Relaxing next to the Black Box

A compagnon blog to http://www.exploringtheblackbox.net

[casmo-blog]

Why are governments so slow in taking up eGov?

I recently was asked this question in an exchange on an article I wrote on good public governance, a couple of years ago. The article underlying this question is behind this link, and was written by Bill Eggers of Deloitte.

Governments aren’t necessarily that slow in taking up eGov

My first off-the-cuff reaction was “but are they?” Because I’m not sure governments are really that slow in taking up eGov. Now, you need to take this for what it is worth, a view from one person who has been involved both as a consultant and as an auditor with the Belgian federal and Flemish governments in one way or another since 1997.

Deloitte’s arguments are not really public sector specific

If you have not read Eggers’ article, the crux of the argument he makes is that technology is easier to access now, the development life cycle of ICT implementations was not appropriate, the skills were not there and the delivery models were not adequately developed. I’m summarising, perhaps too much. The point is, I don’t agree. Some of the points Eggers makes are relevant, but he is not surprising me or kicking in doors that were not open to begin with. His arguments can as easily be applied to private sector as to public sector or government services.

He fails to highlight some of the most essential reasons why digital government/e-gov has not yet fully taken off to date, and is very likely to take off in the near future. Let me explain my main four main arguments.

My four main arguments

First, mosts government are and remain a social employer for quite a few people whose skillset could partially or even entirely be replaced by eGov solutions. Social employment is considered by many government officials and politicians to be a core responsibility of government. However, structural budget constraints are changing this attitude. But such attitude change takes time to have tangible effects. The natural reduction of such employees, mainly through retirement, is not at a point where an eGov replacement solution is completely realistic, yet. And if the work is being done now, many people don’t see the use of replacing people with systems at this point in time. This is one of the reasons that Eggers fails to mention in his article for the proliferation of web front-ends that have no back-end. The back-end are these people. Eventually, they will no longer be required to do this type of menial work.

Second, the article ignores the maturity and the cost of the necessary backbone systems. Because public key infrastructure used to be expensive. As in “really expensive”. And it's essential to ensure the security that these systems need. After all, we're talking about significant amounts of essential information and money being exchanged. Belgium built one of the first integrated public key infrastructures in the late 1990’s to early 2000’s. Our electronic ID card and the integration with our social security systems remains one of the more advanced in the world and an example for many countries. But the upkeep costs a lot. The cost of public key infrastructure in influenced by the need for data quality and the total cost of ownership of the central systems. The cost of ensuring and maintaining data quality is still very important and remains labor intensive, but technology allows citizens and legal entities to provide this information more freely and in an much easier way now than before. The solution for this is really starting to take shape only now. Technologies like block chain can make a real cost difference, because the need for an expensive central clearing house is at least reduced. The cost and time to build a similar backbone system now, using modern techniques, would be significantly lower, as would the total cost of ownership.

Third, and dependent on the second, the need to rethink services e-Services, while often the same for the end-user, will need to be administratively set-up completely differently than the current mainly labor-powered systems. This is beyond restructuring/reengineering, and requires a fundamental rethinking. Few consultants are both embedded enough to understand the specific needs of an administration, its support structure and the end-user on the one hand and independent enough to escape incremental thinking on the other. However, such break-through thinking and the willingness to let go of existing service paradigms will be essential in the future. Now, it happens already. Look at the service-voucher system the Belgian federal, Flemish and Walloon governments have implemented. It is a subsidy based co-payment system that completely rethought the existing service paradigm and ended up bringing a lot of household service from the grey to the real economy. In the process, it automated and outsourced the back-end, which is not a core government competency. Does the government lose out? Not really: it still has access to all the information, but does not need to focus on the menial work of processing.

Fourth and last, questioning the essential tasks of government We often forget that most government services were built in a time where the market could not cost-effectively provide certain services, and those services then evolved into large administrations. Administrations that strive to keep themselves alive and growing. This is not just a conclusion in public sector. Read Clay Shirky on this topic if you need convincing that it plays in any large structure. However, public sector has no real tradition of zero-based service assessment, where we first look at what is necessary, then at what the market can offer at correct rates and then have the government pick up the rest of the necessary services the market does not yet provide. This requires thinking and a certain freedom of thought and action that is not easily found.

In conclusion

Governments are not necessarily that slow in taking up eGov. However, governments are powered by lots of people that do work that computers can do. Budget pressures and an progressively older group of public servants lead to a gradual replacement of menial work by systems. But public sector systems have security requirements whose requirements are much more stringent than most commercial systems. The back bone required for providing that level of security cost a lot of money. New technologies, such as block chain, are likely to bring down that cost. Once those systems are available, creative groups of people, most appropriately combinations of consultants and public servants, need to fundamentally rethink services. This is already being done, but we can go beyond what exists now, and liberate the public sector from the requirement of doing menial work that can be automated. And last, but not least, the public sector needs to question its own role - especially at the task level - in light of the evolving capabilities of systems offered in the marketplace. Why should the public sector provide those services that can be provided by private sector at a correct price?

[casmo-blog]

A better email tool

Whenever I write a letter, especially a draft letter, I usually write the text first. The reason is simple: texts tend to evolve, and may end up being about something completely different from what I set out to write about.

Paper is not forgiving, in that a mistake requires me to cross out or apply correcting fluid to the text. We believe our electronic tools are much more forgiving. But they are not.

Email applications are not fit for email

Case in point: email applications. The way in which they are set up invites mistakes or waste of time. Think about your favorite program. In all likelihood, it asks you for the email address of the intended recipient first, then for the subject, then for the actual text. However, that is not how you work. You know who you are writing to, but the subject line may well evolve throughout the actual writing of the text. And with the change in subject matter may well come the realization that other people need to be informed about the contents of your message.

However, few people take the time to revisit their subject lines or to reconsider whom they add to the already filled in recipient list.

There is one tool I have been using on iPad and Mac and that I miss on my iPhone: Ulysses. This markdown editor has a dazzling array of features, among which is a diverse set of export features. Any email I write starts right there, in that application, in markdown. Forts I write the text, then I write the tittle, which is the subject line, and only when I export as a mail, I add the subject line.

Mails have the time to develop and mature. I have no flashing send button imploring me to share whatever complete or incomplete considerations with the perhaps inappropriate but most certainly incomplete list of recipients.

