Data Analytics and Technology Strategy

Data-driven decision making replaces intuition and experience with evidence from data analysis. Organisations that effectively use data to inform decisions typically outperform those that rely on gut instinct alone.

Four types of analytics (in order of increasing sophistication):

Data quality: Analytics is only as good as the data. Key data quality dimensions: accuracy (free from errors), completeness (no missing data), consistency (same data across systems), timeliness (current and up-to-date), relevance (data relates to the decision being made). Poor data quality ("garbage in, garbage out") leads to flawed analysis and bad decisions.

Big data: Often described by the "3 Vs" (sometimes 5 Vs): Volume (massive datasets), Velocity (data generated and processed rapidly — real-time or near-real-time), Variety (structured, semi-structured, and unstructured data — numbers, text, images, video, sensor data). Additional Vs: Veracity (quality and trustworthiness) and Value (business usefulness).

AI refers to systems that can perform tasks that typically require human intelligence — learning, reasoning, problem-solving, perception, and language understanding. Key AI technologies relevant to business:

AI risks and ethical considerations:

• Bias: AI models can perpetuate or amplify biases in training data — leading to discriminatory outcomes (e.g., biased hiring algorithms, unfair credit scoring)
• Transparency and explainability: Complex ML models (deep learning) can be "black boxes" — difficult to explain why a decision was made. This is problematic for regulated decisions (lending, insurance)
• Data privacy: AI requires large datasets, which may contain personal data. Compliance with GDPR and data protection principles is essential
• Job displacement: Automation may eliminate certain roles, requiring reskilling and workforce planning
• Accountability: If an AI system makes an error (e.g., self-driving car accident, wrong medical diagnosis), who is responsible?
• Hallucination: Generative AI can produce plausible-sounding but factually incorrect outputs — critical for professional services where accuracy is essential

Digital strategy defines how an organisation will use digital technologies to create value, achieve competitive advantage, and transform its business model, operations, and customer experience.

Digital transformation is not just about implementing new technology — it is a fundamental change in how the organisation operates and delivers value. It involves: business model innovation (new revenue streams, platform models), customer experience transformation (omnichannel, personalisation), operational transformation (automation, data-driven processes), and cultural transformation (digital mindset, agile ways of working).

Digital maturity levels:

1. Digital beginners: Limited digital initiatives, fragmented efforts, no overarching strategy
2. Digital developing: Some digital projects underway, emerging digital capabilities, pockets of innovation
3. Digital advancing: Coordinated digital strategy, significant capability building, digital embedded in operations
4. Digital leaders: Digital is core to the business model, advanced analytics and AI integrated, continuous innovation, digital culture permeates the organisation

Key elements of a digital strategy:

• Vision and objectives: What does digital success look like? Aligned with the overall business strategy.
• Customer-centricity: Understanding digital customer journeys, expectations, and pain points. Designing digital experiences that delight customers.
• Technology architecture: Cloud infrastructure, API-driven systems, data platforms, cybersecurity. Build vs buy decisions.
• Data and analytics: Treating data as a strategic asset. Investing in data infrastructure, governance, and analytics capability.
• Talent and culture: Recruiting digital skills, upskilling existing workforce, fostering a culture of experimentation and learning.
• Governance and investment: Clear ownership, prioritisation, and ROI measurement. Agile delivery methodology.

Rogers' Diffusion of Innovations (1962) describes how new technologies are adopted by a population over time, following a bell curve:

The "Chasm" (Geoffrey Moore, 1991): There is a gap — the "chasm" — between early adopters and the early majority. Many technologies fail here because: early adopters want vision and innovation, but the early majority wants proven, practical solutions with references. Crossing the chasm requires: targeting a specific niche first (beachhead), providing a complete solution (not just the technology), building references and case studies, and positioning for the pragmatist buyer.

IT governance ensures that IT investments support business objectives, IT risks are managed, and IT resources are used responsibly. It is a subset of corporate governance.

COBIT (Control Objectives for Information and Related Technologies) is the leading framework for IT governance and management, published by ISACA. The current version is COBIT 2019.

