Security

Self-Service IT: Are Users Up To the Task?

Self-service procurement. Self-service business intelligence. Self-service recovery. User provisioning in private clouds. It's a wondrous world for end users these days as IT departments roll out tools that hand them the reins to the data and services they desire, whether it's instant access to their employee benefits account or a deep dive into corporate data stacks that were once off-limits.

But all this user empowerment raises the question: Are users up to their new role? To be sure, it's been a long time since IT staffers have had to show employees how to use a mouse or check that a desktop PC is plugged in, but there's a big jump between choosing a dental plan from a drop-down menu and applying advanced analytics to large volumes of enterprise data.

Have users really advanced so far that they can roll out their own business intelligence (BI) queries or recover from a hard disk failure entirely on their own? Yes and no, say IT managers and industry analysts.

On the one hand, thanks to the boom in smart consumer devices and the ubiquity of the Internet in corporate and personal life, employees at all levels of the organization are more comfortable with technology than ever before.

On the other hand, the United States is now 20-odd years into a decline in science, technology, engineering and math (STEM) skills (download PDF), according to the National Research Council and other education observers. If you include statistical analysis in that skill set, it potentially sets the stage for a perfect storm in self-service IT, where overconfident but underskilled end users run amok in business systems, draw bad conclusions from randomly mashed-up data or corrupt IT's once-pristine data stores.

"Some employees -- particularly the younger members of the workforce -- have an attitude of 'give me access and I'll figure it out,' but there are nuances to data that they may not realize," observes Cindi Howson, founder of business intelligence consultancy BIScorecard. "Some start out quite cavalier in their efforts, then get to a certain point and have to call for help."

5 tips for successful self-service IT

How do you do self-service IT right? Tech managers and analysts interviewed by Computerworld say the goal is to empower users without overwhelming them -- or putting corporate data at any kind of risk. Their specific tips:

  • Retain tight control over corporate data. User access to that data is important but should never supplant security, privacy or compliance concerns.
  • Know who you're designing for. Users with different roles and technical skills may need different types of tools.
  • Rather than asking what data business users think they need, find out what decisions they need to make or tasks they need to accomplish.
  • Consider bringing in a business analyst during the project's planning stages to facilitate communication between business users and IT.
  • Test with a small group of users to quickly identify and address trouble spots.
  • Change management is crucial to a successful rollout of self-service tools. Line-of-business leaders -- not IT -- should explain to users how the tools will benefit them.

That said, Howson believes such failures are a necessary part of the process as IT, business units and end users renegotiate the delicate balance of who can do what when it comes to corporate data.

After years of tight control by IT, the pendulum is swinging the other way -- "sometimes maybe a little too far the other way," Howson says. Nevertheless, the move toward self-service is only going to accelerate, she and other analysts say, as IT departments face increasing demand, from the newest hire to the most senior executive, for faster, better access to corporate services and data. "IT cannot keep up. They need to be delivering intelligence faster and in a way that's more aligned with the business than what they've been able to deliver in the past," she says.

To gauge IT's handling of this new breed of customer, Computerworld checked in with three organizations -- The Kentucky Community and Technical College System (KCTCS), Intel Corp. and Mitre Corp. -- that serve three different user constituencies. Read on for their take on how to best handle End User 2.0.

Kentucky Community and Technical College System: Broad swath of users

With 16 colleges in 70 locations serving an estimated 130,000 faculty members, staff members, and students, KCTCS supports a broad swath of users.

KCTCS uses Oracle's PeopleSoft Enterprise Human Capital Management system to roll out self-service components to its various user constituencies, says CTO Paul Czarapata. PeopleSoft's Campus Solutions application allows students to enroll in classes, pay their bills and schedule class changes; that module is relatively easy to administer, Czarapata says, for two reasons.

First, "the students really don't have that many mind-boggling choices -- they can see if they're admitted to a class and pay for it. Everything else is on Blackboard" -- a separate student-services system, widely used in higher education, that also incorporates self-service as a cornerstone. Second, "students pick up on [self-service] quicker than employees do. For the most part, they're a little more technically savvy and used to doing things for themselves," Czarapata says.