So, Soulmen, kind purveyors of this app, when will you bring this tool to iPhone? And thanks for developing such a great tool.

[casmo-blog]

Why I use a static and a dynamic phase in a risk management approach?

This article is a rewrite of an article I originally wrote about six years ago on a now discontinued blog aptly titled “complexity risk management”. I am reviewing a paper on risk management and felt it relevant to update this post as an additional comment to one of my review points.

Whenever I speak about risk management, I insist on performing an initial static assessment of the situation in which you are implementing a risk approach, which I refer to as the static risk management phase, to be followed by recurring, significantly lighter phases which I call the dynamic risk management phases. People eventually ask the question on why I insist using both an initial static and the recurring dynamic phase. The simple answer is that there is no real fundamental difference between both phases.

But the actual, real in-depth answer is a bit more complicated than that. While there may not be significant differences in the steps to be executed in each of the phases, the context in which these steps are taken are significantly different. These contexts impact both the scope of the step and the duration and related investment in the step. Static steps are broad in scope, take a significant amount of time and therefore investment, whereas dynamic steps are narrower in scope and take significantly less time. This actually is the essence of the methodology. That is the theoretical explanation. Let me illustrate this with the example I’ve been using since 2002. 

You and a box on the North Pole

Imagine yourself suddenly transported to the coastal regions of the North Pole area and left there with a large box and assurances that most of what you need to survive is present in that box. What do you do? Well, after screaming for a bit, you will eventually settle down and …

Static phase

… you will scan your surroundings, making sure there are no immediate threats to your well being. So you go ahead and scan your environment in order to assess the situation and the event potential around you. Once you are fairly certain nothing can directly impact you, you will open the box.

On top of a lot of other tools you find a wonderful, white, warm jacket and a pair of polar pants. There is also a cute little red hat and a pair of sunglasses. You put on the pants, the jacket and the red hat (remember, it's freezing cold on the North Pole) and you put on the sunglasses and do another 360° observation scan. Once assured nothing threatens you, you examine the other contents of the box: you notice it's a very large box, with in it a big gun, labeled ‘point in the direction of polar bear and pull trigger to discharge, only when life is threatened’. Oh, and there is also a fold-up chair. The box contains some army meals which heat up when you pull a tab, and a large thermos of warm coffee. You take out the chair and decide to have a bite to eat … which you do.

In essence, you have assessed a new situation in which you have been put, as completely as possible with the available tools, and you have dealt with key concerns such as hunger, thirst, safety and comfort.

You are now quite comfortable in your chair, looking around and deciding the arctic region is, in effect, a very nice region to be in …

The static phase entails an as complete as possible inventory of key risks which could threaten the objectives. In case of an individual, this would be survival, in case of an organisation, survival will be defined quite differently but will be a key element too. After this time-intensive first priority inventory and assessment, corrective actions need to be taken. Quite often these actions need to be developed from scratch, and this too requires time and effort. The static phase is therefore time and resource intensive.

Dynamic phase

… when suddenly, you become aware of the relative heat of the sun on you new jacket. It is getting hot … but you quickly figure out there are a number of zipper controlled 'vents' in the jacket which you can use to control airflow through the vest.

Having dealt with this, you turn your attention to your surroundings once more, and you notice a small spec in the distance. You dig in the box for your binoculars, and focus on what appears to be … oh no, a polar bear with a very hungry and determined demeanor, at full speed, running straight at you. You intuitively check whether you consider your life to be in danger. The answer, alas, is yes, so you turn around, grab the gun, aim and fire at the polar bear … But you are not a very good shot. You have missed. You aim again, pull the trigger again, and are rewarded with a small "snap" sound of the trigger hitting the backend of the trigger guard. You are out of bullets.

Meanwhile, the polar bear is getting dangerously close. You reassess your options and quickly scan the small letters on the side of the box. You have not read these small letters, which state "Will protect one (1) person from polar bear attack."

You jump in the box, slam the lid shut, but not before smelling the foul breath of the polar bear … but you are safe … and you fall asleep, happy to have survived this ordeal.

*In essence, you have reassessed the known situation based on the changes in this situation, and focused only on dealing with the changes, not with the rest of your reality which remained unchanged and under control.

The dynamic phase entails an assessment of the changes in a known situation which is initially, after the static phase, considered under control. Any change with a potential of threatening the objectives needs to be dealt with, but after the initial and significant investment of the static phase, the subsequent investment in dealing with these changes is significantly lower. The economy of using a layered approach comes to bear (pun very much intended) only during the dynamic phase.

[casmo-blog]

Minimal requirements

If you have ever played a video game, you must have noticed the “minimal requirements” explicitly mentioned on either the package the game came in or the description on the game store site you purchased the game from. These minimal requirements are an indication of what your system needs to be capable of in order to run the software that makes up the game.

The minimal requirements are seldom absolute. It’s usually not the case that a computer that does not comply with all the requirements cannot run the software, but the experience will be less, to the point of potentially being unsatisfactory. And that is, of course, an issue if you want to enjoy what you paid for.

Minimal knowledge requirements as a barrier to entry

Now, in the world removed from the virtual realms of video games, there are similar minimal requirements … the minimal knowledge requirements. And these requirements are all around us. Some of them are based on culture and assist in “compliance” with societal norms. Those are beneficial, but if you are an outsider you will be sticking out very soon and sometimes the understanding of these norms is assumed.

There are other minimal knowledge requirements as well. These are the exclusive and excluding ones, and are usually based on language.

I, the insider, speak a - usually technical - language with other insiders that you - the outsider - cannot understand. This language has an upside, in that it allows me to efficiently communicate with the other insider, but it excludes you, who does not speak my technical language.

The problem here is that when the outsider is actively implicated by the content and consequences of the communication, he or she tends to become disenfranchised very fast.

Think cancer patients, for example. Quite often, the details of the treatment that have profound impact on their being are discussed over their heads in language they cannot understand. How lost do you feel?

By using the key tool for mutual understanding - language - in a way to separate rather than to include, we distance people who do not have the minimal knowledge requirements.

Government administrations are often worst case examples …

And it’s not just medicine where this is a real problem. Government is quite bad at this as well. Some interactions with government are so convoluted that even people who are supposed to have the minimal knowledge requirements don’t understand whether or not they are in compliance with what the government asks of them.

[This Economist article] on the letter Donald Rumsfeld sent to the IRS is an interesting example of someone who explicitly admits not having the minimal knowledge requirements to return his taxes.

