Category Archives: Compliance

Compliance / frameworks and BPM

Van Halen’s Management 101

Could healthcare take a lesson from the rock band Van Halen?  Atul Gawande, author of The Checklist Manifesto, describes a simple management tool that Van Halen used to quickly gauge process quality and compliance at their concert venues. By demanding M&M’s with all brown ones removed or face cancellation of the show with full compensation to the band. Evidently, they followed through on the threat once in Colorado after finding brown M&M’s:

“This turned out to be, however, not another example of the insane demands of power-mad celebrities but of an ingenious ruse.  As Roth explained in his memoir, Crazy From the Heat, ‘Van Halen was the first band to take huge productions into tertiary, third-level markets. We’d pull up with nine 18-wheeler trucks, full of gear, where the standard was three trucks, max. And there were many, many technical errors—whether it was the girders couldn’t support the weight, or the flooring would sink in, or the doors weren’t big enough to move the gear through. The contract rider read like a version of the Chinese Yellow Pages because there was so much equipment, and so many human beings to make it function.’

So just as a little test, buried somewhere in the middle of the rider, would be Article 126, the no-brown-M&M’s clause. ‘When I would walk backstage, if I saw a brown M&M in that bowl,’ he wrote, ‘well, we’d line-check the entire production. Guaranteed you’d run into a problem.’ The mistakes could be life-threatening, the radio story pointed out. In Colorado, the band found that the local promoters had failed to read the weight requirements and that the staging would have fallen through the arena floor.”

The little things are the best indicator of the bigger ones…

Brown M&M’s in healthcare

Healthcare is also a very complex ‘show’ to pull of successfully time after time. There are many details to be carried out flawlessly or safety is compromised. What’s even tougher on care professionals, reform legislation makes facilities pay for their mistakes, such as patients getting other illnesses and injuries while under care, and preventable readmissions.

Healthcare has an opportunity to take the Van Halen approach. There are events and non-events to correlate and spot problems before they reach crisis stage. Project RED is a great example of specific ways to reduce readmissions by paying attention to the seemingly small details.

This evidence based approach, used by over 250 hospitals, identified 11 key components common in low readmissions discharge processes. It is great to know the factors, but how many facilities have the capacity to manage those points with each and every patient? I would be willing to bet that a facility that can’t manage an 11-point program could be in danger of a host of other challenges.

Transparency

The only approach that makes sense is to be systematic and to manage ‘brown M&M’s’ to the task level for each role in patient care. There needs to be two-way transparency that allows every patient-facing role to know when and why they play an important part, and to be able to see the guidelines and know when and where each component ‘lives’ in the patient journey.

 

It isn’t difficult to have this level of transparency, but it takes commitment from the healthcare organization to make it detailed and meaningful. As reform plays out, everything will depend on it.

Can you clear the hurdles of change?

Organizational change remains the most difficult part of managing business. The reasons for change can be government mandate, greater efficiency, avoiding risks or losses, or capturing a new market. Regardless of the reason, change is very hard. Enormous and small companies alike fail in the face of change. History is littered with the skeletons of  Kodak, Xerox and many others.

Healthcare is a great example of an industry attempting to move quickly from antiquated processes and systems to modern techniques and tools. It is a fantastic, current case study of the good, bad and ugly sides of overcoming the hurdles inherent in change. We will see in five years what took decades in other markets. Healthcare is taking a crash course in every discipline that surrounds change management.

There are healthcare organizations fighting the change and others embracing the inevitable. For those embracing, the only solution is to face the challenge with a realistic view of what must be overcome:

  • A move from paper records to electronic
  • Change from simple codes based on payments to complex codes based on a host of factors, like how an injury occurred
  • Application of quality metrics to ‘living’ process
  • Demonstration of quantifiable improvements over time
Reading that list, these aren’t new problems…they’ve been a part of other industries for years. 

Hurdles

Standing in the way of change are five tall hurdles, evenly spaced apart in a recent article on the PEX Network. I recommend you read this piece, but I’ve summarized it here:

Stakeholders don’t collaborate – The true stakeholders of process include Business, IT, Training and Compliance. Getting a broad group onboard with any improvement requires an easy way to bring and keep everyone in the discussion and change.

Prioritization is challenging – Missing, wrong or fuzzy KPI’s make it tough to identify the greatest pain or where the most change can be made quickly. Getting started is often harder than being underway.

