Chapter.

4
Governance Analysis Using
Enterprise
Architecture
Kinza Razzaq
 What is Governance?

• Relates to consistent management ,Policies , guidance,

processes and decision rights for given area of
responsibility.
 Surbanes-oxley

• Surbanes-oxley act of 2002

• Named as company accounting reform and investor
protection
• Most important goals of the act is to ensure that
company directors and officers and aware and
accountable for the financial condition of the
company they manage.
 Governance Analysis Framework

• The Zachman framework provides a way to cut through

the complexity of today’s enterprises and document the
relationships that exist between each column for each
row
• These relationships are illustrated as matrices
 Different types of matrices

• Data matrices: data to data to locations, data to people

or business units, data to events, data to business plans
• Process matrices: processes to data, processes to
locations, processes to business units, processes to
events, processes to business plans
• Location matrices: locations to data, locations to
processes, locations to people or business units ,
locations to events, locations to business plans
 Cont.

• People or business unit matrices: people or business

units to data, people or business units to processes,
people or business units to locations, people or business
units to events, people or business units to business
plans
• Business event matrices: business events to data,
events to processes, events to locations, events to
people or business units, business events to business
plans
 Cont.

• Business plan matrices: business plans to data,

business plans to processes , business plans to
locations, business plans to people or business
units ,business plans to business events.
• When senior managers use governance analysis
framework matrices as described here, they are able to
demonstrate that they have a powerful management
 Developing a Governance
Analysis Framework
• All the matrices were manual.
• Manually determining the relevant row and column titles
for each of these matrices is extremely difficult
• to keep them manually updated continually as the
enterprise changes overtime is even more difficult
• the row and column titles for each matrix in these
figures can automatically generate from strategic model
by a modeling tool
• These matrices provide a powerful internal control
reporting capability
• These matrices are generated from the business plans
that are defined and agreed on by senior management
for the enterprise
• Plans define the strategic directions that the senior
management team establishes to manage the enterprise
today, and provide direction as it moves into the future
 How strategy model works?

• A strategic model provides a “picture of the business”

• Just like a city map
• The strategic model also enables key business activities
and processes to be identified and named. These
identified activities and processes are automatically used
to create the activity rows
• The named business units responsible for, or involved in,
implementing the business plans are automatically used
to create the business unit columns
 Strategic Model

• The strategic model is automatically used to create the

relevant rows and columns of many other matrices
 Strategic Model

• The development of a tailored strategic model for an

enterprise is the vital first step toward establishing
internal control reporting based on dynamic governance
analysisframeworkmatricesthatcanbeautomaticallygen
eratedasdiscussedearlier.The method used to achieve
this is called strategic modeling.
 Time Period

• A typical strategic modeling project to define a tailored

strategic model for an enterprise takes 25 days—
typically spread over 3 months.
• This 25-day period does not result in completed GAF
matrices, but it does automatically create each relevant
blank dynamic matrix row and column name, tailored to
the terminology enterprise.
 Continued..

• The completion of a strategic modeling project in this

time frame depends on corporate buy-in and support by
senior management. It requires the senior management
team and their direct reports to participate for 2 days in
a facilitated session near the start of the 25-day period
to help develop the tailored strategic model. Their
active commitment is vital: It ensures that their key
needs for internal control reporting are incorporated
into the strategic model.
 Continued..

Two days is a significant demand on their limited

time availability, but it is essential. Although this
facilitated session with management has been
reduced in some cases to 1 day, the accuracy,
usefulness, and maintainability of the resulting
GA matrices suffer if the senior management
team is not actively involved. If their direct
reports participate on the second day.
 Outputs
• The result of this strategic model analysis is
documented in an enterprise architecture portfolio
plan (EAPP) report. This is the main deliverable
from a strategic modeling project. This report
includes an executive summary and key
recommendations, with a description of the
methods used to maintain the delivered tailored
GAF matrices over time. Appendices are also
included that document all components of the
defined strategic model for internal control
reporting.
 Business Plan

• Business plan: Documents the strategic business

planning statements that were used as the catalyst for
the facilitated strategic modeling session. These
address the why questions for SOX compliance.
 Strategic Model

• Strategic model: Documents the enterprise strategic

model and high-level
tacticalmodelsforkeybusinessunits.Thesemodelsarerepr
esentedasdatamaps that show a “picture of the
business.”
 Strategic Data

