A Business Technology Place

How to use SharePoint to create audit trails

Show me the evidence.

I think auditors chuckle inside when they say “show me the evidence.” It’s part of their craft to seek and inspect. Over the past several years I’ve been giving documentation and evidence to auditors for various IT controls. With regard to policies, procedures, and standard practices auditors want to see more than a one-time pieces of evidence. They want to see proof that the behavior is happening on a regular basis. It’s the classic audit trail.

SharePoint – Love it. Hate it.

I’ve had my moments with SharePoint on a few items related to workflow. But one valuable attribute I’ve found with the tool is the ability to version documents and lists. This capability creates the perfect audit trail and evidence proof.

Example 1 – Annual Policy Updates

I keep version information in two places for policy documents. The first is in the document header. This shows the date of the policy, the last review date, and a version number. You can do this part without SharePoint.

 

 

The second place is in the version of the SharePoint document. First make sure that versioning is turned on for the document repository (one-time setup). Go to the library settings and select versioning settings. Then fill-in the specifics for how you want the versions to be incremented and how many versions to keep.

 

 

Each time I edit a document I use the check-out for editing feature. Then I apply my changes and when I check the document back-in SharePoint prompts for a summary of the updates. Each time this happens a new version of the document is created and logged.

 

To see the previous versions and comments select the version history from the document selection menu.

 

Example 2 – Production Change Updates

I use a SharePoint list to track requests and approvals for production change updates. As with documents, make sure the list has version control turned on by going to the list settings and enabling versioning.

 

The version history for a list shows the dates of the field updates and which specific fields were updated. It also keeps the name of the person who updated the fields (redacted in my example).

 

 

This is a simple way to keep history of policies, procedures, and updates. Having this available and ready to show an auditor makes the audit process a little easier.

Onward and upward!

 

Special Sauce

Two all-beef patties, special sauce, lettuce, cheese, pickles, onions, on a sesame seed bun. I remember that McDonald’s commercial like it was yesterday. Now, decades later, I’m still fascinated with ‘special sauce’, just not the sauce on a Big Mac. The topic is universal. What makes companies and groups successful?special-sauce

This article from Harvard Business Review about corporate survival examines the increased failure rate of companies that start today versus those that started before 1980. Their research found that, “firms listed after 2000 spent more than twice as much as earlier firms (in percentage terms) on organizational capital and half as much on physical assets…..But that advantage is a double-edged sword, they add: The good news is the newer firms are more nimble. The bad news for these firms is that their days are numbered, unless they continually innovate.”

Innovation encompasses special sauce. Some companies find it by creating a new paradigm like Cirque de Soleil. They created a new mold for a circus by removing animals and focusing on adults with a more sophisticated form of entertainment. Chic-fil-a uses customer experience and community involvement for their special sauce to make a chicken sandwich more than just lunch. Innovation isn’t limited to technology. The special sauces from Cirque de Soleil and Chic-fil-a have staying power. While competitors can see it, they haven’t really been able to imitate it. I found the Big Mac special sauce recipe online.

Keep searching for your special sauce.

Onward and Upward!

Solve it!

I carry a paper notebook with me through the work week to records notes, thoughts, and action items. I prefer not to take my laptops into meetings because it helps me stay focused on participating injustsolveit the meeting. The content of a meeting, or other interaction, is often the source of ideas or even blog posts! Typically I transform my notes into an electronic system or put them in a to-do list. As I was reviewing my notes from this past week I found this thought:

“We want a formula to solve our problems.”

___________________

What would our business be like if every problem had a formula to follow for a guaranteed answer of success? That would be great. Sign me-up. Books are released every week with answers to common or recurring questions and problems. They give us checklists, rules, and procedures to find success. The ideas, the process, and the results make us feel good inside. It’s a prescription for success. Let’s get started!

But problems in life and the business are rarely that easy. A formula will give an answer and quite possibly a very good answer. But then I think if all the problems had a formula to follow to solve it, and everyone could do it, then there wouldn’t be winners and losers. Everyone should solve the problem every time. But you and I know that’s not reality.

The next thought in my notebook reads:

“Formulas and methodologies position teams for success but don’t ensure it.”

