WEBVTT 00:00:00.000 --> 00:00:18.000 Welcome to the KuppingerCole Analyst Chat. 00:00:18.000 --> 00:00:19.000 I'm your host. 00:00:19.000 --> 00:00:20.200 My name is Matthias Reinwarth. 00:00:20.200 --> 00:00:24.500 I'm analyst and advisor at KuppingerCole Analysts. 00:00:24.500 --> 00:00:26.200 And so are my guests. 00:00:26.200 --> 00:00:32.200 I really would like to welcome Kai Boschert and Patrick Teichmann. 00:00:32.200 --> 00:00:35.800 Both are advisors at KuppingerCole Analysts. 00:00:35.800 --> 00:00:37.900 Hi Kai and hi Patrick. 00:00:37.900 --> 00:00:38.900 Starting with Kai. 00:00:38.900 --> 00:00:39.900 Hi, Matthias. 00:00:39.900 --> 00:00:41.900 Thank you for having me. 00:00:41.900 --> 00:00:44.900 Hi, Matthias. 00:00:44.900 --> 00:00:47.300 And great to be back. 00:00:47.300 --> 00:00:48.300 Great to have you back. 00:00:48.300 --> 00:00:53.200 So for Kai, he's just been recently my guest, but you, Patrick, as well. 00:00:53.200 --> 00:00:56.838 And together you are working as advisors on 00:00:56.838 --> 00:01:00.900 topics with our end-user customer organizations. 00:01:00.900 --> 00:01:06.700 And this is actually where a webinar was initiated. 00:01:06.700 --> 00:01:09.633 So there has been a webinar with topics that 00:01:09.633 --> 00:01:13.100 have been discussed in various customer engagements. 00:01:13.100 --> 00:01:19.100 And so this is really straight from the real life into our advisory business. 00:01:19.100 --> 00:01:24.600 We want to talk about a topic where you, Kai, recently held a webinar about. 00:01:24.600 --> 00:01:27.800 We want to talk about IT governance. 00:01:27.800 --> 00:01:30.300 Before we dig deeper into it, you are advisors. 00:01:30.300 --> 00:01:33.520 So I think it's a result from our advisory 00:01:33.520 --> 00:01:37.200 work, but can you please give a short definition 00:01:37.200 --> 00:01:44.300 of what you consider IT governance to be and where it plays out its strengths? 00:01:44.300 --> 00:01:51.300 I mean, now you started with a short definition with such a complex topic, which is quite 00:01:51.300 --> 00:01:56.000 a challenging thing, but I try to keep it simple. 00:01:56.000 --> 00:02:03.100 IT governance usually can be seen as a bridge between the strategy and operations where 00:02:03.100 --> 00:02:07.887 we really try to craft the strategy and form 00:02:07.887 --> 00:02:13.000 it into operational guidelines to have a proper 00:02:13.000 --> 00:02:17.944 structure for the operations to follow strategy, 00:02:17.944 --> 00:02:23.300 but also following compliance and legal requirements 00:02:23.300 --> 00:02:25.600 from outside the company. 00:02:25.600 --> 00:02:26.600 Right. 00:02:26.600 --> 00:02:32.400 So it's on the one hand, knowing how things should be done and then translating that into 00:02:32.400 --> 00:02:41.300 real operational guidelines, processes and policies that are capable of being implemented 00:02:41.300 --> 00:02:42.300 in real life. 00:02:42.700 --> 00:02:45.700 Is this what you would agree to, Patrick? 00:02:45.700 --> 00:02:46.700 Yes. 00:02:46.700 --> 00:02:52.500 As you know, Matthias, I like metaphors a lot and I would say the governance is kind 00:02:52.500 --> 00:02:56.900 of your compass and how you achieve your compliance. 00:02:56.900 --> 00:03:03.400 So it gives you a view on how the organization should achieve compliance to, for example, 00:03:03.400 --> 00:03:07.238 the strategy, but also to legal requirements 00:03:07.238 --> 00:03:11.600 and equips it with the necessary tools, templates, 00:03:12.300 --> 00:03:17.000 options to actually achieve it and be compliant with 00:03:17.000 --> 00:03:21.700 whatever is demanded from the inside or the outside. 00:03:23.300 --> 00:03:23.800 Right. 00:03:23.800 --> 00:03:31.600 And so we've already used some terms which the layman and also the not so layman usually 00:03:31.600 --> 00:03:32.700 confuse with each other. 00:03:32.700 --> 00:03:41.300 So we are using strategy, governance, compliance and they are all connected, but obviously 00:03:41.300 --> 00:03:44.300 not the same, but they have overlaps. 