Relationship between IT and a Companys Competitive Advantage - Essay Example

? HARVARD BUSINESS REVIEW COMPETITIVE FORCES PAPER Harvard Business Review Competitive Forces Paper Relationship between IT and a company’s competitive advantage Michael E. Porter’s article “How Competitive Forces Shape [Business] Strategy” was first published by Harvard Review in 1979 and the economist and associate professor’s article revolutionized the strategy field. The article explains how the five main competitive forces which include: Customers, suppliers, entrants, established competitors/rivals and substitute offerings/products. While aligning IT with the Business Strategy, some of the forces can take advantage due to IT vulnerabilities and can bring risks to the business. However, the risks can be translated to a competitive advantage (Porter, 2008). Areas where IT represents a risk to company’s competitive advantage Physical threats Physical threats arise from damage of company servers and other IT resources e.g. by fire, theft and floods. It may also happen as a result of unauthorized access of information by malicious employees. Electronic threats Such risks when they materialize aim at compromising the information security of a company. They come in the following ways: virus attacks e.g. luv bug and Melissa viruses; attach by black hat hackers who are usually malicious and crack your IT system hoping to gain something out of the information; fraudulent emails and websites. These threats can cause fraudulent transactions. The staff also misuses organizations emails and web. Organizations bandwidth can also be misused by Staff who performs peer-to-peer file transfer and sharing. Failure to update or configure the organization's software usually brings about these types of threats. Technical failure Occur when a hardware device ceases to function or some of its components get damaged. In some instances, it occurs when a software bug is introduced to the system or shows up due implementation errors. This failure can occur due to large, complex systems which are unstable and are frequently maintained and updated. Infrastructural failure Occurs when network and power outages occur and one cannot access the internet. These will definitely interrupt the business process and valuable transactions might be missed out. A company may have an Uninterrupted Power Supply, but in other cases, they seem to fail. Human error These happen when an employee fails to adhere or to be keen to IT stipulated policies and procedures or when an employee accidentally deletes important business data. Specific areas in which IT may support or promote a company’s competitive advantage Know the IT environment/estate In order to manage risks, a company needs to know all its IT assets. It needs to know how many servers are there, how many PCs per department, the applications running on the servers and client PCs. The company should also keep track of who uses which IT asset, who manages the assets, supports the systems, the data stored and processed in servers and machines, the workflow of the processes e.tc. A company might rate the importance of an asset by the data they store the liability which can be got when the data gets mishandled. Companies also have tools which track the assets even by the person who uses it and can even happen in real time, but the most important thing is arranging the assets in groupings which are organized e.g. as a business unit, data center product line. It can be put in any grouping which allows the analysts to do their job without too much consultation or up and down movements. A manager may want to view analysis reports or an auditor may want to view compliance reports. Identifying risks and policies The organization needs to identify the risks which are a likely and their probabilities. It should also identify the policies which can be utilized in managing risks. The starting point is identifying the operational policy controls which are usually under the company’s IT Governance and risk compliance (GTC) program. The operational controls standards used to protect an organization’s sensitive information should be checked and ascertained that it works properly. The failure of a risk control can be calculated by getting its impact on the occurrence and also the probability that it will happen. Another way to recognize risks is to examine what other organizations or departments have already done to identify the problem. An organization like Delloite Touch have identified key risk indicators e.g. unavailability of skilled and qualified IT staff and systems breaches and third party. Prioritizing of risks also makes the managers to focus and monitor on the progress of that specific risk. Identify gaps and test controls Control testing involves a process where management distribute questionnaires to system analysts and server maintenance staff, gathering data, which is automated from scanners which scan vulnerable IT systems, incidents logs and management systems for network change. From the large amounts of data gathered, gaps in the network infrastructure are gathered, and the appropriate counter measures are put in place. Sometimes if an organization servers from a “test fatigue” in this process if the organization cannot identify the critical gaps in the systems. To minimize excessive stress, which might result to “burn out”, it is essential to establish a set of critical controls which are common to the organization, that get tested for all the regulations e.g. Sarbanes-Oxley 404. Optimizing Mitigation The test controls performed are many and the work implied by the outcome need to be optimized. The outcomes can be optimized by applying risk scoring techniques. Risks scores are outlined by asking questions about each control technique, e.g. How critical, as far as business continuity, data privacy and protection, is the secured system to the business strategy or to clients and suppliers, regulators or shareholders? What is the possibility of the system to fail the control test based on previous performance? How much exposure does the system has to the internet and how many people access it? After doing all this and the risk scores application is done; the priorities for IT work becomes productive and will lead to a more competitive advantage. Continuous report and Monitor Auditors, regulators and companies have to structure the way reporting is done. What is to be reported and to whom, how frequent and why. This structure will separate leaders from laggards. Industry mandates such as PCI is nowadays determining compliance by checking whether controls were in place and properly functioning when a violation occurred rather than checking it from the time of the last audit. This puts across that compliance is not an event a continuous process, an ongoing process. Infrastructural failure How it would occur: A power outage may occur in telecoms provider, for instance due to rain in the area, and water sipped into its infrastructure causing short-circuiting. In the process, the UPS and back-up generator failed to function, and all its operations were disrupted. Steps to reduce the risk: A redundant back-up generator can be provided to reduce the risk. Also, time a mitigation plan like putting a team in place to be deployed as soon as the outage occurs, this can be enhance by having a system which monitors in real-time the power supply in the organization. Optimizing mitigation How it would occur Optimizing mitigation can occur when the management decides to get a risk score for their online-funds transfer system. The management can get a risk score for the system by asking a question like; how much exposure does the system have to the internet and how many people access it? After getting the probability of the risk attached to the system, the company can put the necessary amount of effort in ensuring that the system is secure e.g. by hiring a system analyst. They will be analyzing the system and monitoring so that any outliers can be detected. How it would improve the company’s competitive advantage This will greatly improve customer satisfaction and incidences of the system being hacked are reduced and the organization gains reputation and a more customers increasing its profit and hence competitive advantage. Reference Porter, M. E. (2008). The Five Competitive Forces That Shape Strategy. Harvard Business Review . Read More