Why should IS auditors be involved in conflict resolution?
Because conflict is inevitable in any endeavor that requires the interaction of two or more disciplines or, for that matter, minds. As the complexity of security increases, the likelihood of differences in opinion and approach increases as a function of the number of variables involved and the amount of time required by the employees in their involvement during or after implementation of projects. Normally, these conflicts arise during implementation because of people's natural resistance to change, scheduling pressures or an initial perceived difficulty of the system to support existing reporting criteria or functionality.
What should the IS auditors look for in conflict resolution strategies? The following answers this important question.
Characteristics of Formal Conflict Resolution Plans
Planning for the inevitable means that managers/leaders will not spend valuable time and energy dealing with emotions but will keep their focus on finding optimum solutions for the roadblocks. This is so because conflicts in an implementation can be opportunities to hold back, regroup, rethink, reevaluate and take positive steps, including:
- Reexamining current business practices (often latent problems with established practices manifest themselves in conflicts)
- Interfacing in new ways not previously acknowledged because of logistical difficulties and/or gaining an understanding of underlying problems in which the symptoms manifested in conflicts
- Brainstorming and exploring several perspectives for conflict resolution
- Allowing those inflicted with real or perceived injuries a forum to express regard for their contribution and for their feedback
These are important components in ensuring loyal, productive employees during the project and beyond.
How conflicts are resolved will bear on the relationships among employees and also impact the success of the implementation. Therefore, effective steps need to be taken to manage confrontations and ensure that only positive results are obtained as a result of them. Steps for effective resolution involve establishing approaches specifically geared toward the acknowledgment of differences between project team members and striving for these differences to complement each other by enabling or facilitating the team members to work together.
The foundation for building a strong conflict awareness strategy is acknowledgment by the project-managing principals (team leader, coordinator, executive sponsor) that conflicts will arise, but they must be utilized as positive building blocks rather than negative energy that will debilitate the spirit and the success of the project.
The second premise is an understanding of the reasons that precipitate conflicts. These can range from the following:
- Political reasons--Perceived or threatened loss of power or control
- Reorganizational reasons--Anticipated coalescence of different units as a function of an integrated system, which disturbs the status quo and creates anxiety about roles within the affected staff
- Changes in mandated policy--These cause the staff to leave the comfort zone of change tolerance.
- Fear of the unknown--The most difficult and volatile of conflicts in which reason does not prevail and does not resolve the issues because the adjustment phase was left out
- Paradigm shift--Setting the right attitude for addressing conflicts in an equitable and humane manner to ensure that the benefits received are the benefits required. Recognition and acceptance of the opportunities inherent in conflict resolution will set the tone for the approach to be undertaken and allow for the free exchange of opinions and ideas that are necessary to ensure success.
A critical step in building conflict resolution strategies is a formal declaration to the team members of the probability of conflict, management's attitude toward it, and the mechanisms being established to cope effectively with the issues as they arise. This step amounts to "flushing out" a potential difficulty before it precipitates, and eliminates the possibility of hidden agendas or token acceptance of the team activities or decisions. By declaring that conflict is inevitable and that expectations are set for positive and harmonious resolution, the employees involved in the projects will be less tempted to allow a question or concern to remain buried, which often allows difficulties to ferment and blow out of proportion.
The last and single most important step in building conflict resolution strategies is supplying the "why" in the desire for effective, timely and complete issue resolution. This personal "why" may be supplied to the team members through:
- A discussion of the quality-oriented benefits of conflict resolution
- An acknowledgment of the contributions the team, as a whole, can make
- An assurance that each member can make an individual contribution through issue resolution
- An assurance that an organized procedure is designed and will be implemented to allow all team members to achieve their personal and cumulative goals
Format for Positive Resolution
The first step is to establish the attitude and approach that the team leaders and members are required to take. Then, the structured plan for enactment of conflict resolution and the communication guidelines to be followed during all conflict resolutions should be presented to the entire team.
To validate the importance of the resolution tasks, the plan should be presented at the beginning of the project as a formal, written structure. People normally operate comfortably when the ground rules are clearly defined and understood by all players at the outset. By providing written guidelines, the misconception of different standards for different people is eliminated, putting all team members on comfortable communication ground with each other. This is a difficult task and is dependent on the quality and integrity of leadership at play because past experience has always indicated that lip service is usually the case. When people speak up, there can be repercussions, which is the main reason conflict resolution may appear ideal in theory but improbable in practice and why it fails to secure the desired results.