00:03:44.300 --> 00:03:51.600 How do you distinguish strategy, governance and compliance in practical terms for an IT 00:03:51.600 --> 00:03:52.600 organization? 00:03:52.600 --> 00:03:55.650 How can you convey the message, which is what 00:03:55.650 --> 00:03:58.700 and why do I need to do what in that context? 00:03:58.700 --> 00:04:01.300 Maybe again, starting with you, Kai? 00:04:01.300 --> 00:04:02.300 Yes. 00:04:02.300 --> 00:04:10.300 Since Patrick already provided this wonderful term of options for the governance, I really 00:04:10.300 --> 00:04:15.900 want to grab this term again for the governance 00:04:15.900 --> 00:04:21.500 part where you really receive options to follow 00:04:21.500 --> 00:04:22.500 the strategy. 00:04:22.500 --> 00:04:25.100 So now we are back at the strategy. 00:04:25.100 --> 00:04:26.700 What is the strategy? 00:04:26.700 --> 00:04:28.200 It's a future point. 00:04:28.200 --> 00:04:33.700 It's a future vision of where you want to be and what you want to achieve. 00:04:33.700 --> 00:04:39.006 So it's a term or a static point in the future, 00:04:39.006 --> 00:04:44.200 which you can achieve with options to go there 00:04:44.200 --> 00:04:45.900 and really be there. 00:04:45.900 --> 00:04:49.820 So a strategy is very future looking while 00:04:49.820 --> 00:04:54.300 the governance is really moving forward, looking 00:04:54.300 --> 00:05:01.700 left and right and in front of you to go to the strategy, to go to this future state while 00:05:01.700 --> 00:05:10.000 the compliance really looks backwards on the whole thing, where you get your legal 00:05:10.000 --> 00:05:18.500 requirements, your requirements from risk, from the company itself and looks backwards 00:05:18.500 --> 00:05:20.800 on what did you do in the end. 00:05:21.000 --> 00:05:32.900 It's more a controlling instrument and not that providing a guideline for your company. 00:05:32.900 --> 00:05:36.300 It's just a controlling or it's a controlling cheat shift. 00:05:36.300 --> 00:05:37.300 Right. 00:05:37.300 --> 00:05:39.800 So strategy is where I want to go. 00:05:39.800 --> 00:05:45.600 Governance helps me getting there and compliance helps me understand how I got there where 00:05:45.600 --> 00:05:47.300 I am right now. 00:05:47.500 --> 00:05:50.800 That would be the short version. 00:05:50.800 --> 00:05:54.498 If we translate that into real operational 00:05:54.498 --> 00:05:58.900 tasks, how can I think of an example to illustrate 00:05:58.900 --> 00:06:02.900 that, Patrick, is there, what would be a strategy? 00:06:02.900 --> 00:06:04.800 What would be the governance to get there? 00:06:06.300 --> 00:06:09.673 Yeah, for example, I usually take the topics 00:06:09.673 --> 00:06:13.200 you have on the top level in the organization, 00:06:13.200 --> 00:06:15.713 for example, from your ISMS information 00:06:15.713 --> 00:06:19.000 security management system, which gives you kind of 00:06:19.000 --> 00:06:25.300 the requirements, what you need to achieve and determines the goals. 00:06:25.300 --> 00:06:28.254 They should be, of course, inspired by the 00:06:28.254 --> 00:06:31.700 legal requirements that affect your organization. 00:06:31.700 --> 00:06:35.400 But the governance really gives you or guides 00:06:35.400 --> 00:06:39.100 the organization how to achieve these defined 00:06:39.100 --> 00:06:45.200 requirements, goals of the organization and equips the operational organization with the 00:06:45.200 --> 00:06:48.200 necessary tools and the necessary options. 00:06:48.200 --> 00:06:56.300 So it helps to actually steer the organization by achieving this. 00:06:56.300 --> 00:07:03.500 So, for example, like when it is talking about the identity and access management 00:07:03.600 --> 00:07:07.035 discipline, then you have multiple options to 00:07:07.035 --> 00:07:10.700 achieve the goals that are defined, for example, 00:07:10.700 --> 00:07:11.700 in the ISMS. 00:07:11.700 --> 00:07:14.411 And then the IT governance gives you the 00:07:14.411 --> 00:07:17.800 options, what is the correct way to do it for your 00:07:17.800 --> 00:07:21.913 application, for example, to which systems to 00:07:21.913 --> 00:07:26.300 connect what particular requirements you have to 00:07:26.300 --> 00:07:30.900 follow or you have to implement in terms of, for example, technology or processes. 