OCI Compliance & Governance, Part V
Governance Over Operational Control
Within the Preliminary Specification there is a conflict or contradiction that needs to be managed through the Compliance & Governance module. That is the posture that needs to be adopted by the Joint Operating Committee members towards the service industry representatives. At two different times and two different places during the ongoing operation of the properties the approach towards the service industry may be fundamentally different. At one time the approach will be to have the service industry operate as a free-wheeling marketplace where innovation and ideas flow. And then there will be times when operations are conducted and military precision is expected and required to ensure operations are completed successfully. This Dr. Jekyll and Mr. Hyde routine would give most people, in both the Joint Operating Committee and the service industry, a second look.
On the one hand we have a marketplace and on the other we have operational control. And for many reasons the two may be the same people interacting in different capacities and at different times. The governance issue is; how do we ensure that the operating mode, marketplace or operational control, is the appropriate mode for everyone? This is of particular concern to service industry representatives, as so much of the operational control and success of the operation depends on their full attention.
The answer to this question comes from the “Operational Review & Governance Interface.” If there is an operation currently being conducted by the Joint Operating Committee. And there have been no corners cut or shortcuts taken. Instead, there will be the explicit knowledge contained in the “Dynamic Capabilities Interface,” the “Planning & Deployment Interface,” assignments under the Industrial Command & Control which will include representatives of the service industry, the AFE, and Job Order. While none of these are required in the marketplace. Therefore the onus is on the Joint Operating Committee to ensure that these tools are used to contrast it with a freewheeling marketplace. And it will be at the “Operational Review & Governance Interface'' that governance over the members of the Joint Operating Committee is imposed to ensure they are using these tools appropriately during their operations.
Operational control and innovation are at opposite ends of the spectrum. That however does not mean they cannot be accomplished by the same organization. The innovative and profitable oil & gas producer must have both. One without the other is not worth pursuing. Conflict and contradiction will show up in the organization at some point and the need to deal with it becomes a governance issue. The user of the “Operational Review & Governance Interface” will have the tools necessary to ensure that the Joint Operating Committee can discern the difference between innovative markets and tight operational control.
Governance Over the Second Innovation Process
We have been concerned with governance over operations, and now we want to look into governance over the two major innovation processes in the Preliminary Specification. The first process of innovation is the development of innovation within the producer firm. This is a result of earth science & engineering capabilities being developed. The second process is as a result of field level innovations developed by the service industry. These innovations are either product or service related in terms of their offering to the producer or Joint Operating Committee during some operation. Either way it is critical that the producer firm has a measure of governance over innovation developments for a variety of reasons. These governance elements will again be captured in the “Operational Review & Governance Interface” of the Compliance & Governance module. Quotes are from Professor Richard Langlois' paper “Innovation Process and Industrial Districts.”
What will the innovative oil & gas producer and Joint Operating Committee do when they innovate? That seems to be a fairly reasonable question and one that would be the founding principle in which governance over the innovation processes should be based upon. It's here that Professor Langlois provides us with a very concise summary for our purposes.
In this survey, we examine the operations of innovation within industrial districts by exploring ways in which differentiation, specialization and integration affect the generation, diffusion, and use of new knowledge in such districts. p. 1.
The source, deployment and use of this knowledge is the “Dynamic Capabilities Interface” in the Research & Capabilities and Knowledge & Learning modules. Recall that “knowledge begets capabilities, and capabilities beget action.” The capabilities contained within the “Dynamic Capabilities Interface” are comprehensive and are designed to serve the needs of all of the people required for that particular operation.
While it is possible to conceive of a firm that is so hermetic in its use of knowledge that all stages of innovation, including the combination of old and new knowledge, rely exclusively on internal sources, in practice most innovations involving products or processes of even modest complexity entail combining knowledge that derives, directly or indirectly, from several sources. Knowledge generation, therefore, must be accompanied by effective mechanisms for knowledge diffusion and for "indigenizing" knowledge originally developed in other contexts and for other purposes so that it meets a new need. p. 1.
