A framework for defining and analysing access policies in requirements models

Enforcing access policies derived from management control principles is a way by which organisations protect their information assets. The minimum privileges principle is an example of a management control principle, which specifies that users should only have access to resources they require to carry out their duties. Requirements models use actors to specify their access policies. Actors normally represent roles that users adopt, however a role can have different meanings, such as a position in an organisation or the assignment of a task, and can therefore be misleading. Current requirements modelling approaches do not provide a systematic way of defining roles for incorporation into access policies, and therefore we can not ensure that they satisfy management control principles. In this thesis we address the need to provide precise role definitions by developing a framework that facilitates the derivation of roles from the organisational context. The framework consists of a metamodel, which enables the organisational context to be represented and related to actors; a set of heuristics for deriving the organisational context; and a set of language constructs for formulating access policies, and verifying them using scenarios. We use the meta-model and language constructs that we developed to extend an existing requirements modelling language, the i* framework, and in particular a formal version of it, formal Tropos, to define and verify access policies definitions satisfying the minimum privileges principle. We also investigate the use of automated tool checking by translating the formal Tropos definitions into the specification language Alloy, which is supported by a tool that automatically checks assertions, to ensure consistency of the access policy definitions. We carry out a detailed case study taken from the literature to verify the extensions to the i* framework and the tool supported analysis. The framework presented in this thesis makes a novel contribution to the modelling of access policies as requirements, enabling us to define access policies using actors derived from the organisational context, that satisfy the minimum privileges principle

Control and Change. Analysing the Process of Institutionalisation

This paper studies the process by which a change in the institutional logic of an organisational field is institutionalised in management control systems of a firm. In particular, three elements of organisational control, inspired by the control mix defined by Abernethy and Chua (1996), are studied: management culture, division of powers between functions, and accountability principles. The theoretical framework proposed by Hasselbladh and Kallinikos (2000) enables us to describe the institutionalisation process of management control systems in more detail by observing how ideals are translated into discourse and in turn control techniques. The paper also investigates the internalisation and “decoupling” occurring between the implementation of control systems, and their actual use when applied for monitoring operational managers. Indeed, the empirical findings, based on a field study conducted in the French subsidiary of a pharmaceutical laboratory, enable us to identify a persistent decoupling. Our results show it stems from ambiguous managerial choices and the resistance of the actors to the new norm. However, it appears that, when discourse can not be heard, it can be partially bypassed using techniques. In fact, these techniques enable an insidious institutionalisation of the new institutional logics when “what can be done can not be saidcontrol, change, process of institutionalisation

Identifying Appropriate Governance Principles for Different Types of Sourcing Arrangement

Three shortcomings in existing information technology (IT) governance research are identified: an overemphasis on implementation rather than principles, a focus on the individual organisation rather than the relationships between organisations and a tendency to divorce the technology from the activities that rely on it. A governance framework comprised of the overarching principles of direction and control is proposed and it is suggested that these principles can be delivered through a focus on performance, conformance, openness and transparency, responsibility and accountability, and evaluation and monitoring. The importance of outsourcing as a form of inter-organisational relationship is highlighted and three case studies of different types of outsourcing arrangement conducted to test the usefulness of the framework. The results suggest that organisations recognise the importance of effective governance to the success of their relationships, that designing appropriate governance for relationships is complicated by factors such as the need to accommodate the disparate requirements of the parties involved and that the framework proposed appears to capture the essential areas

Enterprise Agility: Why Is Transformation so Hard?

Enterprise agility requires capabilities to transform, sense and seize new business opportunities more quickly than competitors. However, acquiring those capabilities, such as continuous delivery and scaling agility to product programmes, portfolios and business models, is challenging in many organisations. This paper introduces definitions of enterprise agility involving business management and cultural lenses for analysing large-scale agile transformation. The case organisation, in the higher education domain, leverages collaborative discovery sprints and an experimental programme to enable a bottom-up approach to transformation. Meanwhile the prevalence of bureaucracy and organisational silos are often contradictory to agile principles and values. The case study results identify transformation challenges based on observations from a five-month research period. Initial findings indicate that increased focus on organisational culture and leveraging of both bottom-up innovation and supportive top-down leadership activities, could enhance the likelihood of a successful transformation

Pathways to Accountability II

This report summarises the results of the 2009-2010 review process on the One World Trust Global Accountability Framework and the piloting of the draft framework during 2011, and presents the full One World Trust Pathways to Accountability II indicator framework. Our work in this field work is motivated by a concern about the persisting weakness and insufficient effectiveness of global organisations from all sectors in responding to the challenge of delivering global public goods to citizens and communities, the very people whom they claim to serve and benefit, and who are most often dependent on them