00:07:31.900 --> 00:07:32.900 Right. 00:07:32.900 --> 00:07:39.900 Anything to add from your side, Kai, or does this also reflect your view on this topic? 00:07:39.900 --> 00:07:40.900 Absolutely. 00:07:40.900 --> 00:07:48.900 But maybe to add, since you introduced the compliance, that you look on your processes, 00:07:48.900 --> 00:07:52.900 how you came to your goal. 00:07:52.900 --> 00:07:55.509 It's not only that you check how you got 00:07:55.509 --> 00:07:58.900 there, but also you verify if this really is in line 00:07:58.900 --> 00:08:03.900 with your strategy and with the legal requirements. 00:08:03.900 --> 00:08:08.900 And then you have this whole circle coming back to the strategy again. 00:08:08.900 --> 00:08:09.900 Right. 00:08:09.900 --> 00:08:16.900 And the way how you describe IT governance, that clearly makes clear for me that this 00:08:16.900 --> 00:08:21.900 is not a team-based approach in terms of just the IT team. 00:08:21.900 --> 00:08:23.900 There is a legal team which will take care of that. 00:08:23.900 --> 00:08:25.900 But it's a team effort. 00:08:25.900 --> 00:08:28.900 This is something that needs to be done across an organization. 00:08:28.900 --> 00:08:35.900 And in the webinar that you did, Kai, you've mentioned also the importance of a proper 00:08:35.900 --> 00:08:42.900 target operating model and that this really is a key enabler for actually achieving what 00:08:42.900 --> 00:08:44.900 we've been just discussing. 00:08:44.900 --> 00:08:47.900 Maybe you can elaborate a bit more on this. 00:08:47.900 --> 00:08:53.900 How do you bring people and processes together to make this work at scale? 00:08:54.900 --> 00:08:55.900 Yes. 00:08:55.900 --> 00:09:02.900 There you already emphasized the very key point here to have a holistic structure and 00:09:02.900 --> 00:09:09.900 a complete picture of where you want to go and to involve all the necessary stakeholders. 00:09:09.900 --> 00:09:16.900 As it is a team effort and it cannot be a single department who can achieve it. 00:09:16.900 --> 00:09:21.900 And you really need to incorporate all the different departments and structures in your 00:09:21.900 --> 00:09:22.900 company. 00:09:22.900 --> 00:09:27.173 And to really consolidate them into one picture 00:09:27.173 --> 00:09:31.900 and one moving piece, you really need to incorporate 00:09:31.900 --> 00:09:33.900 all of those different departments. 00:09:33.900 --> 00:09:39.900 And that is where the target operating model really comes into place, where you can manage 00:09:39.900 --> 00:09:46.900 all those departments and make them to pull together in the right direction. 00:09:48.900 --> 00:09:49.900 Right. 00:09:49.900 --> 00:09:50.900 Sounds good. 00:09:50.900 --> 00:09:53.900 What does this look like in real life, Patrick? 00:09:53.900 --> 00:09:54.900 Yes. 00:09:54.900 --> 00:09:56.900 This is a very interesting point. 00:09:56.900 --> 00:10:05.900 If you have such a central function, usually some decentral functions feel like they can 00:10:05.900 --> 00:10:11.900 offload some work to this particular function, to the central IT governance function. 00:10:11.900 --> 00:10:16.900 And it is very important when implementing this particular target operating model that 00:10:16.900 --> 00:10:23.900 you highlight IT governance as a central function supports you in achieving these goals 00:10:23.900 --> 00:10:25.900 that the organization has. 00:10:25.900 --> 00:10:33.900 But still, there is a supportive effort required by the different areas in your IT. 00:10:33.900 --> 00:10:39.900 So the application owners, for example, which are highly relevant here, need to support 00:10:39.900 --> 00:10:43.362 you in achieving this by, for example, filling 00:10:43.362 --> 00:10:46.900 your central asset management with the required 00:10:46.900 --> 00:10:52.900 information and cooperating by giving the data. 00:10:52.900 --> 00:11:01.900 So it is really important to not let them off, but keep them chained to this process 00:11:01.900 --> 00:11:05.900 and to highlight that task within this target operating model. 