Introduction to Implementation and Change Governance

Implementation and change governance is a crucial aspect of managing architecture within an enterprise. As organizations operate in dynamic environments, the need for flexibility in governance processes becomes paramount. This guide outlines the principles and practices of implementation governance, focusing on how to assess compliance, manage non-compliance, and ensure that changes align with the Target Architecture.

Key Concepts

1. Dynamic Environment

Organizations must navigate a constantly changing landscape, which means that the Target Architecture may not cover every possible scenario or change option. Governance processes must be adaptable to accommodate these changes while maintaining alignment with the architecture.

Example: A company may need to pivot its digital strategy due to emerging technologies or market demands, requiring adjustments to its existing architecture.

2. Governance Roles: Auditor and Architect

In the governance process, practitioners often take on two roles: the auditor, who assesses compliance, and the architect, who provides recommendations based on impact assessments. This dual role is essential for ensuring that changes are evaluated thoroughly and that appropriate actions are taken.

Example: An auditor may identify that a new software implementation does not comply with the Target Architecture, prompting the architect to assess the impact and recommend a course of action.

3. Compliance Assessment

Compliance assessment involves evaluating whether changes align with the Target Architecture. This assessment should be conducted promptly to allow for course corrections if necessary.

Example: If a team decides to use a different cloud provider than specified in the architecture, a compliance assessment will determine if this choice is reasonable and aligned with the overall architecture goals.

4. Impact Assessment

When non-compliance is identified, an impact assessment is necessary to evaluate the implications of the change. This assessment should be conducted using the same criteria that were used to develop the Target Architecture.

Example: If a new application is proposed that does not meet security standards, the impact assessment will analyze the potential risks and benefits of this deviation.

Implementation and Change Checklist

The following checklist is designed to guide practitioners through the governance process when addressing a non-compliance report:

  1. Interpretation of Guidance and Constraints
    • Did the organization reasonably interpret the Target Architecture’s guidance and constraints?
      • Yes/No
      • If yes, accept the interpretation as compliant and address issues through architectural changes.
      • If no, proceed to the next step.
  2. SME Agreement on Impact Assessment
    • Do appropriate SMEs agree with the facts and interpretation of the facts in the impact assessment?
      • Yes/No
      • If yes, proceed.
      • If no, engage with SMEs to resolve conflicts and develop a report for stakeholders.
  3. SME Agreement on Recommendations
    • Do appropriate SMEs agree with the recommendation to enforce the target, grant time-bound relief, or change the architecture?
      • Yes/No
      • If yes, proceed.
      • If no, engage with SMEs to resolve conflicts and develop a report for stakeholders.
  4. Reflection of Impact Assessment in Materials
    • Do the views and materials produced for stakeholders reflect the impact assessment and underpinning architecture models?
      • Yes/No
      • If yes, proceed to stakeholders for approval.
      • If no, revise materials accordingly.
  5. Stakeholder Understanding of Limitations
    • Do stakeholders understand any limitations in confidence regarding the impact assessment?
      • Yes/No
      • If yes, proceed.
      • If no, provide appropriate work products highlighting limitations and return to stakeholders.
  6. Stakeholder Understanding of Impact on Value
    • Do stakeholders understand the impact on prior expected value and any change in certainty in achieving that value?
      • Yes/No
      • If yes, proceed.
      • If no, provide work products that clarify the impact on expected value and uncertainty.
  7. Stakeholder Approval of Recommendations
    • Have stakeholders approved the recommendation to enforce the target, grant relief, or change the architecture?
      • Yes/No
      • If yes, action the recommendation.
      • If no, consider providing additional information to stakeholders to address their concerns.

Examples of Implementation and Change Governance

Example 1: Cloud Migration Project

Context: An organization is migrating its applications to the cloud but encounters a non-compliance issue regarding data storage locations.