An initiative such as [the Center for Plain Language] in the US is an attempt to right such a wrong. We have had a similar initiative in Belgium for years, the Agency for Administrative Simplification, but both initiatives, while making inroads, appear to be mostly impacting the fringes.

But never by intent

The interesting thing is that this - according to me, based on the experiences I have had - is almost never by intent. Rather, administrations are so focused on getting done what needs to be done that working on that communication is one aspect that is too often forgotten

Interesting initiatives

There are other initiatives that are worth looking into. Take the [Open Law Lab] for example. This initiative looks at how to make law more accessible. It understands that there are certain aspects of law as it exists now that do not make it accessible to a large group of people. Instead, they need interpreters of the law, lawyers, to explain something that as well could be written in plain language.

There are other possibilities as well. Why make laws just understandable? Why not actively implicate as many interested people as possible in the process. I wrote about wiki-based law initiatives a while back. You can find the article [here].

We need to aim for inclusiveness in our communications

At the most fundamental level, we should not exclude someone because of artificial differences. We should not play the game of information asymmetry but we need to level the playing field. The best way to do that, still, is by providing people with timely access to complete and accurate information provided in an understandable language.

The current inability of people to access our discussions is not to our advantage. No, it is our problem and our challenge. Imposing a requirement on ourselves to give as many people as possible access to the necessary information is essential to our long term credibility and viability, as any type of actor in a society which is becoming more and more replete with data.

Ultimately, it is our responsibility to distill key information out of that data. That information, when adequately and comprehensively put in context, should ultimately lead to the development of insights and wisdom in what is our constituency, whether we are the government, an private sector organisation, a civil society structure … and the only way to realise that is to be as transparent as possible.

[casmo-blog]

An updated look

You may have noticed that the blog has significantly changed. If you are reading this in a browser, you will notice there is a lot less clutter.

I had been an absentee landlord on this blog, only occasionally publishing. The work was only an excuse for my neglect of what had become a set appointment in my schedule: publish a blog post. When thinking about why I was no longer that committed to writing, I realised it was not about the writing at all. I’m still writing as much as I ever was, only not on my blog … but rather in my journal, or when writing individual papers.

But the idea behind the blog was for it to be a repository of my thinking, which would include some of the ideas I developed during my off the blog time. And it turns out that the main reason I did not write on the blog anymore was because I did not like the lay-out of the blog anymore.

Once I realised that, I started experimenting … mainly with Jekyll and Github Pages, because they allow for a minimalist design. But that turned out to be a time sink all by itself … and while I did okay in terms of the look and feel of a minimalist blog, it still was not what I really wanted it to be.

Therefore, I turned back to my original blog on Squarespace, and found a template which is very simple and really what I like. I removed most of the pictures from the headers and the articles, and toned down the blog to what I want it to be.

And now it is nice. I like it. It generates a certain rest for the reader, as it should.

Now if I only could convince the good people at Squarespace to allow plugins for the more popular Mac blogging software …

[casmo-blog]

Your tools are not your problem. You are

Sometimes I need to make a point. And on occasion, I want to make that point quite clearly, because I see quite a few people making the same mistake I have made. This is one of those times. Now, there is nothing in this post that is likely to be new to you. Most of what you will read on this page has been said before, by people much wiser than me. But what I am saying here is important. It may be more important than anything you will read today, even though it is so obvious if you think about it. So thanks for paying attention.

My 2 cents

Anything you do, any activity that you engage in that is more focused on support, on tool optimization, on anything but what you are about is aimed at avoiding the confrontation with your worst fear: you becoming who you can be. You are afraid of that because you fear you may not be worthy. The point is: you are worthy. There is no one better to be you than you. So stop trying to be other people. Be you. As soon as possible.

So you want to be creative

You want to be creative. Everyone else seems to be creative nowadays, so why not you? You want to be Richard Branson, or Steve Jobs, or J. K. Rowling … But what you really want is the life style, and you want it by the shortest route possible.

But there are no shortcuts. There never were. You will never be Steve Jobs, nor Richard Branson. Those jobs are already taken. The only person you can ever be, and be best at, is you. And no one can be a better you than you. That is both liberating and very scary.

You are looking for excuses not to look at yourself

But who are you? What are you? Well, I don't know, that's for you to find out. But I know one thing: I know that right now, you are the problem. You are what is keeping you from truly becoming you. And I mean this not in a wishy washy, flowers in your ears kind of way, but in the hardest, most down to earth way possible.

You are what is standing between you now and what you are, fundamentally. Read these words and understand them. Profoundly. You are preventing yourself from being who you are, or can be … well, should be.

Let me clarify that a bit more before you think I’m off the deep end here … Any tool you use in an effective and efficient manner is a tool you have both learned how to use and honed for its purpose. The problem is that not only the tools needs to be optimised, the tool user needs to be focused and trained as well. We all tend to neglect that aspect.

A comparison: one of the reasons I don’t like working with word processors such as Microsoft Word is its feature bloat. It tries to be everything to everyone, and it ends up being a bit of everything, but really nothing. Compare that to the recent developments, especially on mobile platforms, of single purpose tools, such as text editors. Much more focused, much better to use in an efficient and effective manner.

So, you are the problem.

For one reason or another, you are looking for every available excuse for becoming you. At the end of the day, there is really only one reason and that is the really bad part: you scare you. And there is always an excuse, isn't there. “I don't feel right”, “I don't feel I have the inspiration”, “I don’t find my muze” “I don't have the right tools.” Really, there are websites specialising in offering people wonderful new tools which will keep them from doing what they should be doing.

But it is not about the tools. It is never, ever about the tools. It is not about the inspiration either. If you show up, it's likely the inspiration will also show up. And if you want to, you will capture it. Even if it is on a beer coaster.

Quick side note: the work I still am most proud of to date, the work that ended up becoming the 2003 risk management model I co-authored with J. Van Waesberghe, was first developed on a (couple of) beer coasters, in a small spaghetti restaurant, during a conversation with my wife. My wife is the most true mirror and critical thought challenger I have ever met.

Where do you start? Usually at a beginning, which you determine

Now, I believe you when you say that you don't know how to start. It does not matter. Just show up. Just start. Don't spend all of your time obsessing over planning tools, and ways to organise your work, and how you would be so much more productive if only ... if only what? What is the next excuse you will be hiding behind? Enough already. Stop being scared of what you can become. That’s as bad as being scared of you own shadow.