00:11:06.900 --> 00:11:07.900 Right. 00:11:07.900 --> 00:11:10.900 But in the end, it is also a matter of culture, right? 00:11:10.900 --> 00:11:17.900 So to understand that governance compliance and the implementation of a strategy as part 00:11:17.900 --> 00:11:20.900 thereof is really something that needs to be understood. 00:11:20.900 --> 00:11:23.900 And this is 2025 or almost 2026. 00:11:23.900 --> 00:11:25.900 This is no longer an afterthought. 00:11:25.900 --> 00:11:31.900 This governance and compliance needs to be woven into the overall way of how organizations 00:11:31.900 --> 00:11:33.900 actually do their business, right? 00:11:33.900 --> 00:11:34.900 Yeah. 00:11:34.900 --> 00:11:42.900 I would also phrase in a way that you have to then position IT governance not only as 00:11:42.900 --> 00:11:46.362 someone or as part of the organization, which 00:11:46.362 --> 00:11:49.900 is like just another audit organization, which 00:11:49.900 --> 00:11:53.362 is like finger pointing onto issues, but it's 00:11:53.362 --> 00:11:56.900 like a business partner which helps you really 00:11:56.900 --> 00:12:01.900 to achieve the goals and is supportive in this regards. 00:12:02.900 --> 00:12:10.900 And yeah, really, I like this picture of a business partner establishing this organization 00:12:10.900 --> 00:12:11.900 as such. 00:12:12.900 --> 00:12:13.900 Right. 00:12:13.900 --> 00:12:18.900 One term that really, really struck me in the webinar and also in the discussions that 00:12:18.900 --> 00:12:23.900 we had is based on the notion of having a first line of defense, which is operations 00:12:23.900 --> 00:12:27.900 and the second line of defense, which is actually risk and compliance. 00:12:27.900 --> 00:12:30.900 So those who monitor things while the others have to do it. 00:12:30.900 --> 00:12:36.900 And Kai, you came up with a one and a half line of defense or 1.5 line of defense. 00:12:37.900 --> 00:12:38.900 Yeah. 00:12:38.900 --> 00:12:40.900 Can you please elaborate a bit more on that? 00:12:40.900 --> 00:12:43.900 So you add another layer just in between, right? 00:12:43.900 --> 00:12:44.900 Yes, absolutely. 00:12:44.900 --> 00:12:48.900 And that's what Patrick already started to emphasize here. 00:12:48.900 --> 00:12:57.900 You really need to have a business partner between risk and strategy and IT security 00:12:57.900 --> 00:13:05.900 and operational functions because we often see that there is not always the same language 00:13:05.900 --> 00:13:06.900 spoken. 00:13:06.900 --> 00:13:09.778 And therefore, it is hard for them to 00:13:09.778 --> 00:13:13.900 understand on the one hand side what needs to be done 00:13:14.900 --> 00:13:17.900 to achieve the strategic or security goals. 00:13:17.900 --> 00:13:25.900 And on the other hand side, how do I need to phrase our requirements that operation 00:13:25.900 --> 00:13:29.900 really can achieve all those requirements? 00:13:29.900 --> 00:13:36.900 And that's where the one and a half line come into play is where they really can advise 00:13:36.900 --> 00:13:45.900 the first line, how to do things, how to actually achieve the goals, which is set by 00:13:45.900 --> 00:13:54.900 risk, is set by security or strategy, and then helping to report all those achieved 00:13:54.900 --> 00:13:55.900 goals to them. 00:13:55.900 --> 00:14:03.900 So it's really the part between the first and the second line helping to have a proper 00:14:03.900 --> 00:14:07.900 and smooth working operations. 00:14:07.900 --> 00:14:08.900 Right. 00:14:08.900 --> 00:14:10.900 But this is also stakeholder communication. 