Tooling is missing - Simple but effective automation of idea capture, analysis and communication is the single best way to clear this hurdle.

Change management is complicated – Creating a race car from a bicycle while driving down the road requires careful management of improvements. The business needs to keep the lights on and invoices moving throughout.

People resist change – There are two halves to change for your front-line people. Bring them in early and they’ll be invested in the change, but there also needs to be a way to make sure they’re sticking to the plan once change start to happen.

Every one of these five is necessary for a a culture of continuous improvement.

Skeets Nehemiah

One of the most famous hurdlers in history, Renaldo “Skeets” Nehemiah, who broke the world 110 m record three times, said it best, “The art form is to become one with the hurdle, to make it your friend, and I embraced that process.” 

Words of an athlete, but he could have been a businessman. He recognized that hurdles are cleared not by heroics or good fortune, but by a great technique executed well.

How does Northrop Grumman become process-focused? #BPM

Northrop Grumman has a remarkable history that includes developing the B2 Bomber, the EA6-B Prowler, satellites, the new Gerald R. Ford super carrier, and the history-making Apollo lunar module. It is an enormous enterprise with over 130,000 employees and a tough challenge…their principal customer, the US Government, plans to cut $500 billion in spending over the next decade. Beyond budget cuts, projects are becoming smaller and shorter, and the number of competitors that can play in the ‘smaller and shorter’ space is much greater.

Moving to process focus

I’ve had the pleasure of working with Northrop Grumman’s Aerospace Sector, made up of 23,000 people from the merger of several companies that each had their own way of doing business. Bringing together all of this into one cohesive group required a clever approach. People, process and systems need to be aligned in a way that only a true process focus can achieve, considering that they make aircraft, SEAL Team prototypes, spacecraft and more. The approach they’ve taken is an exceptionally smart one based on creating and maintaining (the key word is ‘maintaining’) nine defined operating models.

Operating models

The nine operating models they’ve developed allow for specialization within reasonable boundaries of standardization. Each model has specified ownership that allows for best practices to be ‘built in’, like the way to create a rapid prototype that allows for speed but still aligns with corporate structures like Global Supply Chain for contracting compliance purposes. This capability means that all 134,000 people in the enterprise can have the same understanding of things that should be standard while having the flexibility to be exceptionally good at specialized ways of doing business…the best of both worlds. This kind of flexibility is remarkable in a company this size.

Making it work

Sitting atop these governed models is a system that allows for the entire spiderweb of communication to be managed through automation. Without the automation part, keeping such a system running and current would be an overwhelming task. For one, their technology stack allows them to manage multiple process, governance and compliance hierarchies at the same time…they can link their governance structure directly to their value chain activities with an overlay of compliance requirements. This may sound like the Holy Grail, but it is reality for Northrop Grumman.

If you’d like to read for yourself, see the Northrop Grumman Case Study in this month’s BPTrends Magazine.

The ThyssenKrupp supply chain and compliance story

Just this week, BP Trends published a case study that is well-worth taking in. ThyssenKrupp Steel USA spent US$6B to create a seamless system for producing rolled steel primarily for the automotive industry.  They made very early decisions to make sure their enormous capital investment broke from traditional industry by focusing on business process rather than functional organizational silos.

Download the case study

I’ve been to the plant in Calvert, Alabama, and what they’ve accomplished is remarkable to see first-hand.  An hour or so north of Mobile, there is an exit labeled “ThyssenKrupp Drive” and as you crest the hill, the horizon is filled with a very modern-looking version of a very traditional industry…rolling and galvanizing 8-ton ingots of steel that are produced in Brazil and operationally managed from Rotterdam, The Netherlands.  To make such a geographically dispersed system work with any sort of efficiency meant creating a system that allowed common business processes at a macro (marketing, orders, confirmations, delivery) level as end-to-end as the micro (OSHA, work instructions, training).  They do this by having a single, centralized repository of process and its supporting information available to every employee, even those who don’t work with PC’s (they have kiosks).   They are the embodiment of centralize, govern and distribute something that everyone can understand and follow.

Compliance

Because they have a centralized way to see how all business is done, they have by extension a centralized way to show their compliance to several ISO standards.  The Case Study covers their aggressive schedule for certification, which would be unachievable in such a complex and start-up environment without the business process effort they’ve undertaken.  Why is compliance significant?