This is the place you must stand

Stand. Here and now. Do the work. Do not look for excuses, don’t run away. Just show up and do what you should be doing, which is being you. Create you. Not out of thin air, but by acknowledging that you are the best you there can possibly be. Not the fearful, hesitant you that is afraid of being judged and therefore hides away, or does not show up in the first place. The one who does not do the work because he or he is afraid of what the opinion of the others may be. That is avoidance. That is cowardice. Be who you are. Don’t be afraid of that. Because the one person you cannot ever avoid is the person who will be looking back at you from the other side of the mirror, every morning and every evening.

Tick Tock

Your clock is ticking. It is not because you chose not to show up that your race has not yet begun. It started the day you were born, and there is only one competitor. It's that little voice in your head that tells you “You cannot do this. You are not good enough.”

Think about that for just a second: there is a little voice in your head that tells you you are not the best possible you. Well, to that little voice in your head you need to be very clear and very outspoken: “I am the only possible best me.” But be you. Don’t try to be someone else.

You have just one enemy standing between where you are now and where you should be. And you know who that enemy is.

You are.

Now be. Show up and do what you are supposed to be doing. Do the work.

Oh, you are wondering what are you supposed to be doing? What do I know. I’m not you. Ask yourself. And listen to the answer.

[casmo-blog]

The governance and oversight structures in the Belgian federal government

When looking at the public sector, people not familiar with the structures and the relationship between administrations and the political level often ask how its governance structure compares to other environments, such as the private sector.

Governance in the private sector is based on the management and control of a traditional principal - agent relationship. A principal, invested with a certain power, such as money or public support, asks an agent to execute certain roles and responsibilities it does not deem itself adequately capable of, for a compensation. This translates down into the organisation structures all the way to the proverbial work floor, or desk in the case of an administration. Responsibility is delegated down. Governance describes the structures put in place to ensure such a delegation continues to function well, without abuse by either the principal or the agents and with the proper safeguards built in to avoid a crowding out of minority shareholders. But how does this translate to a public sector context? We will see that this principal-agent concept and the related ideas on delegation and control hold pretty well in a public sector environment.

We, the people, are the principals

As citizens, we are ultimately the shareholders of government. As tax payers we can claim certain rights as a result of our willingness - albeit sometimes begrudgingly - to pay these taxes. One of these rights is the right to elect our representatives. We elect these representatives to - what is in a word - represent us, because a direct democracy actually turns out to be quite difficult to manage when dealing with populations of any meaningful size.

First level principal-agent delegation

As principals we select by means of an election a first group of agents to fulfil the task of managing the country. This represents the first level of principal-agent relationships.

An important risk is that because of the number of people voting, some people whose ideas are outside of the “norm” can feel significantly disenfranchised. People often wonder whether their vote really matters. Significantly disenfranchised people sometimes turn to extremist parties to make the point they don’t feel their ideas are represented. These more extremist ideas sometimes turn out to be indicators of an undercurrent running through society. They are then picked up and integrated into mainstream political party programs.

Oversight on the first level principal-agent delegation

Note that the election mechanism is the only “control” mechanism we have in place to manage that first level of principal-agent relationships. However, that statement is not entirely true, or at least incomplete.

Let me elaborate on that. Representatives are elected locally (within a certain geographical area) and can usually only get on the ballot if they have the support of a political party. To get the support of an established political party, you need to be considered as a viable candidate by that political party. And the most common way to achieve that is to start building your political credibility at the street level, by actively engaging in the local political scene. There are some noteworthy exceptions to this rule, as parties that see a sudden upsurge in popularity often scramble to find good candidates will confirm, but even these “new” candidates will need to build a local credibility to get elected the next time around, when they can no longer coast on the popularity of their party.

That said, there is no permanence in the control of the people on their representatives, but there is oversight in the form of civil society monitoring. Depending on what the representative is specialised in, this monitoring may be very strict or non-existent.

Second level agent-agent delegation

Within this body of agents representing us principals, the representatives - the representatives of the people, assembled in parliament, and structured in parties representing broad idea sets - determine among themselves, based on which party or coalition of parties has the majority in the representative body, who will be selected to govern us. Within their ranks, and sometimes even outside of their ranks, they choose the ministers who will form the government. The agents choose the 2nd level agents, usually - but not always - among their peers. This is the second level agent-agent relationship.

Note that this selection is very unlikely to be unanimously approved. Rather, it will be a selection which is supported by the majority but opposed by the opposition. There are hearings, but they come after the selection and are about the longer term vision a minister has on certain issues within his or her area of responsibility.

Oversight on the second level principal-agent delegation

There is a more formal oversight on this second level of delegation. The Court of Auditors functions a broad terms just like a certified public auditor would - I once heard the Court of Auditors referred to as the largest CPA firm in the country - but they have also built capabilities to assess beyond the mere financial evaluations, with more and more focus being put on the assessment of the internal control evironment, with COSO or rather INTOSAI, a COSO based public sector adaptation, as a reference framework.

There is often critique directed at the traditionalist ideas of the Court of Auditors, but in my opinion this oversight mechanism has kept up admirably well with governance evolutions. Essential new governance aspects such as regular rotation of audit responsible collaborators is not yet firmly embedded everywhere, but the Court has shown itself to be aware of some of the remarks directed at it.

In essence, the Court of Auditors remains the foremost structural oversight system reporting to parliament. I’m making abstraction here of ad hoc or even structural commissions the parliament can set up for a specific purpose.

The third level of agent-agent delegation

But a minister is not working alone. In order to do the work, he is supported by an administration, and delegates the operational responsibility to the management of that administration. A minister as such acts as a board of directors would towards a management team in a private sector company. And there are a number of control structures in place in these administrations as well.

The federal Copernic reform of the early ’00’s gave each federal government service (the former ministries) a management team. The president of the federal government service acts like a CEO and has comparable authority. He in turn has a team which consists of a number of directors-general who manage the line services while staff directors manage the support services.

Oversight on the third level of agent-agent delegation

There are a number of complementary, and sometimes overlapping third line of defence controls present in a typical federal administration. First, the minister of the budget has his inspectors in each administration. The finance inspectors, as they are called, although budget inspectors would be a more appropriate name, have a double role. First, they are to ensure compliance with the budget related laws. Second, they have an advisory role to the minister responsible for that specific area. While their advice is not necessarily the end of any discussion on how to use the available means, trying to circumvent their advice takes quite a significant administrative procedure.