In the verbal component of the conflict plan, the team leader should pay special attention to the use of "I" statements as a positive tool for clarification of the concept of organized, structured conflict resolution. Conflict is always integrated with emotionality, even if it is couched in totally professional, business-directed terms. By saying, "I believe," "I feel" or "I am confident that our approach to resolutions will be positive," the leader is recognizing and affirming a personal emotional connection.
In a large team formation (e.g., 12 or more participants), it is more beneficial to use an issue coordinator than to have the project team leader assume the duties of logging, monitoring and documenting each issue that arises. Although the team leader is the appropriate individual to present the issue resolution structure, the issue coordinator should then explain the mechanics and steps being used to ensure complete resolution. The ideal issue coordinator should be a team member with high company visibility and credibility with the other team members.
Using an issue log that adequately defines and categorizes each particular concern is absolutely necessary for organization of conflict resolution. These logs should be provided for all team members so they have a tool at hand to address their concerns as they arise. The log, stating the description of the problem with the date and name, should be submitted to the issue coordinator who is responsible for the monitoring and follow-up of each particular issue.
The issue coordinator will want to create a summary log that becomes the "tote sheet" for all issues addressed during the implementation. This will become the final tool for the summary and tracking of all concerns that have been satisfied successfully throughout the project period.
When the coordinator has received an issue from a team member, the determination must be made relative to the "ownership" of the particular concern (e.g., if the concern is of a policy nature, the resolution would be referred to decision-making individuals within or outside of the team; if the concern is procedural or system-based, then resolution is "owned" by the project team members themselves).
The issue coordinator assigns team members to the task of examining, discussing and offering viable, mutually agreed-upon suggestions for the resolution. The members selected for the resolution should be composed of representatives from the departments or functions directly impacted by the issue raised. As an example, consider a system-use issue. This would be the responsibility for the creation of product masters. The issue could be whether the input data for the creation of the master should be accounting, purchasing or engineering. Only the representatives from each of the applicable departments (i.e., accounting, purchasing and engineering) would be ideal and therefore should be empowered to examine, discuss and make a preliminary resolution.
During implementation, conflicts also surface that involve business practices currently in use, either between or within departments. An example could be where a production manager is concerned about the time it takes purchasing to create a purchase order after the request has been made. The purchasing manager may be concerned about the increase in costs that results by reducing time. Each party is trying to serve an individual department objective at the expense of the overall company objective for the delivery of the required product in time to meet company requirements--reliability and competitiveness in the market place.
This is an example of a common issue that, while not necessarily system-related, surfaces during system implementation and is therefore appropriate to address during the project. In this case, the issue coordinator would assign the two persons most closely affected by the issue to develop the resolution. In cases in which the issues to be addressed do not have the appropriate department representatives, the issue coordinator should solicit the appropriate department's management to provide the necessary human resources to complete an adequate resolution.
After the assignments for the discussion of every significant issue have been made, time frames should be developed for discussion and brainstorming, if necessary, as well as resolution suggestions. The time frame must be pragmatic with reference to the workload of the other team members, but should establish a sense of urgency and progress in the timely resolution of all issues.
Once the team members are assigned to each issue, their preliminary resolution should be brought back to the team for review and acceptance. To explain the mechanics involved in the decision-making process, the team should provide the "what if" scenarios to assure team members that realistic expectations are being sought. These review periods can be at the start or end of the day, during a reinforcement session, or during regularly scheduled project team meetings. However, the consistency and the seriousness with which they are held determine the confidence and respect that they instill within the project. Moreover, the benefits derived from bringing the preliminary resolutions back to the team for their review and acceptance range from the possibility of resolving latent conflicts, such as internal departmental problems no one could address previously because of the poilitical nature of the beast; the support and validation to those involved including important feedback to their efforts; and an example of the value of the growing pains to the rest of the team. The awareness of growing pains is important because it creates a culture of objectivity and reality that issues and conflicts, which are either system- or business-related, can and will be resolved many times with persistence and patience. A journey of many steps, one forward and three backwards, is the prerequisite for accepting small failures in pursuit of a continuous improvement strategy.
If a conflict or issue has not reached a satisfactory, preliminary resolution in the initial discussion between the assigned team members, it is important to reach a tentative compromise while attempts to try to develop a resolution that is satisfactory to all continues to be synthesized. During this process, the environment should be expanded to include additional input and monitoring by other persons who may provide valuable insight. This may include technical support, management representation or input from the issue coordinator. However, it is still important to have the original team members lead the discussion, thereby reinforcing the intent and value of the original assignment.