• Strategic data: Documents the underlying data

represented in the enterprise strategic model and high-
level tactical models for key business units. This answers
the what questions for SOX compliance.
 Business Activities

• Business activities: Identifies key business activities that

are reflected in the strategic model, as determined
during and after the facilitated session. This answers the
how questions for SOX compliance
 Business Activity Cluster

• Business activity clusters: Documents automatically

derived project plans that identify the data required by
each activity. This identifies activities that can be reused
throughout the enterprise—with large potential cost
savings from this reuse. This also answers the how
questions for SOX compliance.
 Business Locations

• Business locations: Lists key locations (where relevant)

that were identified during and after the facilitated
session. This answers where questions for SOX.
 Business Units

• Business units: Lists key business units identified during

and after the facilitated session based on the high-level
tactical models from the strategic model. This answers
the who questions for SOX compliance.
 Business Events

• Business events: Lists key business events (where

relevant) identified during and after the facilitated
session. This answers the when questions for SOX
compliance.
 GAF Matrices

• GAF matrices: Documents blank governance analysis

framework matrices from the data, activities, locations,
business units, events, and business plans from the
earlier appendices.
 EAPP Report

• The EAPP report and its contents (as described earlier)

provide a high-level documented view of tailored
internal control reporting from the perspective of senior
management.Thesematricesthenmustbecompletedbyr
elevantbusinessexpertsas discussed earlier. The
strategic GAF matrices are typically defined later as
more detailed matrices by key business units.
 Strategic & Tactical Modeling

• Strategic modeling and tactical modeling projects have

been completed for large and medium commercial
enterprises throughout the world. Some of these.
Strategic modeling and tactical modeling projects for
government and
defensehavebeencompletedintheUnitedStates,Canada,
Australia,andNewZealand.
8-Steps Listing for Governance
Analysis

Establish plan for strategic Capture initial business

modeling project planning input as catalyst

Conduct strategic modeling Carry out strategic model

facilitated session analysis
8-Steps Listing for Governance
Analysis

Derive governance analysis Review matrices and

framework documentation governance implementation
plan

Manage progressive Manage implementation of

completion of GAF matrices governance analysis systems
 Manage 3-Motnhs Senior
Task Period Managers
& Direct
Reports

Step 1—Establish Plan for

Strategic Modeling Project

2-Days Convenient
Session Later Date for all
Review Managers
Session
 Input from all
Participating Business Template
Managers Planning on the
Questionnaire CD-ROM

Step 2—Capture Initial

Business Planning Input as
Catalyst
Anonymous
Responses Entered into
Responses the Modeling
Returned to a Tool
Central Point
 Expansion of
Consolidated “Picture of
Business
Responses the Business”
Strategies

Step 3—Conduct Strategic

Modeling Facilitated Session
Progressive
Development Activities
on Processes
Whiteboard Used by Key Locations
Facilitator and Organizational Units
Managers Business Events
 Entry of Analyze and Data Required
Model to Automatically by each Activity
Modelling Identify or Process
Tool

Step 4—Carry Out Strategic

Model Analysis

Business & IT Date

Experts, Under Activities
Guidance of Develop Processes
Facilitator Textual Key Locations
Definitions Organizational Units
Business Events
 Facilitated
Session &
Associated Activities and
Definitions Processes Locations
of Data (HOW) (WHERE)
(WHAT)

Step 5—Derive Governance

Analysis Framework
Documentation
Organizational
Units Business
Business Plans
(WHO)
Events (WHY)
(WHEN)
 Managers
return for
the 1-day At the end of
review 25 days changes are
session made
immediately

Step 6—Review Matrices and

Governance Implementation Plan

Required under the

changes or guidance of
by the
reprioritization the
business and
IT expert facilitator
team
 Managers
return for
the 1-day each required
Progressively governance
review complete
session analysis
framework matrix

Step 7—Manage Progressive

Completion of GAF Matrices

matrices are these two

reviewed steps are
kept up to repeated
date periodically
 for further
internal
control each required
used for rapid governance
reporting to
delivery of analysis
senior these systems framework matrix
management

Step 8—Manage Implementation of

Governance Analysis Systems

managed as
3-month
tactical modeling
systems increments,
projects
are delivered using
into technology
production