Does a finance inspector have a parallel in a private sector company? Yes, but in private sector this third line of defence role is seldom permanent. Imagine that a court would appoint a financial watchdog to a company, to monitor and avoid certain spending behaviours and to ensure legal compliance. Imagine that watchdog being an overall nice person, willing to impart some of his or her advice to the organisation. That would pretty much be the role of the finance inspector if he or she were to operate in the private sector.

Within the internal control structure of any federal government service are other, more second line of defence roles that exist, such as a “controller” function whose responsibility it is to approve budgetary reservations. I’m not going into these roles in this blog post.

The role of internal audit

What had been missing, and was initially described in Royal Decrees going back to 2002 but never implemented, was a third line of defence oversight structure supporting the minister in his or her role as board of directors, looking not just at the financial dimension but first and foremost at the operational dimension: an internal audit function. Where parliament has the Court of Auditors, where the minister responsible for the budget has his finance inspectors, the minister responsible for the content has no structural oversight capability in place. And this is why the internal audit function in the Belgian federal government is so necessary.

Internal audit structure and independence

The initial 2002 Copernic documents and the Royal Decrees spoke of an independent audit committee and internal audit department for each federal government service. Some federal government services built these functions, sometimes on the remains of prior internal audit departments, dismantled during Copernic to perform project and change management. Only few succeeded in forming audit committees. While the cost of putting such structures in place was an element, I believe the most important factor impeding the timely establishment of these functions was the availability of capable audit committee members.

Staffing at least thirteen audit committees with between three and five competent members requires between 35 and 65 people. Even with some overlaps this would have meant finding between 20 and 30 people with relevant internal audit and content experience that were independent. And this turned out to be an insurmountable task.

However, the Royal Decrees were revised in 2007 and by the end of 2010 there finally was a single audit committee for the Belgian federal government. This audit committee will do the necessary oversight, enforce internal auditor independence and function as the go between between the auditors and the minister, while maintaining a close link to the presidents of the federal government services.

The new central federal internal audit service that will be established in the coming months will likely be a single internal audit service for the entire Belgian federal government, but with links to each of the federal government services, in order to keep abreast and informed of the internal control environment. The exact modalities are still to be discussed and established. Suffice to say that after thirteen years, one of the most important control framework gaps has finally been resolved.

Key challenges for the new central federal internal audit service

I believe the following three elements to be the most relevant short term challenges to the new central federal internal audit service:

Staffing: there is a shortage of good internal auditors. Not just in Belgium, but in the world. Finding and more importantly keeping high potential profiles to work in this challenging environment will require a creative approach to the recruitment, the training and the day-to-day work;

Single audit: there are many different actors active in the second and third lines of defence in a public sector organisation. Ensuring the audit burden is as low as possible to the organisations being audited while maintaining independence and timely, complete coverage will be another important challenge;

Remaining in touch with the federal government services: one of the most important challenges to the Flemish internal audit - also a centralised internal audit - was remaining in touch with the departments it audited. As an external service, the auditors were seen as “not one of us” and it took a lot of time and a high degree of diplomacy of its head of internal audit to convince these departments to show and tell all. An internal audit needs to be seen and believed to be internal in order for the people being audited to open up. Otherwise is will just be like the Court of Auditors, but with less power and prestige. And the internal audit service has a place next to the Court of Auditors.

[casmo-blog]

Speaking about internal controls

Good governance, risk management and internal controls are essential to any organisation or group of organisations that deems itself mature. It's been a pleasure to speak about their relevance at the FGS Finance top 400 meeting on May 12th. 400 top managers of the FGS had come together for a day long discussion on the topic, and asked me to join them to discuss my thoughts. I did some further development on a presentation and white paper I wrote a while back.

For those interested, here is the entire lecture text in Dutch. It uses a specific airplane accident to illustrate some of the key points I consider essential when implementing internal control systems in organisations.

The text of the speech is in Dutch, but in case someone is interested, I'm certainly willing to provide an English translation.

[casmo-blog]

Low maintenance GTD

My failure to use electronic GTD tools

I’ve been going back and forth on the tools I use to implement GTD. I’ve been all over the place: I’ve started with [Omnifocus]. It’s an interesting tool, but it tends to get very complex very fast, even with great teachers, such as [Kourosh Dini]. Do check out his work if you’re an OmniFocus user and are looking for guidance. After OmniFocus, I used [Things]. The Apple store had a sale, and I jumped. I have to be honest, of all the electronic GTD solutions I’ve used, Things still is the most natural to me. I’ve written about that in a blog post a couple of months ago. I tried going the all text files route, using [Taskpaper] format and even revisiting Gina Trapani’s excellent [todo.txt]. But none of it stuck. I was obliged to use Android (actually, the experience is better than I expected, certainly under Lollipop) and moved my GTD set-up to [Todoist]. But still, it did not stick.

Back to my Filofax basics

And now I’m back to my very old, but still very trusted Filofax. I invested 10 USD in David Allen’s set-up guide for paper-based systems, but the set-up has not changed fundamentally from what it was a couple of years ago.

Paper based GTD is ubiquitous

I’m not going to bore you with the specifics of my Filofax GTD set-up. There are many excellent writers on the internet that have shared theirs, and mine is not fundamentally different. What I want to explore a bit is why none of the electronic methods stuck. And why the paper based method does. And the answer is very simple. The paper based method is ubiquitous, while the electronic ones are not.

Taking our my phone is a tool change

Let’s explore this a bit. My technology is usually quite close to me. I carry my iPhone and my Android phone close to my pretty much all of the time. Yet it takes a deliberate action to stop whatever activity I am doing to perform an input in that specific system. It is a tool change.

Only movements which are deeply trained muscle memory memory can be performed outside of the rigorous reality of tool changes causing significant interruptions. And to date, our ability of using our phone is not that. At least, mine is not.

Writing is muscle memory, hence not a tool change

My entire subconscious muscle memory is a writing muscle memory. I was trained to write, longhand, a long time ago. I can do pretty much anything in terms of taking notes while not losing track of what is going on outside of me, in a conversation, during a meeting. I can take notes and pay attention. That is the extent of my multitasking capabilities. My writing skills are my reflex brain doing the work. My attention is with the meeting. The act of taking out my notebook and writing something down does not break my concentration. It does not pull me out of the zone. It does not, by itself, constitute a tool change.