Work Organisation and Innovation

[Excerpt] Innovations in work organisation have the potential to optimise production processes in companies and improve employees’ overall experience of work. This report explores the links between innovations in work organisation – under the broader label of high performance work practices (HPWPs) – and the potential benefits for both employees and organisations. It draws on empirical evidence from case studies carried out in 13 Member States of the European Union where workplace innovations have resulted in positive outcomes

Governance for sustainability: learning from VSM practice

Purpose – While there is some agreement on the usefulness of systems and complexity approaches to tackle the sustainability challenges facing the organisations and governments in the twenty-first century, less is clear regarding the way such approaches can inspire new ways of governance for sustainability. The purpose of this paper is to progress ongoing research using the Viable System Model (VSM) as a meta-language to facilitate long-term sustainability in business, communities and societies, using the “Methodology to support self-transformation”, by focusing on ways of learning about governance for sustainability. Design/methodology/approach – It summarises core self-governance challenges for long-term sustainability, and the organisational capabilities required to face them, at the “Framework for Assessing Sustainable Governance”. This tool is then used to analyse capabilities for governance for sustainability at three real situations where the mentioned Methodology inspired bottom up processes of self-organisation. It analyses the transformations decided from each organisation, in terms of capabilities for sustainable governance, using the suggested Framework. Findings – Core technical lessons learned from using the framework are discussed, include the usefulness of using a unified language and tool when studying governance for sustainability in differing types and scales of case study organisations. Research limitations/implications – As with other exploratory research, it reckons the convenience for further development and testing of the proposed tools to improve their reliability and robustness. Practical implications – A final conclusion suggests that the suggested tools offer a useful heuristic path to learn about governance for sustainability, from a VSM perspective; the learning from each organisational self-transformation regarding governance for sustainability is insightful for policy and strategy design and evaluation; in particular the possibility of comparing situations from different scales and types of organisations. Originality/value – There is very little coherence in the governance literature and the field of governance for sustainability is an emerging field. This piece of exploratory research is valuable as it presents an effective tool to learn about governance for sustainability, based in the “Methodology for Self-Transformation”; and offers reflexions on applications of the methodology and the tool, that contribute to clarify the meaning of governance for sustainability in practice, in organisations from different scales and types

Assessing police privatisation in the United Arab Emirates

The growth of private security companies and the privatisation of police is a development that has been witnessed around the world in both developing and developed nations. The rapid pace of transformation in policing in the UAE potentially poses severe risks to the future of policing. Different categories of risks have been identified in connection with the transference of public functions to the private sector: regulatory, economic and social risks. In the UAE, the outsourcing of policing operations to the private security sector is significantly embedded as a key policy objective driven by a wider commitment to deliver efficient public services. While the UAE and institutions are committed to applying best practice and principles in this area, a framework to assess police privatisation was lacking. The aim of this research was to investigate the effectiveness of governance, oversight and accountability of private security in the UAE. The theoretical basis for this research was underpinned by privatisation theory and principles of accountability and control systems. The research design employed an action research strategy gathering qualitative and quantitative data. Action research was adopted as a means for addressing organisational change and enabled the private and public sector organisations to adopt invigorated perspectives and stimulated engagement regarding organisational issues and cross-sector partnership. In terms of external controls influencing governance and accountability there were gaps when benchmarked against key dimensions identified in the literature. There was a lack of a comprehensive evaluation framework that addresses all dimensions and an absence of systematic and meaningful evaluation of programme effectiveness impacting sector stakeholders. Findings revealed a lack of democratic accountability and public engagement, market control in terms of self-regulation, regulatory limitations and limited engagement and trust between the public and private security organisations. Assessment of internal controls revealed moderate performance in terms of motivation and morale of security personnel and weaknesses in recruitment and training and organisational learning capacity. A framework was formulated contributing a holistic and integrated approach for assessing private security performance. The evaluation dimension contains key factors, such as evaluation criteria and evaluation mechanisms, with associated criteria specifying the nature of the content of the evaluation criteria, such as comprehensiveness and reflection of stakeholder priorities. A key change objective is the implementation of multi-level, multi-dimensional evaluation mechanisms, with compliance measures related to diverse evaluation mechanisms and regularity of evaluation. This framework reflects an embedded approach to assessing the performance of private security model evaluation as a reflexive social process that enables continuous reflection and emergent transformation

Work Organisation and Innovation in Ireland

[Excerpt] Innovations in work organisation have the potential to optimise production processes in companies and improve employees’ overall experience of work. This report explores the links between innovations in work organisation – under the broader label of high performance work practices (HPWPs) – and the potential benefits for both employees and organisations. It draws on empirical evidence from three case studies carried out in the Republic of Ireland, where workplace innovations have resulted in positive outcomes and where social partners played a significant role in their design and development