Monday, March 16, 2015

When on the CLOUD, Mind the Gap(s)

The CLOUD is here; it is here to stay, say and sway. Think about any business and chances are they are on the cloud already. Right from the simple web mail, to the moderately sophisticated Video collaboration tools, the Lync, sharepoint and other communicators, to the most complex CRM, ERP Dashboards, every tool that we use is on the cloud today- unknowingly, we are on the cloud more than we know.

With all its benefits of speed, flexibility, cost and variety, the cloud suffers from some drawbacks at the implementation level.

1) Contracts and administration: I believe there is still a lot of weakness in Businesses' understanding of cloud contracts. Applications that are outsourced to the cloud come with thick contracts, which are very technical and not too easy for businesses to understand immediately. For instance, how is the payment really scheduled? What is in-scope? The grayest of all areas lies around maintenance and changes. It becomes difficult to understand what truely constitutes a change request and what is indeed part of the support package. Is it surprising therefore that most businesses tend to never use all that they buy? The packaging, in my opinion, makes it difficult for businesses to buy exactly what they need- they land up buying a lot more and then never use everything they buy in a cloud contract.

2) Time to implement: Cloud applications dont simply "WALK INTO" a company. Its not as if a business decides to implement a CRM application, and it magically becomes available tomorrow. Cloud applications have to be IMPLEMENTED like any other. They have to follow the usual project delivery process that any business usually follows. This is mostly done by way of the usual application projects and typically takes months to implement. By any standard, any simplistic application will take 4 to 5 months at the very least, before the end user actually starts using it. This greatly diminishes the advantage that cloud applications bring- customized, off the shelf and READY TO USE. I like to use the phrase "This clouds the cloud"

3) Implementation issues:  A common practice in many organisations in project delivery is to test the application from the point of view of security-the web applications testing as we commonly know it. This is where technical teams typically BREAK the application from various points- SQL Injection, un-necessry DB privileges, unsecured transmission of data, SSL implementations etc. While such testing is common place for in-house applications, it is not easy to test cloud based applications for such gaps. Cloud vendors sometimes have a problem with letting a technical team BREAK their application, for this may compromise the data of other customers, cause issues etc. A way around this is to have the cloud vendor provide a certificate from a 3rd party that his application is secure and follows the usual web application standards and guidelines. But this can be costly and the cost immediately gets transferred over to the client. One way or the other, cloud applications suffer from issues at the implementation level which mar their proposition of being cost-effective.

4) Support Model: Cloud and 3rd party applications are fundamentally changing the way support departments, or operations department are serving their end users. The concept of the HELPDESK is shifting fundamentally. Earlier, and for the longest time, every time an end user would face an issue, he would simply pick up the phone and call up the help desk. Or, he would log a ticket in his remedy system. But with the advent of cloud, support has moved to the 3rd party- indeed, this is one of the biggest value propositions of the cloud- to transfer support and ownership issues to a 3rd party so the business can focus on its core areas.
But this has its own complications. Because the application will be supported (read HANDS ON issue resolution), help desk and operation teams will not get totally familiar with the hands on issues of the applications-they aren't even expected to. In such a situation , whom does the end user call? If he calls the help-desk, are they expected to turn him away under the pretext that this is a cloud project and that he must call the vendor? If so, and if the user is indeed supposed to call the vendor support directly, this adds a change in the usual ways of working of the end users. This is something businesses don't like to see happen. This also involves training the end users to use the new ticketing system, and introducing the risk of having multiple such ticketing systems, one for each cloud application or vendor.
On the other hand, if the user still is expected to continue to call the help desk, then the help desk must be trained to route this issue to the vendor. This means linking the 2 ticketing systems together so that the vendor recieves the ticket without the end user experiencing a change in his experience. One way or the other, this involves BRINGING THE VENDOR into the business organisation- either by way of remote access ,or onsite support or something else. Either way, this adds cost and complexities, most of which must be borne by the business.

In my opinion, the last 2 issues- implementation related and the support model- will continue to cause disclaimers in cloud implementations. The entire cloud model must move to the next level of maturity to seamlessly integrate cloud applications with the usual ways of working within businesses. 

Tuesday, March 10, 2015

Its a RISK to ignore the RAID log

The RAID Log means so many things to so many Project Managers. Some (including me for a long time) look at it as a mere Risk Register to record those one-off risks in the project- delays in milestones, approvals not coming in time, a failed UAT, a defect somewhere etc.

Some (including me now) use the RAID log as a very important tool that AIDS the PM. The 4 components of the RAID log are crucial components of the Project Mgmt tool set at the disposal of a project Manager. Here is why I love the RAID Log so much:

1) RISKS: The conventional way of logging risks is to identify them in the execution stage, and that's not right. The process of collection and identification of Risks begins on the first day. For instance, every project deals with and processes data of varying complexity levels. This means identifying recommendations such as data encryption, security tests and DB encryption etc at the beginning of the project. These recommendations get implemented in the solution. This is the best way to use the Risk Register of the RAID. Log a RISK for this level of data complexity, identify these recommendations in the mitigation, and put them in the project plan or in the design document. Remember, the RISK log itself just acts as a placeholder for things that can go awry. It is how and when the mitigation is implemented that is more important. This is a great example of how the RAID log can help in designing, planning and tracking, not just in identification of a RISK.
A good way to make sure all risk are being covered is to conduct a risk identification session once every week or two with the main stakeholders.

2) Assumptions: Log every assumption there is to assume! and act on it, confirm it or reject it! Far too many problems in the project happen later because things were ASSUMED, but not recorded. The simplest example is to assume the business will drive the UAT. Much as the project manager holds this as universally understood, it is not always evident to the business that they are the ones who will drive the UAT. Most businesses may have a generic impression that they will get a chance to REVIEW the product before implementation, but thats about it. It is best to record this in the assumption log and align with the business. Keep revisiting assumptions every now and then, and make sure everyone knows what is being assumed. False and unidentified assumptions can cost the project dearly.

3) Issues: This is the trickiest area- things that HAVE GONE WRONG. These items find their ways into the escalation sections of the status reports on most occasions. Most importantly, correctly logging an issue and its mitigation plan demonstrates to the sponsors that the PM is still in control of the project. It also highlights to everyone involved that we have a problem, and we must all work together to resolve it soon, before it impacts other things.

4) Dependencies: This is the subtlest of all the components, yet so important when used effectively. There is a reason why the MS Project is a very popular PM tool today, and that's because it respects dependencies like none other. I once worked on a project wherein, a particular person sitting in the USA would activate a site, only after which it would be made available to users the next day in my country. The problem here is obvious- the time difference between India and USA meant he would do this when i would be fast asleep in the night. What if he failed, for any reason? How would he contact me to inform me in the middle of the night? Importantly, how would I tell my users, before 8 am that the site cant be used? This is a classic case of how useful dependencies can become. I logged a dependency, aligned this with his team, and ensured there was enough backup and communication between the 2 teams, to wade off any last minute hiccup. Dependencies are usually followed by clear and crisp regular communication, with a call-to-action at a particular date. When dealing with multiple teams each with a contribution to the project, not using the Dependency log is invitation to disaster. Planned leaves, back up plans, are other classic examples of dependencies.

In conclusion, the RAID log acts as a written contract between all concerned parties in the project, and gets everyone on board to act when required. The RAID log is not just a save-my-skin tool for the PM, it is so much more. When used correctly and effectively, it can act as a tool that can help the PM plan, design, execute, monitor and close the project well.

What's not to love about it then?