Taking out my phone, or any other electronic device, does.

But is this the case for younger people as well?

But what I am wondering about is whether this is the case for younger people, people that worked with a phone from a very young age. Young people to who longhand writing was not as essential as it was to my own formation and upbringing.

[casmo-blog]

Why I prefer Things instead of OmniFocus

A faithful Omnifocus user ...

For years I was a faithful Omnifocus user. I read the collected works of many bloggers and productivity specialists who would not talk of any other tool but Omnifocus. I followed the video courses which the OmniGroup so kindly provided. I worked with contexts, and projects, and did all I had to do.

For large periods of time, I was okay. I was especially okay if my system did not come under too much pressure. However, whenever quick capture and qualification of the relevance of a task was of the essence, Omnifocus was too wieldy. It lacked flexibility, or perhaps it offered just way too much of it.

A change in my use case inspired a tool switch

Now, I must admit my use case changed considerably. As the head of internal audit for the Belgian Technical Cooperation, my tasks and my workload were quite predictable. As a professor teaching at two management schools, I still have some predictability I had before, but ... the biggest change in my use case was moving to the staff of our vice prime minister and minister responsible for development aid, digital agenda, telecommunications and postal services in Belgium. Working for the cabinet responsible for development aid has resulted in a wonderfully satisfying work life with a task list that changes regularly, with new tasks and challenges coming in.

The reality is that what appears to be priority now may not be that priority a couple of hours later. Things change, and Omnifocus as I had set it up was not capable of dealing with that reality. It took too much time to manage, so my tool became a burden.

Two important aspects of Things I cannot find back in Omnifocus

Now, a while back I had purchased the entire Things application suite (Mac, iPad and iPhone) because they had a sale and I was curious. So I migrated my extensive task and project list over to Things ... and I have not looked back.

While there are quite a few reasons why I prefer Things over Omnifocus, two stand out as ultra-important:

Multiple tags/contexts: I tended to overcomplicate my contexts in Omnifocus, because I could only have one. Thinking about defining the appropriate contexts turned out to be a time sink. Witness of that time sink are some of the posts I wrote here on contexts. The point is, contexts matter, but they should not matter in such a way that they impede your work. In Things, I can use overlapping contexts. I have no issue marking two or even more contexts ... as long as I feel safe I will see the task when I need it, I am comfortable. Out of my head and in the system.

Today is a choice, not an obligation: The Today list offers me a choice of which tasks I want to commit to putting on there. Omnifocus always confronted me with a list of to do's for the day, which was of course my doing, but it may have been my doing yesterday, or even a week or a month ago. The situation may have changed from the start date. With Things, I plan ahead and I move tasks to the propriate day, but in the morning, when they crop up on my Today screen, they are nicely in yellow, and I cannot act on them unless I explicitly accept them as tasks of this day. Each day, when I plan my tasks, I choose whether I want to work on that specific task or not. I don't need to decide then and there about all of these tasks, no, I can actually select a couple and feel good about having done them. If I have time left, I go and select a few more ... but contrary to Omnifocus, I never feel like a loser ... because I do not defer tasks in my Today screen unless I explicitly want to.

Of course, it's not all wine and roses with Things. A couple of important functionalities remain missing, such as the lauded start date/due date system in Omnifocus.

However, for now, Things gives me peace of mind, while Omnifocus gave me stress and headaches.

[casmo-blog]

On teaching

This stray but very powerful thought just hit me:

Teaching is, to me, still the most compelling reason to learn something new, either by exploring new horizons or, more importantly, by critically reexamining those areas I thought I knew.

Something that just came to me and that I wanted to share.

[casmo-blog]

TextExpander: support with a smile

I'm a heavy TextExpander user and I love the application. Taking the time of setting up the text expansion "snippets" once and using them multiple times across different machines saves me time every single day.

Losing my snippets

But I had an issue. For some reason, after acquiring my MacBook Pro a couple of months ago, my beloved TextExpander started to behave, well, badly. It dropped the synchronisation with my Dropbox folder, requiring me to relink to the synchronisation file again and again. Now, I'm a slow learner, so it took me a while to concede that this was not something I was going to solve myself, just by thinking about it.

Delightful support

So I made the support call, to Smile Software, the company that distributes TextExpander. Remember my discussion on delightful processes, based on Shawn Blanc's "Delight is in the details"? Well, Smile most certainly earns the accolade of a delightful support experience. They were quick in reacting to my query, especially considering they were at the other end of the world - kind of.

Guided self-assessment

In non-threathening wording they guided me through a self assessment of my system, and after a couple of exchanges they gave me clear instructions on how to log the events on my system for further analysis. Once I sent that information, they returned very quickly to me with an answer, to which the solution was so obvious that I managed to solve it myself. So, thanks Smile for a wonderful service experience.

A simple problem

Now, what went wrong, or what did I do wrong? Well, my MacBook has an SSD of 256 GB, and I wanted to avoid putting too much information on it. So I installed a 64 GB TinyDrive in the appropriate bay on which I put my Dropbox folder. What I did not know was that it takes some time for the system to mount the drive, during which time TextExpander was desperately seeking Dropbox, in the end deciding it was not there and reverting to factory settings, hence no snippets. An entirely logical thing to do.

A simple solution

So what did I do? The answer was very simple. I switched off startup at login for TextExpander and wrote a very short Keyboard Maestro macro that activates when I login, waits for 60 seconds, then starts up TextExpander. Problem solved.

[casmo-blog]

The "why" of storytelling

Maria Popova hits one out of the ballpark again with this "animated essay" on the importance of storytelling.

Two essential quotes from a great article.

In the first one, she describes in a very clear and concise manner the difference and the interrelation between information, knowledge and wisdom:

At its base is a piece of information, which simply tells us some basic fact about the world. Above that is knowledge — the understanding of how different bits of information fit together to reveal some truth about the world. Knowledge hinges on an act of correlation and interpretation. At the top is wisdom, which has a moral component — it is the application of information worth remembering and knowledge that matters to understanding not only how the world works, but also how it should work.