This October, KCTCS is rolling out an ambitious e-benefits enrollment system that will rely heavily upon self-service options, a big change that could represent a challenge to KCTCS employees, at least initially. "On the HR side, we've got a lot of choices. We've got a super-complex HR system," Czarapata acknowledges. "Change management and communications are going to be super important" for achieving a smooth rollout, he says, "especially since we have to reach 70 locations."

In trying to ensure that the e-benefits system matched the technical expertise of its future users as it was being developed, KCTCS did have one advantage, Czarapata says. "We do know who our employees are, as opposed to a business trying to attract customers online."

Another plus: Having worked together closely on other projects, IT developers generally agreed with HR's assessment of users' abilities -- and when they didn't, they felt free to make suggestions or ask questions. "Other times, IT might not push back as much, but on this project, most of the people have worked with each other for a long time," Czarapata says. "[IT's] role was to look at designs, follow the flow-through, and establish filters to determine who gets the appropriate data," most of which was done in concert with the lead systems person from the HR side.

His advice to other organizations developing self-service systems for users with a wide range of abilities is: "Pilot, pilot, pilot." With a small group of test users, KCTCS developers were able to identify "landmines" and figure out where users needed more or different information, and do so quickly. "A small pilot means a faster feedback cycle," Czarapata points out.

Overall, Czarapata finds that end users today tend to have high expectations that internal systems will look and act like the consumer Web applications they're familiar with -- an expectation he sometimes has difficulty fulfilling.

"It's not that big a deal for a Twitter or a Yahoo to be constantly tweaked, but monolithic ERP stacks don't change as rapidly on the UI side as today's generation expects," he laments. "We're kind of at the mercy of the vendor about how the self-service components work. The functionality to do everything [users] need to do is in there; it just looks clunkier than they'd like."

Intel: 'Four big buckets' of self-service

"It's intriguing to stand back and think about end users," says Diane Bryant, CIO and vice president of Intel Corp. "When you look at tech trends, you see that IT has been delivering greater and greater capabilities into the hands of employees over the years."

At Intel, self-service initiatives can be roughly categorized into "four big buckets" -- traditional help-desk capabilities, BI, web publishing and infrastructure as a service.

Some initiatives, like self-service tech support, are designed for all of Intel's 93,000 employees, who, even at a high-tech company, encompass a wide range of skills. "We roll things out and some will dabble, some will be far more curious and more aggressive in pushing the limits of the tool, and others will shy away," says Bryant.

"We have a workforce that has a long tenure," she elaborates. "People coming into Intel tend to be more comfortable with these new ways of operating, but there's always a base of employees that isn't comfortable." As the solutions mature and more and more rank-and-file employees adopt them, "the rest of the users eventually get swept in," Bryant observes.

Self-service systems that are targeted toward specific groups of employees, on the other hand, tend not to face that kind of adoption lag, Bryant says. The company's new web publishing system, for example, allows the firm's approximately 2,000 corporate marketing employees to create and self-publish content for Intel.com.

Likewise, self-service BI solutions give salespeople access to analytics on customer leads and allow senior financial analysts to run what-if scenarios to determine where the company's financials are going to land for the quarter.

Those types of self-service systems typically take off much more quickly, for two reasons, Bryant says -- the user community tends to comprise high-level, highly skilled employees, and the tools themselves have evolved to the point where they can accommodate users' expectations without sacrificing quality.

"BI tools have matured to the level where you don't have to have a master's degree in computer science. They respond to the employee request. You get better access to the data, converted into formats that users are familiar with."

In her experience, Bryant says, the biggest question around self-service isn't whether users can meet the demands of a new system; it's whether business-unit managers can sell the merits of the system effectively enough that users will adopt it willingly.

"When you tell people you're going from a single point of control to a self-serve model, you are changing an existing business process," Bryant says. "Senior leaders often underestimate how hard that is. IT can't tell the sales force to start doing things differently. The business side needs to educate them on how this change will make them more productive."

Mitre: Early adopters, demanding users

When asked about the technical skill level of his typical employee, Vice President and CIO Joel Jacobs deadpans, "Are you familiar with Mitre?"

Indeed, the not-for-profit research lab, originally founded by employees from MIT's Lincoln Labs, employs some 7,000 scientists, engineers and support specialists, of whom 65% have a master's degree or a Ph.D.