00:14:10.900 --> 00:14:13.400 Coming back to Patrick as the practitioner who 00:14:13.400 --> 00:14:15.900 has gone through all the pains of implementing 00:14:15.900 --> 00:14:21.900 such a thing, how important is this 1.5 line of defense? 00:14:21.900 --> 00:14:27.900 From my perspective, very important because the thing is when you look at the strategic 00:14:28.900 --> 00:14:34.900 units in your organization, for example, the ISMS, which defines overall requirements, 00:14:34.900 --> 00:14:37.900 which need to be valid for the whole organization. 00:14:37.900 --> 00:14:43.900 There's a gap between this strategy and the actual doing on the operations level. 00:14:43.900 --> 00:14:51.900 And a lot of operational units often suffer that they do not know if their implementation 00:14:52.900 --> 00:14:58.900 is compliant and enough to fulfill the requirements and need some more guidance. 00:14:58.900 --> 00:15:08.900 And this is where the 1.5 line of defense really comes into play and ensures that also 00:15:08.900 --> 00:15:12.900 targeted measures are applied. 00:15:12.900 --> 00:15:13.900 What does this mean? 00:15:13.900 --> 00:15:18.443 So, for example, if you have highly or 00:15:18.443 --> 00:15:24.900 applications that need to be highly secured and not so 00:15:24.900 --> 00:15:32.900 critical applications, for example, as the container plan or usual example, then you 00:15:32.900 --> 00:15:39.900 need someone who is like advising you can act as a sparring partner and help to make 00:15:39.900 --> 00:15:42.900 things work and to orchestrate it. 00:15:42.900 --> 00:15:43.900 Right. 00:15:43.900 --> 00:15:44.900 Make things work. 00:15:44.900 --> 00:15:46.900 How do you make things work? 00:15:46.900 --> 00:15:51.400 I think providing the right tooling, the right 00:15:51.400 --> 00:15:55.900 help in terms of documentation, plus the right 00:15:55.900 --> 00:15:57.900 stakeholder communication are key. 00:15:57.900 --> 00:16:02.900 But how can you support an organization actually in achieving their goals? 00:16:02.900 --> 00:16:10.900 What are typical artifacts that you can provide to an organization to make it easier? 00:16:10.900 --> 00:16:18.900 So the easiest way to help an organization is usually to reduce the effort spent in 00:16:18.900 --> 00:16:25.900 complying to risk, to comply to security and be compliant in the end. 00:16:25.900 --> 00:16:31.900 So therefore, as you already state, providing templates for the organization and have a 00:16:31.900 --> 00:16:35.900 proper centralized reporting format, have it centralized. 00:16:35.900 --> 00:16:41.900 So there is one central point where everybody can find the necessary reports. 00:16:41.900 --> 00:16:50.900 So there and the second line really has one point to contact as well as the operations 00:16:50.900 --> 00:16:57.900 where they have one central place where all the formats and templates are, where they 00:16:57.900 --> 00:17:03.900 can report into, don't need to spend time to create own report templates, which nobody 00:17:03.900 --> 00:17:06.900 understands because they always look different. 00:17:06.900 --> 00:17:14.900 So you really want to reduce redundancy and have proper communication channel in there. 00:17:14.900 --> 00:17:16.900 I would also add there. 00:17:16.900 --> 00:17:21.900 So the templates and when this all comes to play is a really good measure and method. 00:17:21.900 --> 00:17:26.900 We are now tending to recommend you to establish standard patterns. 00:17:26.900 --> 00:17:33.900 We are, as computer scientists are going or are well known for patterns when developing 00:17:33.900 --> 00:17:36.900 solutions, but this can also be applied here. 00:17:36.900 --> 00:17:38.900 Utilize standard patterns. 00:17:38.900 --> 00:17:43.900 When is what requirement valid for which kind of application? 00:17:43.900 --> 00:17:49.900 What particular tools are necessary to stick to and to apply to and make it easy for the 00:17:49.900 --> 00:17:53.900 organization to close this gap between the strategy and the operations. 