She then goes on to define what the contribution of a great storyteller should be:

A great storyteller — whether a journalist or editor or filmmaker or curator — helps people figure out not only what matters in the world, but also why it matters. A great storyteller dances up the ladder of understanding, from information to knowledge to wisdom. Through symbol, metaphor, and association, the storyteller helps us interpret information, integrate it with our existing knowledge, and transmute that into wisdom.

Spot on. I would extend this to anyone who is responsible for translating the amazing amounts of information available today into wisdom, such as data analysts or anyone who stands up in front of a group to assist them in making sense of "the data".

Go ahead, watch the video and read the transcript. It's excellent.

[casmo-blog]

A last comment on time budgeting

Throughout the articles on time budgeting, I was looking for a good wording for what I intuitively felt was a relevant and value added approach. Then I read this article on brainpickings.org, which words it in the most excellent and eloquent manner possible. In the words of Annie Dillard in her book "The Writing Life":

How we spend our days is, of course, how we spend our lives. What we do with this hour, and that one, is what we are doing. A schedule defends from chaos and whim. It is a net for catching days. It is a scaffolding on which a worker can stand and labor with both hands at sections of time. A schedule is a mock-up of reason and order—willed, faked, and so brought into being; it is a peace and a haven set into the wreck of time; it is a lifeboat on which you find yourself, decades later, still living. Each day is the same, so you remember the series afterward as a blurred and powerful pattern.

The original article can be found here, at the brainpickings.org website, an excellent analysis by Maria Popova. Do look at that site for other publications as well. Mrs. Popova writes great articles.

[casmo-blog]

How my areas of responsibility contaminated my contexts

My struggles with contexts

I don't know about you, but I have suffered through long years of struggle with contexts. I adore the idea that David Allen proposed in his work "Getting things done", but it took me a very long time to get them to work appropriately for me.

I scoured the internet looking for suggestions on how to best organize contexts. There are quite a few interesting articles out there. Nevertheless, I always ended up with a context structure that was way too complex and distracted from my work instead of making it easier.

An epiphany!

Fast forward a couple of years, where I had this epiphany. Now, the way I write it, it must read as if this was a sudden "Aha!" moment. To be more accurate, it was more like a glacial movement in my brain. Now, what did I realize? In order to explain that, I need to go back to the way I used to organize my context. To give you a quick and incomplete taste (just to show the issue ...):

Places / Work

Places / Home

Places / University

Places / Errands

Tools / Tools @work / Work phone

Tools / Tools @work / Intranet

Tools / Tools @work / Servers

Tools / Tools @home / iMac

Tools / Tools @home / Home phone

Tools / Tools @home / Internet

Tools / Tools on the move / MacBook

Tools / Tools on the move / iPhone

People / Family / Wife

People / Family / Kids

People / Friends / Friend 1

People / Colleagues / Colleagues @work / ...

People / Colleagues / Colleagues @university / ...

Now, looking at it, I see immediately what the significant issue was that caused my problems. Can you see it?

Identifying my mistake

In my effort to properly segregate my contexts, I made the mistake of mixing contexts and areas of responsibility. This led to a significant overcomplication of my contexts.

Now, someone like for example Sven Fechner goes all in when he defines his contexts as a set of physical and psychological boundary conditions. Depending on the location and/or state of mind he can select what he will be doing. That is not an approach that would work for me, but I can see how that would work.

A simple mix of contexts

I currently use a very simple mix of contexts, where I focused on tool changes. After all, one of the key advantages of working in a certain context during a period of time is that I do not need to step outside of that context. I can keep my "tool set" active throughout my work in that context. And that will optimize my use of time. Now, you will see that there are certainly overlaps, but the overlaps to me are less important that the fact that I can really stay in that one context and work my way through what I need to be doing.

I've opted not to introduce hierarchies, although I could. I want to avoid confusing myself, so I kept it very, very simple. Let's explore my contexts for a bit ...

Location specific contexts

I use the following contexts:

@BTC: my employer

@Antwerp Management School: a university management school where I teach

@Solvay Brussels School: another university management school where I teach

@home

@errands

These are physical locations. When I am physically there, these contexts pop up on my OmniFocus screen thanks to my iPhone's location based capabilities. That is actually the only reason why I created them.

Menial tasks contexts

I use the following menial task contexts:

@calls: whenever I have a couple of minutes and my phone with me, I can do calls

@emails: I have access to all my email accounts from wherever I am, so this context allows me to send out some emails whenever I have the opportunity

@agenda/planning: when I am doing my daily and weekly planning, I look at this context to make sure there is nothing in there that I need to make sure to put in my schedule somewhere.

@administration: a catch-all for other menial tasks that need to get done

For these, all I need is a computer or an iDevice and access to the internet.

Shipping contexts

I use the following shipping contexts:

@research

@thinking/brainstorming

@reading/reviewing

@writing/analysis

These contexts are where I earn my money. This is where I add my value. What I do here will ultimately lead to some kind of shipping of a "deliverable" which is what I do. You will note that there is no context @teaching. That's because my teaching is solely calendar-bound. Tasks in preparation for teaching will be part of the shipping contexts as I go through the activities that lead to slides and a document. The same with internal audit work for BTC or consulting work I do from my own small company. They all involve these shipping contexts.

Interaction context

I currently have a single interaction context:

@meetings/people

Whenever I meet people, either individually or during a meeting, this is the context I will open to make sure I covered everything I wanted to cover with them. Note this context will not be complete, but it will contain those subjects which I am likely to forget. It does not replace a meeting agenda, it provides me with essential input for that agenda.

Waiting for context

And then, of course, I have the waiting for context:

@waiting for

This one I use to trigger follow-up actions. I usually defer the action item until the moment I need to follow-up with the specific people.

Overlaps

Apart from the location contexts, which I established to use the location based triggers on my iPhone, the contexts are (largely) agnostic to my areas of responsibility, which was my biggest problem. Now, there is certainly some overlap between the contexts. If I consider for example the @meetings/people context and the location based contexts, I do meet people usually in the same place ... but not always. However, I have established the habit of checking my @meetings/people context right before the start of a meeting or at the end of a conversation, so if anything is in that context, I am quite sure it will show up.

Conclusion

And that's how I solved my context issue. I know that from very complex I have gone to very simple, but the fundamental use is there: I am able to stay in a context and avoid unnecessary tool changes. And that is what contexts are all about. And there is no longer any confusion with my areas of responsibility.