"There's a high probability of the [end user] being technically oriented in computer science or engineering," Jacobs says. "Their ability to cope is pretty high."

Mitre was among the earliest organizations to embrace the Internet and the World Wide Web. "We had those funny characters" -- meaning email addresses -- "on the bottom of our business cards 20 years ago," Jacobs recalls. Launched in the early 1990s, the firm's intranet, Mitre Information Infrastructure (MII), is well integrated into corporate culture.

In two decades, MII has evolved to include a high level of self-service access to a range of corporate tools, including time cards, travel expense reports, and almost all HR changes and transactions except those that are required by law to be on paper.

An upgrade in early 2010 now allows Mitre to push role-based content out to users via a "my actions" gadget that resides on users' personalized home pages. One user's actions may include completing a time-off request or installing a security patch to her computer; another's may prompt him to approve the public release of a particular document or approve a procurement request.

Beyond that, when developing other self-service applications, Mitre has a fairly well-established process that takes place between IT and an identified data owner within a business unit to determine which employees get access to what data. Even then, it can take a few tries to get it right.

"Often the first request is for some raw feed, but it's easy to wind up with people just drowning in data that they don't know how to make good use of," Jacobs explains.

Rather than having the business side tell IT what data they think they need, he prefers that they frame their request in terms of what decisions they need to make. "Instead of saying 'I need XYZ data set,' if they say, 'I need to better manage this part of my cost structure,' then we can tell them what data is available and guide them to what will be most useful," Jacobs says.

If there is a downside to having a sophisticated workforce, Jacobs says, it's that users can be intolerant of poor user interfaces or unnecessarily clumsy processes -- some of which can't be avoided when adapting off-the-shelf software. In designing systems, "Our expectation isn't that they can't figure things out -- our user population can figure things out -- it's that they don't want to spend their time navigating obstacles," Jacobs says.

3 challenges for IT in self service

These IT managers and others agree that the most successful self-service implementations come from an equal partnership between IT and the line of business that's requesting access to data or services. That's not always easy, of course, but keeping these three hurdles in mind during the planning stages can help.

The biggest challenge for IT is to keep tight control over the integrity of corporate data, while still allowing appropriate users a sufficient amount of access to actually accomplish their goals, says Forrester analyst Boris Evelson.

"The best scenario is a win-win when you divide the analytics application stack into multiple components -- data foundations, integration, quality assurance, persistence, warehousing. IT still has to be responsible for those, and for security and robust disaster recovery," Evelson says. "If IT says, 'We are in full control of that' -- if they can say the data resides in one logical place that's securely integrated -- then sure, let users have a field day."

IT should also have a fully nuanced understanding of exactly which user community it's being asked to serve, says BIScorecard's Howson, who has developed a graphic showing what types of users are best served with which types of BI tools. A power user, for example, could probably handle an advanced data-analysis program like Microsoft PowerPivot, while an executive would work best with an interactive dashboard and a front-line worker might need just an interactive report that lets him tweak and re-chart certain rows and columns of data.

Matthew Ripaldi, a senior vice president at the IT staffing and recruiting services company Modis, says he's fully confident that today's workers are able to handle self-service analytics. He's more concerned that not every IT employee is equipped to handle the softer skills necessary to sufficiently define the scope of a project.

"Requirements gathering requires good listening skills. You need someone who can say, 'What do you want this system to do? What analysis are you trying to accomplish?' and then translate that into a tech solution," Ripaldi says.

In cases where the IT staffers assigned to the project are more "black-and-white tech people," Ripaldi recommends bringing in a business analyst -- from the business side or as an outside consultant -- to ensure communication stays on track.

In the end, Forrester's Evelson finds it useful to put the self-service movement in context. Yes, self-service access to enterprise data gives users power and flexibility they haven't had before, and yes, that requires a higher level of control on the part of IT, he says.

But by the same token, these new systems are part of a trend that's been building ever since computers became personal. "Business users have been using spreadsheets since the day they were invented. If you think about it, [Microsoft] Excel is still the No. 1 BI tool out there."

Tracy Mayor is a Computerworld contributing editor.

Subscribe to the Security Watch Newsletter

Comments