Supply chain competitiveness

Compliance is the single greatest way to assure their end customers that they have the ability to provide a reliable supply of rolled steel, at a quality level expected, and delivered in the amounts and on the dates contracted.  As a start-up system, they would otherwise take years to establish a track record that would provide these assurances.

Getting attention

The Wall Street Journal took notice of their unique model in a recent article that lays out an external perspective on what they’ve done.   The article does a great job of describing how the multiple locations come together in a single business model.  Beyond that, they’ve garned a great deal of attention from the marketplace they were seeking to impress…auto manufacturing.  The initial orders came more quickly than expected and put the mill on notice that there would be no slow ramp-up.

In December 2010, their model was demonstrated as part of the APQC Frameworks Study as they accelerated development by basing their process model on the APQC PCF.  Having a broadly-used standard allowed them to avoid a great deal of debate as they decided how to align their business and avoid the classic pitfalls.  You can download a free copy of the APQC Frameworks Study findings to see the story from a frameworks angle.

Take a moment to download the case study.  It is very detailed and gives an excellent step-by-step breakdown of how ThyssenKrupp arrived at their current state.

When Supply chain, compliance and BPM are one #BPM #supplychain #compliance

In the next issue of BP Trends coming out on July 5th, 2011, you’ll see a story about the success of ThyssenKrupp Steel and their ability to ensure an uninterrupted supply chain through a focus on business process and ISO compliance.  One of their very first decisions was to make end-to-end process management the cornerstone for operations in the US’ newest steel mill near Mobile, Alabama.  Their approach and the success they’ve had are a subtle but powerful trend that will to continue to gain traction in the coming years.

People often manage careers by developing niche expertise around topics like supply chain and compliance, and ideas that disrupt the ‘niche-ness’ of knowledge can spark significant debate.  Today’s Big Data revolution, however, is putting many business concepts on a collision course that puts traditionally disparate ideas under a larger umbrella of operational excellence and business process management.  The ThyssenKrupp story is about centralizing the ERP, supply chain, compliance and operations (including training and performance metrics) in such as way that enterprise data is moving in and out of these disciplines without duplication and with a high level of accuracy.  The efficiency gains from doing this are very, very convincing.

Supply chain and compliance

Supply chain excellence is about knowing your supplier’s supplier and your customer’s customer.  If you look at the fast-moving technology space, Cisco, Intel, Micron and others lead a trend where rapid fluctuations in markets and technologies have led to supply chains that rely external organizations to create just-in-time supplies of parts and even whole products.  The risk this creates can be enormous, and requires new systems to manage new risks.

Creating guarantees

The most direct way to mitigate risk is to demonstrate compliance to recognized standards. That means centralizing and managing large amounts of process and compliance data –exactly what ThyssenKrupp has done.  This centralization allows them to aggressively pursue ISO certification without significant time and resource investment, and using the very same systems that manage end-to-end process across the enterprise.  The benefits include:

  • The ability to ensure their suppliers share their Green commitment and are reducing impact to the environment – ISO 14001 as an environmental management system framework
  • Ensuring ThyssenKrupp and their suppliers aren’t running sweatshops or dangerous workplaces that are risky for employees…or can end up in the NY Times with their name attached – ISO 18001 for occupational health and safety
  • Mitigating information security risks, threats, vulnerabilities and their impacts – ISO 27001 for information security management
  • Proven quality standards – ISO 9001

The new game is to have supply chains that meet these measures of quality and process as the best guarantee against disruption, bad products, bad press and more.  As a business relies more on people and behaviors NOT directly under its control, the more standards become the new currency of the contract.

Compliance = Competitiveness

ThyssenKrupp spent $5B to build a steel mill in Alabama to serve primarily the needs of the US automotive industry, and they’ve had remarkable early success in sales.  Their best pitch for their commodity product is their ability to prove their excellence through ISO compliance, which in turn promises an uninterrupted supply chain backed by quality, environmental, health, safety, IT and business process standards.  ISO certifications are as critical as the plumbing and wiring of the mill.  See the Wall Street Journal write up here.

Traditional niche disciplines and their segmented data are on a collision course…centralization of data allows us to manage supply chain efficiency, operations excellence and compliance a single system. 