[casmo-blog]

Delightful internal control processes in public sector organisations

Inspired by "Delight is in the details" by Shawn Blanc

The nascent public sector problem

Here's the problem: a lot of public sector organisations have been forced to shed a lot of what has long been considered their bloated structures. This often takes the form of personnel reductions. Some of these are retirees that do not get replaced in their functions. Some are public servants being moved around to other functions. Some are people leaving public service to try their luck in other sectors. At the same time, the tasks to be executed by the public sector remain the same or are, at best, reduced a bit. However, a government cannot immediately and radically reduce the service its citizens and private sector organizations have come to expect. The solutions are both a significant automation, mainly by means of information technology, and mainly in back-office activities, and an increase in the competency levels of the average public servant.

There is no silver bullet

Two considerations here: ICT will not solve everything, and is only as good at the software-implementor combination can make it, and the competency level of the average public servant is actually not necessarily lower than that of an average private sector collaborator.

The public's expectations only continue to increase

Meanwhile, the beneficiaries of the public sector activities, the public, expects that the core tasks of government are executed as well or better as before. This means that a core task should be executed efficiently, effectively, economically and ethically.

The road more traveled

There are two possible roads to achieve those ambitious objectives. The first one is the road more traveled by. A strong level of accountability is established, with strongly established hierarchical structures that "force" the collaborator to perform to a set of key metrics. This traditional approach imposes an order and a level of control that is wanted and required. I just wonder whether or not it is realistic, or whether it will lead to an increase in burn-out of public servants, leading to even larger problems over the long term.

From an internal control point of view, this approach asks for high degrees of internal controls, often added to existing processes. However, once those processes come under pressure, the internal controls added to them will quickly be abandonned, because performing them feels like it does not add any direct added value. And believe me, with further reductions of personnel and the usual teething issues with ICT, it is more than likely that the processes will come under pressure.

The road less traveled

There is another option, one I would like to refer to as the road less traveled by, the road not taken, referring to the poem by Robert Frost.

Qualitative performance is more important than quantitative performance

We can choose to optimize the processes not just from the point of view of quantitative performance, but also in terms of qualitative performance. The public wants a quality service, also from its government. Burden reduction initiatives are essential here. But it's not just the public we should target in this optimization exercise.

Engaging the process owner

The process owner should be able to execute his assigned tasks in the most logical, pragmatic way possible for him or her. This means stepping away from the production optimization mentality that has ruled pretty much any large scale organization since Ford's production chain. There is value in that, but we have likely exhausted that value years ago.

Tasks should not be executed for the benefit of executing a task, they should be executed for the benefit of the public. In addition, we need to establish ownership of the process related risks at the level of the process users themselves. That means that these people need to be allowed to manage their own risks, in the way most appropriate to them. Controls can be validated and optimized, but controls need to be adapted not only to the process and the context, but also to the process user as well.

The question then remains as to how we will monitor this. Nothing in the above excludes the measured use of metrics. Ideally, public sector can introduce some measure of performance based compensation, which should not necessarily be monetary at all.

It is okay to like your work

Ideally, process owners need to "like" doing the work they are asked to be doing. Now, like is of course a very subjective concept. I believe we can go a long way by translating a "liked" process as a process that is as simple as possible (but not simpler), logical, with tangible and measurable results, and ownership complemented by an accountability which is established not at the level of the individual metric, but at the level of the overall personal performance. Ideally, the end user of the public service, the public, has a say in how they appreciate what their public servants are doing.

This counterbalances a move which I often see for the establishment of traditional internal controls, attached to a process which are likely to be ignored under pressure.

[casmo-blog]

Time budgeting: a thousand no's

Brian's question

Brian made the excellent point in this question that it wasn't clear to him whether putting in the time to time-budget was not more of a waste of time than a benefit.

His question is highly relevant. It would make no sense if I would do this exercise without it bringing me some benefit. But how do I know that the significant effort I put into my time budget development will pay off in better used time? How do I know that time budgeting pays itself back? I don't have a 100% certain reply to that ... but as an internal control practitioner, I know from experience that increased accountability generates increased awareness and increased care. Just like developing and following up a financial budget makes me aware how money flows into and from the hands of my family and my business, a time budget increases my awareness and my care for my time.

Lying to ourselves

That whole awareness also works at the level of self-accountability. And this is important as I know I am very good at lying to myself, usually without me being aware of it myself. Let me give you an example:

5 minutes for me are usually between 7 to 10 minutes long. That may seem laughable, or bizarre, but how accurate are you yourself in predicting use of your time? If I tell my wife I'm writing an article which will take me about 30 minutes, she knows we'll be leaving the house in 45 to 60 minutes.

Front and back

I'm constantly kidding myself about my use of my time and I often fail to properly account for its use at all. Put that together with the above, that means I have an issue at both the front- and the back-end of my process. Another example to clarify:

I started my career working for a Big 4 (then still Big 6) accounting and consulting firm. We billed our hours, and I remember the struggle the first time reports were when I had to remember what I had exactly done the previous week. I learned in the first few weeks that the only way to properly account for my time was to keep timely and detailed records of my use of time.

Increased awareness

What time budgeting adds to this for me is the awareness of the available time, the intended use I give to it and the conscious choices I make to either follow the budget or deviate from it, with all the consequences. I know how much time I have available to me and I know what I would prefer doing in that available time. I give my available minutes and hours a purpose.

A thousand no's

When I am "doing" (GTD parlance), when I am living my life, alternative choices will come up. The fact I have to make a choice is not something that I feel as a constraint. Rather, it allows me to not fill the available time with the first type of "relevant use" that comes by. I am not getting sucked into a use of time before I even consider all the alternatives. Rather, I make a conscious choice to either do as I planned to do or to deviate from that intention, to do the planned activity later or even never at all.

Note that I don't feel this is about rigidity at all, no, it is about me making a conscious choice because I have an intended use before any opportunity presents itself. It's like this Apple commercial: "There are a thousand no's for every yes."

A quick side note

To close, a quick side note: as to spending my time with my wonderful wife and kids, I hear you say that that should be evident, at it should not be planned. And perhaps you are right ... but consider this: explicitly marking that time in my time budget as "their" time helps me to say no to other tasks and activities or opportunities whenever they present themselves. It is a conscious choice on my part to spend that time with them and not on other things ... unless I pay them the respect they deserve and discuss with them the fact that there are opportunities that may benefit us all.