMSUse formal Process Models to limit process non-complianceProcess Models can be scripts or mapsIf Scripts: Use BPMS to automate control flow, task allocation, application/service invocationIf Maps: Use collaborative tools to allow execution flexibilityBPMS provide risk management servi

43、cesAuthorizations / Access ControlEnforcement of routings, reviewsAudit capability to document compliance43May 22-24, 2007 Washington Dulles HiltonThe Business Transformation ConferenceManaging Risk with BRMSUse Business Rules to limit contextual non-complianceDocument process objectives to prevent

44、business rules from turning into process rulesPerformance Objectives combine BAM with BRMSDecision rules allow context-dependent enforcement of oversightUse Business Rules Management System to enforce complianceDocument rules limit the state changes on documentsExample: Cant go from draft to approve

45、d without reviewCustomer rules configure case handling4344May 22-24, 2007 Washington Dulles HiltonThe Business Transformation Conference44TakeawaysMap Risks from different anglesFaults (cant eliminate all)Errors (prevent, detect, mitigate)Failure (where is the point-of-no-return?)Use Process Objectives to determine critical risk factorsUse Scenario Techniques to test different risk management strategiesCompliance refers to Process Rules and Business RulesDont confuse the twoBPMS can help document and audit process rulesBRMS can help e