David Jacobson's External Insights

Policy development

Last month I asked what laws apply to you?

Organisations need to develop policies to comply with laws and new court decisions.

Do you have a policy development process?

How do you determine what is your policy on an issue?

Who is it addressed to? To internal users or external users or both?

Is it mandatory and enforceable or advisory?

How do you adopt a policy? Who initiates new policies, who reviews them, who signs off on them and the timetable for adoption.

How do you implement the Policy?

Read the article (pdf)

Health care and technology

I saw Johnson & Johnson‘s Dr Theodore (Ted) Torphy, Corporate Vice President of Science & Technology and Chief Scientific Officer speak today.

Given Queensland's newly announced mini-Budget to deal with health system issues the talk was timely.

His main theme was the convergence of technology in health care solutions and its implications: not only the improvement in health care but also the convergence of information and communications with medical products.

He gave 2 examples: firstly the dramatic reduction in heart disease deaths through improved technology in dealing with myocardial infarctions (he gave a history of the use of advanced imaging with balloon catheters followed up by the invention of stents and more recently drug-eluting stents which solve the problems of bare metal stents) and secondly the possibility of organ replacement parts through the use  of your own stem cells.

In both cases he identified the increased costs of the new technology but also at the same time the significant savings to the health care system.

He then linked these advances in to the use of the mobile phone: what if your phone could monitor your health and manage your diseases and your compliance with prescribed medicines? What if the data it stored could be used for clinical trials of new products or to help your doctor monitor your reaction to new products? Or to automatically order refills of your scripts? It could be your personal medical electronic record (particularly relevant when Hurricane Katrina destroyed the paper medical records of 1.2 million people).

So what is the most important health issue facing us? Ageing. Longer lives mean there is greater demand for health care as we all grow older. And we all want the latest (expensive) therapies. Are they worth it if they keep us productive and out of hospitals?

The problem is that it won't be consumers who decide, but regulators and health insurers.

IT Governance committee composition

I recently looked at the difference between IT governance and IT administration.

So what should an IT Governance committee look like?

In Building an IT Governance Committee, Richard Nolan and Warren McFarlan argue that the role of the committee will depend on how the organisation uses technology, defensively or offensively. (They describe 4 strategic modes of using technology). This will influence the committee's composition.

The key quotes on committee composition:

A company that decides it needs board-level IT oversight must do three things: Select the appropriate members and the chairman, determine the group's relationship to the audit committee, and prepare the charter...

We recommend that the IT governance group be made up of independent directors, as is the case with audit and compensation committees...

at least one person on the committee should be an IT expert who should operate as a peer at the senior management and board level. The expert's job is to challenge entrenched in-house thinking...

We recommend that the relationship of the IT governance committee to the audit committee be very close, because IT issues can affect economic and regulatory matters ... For this reason, it's a good idea to have one audit committee member serve on the IT oversight committee. The charter of the IT committee should explicitly describe its relationship to the audit group, as well as its organization, purpose, oversight responsibilities, and meeting schedule.

Emails, ediscovery and litigation

I have discussed the need to write emails prudently previously.

So it doesn't surprise me to see emails being used as a source of evidence in current legal hearings.

The C7 litigation between Australia's biggest media players has already extensively referred to personal comments made in internal company emails.

Closer to home, the Crime and Misconduct Commission Inquiry into the Gold Coast City Council  is also referring extensively to emails. (search the transcript of Day 9 (pdf) for references to "email")

The message? Emails (and Instant Messages as well) may be easy to compose and send but if you treat them like letters and send them with less haste and more formality, there may be less for you to explain if they are scrutinised in the future.

The difference between IT governance and IT administration

The latest issue of CFO magazine contains an article in which the writer interviews a range of people asking their views on IT governance.

Some key quotes:

IT governance isn't just IT management, which I think a lot of people think it is. It's more about who is entitled to make major decisions and who has input into those decisions and is accountable for implementing the decisions

Managing costs and projects are administrative issues, not governance issues.

administration is about executing day-to-day activities as opposed to deciding who makes the decisions, setting down the criteria for decision-making, and ensuring that these criteria are met.

IT administration as tactical - which systems and applications to use, for example, and whether to insource or outsource functions - and IT governance as strategic.

good IT governance enables enterprises to make and implement better IT decisions, and boards and senior executives to know what is actually going on in IT. CFOs, in particular, ..., need to identify the risks and work out which risks sit within the overall risk profile of the enterprise, and then determine how to measure and monitor those risks in accordance with a framework approved by the board.

good IT governance as capturing and delivering the value from the investment you are making, because from that you also get control over compliance issues

CEO contracts and remuneration

The new rules on listed public company remuneration reporting  (including a shareholder vote on proposed executive remuneration packages under Section 250R of the Corporations Act) are having a reaction from shareholders.

In turn, at least one CEO has indicated that as his new package won't be approved, he won't renew his employment contract. In a letter to shareholders (download from ASX) Consolidated Minerals managing director Michael Kiernan will now leave next year following a shareholder backlash over his proposal.

The company last week withdrew a proposal that would have allowed Mr Kiernan to be paid $18 million worth of shares over five years at a cost of $8 million at current market prices.

Mr Kiernan referred to the fact that "We have grown from negative $28.5 million shareholders' funds at June 1998 to currently $217.5 million" under his guidance.