00:17:53.900 --> 00:17:58.900 And this pattern really helped there, but not only telling the rules, but also what 00:17:58.900 --> 00:18:06.900 helps you actually to fulfill these rules and to automatically know what is valid for 00:18:06.900 --> 00:18:07.900 you. 00:18:07.900 --> 00:18:08.900 Right. 00:18:08.900 --> 00:18:15.900 I'm a big fan in almost every area to start small and then scale smart. 00:18:15.900 --> 00:18:19.900 So this really to begin at the right point. 00:18:19.900 --> 00:18:26.900 So maybe you will begin with a very small team of first line, second line and the 1.5 00:18:26.900 --> 00:18:27.900 line in between. 00:18:27.900 --> 00:18:31.278 When it comes to growing in this area, 00:18:31.278 --> 00:18:35.900 because governance compliance is a key challenge for 00:18:35.900 --> 00:18:36.900 every business. 00:18:36.900 --> 00:18:42.900 Is there kind of recommendations that you can give when it comes to the role separation 00:18:43.900 --> 00:18:48.900 between the governance team and their design and the lead people in there? 00:18:48.900 --> 00:18:54.900 And the execution, the operations team, on the other hand, how should they communicate? 00:18:54.900 --> 00:18:58.900 And is there a clear segregation of duties in that area? 00:18:58.900 --> 00:19:00.900 Patrick, maybe you first. 00:19:00.900 --> 00:19:01.900 Yeah. 00:19:01.900 --> 00:19:05.011 So with compliance, governance and these 00:19:05.011 --> 00:19:08.900 topics, it's always the question, is there an MVP? 00:19:09.900 --> 00:19:13.096 The thing is, as soon as you are shining a 00:19:13.096 --> 00:19:16.900 light on the issues you have in your organization, 00:19:16.900 --> 00:19:18.900 you need to close everything. 00:19:18.900 --> 00:19:21.900 So it's all about mitigation at the end. 00:19:21.900 --> 00:19:27.900 But I think the very first step is always to get a complete picture of the landscape. 00:19:27.900 --> 00:19:30.900 So where are we before rushing to solutions? 00:19:30.900 --> 00:19:32.900 Understand where are we? 00:19:32.900 --> 00:19:39.900 And that can be with starting with a registry of all the applications, for example, and 00:19:39.900 --> 00:19:42.900 what four measures are already applied. 00:19:42.900 --> 00:19:45.233 Understand what are the requirements, what 00:19:45.233 --> 00:19:47.900 are your applications and how they are currently 00:19:47.900 --> 00:19:50.900 applied and to get an understanding. 00:19:50.900 --> 00:19:53.900 And of course, it can start with an Excel sheet. 00:19:53.900 --> 00:19:56.900 Yeah, of course, there's always the issue. 00:19:56.900 --> 00:19:59.900 It becomes outdated quite quickly. 00:19:59.900 --> 00:20:04.900 But to start the collection of information about the applications and what four measures 00:20:04.900 --> 00:20:06.900 are applied there. 00:20:06.900 --> 00:20:13.900 And then you can start focusing on the most nagging problems, I would call it. 00:20:13.900 --> 00:20:18.900 Yeah, the top priorities and apply a phased approach. 00:20:18.900 --> 00:20:21.900 Don't try to resolve everything in one shot. 00:20:21.900 --> 00:20:24.900 I think that is a recommendation we can give. 00:20:24.900 --> 00:20:30.900 Yeah, keep a focused, phased approach and have a plan how to actually resolve gaps you 00:20:30.900 --> 00:20:33.900 have within your organization. 00:20:33.900 --> 00:20:34.900 Right, Kai. 00:20:34.900 --> 00:20:35.900 Any additional thoughts? 00:20:35.900 --> 00:20:38.868 I think because you've gone through some heavy 00:20:38.868 --> 00:20:41.900 effort in that area for ourselves, for Kupinger 00:20:41.900 --> 00:20:42.900 Co. 00:20:42.900 --> 00:20:43.900 Yes. 00:20:43.900 --> 00:20:44.900 So this is something that you led already. 00:20:44.900 --> 00:20:48.900 So sometimes in the end, also celebrate what you achieve. 00:20:48.900 --> 00:20:49.900 Yes, absolutely. 00:20:49.900 --> 00:20:54.900 So the name of the game is, I think, simplification. 00:20:54.900 --> 00:21:02.900 So as Patrick stated, shining the light into the whole governance department usually tends 00:21:02.900 --> 00:21:06.900 to, OK, we have a lot of topics to cover now. 00:21:06.900 --> 00:21:10.900 And top management wants to have it closed yesterday. 