And
Relationships within industrial districts therefore lead to diffusion but also to the creation of new knowledge through shared preoccupations. Because many people or firms can work on a problem simultaneously, a number of different solutions may be found (Bellandi, 2003b). The result is a larger and stronger "gene pool" within the sector (Loasby, 1990, 117), with the further advantage that solutions that are originally regarded as competing may turn out to be complementary and well-suited to different niches within the district. p. 7.
I could recite more of the elements of the Preliminary Specification as the reasons for the governance requirements in the “Operational Review & Governance Interface.” The point needs to be made is that the two major innovation processes need to be reviewed at a high level within the firm. There are many interactions between the firm and the Joint Operating Committee, and the larger service industry. This means that the possibility that all valuable knowledge is not codified is high. That is just one of the risks. Another is that the “Lessons Learned Interface” doesn’t capture failures accurately for further learning. These are necessary to be reviewed to ensure that knowledge, capabilities, and innovations are built upon for the future.
People, Ideas & Objects and Oracle Corporation
Where to begin? Let's start with a high level summary of the Oracle Governance, Risk & Compliance Management Suite of modules. There are three groups in which the modules are organized. These are Risk & Financial Governance, Performance & Financial Controls and Access & Segregation of Duties Controls. Within these three groups you will find the modules Oracle developed in Oracle Fusion Applications, Oracle Governance, Risk & Compliance Management Suite. We will discuss the Risk & Financial Governance module with Performance & Financial Controls and Access & Segregation next. Needless to say these modules have all been adopted within the Preliminary Specification.
To the larger issue of compliance and governance and how a firm handles the growing demand for more regulation. Oracle and People, Ideas & Objects have similar ideas on how to keep ahead in this difficult area. Oracle asks the following.
No one expects this to be the end of ongoing industry and legislative requirements. Business executives continue to struggle with questions like: How can we stay on top of regulatory demands while controlling costs? Can we better manage risk to prevent business and compliance failures? How do we achieve better performance while ensuring accountability and integrity?
And it is through automation, Information Technologies and the use of specialization and the division of labor that the innovative oil & gas producer can achieve these objectives of getting ahead of regulations. As we have proposed in the Preliminary Specification, the producers that participate in our user community will have the opportunity to shape the software they will use. People, Ideas & Objects is user defined software based on the Joint Operating Committee. Giving the producer the ability to remake their organization into an innovative, profitable and performance-oriented oil & gas producer.
In terms of Oracle’s Risk & Financial Governance module. Producers will be able to increase compliance efficiency, improve financial reporting reliability and anticipate and respond to risk. We discussed the element of risk in the Financial Marketplace module and the assessment of all investments based on their anticipated returns. Each of the potential investments have to be “risked” in order to bring the return on comparable terms that consider the risk. It is here that the two modules, Oracle Risk & Financial Governance and Financial Marketplace will crossover. It is also at this point that our two firms have similar attitudes, again, with respect to how the producer attains value. Oracle states.
KPMG's Assurance & Advisory Service Center understood early that value and risk go hand in hand and that performance and risk management should converge to create, enhance and protect stakeholder value. In May 2007, the Institute of Management Accounting further characterized Enterprise Risk Management as aligning strategy, processes, technology, and knowledge with the purpose of evaluating and managing the uncertainties the enterprise faces as it creates value. It considers ERM to be a truly holistic, integrated, forward-looking, and process oriented approach to managing all key business risks and opportunities—not just financial ones—with the intent of maximizing stakeholder value as a whole.
This will be a key insight that our user community will be able to build off of the People, Ideas & Objects Financial Marketplace and Oracle’s Risk & Financial Governance modules.