Meanwhile in USA, the new Disney CEO's employment contract has incorporated some new terms, seeking to avoid a repeat of recent litigation over its payout of  US$140m to a previous CEO who was sacked after 14 months.

Confidentiality of information and documents

What do you do when you receive a document "in confidence" but believe it should be published in the public interest?

This week, the ACT Chief Minister John Stanhope released a copy of the draft Commonwealth Anti-Terrorism Bill. (ABC News)

The Government was upset at the breach of confidentiality. Other Premiers said they wouldn't release it. Stanhope said he had a public duty to release it, it should not be kept confidential.

UPDATE 21 October: Stanhope excluded from further consultation

What do you do if you obtain such a document (eg it is given to you or you are told where to download it) if you had no personal agreement to keep it confidential?

Well, most Australian journalists seem to have taken the approach that the document shouldn't be confidential and that their readers had the right to know what was in it.

Some lawyers have taken the same approach but I'm not so sure.

UPDATE 21 October: Academics are also happy to publish: see Jupp's analysis

If I was a lawyer acting for a client and received documents from another party's lawyer that was clearly confidential or sent to me by mistake, I would return the documents. Would I use the information in the documents? Hopefully the same information could be obtained from other sources.

But where I'm not a party to the confidential agreement or acting as a lawyer, do I take the same approach?

I have been reluctant to comment on the Bill even though there are issues I am interested in. Why?

In "strictly confidential" by Simon Longstaff from the St.James Ethics Centre, he discussed the the alleged use by some radiologists of confidential information relating to changes in government funding as a result of which they manipulated orders for expensive diagnostic equipment.

He argued:

Understood in its simplest terms, the doctors must have known that the information they received was not legitimately theirs to be used. It really doesn’t matter how or by whom the doctors were informed. Even when governments break their own rules on confidentiality and orchestrate a ‘leak’, they do so in a public manner designed to avoid the perception that they are providing special access to some favoured group. Indeed, to do otherwise would be to court the charge of corruption.

All of this suggests that if the doctors received confidential information, then they should have refused to use it. If we think of information as property, then this information belonged to someone else. To use it would be similar to putting your foot on a two dollar coin dropped by a person, at the front of the queue, so that you can spend it later. The same would be true if the money was found by someone else and offered to you in the mistaken belief that it was yours. In neither case is the money yours to spend. ..

I encounter many people, in business, politics and the like, who seem quite happy to make use of strictly confidential information that falls off the back of the proverbial truck. Their typical response is to say that all is fair in love, war and business and that if a competitor makes a mistake, then it is perfectly ethical to take full advantage of their error and make use of the lost property – no matter how sensitive or valuable it might be.

What if you get no personal benefit from use of the information? What if it is in the public interest, like Watergate?

Perhaps in this case where the Bill will be introduced into Parliament within weeks, there is no major issue. But I think I'll wait anyway.

Water

Water has become a major discussion topic in Brisbane.

Not just the weather: a discussion of weekend rain is now in the context of its effect on  dam levels rather than spoilt sporting events.

The Brisbane City Council's rate notices now include a comparison of your family's water usage with that of your neighbours.

Water, water usage and water restrictions are now constant radio talk-back topics.

In Turning on the Tap: Is Water the Next Oil? Garry Emmons argues that water, not petroleum, may emerge as this century's most essential—and contested—product:

"the demand for water to sustain, feed, and employ the world's people is projected to double by 2025. By that date, nearly half of the estimated population of more than 6 billion will be living in "water-stressed" countries, where either the quantity or the quality of water supplies will have sunk to levels ranging from inadequate to economically crippling. At the same time, another valuable water-infrastructure system, the environment, is in steep decline because of human mismanagement. All these competing forces lead some experts to believe that water will replace petroleum as the twenty-first century's core commodity, with nations rich in water enjoying enormous social and economic advantages over those that are not."

Disaster recovery and business continuity planning

If the recent natural disasters around the world (including Hurricane Katrina) were too remote and did not prompt you to review your disaster planning then take 2 minutes to think about what you would do if:

• your computers were stolen;
• your office was flooded;
• your office was destroyed by fire;
• your key IT or accounts employee quit;
• you had a heart attack.

The title of this post deliberately has 2 elements: disaster recovery and business continuity. Disaster recovery involves overcoming the effect of an unplanned/unscheduled incident so that you can hopefully restore the status quo. While you are doing that you can't do any productive work. Business continuity means allowing your business to continue as normal.

Disasters aren't always technology related.

Wikipedia has this starter article on disaster recovery planning.

CIO has a good article on continuity planning: it contains a good tip on determining which business  functions are mission critical by classifying them as air, water, food.

Via Dennis Kennedy.

Vivian Alvarez and DIMIA: Ombudsman's report

In this note I referred to the Palmer Report on Cornelia Rau.

The Commonwealth Ombudsman has now released its report on the deportation of Australian citizen Vivian Alvarez.

The Ombudsman said:

‘There are many lessons that emerge from this report. Government administrative systems and processes must have a sound legislative basis. Staff must receive adequate training and support to administer the law in a fair, lawful and transparent manner. It is expected of all officers in government that they act responsibly and with integrity. Unless these lessons are put into practice, serious failures in public administration can occur with potentially devastating results for vulnerable members of the public.’

The Department has apologised to Ms Avarez. The report found  a negative culture and recommended new systems and training programs.