When the resolution strategy is outlined initially to all the team members, particular considerations in conflict examination and resolution should be presented and adequate explanations should be completed. By providing a set of ground rules to be followed in their meetings, the participating team members will be more apt to stay on task, and the time spent will allow resolution to be reached more quickly and completely.
The rules for effective conflict resolution address behavioral styles in all possible emotional interchanges and provide a self-monitoring check to ensure the open and free exchange of ideas without having the the problem of lingering negative repositories.
The rules for effective resolution are as follows:
- Discussion should be for resolution, not for the intellectual exercise or just for the meeting. This is an insidious, covert practice that sometimes develops when team members seek attention or attempt to regain control that they may feel is being lost because of the system changes. The issue coordinator should verify the existence and validity of the concern in question through thorough questioning techniques before accepting the assignment. By ensuring that this is the first rule for resolution, petty issues are more likely to disappear.
- Discussions should concentrate on one specific topic at a time, without floundering and straying into other areas. During the discussion, if other concerns surface or are highlighted that may a have a bearing on the original issues, they should be brought to the coordinator's attention, logged, and assigned as a separate issue or concern for resolution. Limiting the scope of each discussion helps issues become resolved adequately and in a timely manner. It also causes interference with the specific goals of the meetings.
- The technique of aggressive silence should be employed. This ensures that each person concentrates on listening to the viewpoint and input of the others involved. No overtalking or interupting should be allowed, so that each participant gets an equal opportunity to state his/her viewpoint openly. A good rule is that the number of questions asked by each person should be equal to the number of statements each is making. The questions should help to gain clear understandings of the other's point of view and to elicit and examine all aspects of the situation surrounding the issue. The objective is to avoid presenting only one side of an issue and not "digging in" for an understanding of the other's perspective. This increases the chances for positive and complete resolution of the underlying issues.
- Only positive-response body language should be employed since normally potentially high-quality communication is reserved by what is seen rather than by what is heard. Employing positive-response body language means using open, receptive posture and presenting to the other person(s) a face that is free from judgmental expressions. It also is helpful to review the following considerations to keep a conflict discussion focused on the goal of resolution that is in line with the company's operational and managerial framework. The questions to be addressed in effective conflict discussion include:
- What is the relative importance of the issue to each dissenting party? This may bring a discussion to a successful conclusion sooner because the issue being raised often is easily accommodated by the other party.
- Where did the conflict or the issue-causing practice originate (e.g., what person or department has ownership of this particular topic)? It is often better to go back to the beginning of a problem to find the solution when in search of an expedient answer.
- How many people would be affected by a change in each relative department? People are more difficult to change than things, so primary consideration needs to be given to the number of people involved, which is a determination of the degree of difficulty in effecting the change.
- What would be affected by a change in each relative department? After the number of people involved has been resolved, the degree of difficulty can be measured by the reports, forms or techniques that would be affected by an alteration in the practice being examined.
- What is the view from the top? This should be a "best guess" relative to the concern, if any, that may be presented by management concerning the issue at hand and the potential change mechanisms that are being discussed.
- If, at this point, it is determined that the considerations surrounding the issue make it an "even" concern--approximately the same number of people and things will be affected--then the following question should be asked: "What is more important, to satisfy my viewpoint and concern or to maintain cooperation with other individuals or departments?"
The exercise of examination and discussion, when focused completely on resolution, may contribute to the company not only by facilitating system integration, but also by improving the efficiency of business practices, raising the levels of communication and increasing the level of company loyalty and employee commitment.
Please bear in mind that this is a review for the auditor. Depending on the nature of the conflict, the resolution process may require far more sophisticated procedures, such as diffusion, before conflict resolution can be addressed. In such a case it becomes the auditor's responsibility to communicate the existence of such tension in the workplace. In all cases, evaluating how conflicts are managed and resolved adds value to the organization's management function.
Yusufali F. Musaji, CISA, CGA, CISSP
is the founder, director and president of Ali's N Y Consulting, Inc., an IT and financial consulting firm specializing in computer consulting. Yusufali's experience embraces the full spectrum of financial, operational and IT disciplines required of the state-of-the-art organizations. His functional and technical areas of expertise include financial system development and implementation and computer security. He is widely published in IT, financial and security journals regarding IT/user relationships, and he has developed numerous business continuity and disaster recovery plans. His book, Auditing and Security, AS/400, NT, UNIX, Networks and Disaster Recovery Plans, was published by John Wiley in January 2001. His upcoming book, Auditing the Implementation and Operation of ERP Systems, will be published by John Wiley in third quarter 2002.