How does an underway business adopt a framework? #bpm #frameworks #apqc

I hosted a seminar this morning along with Northrop Grumman’s Dennis Pikop on the topic of how to implement and mature business process and other frameworks.  We used examples that highlighted three circumstances; withing ‘legacy’ businesses that merge or acquire (Northrop Grumman), from the top downward (UPS) and from the bottom up (ThyssenKrupp Steel USA).  If you missed the webinar, you can listen to a recording here.  Most of our observations came from the work done for the APQC Frameworks Study, led by APQC’s John Tesmer, who was also on hand for the seminar.  You can download a free copy of the APQC Frameworks Study here.

Frameworks in legacy environments

Customers often ask how to get started with frameworks such as APQC’s PCF.  Not everyone has the benefit of UPS’ significant focus on process (it is simply put, the only thing they do), or the green fields approach that TKS used when they built a $5B steel plant that just opened in December 2010.  Ask around…you’ll hear from most business process people that it isn’t easy to convince an underway, profitable business that a framework would provide a common vocabulary for business from the day 1, and would gradually increase in value as it matures to the point that an enterprise can have process excellence at the heart of its strategy and goals.  Some would say, “Impossible.”

A success story

Today, Dennis showed us that Northrop Grumman has come quite a ways on the journey while going through significant mergers and acquisitions (TRW, most recently), and that their secret sauce was to make it “leader-supported but do-er empowered.”  Neither executive support nor end user input alone is enough.  It takes strong leadership and mass adoption for a framework to be implemented effectively and then matured.  Most of all, he advised participants to appreciate the journey as it will likely take time.

From my own experience in working with them for the past couple of years, Northrop Grumman has a remarkable level of maturity when it comes to frameworks and process through their adaptation of an APQC-like hierarchy that they call, simply, the Process Architecture.  It allows this very large enterprise (over 130,000 employees) to find the common ground for their global supply chain, for example, while enabling fast-moving, innovative work such as the LCROSS space system that successfully impacted the moon, as designed, in October 2009.  The fact that a large defense contractor very quickly brought together the resources and methods for a fast, experimental-but-inexpensive project is a testimony to their ability to flex their business while maintaining long-term programs like the F/A-18, ship building and more classic space vehicles.  The fact they won awards for doing it was just icing on the cake.

Northrop Grumman is able to use a framework of process to draw together common areas of their business, like design or purchasing, and to allow those areas to flex within boundaries to meet the needs of highly diverse projects.  When you see what they’ve done, you begin to realize the power of frameworks and the way it has liberated what could easily be a very stodgy business model.  As defense budgets draw down and projects become smaller and more frequent than in the past, Northrop Grumman is well-positioned to be highly competitive with companies that don’t have the benefit of strongly supported, highly adopted process frameworks.

Companies that don’t start the on the journey now will be playing catch up before they know it, and with competitors that will be moving ever higher in maturity level.

The four corners of social BPM

We had a great call with Gartner yesterday that helped shift my views on social BPM ever so slightly, but enough to inspire a blog.  The discussion centered around blending classic content collaboration with a realistic social strategy.  It is clear from the blogosphere, conferences and (most importantly) customer conversations that many enterprises are trying to get their heads around these ideas and to enable their people with technology.  Everyone accepts that there’s great business benefit from supporting and capturing business process conversations but people are still trying to figure out how to take advantage of the combination of new technology and ’social comfort’ without creating cycnicism and chaos.  Or worse…too much structure that kills creativity.  Of course, a false start is perceived as worse than no start.

From an investor standpoint, look no further than yesterday’s LinkedIn IPO, where shares doubled from the asking price shortly after their open on the NYSE.

Nothing new

Most important to keep in mind, the social conversations are happening and always have been.  As I said a while back, absent technology, this will be done in diverse ways that are fragmented and not reusable or directly actionable.  This makes for far fewer contributors to the conversation, and fewer people gaining benefit.  It isn’t so complicated to open up the discussion to allow more participation and gather more points of insight.   Where this gets tough (and why all the conversations) is trying to classify the primary types of social interaction that are useful and should be enabled.  And to avoid getting caught up in the hype and the latest craze.  These are four candidates for technology-enabled social conversations that quickly come to mind:

  • Process that MUST be done repeatedly the same way (i.e. regulatory, compliance, higher-volume transactions)
  • Process that SHOULD be done repeatedly the same way (i.e. customer service) but has room for creativity
  • Processes that SEEM fluid or unstructured (i.e. consulting, non-admin parts of sales) but have structure behind them that must be followed (and talked about)
  • Conversations that are tangential to business and process but still important ways people establish communication capability (i.e. the truly social–like weekend planning)

If I were to map this idea, it would be a continuum like this, with the diagonal as arbitrary (but getting the mix wrong is a problem):

It becomes clear at a glance that ownership and management across such diverse concepts is the challenge.