Key elements of COBIT 2019:

• Governance system principles: Six principles guiding the governance system: (1) Provide stakeholder value, (2) Holistic approach, (3) Dynamic governance system, (4) Governance distinct from management, (5) Tailored to enterprise needs, (6) End-to-end governance system
• Governance and management objectives: COBIT defines 40 governance and management objectives organised into five domains:
  • EDM (Evaluate, Direct, Monitor): Governance domain — the board evaluates strategic options, directs management, and monitors performance (5 objectives)
  • APO (Align, Plan, Organise): Aligning IT with business strategy, planning IT resources, organising the IT function (14 objectives)
  • BAI (Build, Acquire, Implement): Developing, acquiring, and implementing IT solutions and changes (11 objectives)
  • DSS (Deliver, Service, Support): Delivering IT services, managing operations, and providing support (6 objectives)
  • MEA (Monitor, Evaluate, Assess): Monitoring performance, evaluating internal controls, assessing compliance (4 objectives)
• Components of the governance system: Seven components that support the governance and management objectives: processes, organisational structures, principles/policies/frameworks, information, culture/ethics/behaviour, people/skills/competencies, services/infrastructure/applications

Why IT governance matters: IT spending is a major investment for most organisations. Poor IT governance leads to: failed projects (over budget, late, not meeting requirements), security breaches, regulatory non-compliance, misalignment between IT and business strategy, and value destruction. Effective IT governance ensures IT delivers value, risks are managed, and resources are optimised.

Cybersecurity strategy defines how the organisation protects its information assets, systems, and data from cyber threats — while enabling the business to operate effectively.

The threat landscape:

• Malware: Viruses, worms, trojans, ransomware (encrypts data and demands payment)
• Phishing: Social engineering attacks — fraudulent emails/messages designed to trick users into revealing credentials or installing malware
• Denial of service (DDoS): Overwhelming a system with traffic to make it unavailable
• Insider threats: Employees or contractors who misuse access — either maliciously or through negligence
• Advanced persistent threats (APTs): Sophisticated, targeted, long-term attacks by well-resourced adversaries (nation-states, organised crime)
• Supply chain attacks: Compromising a trusted supplier or software vendor to gain access to the target organisation

Defence in depth: A layered approach to cybersecurity — no single control is sufficient. Multiple overlapping controls at different levels:

• People: Security awareness training, phishing simulations, clear policies, security culture
• Process: Incident response plans, access management procedures, patch management, change control, vendor risk management
• Technology: Firewalls, intrusion detection/prevention systems (IDS/IPS), encryption (at rest and in transit), multi-factor authentication (MFA), endpoint protection, network segmentation, SIEM (security information and event management), backup and disaster recovery

Cybersecurity frameworks:

• NIST Cybersecurity Framework: Five functions — Identify, Protect, Detect, Respond, Recover. Widely adopted, flexible, risk-based.
• ISO 27001: International standard for information security management systems (ISMS). Requires certification audit.
• Cyber Essentials (UK): Government-backed scheme with five basic controls: firewalls, secure configuration, access control, malware protection, and patch management.

Digital transformation is as much a people and culture challenge as a technology challenge. Most digital transformation failures are not due to bad technology — they are due to poor change management, resistance, and lack of leadership commitment.

Key challenges:

• Resistance to change: Employees fear job displacement, skill obsolescence, loss of status, or increased workload during transition. Middle management may resist changes that reduce their control.
• Skills gap: Existing workforce may lack digital skills — data literacy, familiarity with new tools, analytical thinking. Significant investment in training and recruitment is needed.
• Cultural barriers: Traditional cultures (risk-averse, hierarchical, siloed) are often incompatible with digital ways of working (agile, experimental, collaborative, data-driven). Changing culture takes years, not months.
• Legacy systems: Old IT infrastructure may be difficult and costly to integrate with or replace. Technical debt can slow progress.
• Leadership commitment: Digital transformation requires sustained executive sponsorship. If leaders lose interest or move on, initiatives stall.

Applying change management principles:

• Kotter's model: Create urgency (digital disruption threat), build a digital guiding coalition (CDO, CTO, business leaders), communicate the digital vision, empower with new tools and training, quick wins (successful pilot projects), sustain and embed.
• Agile delivery: Adopt agile methodologies for digital projects — iterative development, frequent releases, customer feedback, cross-functional teams. This contrasts with traditional waterfall approaches and requires cultural adjustment.
• Upskilling and reskilling: Invest in digital skills programmes — data literacy for all, specialised training for analysts and technologists, digital leadership development for managers.
• Measuring success: Define digital KPIs (digital revenue %, customer digital adoption, process automation rate, time-to-market for digital products) and track them alongside traditional financial metrics.