00:21:10.900 --> 00:21:13.900 But in the end, this is not possible. 00:21:13.900 --> 00:21:20.900 And there you really need to focus and step a little bit back and see, OK, what are the 00:21:20.900 --> 00:21:23.900 topics we actually have and simplify them. 00:21:23.900 --> 00:21:27.900 So you have proper names for your problems. 00:21:27.900 --> 00:21:32.900 And if you can write down your problem, you are 50% done already. 00:21:32.900 --> 00:21:39.900 So if you have all your problems properly defined and stated, you really can deconstruct 00:21:39.900 --> 00:21:43.900 them into actual tasks you need to do. 00:21:43.900 --> 00:21:49.900 And for all those tasks you need to do, you can have proper role assignments and you can 00:21:49.900 --> 00:21:52.900 find your resources to target those tasks. 00:21:52.900 --> 00:21:58.900 So therefore, you really simplify the whole structure. 00:21:58.900 --> 00:22:02.900 You name your problems and then you prioritize them. 00:22:02.900 --> 00:22:09.900 And then you have a proper roadmap in the end, which is kind of simple, but yet it's 00:22:09.900 --> 00:22:12.900 challenging to achieve in the end, of course. 00:22:12.900 --> 00:22:17.255 But you have at least an MVP in the end where 00:22:17.255 --> 00:22:21.900 you want to start and which you want to achieve. 00:22:21.900 --> 00:22:25.900 And then from there on, you have a proper baseline which you can grow from and really 00:22:25.900 --> 00:22:29.900 scale into the whole picture. 00:22:29.900 --> 00:22:30.900 Right. 00:22:30.900 --> 00:22:34.900 I think you not necessarily always have a greenfield approach. 00:22:34.900 --> 00:22:38.900 Sometimes there are pressing issues which need to be resolved immediately. 00:22:38.900 --> 00:22:43.400 So for reducing risk and achieving governance, 00:22:43.400 --> 00:22:47.900 you might even be forced to apply a risk-based 00:22:47.900 --> 00:22:52.900 approach to that to start with where the high risks are to reduce the overall risk. 00:22:53.900 --> 00:22:57.556 So there is often a natural sequence of 00:22:57.556 --> 00:23:02.900 initiatives to execute to get to where you want to first. 00:23:02.900 --> 00:23:08.900 I think that's also some lesson to be learned because it's not just paperwork. 00:23:08.900 --> 00:23:14.900 It's also improving your compliance governance, but also your security posture in the end 00:23:14.900 --> 00:23:17.900 because it's the same kinds of measures that you apply. 00:23:17.900 --> 00:23:19.900 We're getting to the end of this episode. 00:23:19.900 --> 00:23:24.900 And I can only highly recommend that those who are watching and who are interested in 00:23:24.900 --> 00:23:28.900 more that they follow up with Kai's webinar. 00:23:28.900 --> 00:23:32.856 So if you look just on the Copenhagen website 00:23:32.856 --> 00:23:36.900 for Kai and his name and for some terms around 00:23:36.900 --> 00:23:43.900 governance and compliance and webinar, very important, then you should be quickly there. 00:23:43.900 --> 00:23:48.900 It's an hour of presentation plus Q&A with the audience. 00:23:48.900 --> 00:23:52.900 And I think that's really a good starting point for everything else. 00:23:52.900 --> 00:23:56.900 You are currently considering providing more research. 00:23:56.900 --> 00:24:01.900 Of course, you're doing this in advisory work, both of you and our team, because this is 00:24:01.900 --> 00:24:05.900 a growingly important topic as we can see. 00:24:06.900 --> 00:24:13.900 But if there are any questions, if there is any demand for documentation, we are happy 00:24:13.900 --> 00:24:21.900 to take your input, dear audience, just to react on what is actually needed. 00:24:21.900 --> 00:24:29.900 And we want to be not only advisors, but also enablers of governance and compliance. 00:24:29.900 --> 00:24:32.900 So please let us know what you are interested in. 00:24:32.900 --> 00:24:39.900 And if it's the guideline, maybe there will be an advisory note by Kai explaining how 00:24:39.900 --> 00:24:40.900 to get there. 