Finding an owner

There is a perception in analyst circles that BPM vendors are focused on the flows and mapping of process but not on understanding the less-structured part of work, the part that is at the discretion of the people involved.  Conversely, in the purely social space, there is little conversation about collaborative ways to improve process.  The natural boundaries of each niche makes it hard to bring this together into one conversation.  Companies are spending to put multiple systems in place but aren’t likely to achieve their goal of enabling social business process management by doing so.

Adam Deane writes about this topic in his recent blog “Enterprise Activity Streams“…how long will it be before a tweet launches a business plan?  Not long, I believe.

The challenge for the decision makers is obvious.  In their own take on the issue, Deloitte makes a very strong call to action but acknowledges, “Skepticism with social software persists, in part, because social software evangelists are their own worst enemy. They have failed to effectively communicate how social software can drive real operating benefits.”

My view is that nothing is black and white.  All business activity flows through structured and unstructured realms constantly, just as it flows from human work to automation and back.  Whether you call it adaptive, social or collaborative, there is a need to organize and harness the power of this capability and existing technology can enable this.

As always, your comments are welcome.

Note:  As another indicator of where this is going, check out the introduction of Asana software, the creation of Facebook cofounder Dustin Moskovitz:

Asana Open House from Jerry Phillips on Vimeo.


All you’ve ever wanted to know about frameworks…APQC Study sneak preview

Why this study?

APQC knew that their Process Classification Framework (PCF) is widely used in business, fairly evident from 100,000 downloads from their website over twenty years.  They were also aware that it has been translated into Japanese, Mandarin, Spanish, Polish and Portuguese.  What they didn’t know, however, were the individual uses of the PCF or other frameworks within organizations.  It was a good time to find out.  Thus was launched the broad and ambitious look at “Using Process Frameworks and References Models to Get Real Work Done.”  After participating as a Research Champion for over four months, I’m convinced this could become ‘the study that launched a thousand studies.’  I profile just two of the companies that participated, below.

UPS

UPS had the floor for an entire day and presented to the Study group of around 75 sponsor companies.  It was a great story around the marriage of program and process management, process simplicity through a mapping/costing tool, and connecting executive initiatives and workplace activities through a custom process framework.  It was a very mature approach to BPM and generated a great deal of buzz.  It was obvious that the UPS focus on logistics has the company taking a new look at how business process is managed.

ThyssenKrupp

A second great story came from ThyssenKrupp Steel, the world’s second-largest steel producer and the largest capital investment ($9B) in the US in recent times.  As a greenfield project, they were able to make the APQC PCF the baseline for all
business process and to specify and manage workplace activity and compliance through a single interface.  It was a story in simplicity and automation that was unique among the companies that participated.  ThyssenKrupp is poised to be the leading provider of rolled steel to the automotive and other industries in the US soon after firing up their rolling mill.  Across the Study site visits, this was the most interesting case of an end-to-end solution empowering every aspect of process for a major enterprise.

The Findings

This Study was a great look into how some of the World’s great corporations are thinking about business process management.  Go to here to download a free, advance copy of the report.

Frameworks and getting REAL work done

Cisco, UPS, ThyssenKrupp, Pitney Bowes, Williams Exploration, Sandvik, ING Life…these are enormous enterprises with something fundamental in common…they use frameworks to get real work done.  A recent study by the APQC organization focused on those companies to find out how and why.  As technical champions, Accenture, Nimbus, and Northrop Grumman provided their BPM expertise to seed the discussions, conducted as virtual and in-person site visits.  Somewhat surprisingly, the answers were as varied as the participants.   It lasted four months and drew a large audience for each event.

In preparing the Findings, I had a chance to ask Ron Webb, APQC’s Executive Director Membership and Research Services what led up to the study:

“The use of process frameworks – like APQC’s Process Classification Framework (PCF) – is increasing at an amazing pace. We commissioned this research project to better understand how organizations are using these frameworks to obtain real results for their organization.”