Oracle Transaction Controls Governor is an application designed to continuously track key transactions. It also monitors data and application modifications. In terms of reviewing transactions, much of the application is programmable and can be set to look for certain criteria. This is done through an intuitive interface that controls and monitors all transactions for certain behavior. Oracle also provides a library of internal controls that can be deployed if the producer finds them useful. People, Ideas & Objects, working on behalf of our subscribing producers, will be able to provide a library of these internal controls specific to the innovative and profitable oil & gas producer. These controls output can then be directed to the appropriate individual within the firm to be dealt with.
Oracle Configuration Controls Governor is an Oracle Fusion Application that provides Sarbanes Oxley compliance to the producer of IT infrastructure configuration changes. When there is a change to your IT environment, the who, what, where and when of the change is sent to the appropriate people within your organization. There they can review the changes to ensure that they were carried out in compliance with the company's policies. The Configuration Control Governor also allows establishing tolerances for fields. So if a user entered a number that exceeded the field's tolerance, the transaction would be rejected.
During our discussion of the Compliance & Governance module we discussed the need for more internal controls. These transaction and configuration controls will provide appropriate governance for an element of the internal controls. That these are automated helps to provide a strong understanding of the appropriateness of the global transaction base the producer firm’s base their financial reports upon. However, they are not the whole picture of internal controls. And that is where Oracle Preventive Controls Governor comes into play. Using configurable workflows, Oracle Preventive Controls Governor enables the user to design and implement appropriate internal controls for their firm. This tool provides both contextual and intrinsic policy applications to business processes.
We look at Oracle Fusion Applications, Governance, Risk & Compliance Suite, Access Controls Governor module. This will be a key element of the Preliminary Specification as segregation of duties (SOD) is taking on heightened importance in the firm. The SOD offers many advantages to innovative oil & gas producers, regardless of whether it is a result of regulation or better governance. Having multiple people involved in the process from beginning to end ensures that no one individual can manipulate firm resources for their own benefit.
Oracle notes the following is also part of the Access Control Governor module functionality.
Global regulations are driving organizations to improve the transparency and accountability of financial data, processes, and transactions. Controlling, tracking, and reporting on user activity within the application environment are critical components of compliance.
So apparently Big Brother needs to watch. And as good as your internal controls may be, there will always be ways to hack the system in ways unknown before. Thankfully Oracle’s Access Controls Governor module is automated and implements policies based on management's understanding. There is also a library of controls that can be implemented developed by Oracle in collaboration with leading audit and consulting firms. As with the libraries mentioned, People, Ideas & Objects will maintain a library of these policies for the innovative and profitable oil & gas producer. And the system is not just reporting violations, it is actively stopping and enforcing SOD when they occur based on those policies. And they can be dynamic and proactive in their enforcement, stating that no user can be involved in more than two steps of a five-step process, and disabling the user to sign on to another process at the time of assignment.
When preparing policies for implementation the Oracle Access Controls Governor provides a tool for simulating the revised policies. Using the historical record of user access as the base of information it can run the revised policy against that data. This will enable it to determine what the outcome of that revised policy will be. Would there be any violations, false positives etc? Then they can tune the policy based on the feedback they receive from the tool. This will ensure that it is only targeting the desired situations. Saving costly resources in the future.
From a People, Ideas & Objects perspective the Oracle “Governance” applications that we have discussed help to bring 21st Century internal controls to the Preliminary Specification. When we think of the manner in which the industry will operate, we will see large portions of the existing producers' overhead being provided by service providers. And those service providers access their work through the People, Ideas & Objects Preliminary Specification. It will be necessary to extend these internal controls to those individuals. The producer will need to know that these controls are effective in their firm, their Joint Operating Committees and the service providers they hire to maintain their firm.
Conclusion
Here we have the beginnings of compliance and governance for the innovative oil & gas producer and Joint Operating Committee. What we need to do is deal with the compliance of an innovative oil & gas producer with the tools of the 21st century. Those include automation, specialization and the division of labor. And in terms of governance, we can begin to provide the producer firms with the appropriate operational governance that is consistent with innovations demands.