00:24:40.900 --> 00:24:44.329 Or if you need, for example, some good templates 00:24:44.329 --> 00:24:47.900 to use as a starting point for this documentation, 00:24:47.900 --> 00:24:50.213 could be Excel, as you said, or maybe 00:24:50.213 --> 00:24:53.900 recommendations towards which software solution actually to 00:24:53.900 --> 00:24:54.900 apply. 00:24:54.900 --> 00:24:55.900 We can support in there. 00:24:55.900 --> 00:24:57.900 And please reach out to us. 00:24:57.900 --> 00:25:00.700 We are really looking for your feedback on 00:25:00.700 --> 00:25:03.900 how to evolve this topic, because it's a growing 00:25:03.900 --> 00:25:04.900 one. 00:25:04.900 --> 00:25:06.900 Before we close down, final words. 00:25:06.900 --> 00:25:09.900 I start with, oh, I don't know, with Patrick. 00:25:11.900 --> 00:25:20.900 Yeah, I would say, as my colleague Phillip, or our colleague Phillip always says, don't 00:25:20.900 --> 00:25:22.900 start the transformation before you assess. 00:25:22.900 --> 00:25:23.900 Yeah. 00:25:23.900 --> 00:25:24.900 And this applies also here. 00:25:24.900 --> 00:25:29.900 Don't rush for a solution before you had a complete picture of your situation. 00:25:29.900 --> 00:25:32.426 So really utilize this and start with an 00:25:32.426 --> 00:25:35.900 assessment where you are with your applications and the 00:25:35.900 --> 00:25:39.900 requirements applying here, and then start the transformation. 00:25:39.900 --> 00:25:40.900 Right. 00:25:40.900 --> 00:25:42.900 Then final words from Kai for today. 00:25:42.900 --> 00:25:44.900 Yes, of course. 00:25:44.900 --> 00:25:45.900 Final words. 00:25:45.900 --> 00:25:49.900 So I want really to emphasize what you already started. 00:25:50.900 --> 00:25:53.900 Just give us a hint, which is really interesting. 00:25:53.900 --> 00:26:01.900 Since we covered a quite big topic here within, I think, not exactly 30 minutes. 00:26:01.900 --> 00:26:04.900 And the webinar is a little bit longer. 00:26:04.900 --> 00:26:11.900 And I think all of those topics can be dived into a lot more. 00:26:11.900 --> 00:26:15.900 So really highlight us, which is interesting for you. 00:26:16.900 --> 00:26:20.900 And then we can really find the right things to speak about. 00:26:21.900 --> 00:26:22.900 Right. 00:26:22.900 --> 00:26:28.900 So it's a combination of best practices on how to do things properly in general, but 00:26:28.900 --> 00:26:31.900 then translating that into the actual organization. 00:26:31.900 --> 00:26:37.900 That is also a task that can be done by the team itself, can be done with support by third 00:26:37.900 --> 00:26:38.900 parties. 00:26:38.900 --> 00:26:40.900 Us, others don't care. 00:26:40.900 --> 00:26:47.900 But also to provide a second pair of eyes that can support an organization in achieving 00:26:47.900 --> 00:26:48.900 that. 00:26:48.900 --> 00:26:50.900 Having said that, I want to close down. 00:26:50.900 --> 00:26:51.900 Thank you very much, Kai. 00:26:51.900 --> 00:26:56.900 Thank you very much, Patrick, for showing your different perspectives on this really 00:26:56.900 --> 00:26:57.900 evolving topic. 00:26:57.900 --> 00:27:01.900 In the first place, it sounds a bit dry. 00:27:01.900 --> 00:27:08.900 But to implement that in the end is, on the one hand, an effort, on the other hand, really 00:27:08.900 --> 00:27:09.900 beneficial. 00:27:09.900 --> 00:27:16.900 And it goes far beyond just achieving compliance for checkbook check checkmark compliance. 00:27:16.900 --> 00:27:18.900 But it's really improving organizations as a whole. 00:27:18.900 --> 00:27:20.900 So it's really something to strive for. 00:27:21.900 --> 00:27:22.900 Thanks again, Kai. 00:27:22.900 --> 00:27:23.900 Thanks again, Patrick. 00:27:23.900 --> 00:27:26.163 Patrick, looking forward to having you soon 00:27:26.163 --> 00:27:28.900 again and maybe talk a bit more about IT governance. 00:27:29.900 --> 00:27:30.900 Thank you very much. 00:27:31.900 --> 00:27:32.900 Thank you.