___________________

I enjoy the experience of a good game of baseball. Recently I read the book Moneyball by Michael Lewis. The book discusses the journey of Billy Beane as a professional baseball general manager who sought a formula to predict the baseball players most likely to succeed at their sport. With the help of some smart data analysts Bean did come up with a formula and it was used as the basis to build some successful baseball teams.  

But even with that formula there was more required. Even with the latest and greatest software development methodology more is required. Even with the dieting rules defined in that book more is required.

What the formulas don’t provide is the ability for someone to read current conditions before making decisions about the inputs and timing. In a business environment I’m thinking about conditions such as when people will be available for a project, when cash is available to fund an investment, or the opportunity cost for two competing projects.

I want to formula to neatly solve all the problems. But I can’t miss the requirement to read the context of the situation to augment the benefits of following the formula. I feel the skill to read the context of a situation and then execute the play is often times what separates a successful outcome from one that doesn’t meet the goals. Easy to say. Not easy to execute. There’s no formula for that.

Onward and upward!

What’s your True North

Sometimes when I read books I realize the author’s point is a variation or derivative of another concept that I studied in the past. It’s doesn’t mean the two authors thoughts are necessarily linked in any-way. I just get the same basis from each of their thoughts as I consider application in my life.

Here’s an example:

In Start with Why Simon Sinek talks about the power of understanding ‘why’ we do something and its relationship to ‘how’ and ‘what’ we do. He argues successful companies are started with a ‘why’ by an individual or group. ‘Why’ is the driving idea for inspiration and innovation.  When companies lose sight of ‘why’ they are in business and solely focus on what they produce, the results are not as beneficial to employees and customers.

I linked Sinek’s idea to basing management decisions on a long-term philosophy, (even at the expense of short-term financial goals), from the book The Toyota Way by Dr. Jeffrey Liker. In the Lean Principles a True North is a vision of an ideal state. True North is a guide to help with long term thinking because it is based on ‘why’ more than ‘how’ and ‘what’.

Why?compass

A while back I considered the lean principle of basing management decisions on a long-term philosophy. I thought about why I chose a professional career in Information Technology. Why am I motivated by certain experiences at work and not others?

I documented my answer as a mission statement.

IT Mission – “We connect people through systems and solutions.”

It’s simple. My ‘why’ is more about people than machines. My ‘why’ is more about solving problems than working with technology.

What’s your True North?

 

Photo Credit: Verino77 via Flickr Creative Commons.

Pick your team.

I have fond memories from my youth when I was with a group of friends and we picked teams for a game. The games varied; baseball, kickball, capture the flag, football, or war. But the act of picking teams usually followed the same process. Two captains were selected and then each captain would take turns picking team members from the rest of the group. The order of selection was based on skills and the kid the captain thought provided the best chance to win. Sometimes it was based on friendships and alliances made outside the field of play. Then we played.the-sandlot-crew

When I select members for a technology department today, I have a different perspective. I like to look for team members that can contribute beyond a specific technical skill set. A base technical skill is required, but it is not enough to be on the team I would pick. Daniel Pink writes in his book A Whole New Mind that technical skills are increasingly being replaced by someone who can do it cheaper (think Asia) or a computer that can do it faster. Pink argues knowledge workers who can contribute beyond direct technical output will find more options for employment and a higher likelihood of career fulfilment. These workers can detect patterns, see opportunities, and combine results into new inventions and stories to connect with customers and coworkers.

This past week my wife interviewed two candidates for a position on her team. She asked me for advice on how to approach the process and make a distinction between the two candidates. I recommended looking for the candidate who showed interest in the mission of her workplace. Did they ask questions about the business, the workflows used by the team, the current challenges, etc.? This employee would become more fully engaged in looking at the big picture and trying to help find solutions and make improvements.

In another conversation this week, I was asked about replacing a member on our technology steering committee. The basis for the question was the new prospective member was younger and more comfortable with technology solutions. I reminded my colleague the primary purpose of the committee was to discuss the direction and impact of technology solutions on the business more than any specific technology used. The skill set I want on the committee requires more institutional knowledge of the business than it does technical knowledge.

Picking teams today is different than when I was a kid. I want team members who are engaged enough to ask clarifying questions, to ask why, and to suggest areas of improvement. I want team members to make an intentional effort to understand the whole solution and not just the tasks assigned to them. When we play the game, these are the skills that will help us win. You in?

Onward and upward!