  1. Interpretation of Guidance: The team interprets the Target Architecture to allow for data storage in a specific region, but the cloud provider offers a more cost-effective option in a different region.
    • Assessment: The interpretation is reasonable, and the team is deemed compliant.
  2. SME Agreement on Impact Assessment: Security SMEs confirm that the new region meets compliance requirements.
    • Outcome: Proceed to the next step.
  3. SME Agreement on Recommendations: SMEs agree that the architecture can be adjusted to allow for the new region.
    • Outcome: Proceed to the next step.
  4. Reflection of Impact Assessment: The updated architecture documentation reflects the new region and its compliance with security standards.
  1. Stakeholder Understanding of Limitations: Stakeholders are briefed on the potential risks associated with data sovereignty and compliance with local regulations.
    • Outcome: Stakeholders understand the limitations and proceed to the next step.
  2. Stakeholder Understanding of Impact on Value: Stakeholders are informed that while the new region may reduce costs, it could introduce uncertainties regarding data access and compliance.
    • Outcome: Stakeholders acknowledge the trade-offs involved.
  3. Stakeholder Approval of Recommendations: Stakeholders approve the recommendation to adjust the architecture to include the new cloud region.
    • Outcome: The organization proceeds with the migration to the new cloud region, ensuring compliance with the updated architecture.

Example 2: Software Development Change

Context: A software development team proposes to use a new programming framework that is not specified in the Target Architecture.

  1. Interpretation of Guidance: The team believes that the new framework aligns with the architectural principles of modularity and scalability.
    • Assessment: Their interpretation is deemed reasonable, and they are considered compliant.
  2. SME Agreement on Impact Assessment: Development SMEs agree that the new framework can enhance development speed but may introduce compatibility issues with existing systems.
    • Outcome: Proceed to the next step.
  3. SME Agreement on Recommendations: SMEs recommend granting temporary relief to allow for testing of the new framework while assessing its impact on existing systems.
    • Outcome: Proceed to the next step.
  4. Reflection of Impact Assessment: The documentation produced for stakeholders includes a detailed impact assessment that outlines potential benefits and risks associated with the new framework.
    • Outcome: Proceed to the next step.
  5. Stakeholder Understanding of Limitations: Stakeholders are informed about the uncertainties related to the new framework’s integration with legacy systems.
    • Outcome: Stakeholders understand the limitations and proceed to the next step.
  6. Stakeholder Understanding of Impact on Value: Stakeholders are made aware that while the new framework could speed up development, it may also delay integration with existing systems.
    • Outcome: Stakeholders acknowledge the potential impact on project timelines.
  7. Stakeholder Approval of Recommendations: Stakeholders approve the recommendation to grant temporary relief for the use of the new framework, with a plan for a follow-up assessment after a trial period.
    • Outcome: The development team proceeds with the new framework under the agreed-upon conditions, with a commitment to reassess its impact after implementation.

Best Practices for Implementation and Change Governance

  1. Timely Compliance Assessments: Conduct compliance assessments as soon as changes are proposed to allow for timely course corrections.
  2. Engagement with SMEs: Actively engage with SMEs throughout the governance process to ensure that all perspectives are considered and conflicts are resolved.
  3. Clear Documentation: Maintain clear and comprehensive documentation of all assessments, recommendations, and stakeholder communications to provide transparency and facilitate future reviews.
  4. Stakeholder Education: Provide training and resources to stakeholders to help them understand the architecture, its implications, and the governance process.
  5. Iterative Feedback Loops: Establish feedback loops to gather insights from stakeholders after changes are implemented, which can inform future governance processes.
  6. Risk Management Framework: Develop a risk management framework that identifies potential risks associated with changes and outlines mitigation strategies.
  7. Regular Review of Governance Processes: Periodically review and refine governance processes to ensure they remain effective and aligned with organizational goals.

Conclusion

Implementation and change governance is essential for ensuring that architectural changes align with the Target Architecture while accommodating the dynamic nature of organizational environments. By following the TOGAF framework and utilizing the provided checklist, practitioners can effectively navigate the complexities of governance, assess compliance, and manage non-compliance situations.

Through real-world examples, this guide illustrates how organizations can implement effective governance processes that foster flexibility while maintaining alignment with architectural principles. By embracing best practices and engaging stakeholders throughout the process, organizations can enhance their architecture governance, ensuring that changes deliver value and support the overall business strategy.

 

Leave a Reply

Your email address will not be published. Required fields are marked *