Governance Maturity & Standards
Chris 
Why are construction standards a mandatory "floor" while IT standards are an aspirational "ceiling"? Explore how to bridge the governance gaps between IT management aspirations and current reality.
While simultaneously working on IT governance and operational documentation, I was wondering how and why standards between industries differ in application. On one hand, some industries must conform with industry standards. For other industries, achieving standards is a sign of maturity that not many achieve, and in these industries, not achieving a standard is acceptable.
Having worked as an architectural draughtsman I had to familiarise myself with the New Zealand Building Code and NZ3604. NZS 3604 is a standard that sets out construction requirements for timber-framed buildings. The buildings must be built on good ground, and can only be up to 10 metres in height and a maximum of three storeys. Amongst other things, standards are set for bracing, foundation and subfloor framing, floors walls, and so on.
Note: As a standard, NZ3604 is regarded as an acceptable solution. There is nothing to prevent other acceptable solutions from being produced.
The takeaway here is that when it comes to the construction industry, there are a lot of standards that must be adhered to when designing and constructing buildings.
Floors and Ceilings
In the construction industry, standards are a floor above which all building practitioners must work. To ignore the Building Code and industry standards can result in prosecution and costly litigation, so working below this floor is to be avoided at all costs.
By comparison, when it comes to working with standards in the IT industry, it's a very different story. Instead of a floor, industry standards for IT operations are a ceiling. Achieving a standard in the IT industry is not a 'must' like it is in the construction industry. It's more of an aspiration or target state that many organisations are not going to achieve, and if they do, it may not be for long.
The Consequences of Failure
In construction, failure is physical and dangerous. Failure to meet a standard carries the risk of serious injury or death should the structure of a building fail. In IT, failure is often financial or operational. This explains why one is legally mandated and the other is aspirational.
The Pace of Change
Timber framing physics does not change, at least not much. Because of this, NZ3604 remains stable and relevant for long periods of time. IT evolves so fast that a prescriptive "floor" might be obsolete before it is even published! It could be argued that setting a target state is an exercise in futility. However, not setting and not working towards a target state can lead to costly failure. The process of continuously improving methods of work and pivoting in response to changing circumstances makes desirable levels of governance maturity difficult to maintain.
Just as NZ3604 requires updating in response to events like earthquakes, high winds and storm damage when it occurs on a large scale, IT departments must plan for future events in order to keep an organisation's information assets safe.
Mistaking the Aspirational for Reality
On their own, aspirational documents can be mistaken by management as descriptions of reality, inflating the perception of maturity to heights that do not reflect daily operations. It doesn't take much to dispel this aspirational perception of reality. Often, all it takes is establishing that there is little to no evidence to support it. The real challenge is easing management into this realisation and gently realigning their expectations with reality.
The Road Forward
Because IT standards act as a "ceiling", achieving them requires an iterative approach rather than simply writing an aspirational document and leaving it there.
This generally happens in three stages:
- Establish the Target State: Define what "good" looks like based on regulatory requirements, industry standards and organisational goals.
Note: This is the aspirational or target state. - Document the Current State: Honestly assess how things are actually being done today.
Note: This is current reality. - Align the Two: Identify the gaps between current reality and the target state, then build practical, achievable steps to close the gaps between them.
Note: At the very least, openly acknowledge the gaps. Not all gaps can be closed if the resources are not available to do so. Acknowledging gaps is also a sign of maturity. Just as not closing the gaps, not acknowledging the ones you can't close at this time, leaves your IT operations exposed.
This approach ensures that governance artefacts don't become an aspirational set of documents on a shelf, they establish themselves as practical tools for continuous improvement.