The Study Findings will be published very soon and are a must-read if you work in business process.  Stay tuned to this blog to get details on how you can get a copy of the findings.

About APQC

APQC is a non-profit that manages and distributes the Process Classification Framework (PCF), a commonly used tool in business process.  In twenty years, this framework has been downloaded from their website over 100,000 times and is one of the most widely-accepted ways of classifying process.  Beyond the cross-industry PCF, APQC has industry-specific frameworks for Aerospace and Defense, Electric Utilities, Automotive, Petroleum Downstream and Upstream, Banking, Broadcasting, Pharmaceutical, Consumer Products, Telecom and Education.

Why a framework like the PCF?

Organizations adopt the PCF either at the enterprise level or within a business unit or division.  The reasons for doing so vary, but the value is found in one or a combination of three areas:

Benchmarking – Adopting the PCF as a standard process language organizations to ‘compare apples to apples’ with other businesses who also adopt the PCF.  It makes peer-to-peer measurement possible without elaborate measures to make sure what is being compared CAN be compared.  Benchmarking yourself against others is a tough exercise without a common language and hierarchy.

Standardization – The PCF acts as a checklist to map current processes, identify gaps, note where key performance indicators (KPI’s) should be tracked, and to replicate processes across other parts of the business.

Governance and Accountability – Having a common structure allows managers to hold employees accountable for specific activities.  This accountability combined with KPI’s allows for true management of business process.  The KPI’s can flow up through the organization to show executives how the combination of activities creates value across the enterprise.

The best-run companies already have these three areas in focus, whether they have the PCF or another framework.  The Study was a rare, in-depth look at what several of the World’s top corporations are actually doing when they manage business process through frameworks.

For more on frameworks, see my blog, “The wonderful, powerful, confusing world of Frameworks.”

Can these Siamese twins be separated?

What I didn’t write

I had a clever plan to write this as a love story.  It was supposed to start with, “What brought business process management and compliance together?  Was it a marriage of convenience, an arranged marriage, love at first sight?  Shotgun wedding?  Are they are each others’ destiny?  It would have had a very clever, emotive title that piqued your interest, hopefully.

Then my brilliant, non-BPM-focused wife looked over my shoulder at the questions and said, “They’re not married, they’re Siamese twins.”  The new metaphor killed my closing line of “speak now or forever hold your peace”, took away the propriety of being funny, but I knew immediately that she was dead right.

Inseparable

They can’t be separated.  They share the same blood supply, most of the same organs, and can’t have a meaningful life if they aren’t together.  The mantra of compliance is that it allows companies to “say what we do and do what we say” but more often, companies use compliance as a way to seek a stamp of approval without fundamentally connecting human and system behaviors to the standard’s requirements.  Maybe they think they can’t, or they don’t think it really matters.  This is a sure-fire recipe for cynicism.  One of my favorite cynical quotes of all time came from an old Navy flying buddy who loved to say, “The key to success is sincerity, and once you can fake that, anything’s possible.”  Well, what’s possible in a cynical organization that fakes compliance?  Look no further than the newspaper headlines.

Closer to our workplace, cynicism has a numbing effect toward work and success.  General Patton is often quoted for saying, “Watch what people are cynical about, and one can often discover what they lack.”  He may have been talking about Army soldiers, but he understood that cynicism anywhere comes from an unfulfilled need.  People want to feel that the standards they are meeting are genuine and tangible in their everyday work.  The places where standards and activities are aligned and managed are the ones that have high energy levels and are consistently known as the best places to work.  It’s where I want to work.

Line-of-sight management

The Siamese twins metaphor remains perfect.  There needs to be a high level of cooperation for compliance and business process to function.  There needs to be a system that supports ownership, centralization, awareness and change.

direct linkage between compliance and process

Dennis Pikop, Quality Manager for the Aerospace Division of Northrop Grumman, once told me, “Unless there is a direct, line-of-sight connection between a standard and the business activity that supports/proves the standard, the standard is a myth and the activity’s is suspect.”  Like me, he believes that compliance and process are joined at the hip and inseparable.  The best run companies can create, assign ownership, communicate and manage that connection.  They have compliance and best-practice behavior in their DNA.

Just as I published this, I came across the following Infosecurity post on skepticism, the fraternal twin of cynicism…