Resumo

Business environment has become more complex and interconnected. These increasing complexity and interdependence are deeply present in the enterprise risk management (ERM) field of organizations. In order to evaluate how ERM is supporting the evolving business environment of an incumbent technology company, the objective of this paper is to answer the question: what is the risk maturity level of a shared services function of an incumbent technology company? The paper analyzes IBM's Quote to Cash (Q2C) organization, assessing the ERM maturity model of a a shared services area (Oliva,2016).

IBM is one of the biggest technology companies in the world. Q2C is a shared services organization of IBM that lies in the center of the company’s back-office operations, supporting all sales and delivery business lines, performing most back-office workflow tasks, from bid management to accounts receivable. Throughout IBM’s operations, Q2C is a part of important relationships with the company’s agents (clients, governments, etc.). Q2C has a critical role in IBM’s strategy by working is fields such as customer experience, compliance and delivering value to clients and shareholders.

As a key part of IBM’s operations, Q2C is also responsible to manage enterprise risks and ensure that new risks as well as known ones are managed as a part of the company’s ERM. In order to assess the level of ERM maturity in a shared services function of an incumbent technology company, the researchers have selected the methodology of a single case study, with exploratory purpose. There were three interviews conducted with executives and managers in order to assess the matury level of Q2C.

IBM scored high in all factors. In terms of opportunities, this intervention proposes the revision of metrics defined to measure risk, to ensure that metrics are evolving with the increasing complexity and includes risks related to external agents. It was identified as a possible area for cultural and strategic alignment. While Q2C process reviews were defined to be dynamic and are both agile and secure, initial findings indicate that IBM has a lower risk tolerance in its operations, and it may cause IBM to be not as fast to adjust its processes to the complex environment where it operates.

IBM and its back-office operation, Q2C, seem to benefit from well structured processes that are periodically reviewed and have a strong technology driver. The level of maturity identified seems to be built from a positive environment on ERM, in which both employees and leaders get to share information and feedback on the risks associated with the area. The analysis has shown that Q2C scores high in all four factors of the model, which places Q2C in the highest level of maturity in ERM. The intervention was able to identify best practices and opportunities of improvement .

It was possible to identify that Q2C has established ERM practices aligned with the whole corporation and that all factors described in the ERM maturity model of Oliva (2016) are presented, hence the model is a fit to the operations of incumbent companies. We also have identified that the exercise to go through an evaluation of ERM maturity enables leaders to rethink the company’s practices and identify opportunities. We have identified and agent-centric view is essential for developing metrics and controls for risk and should be among ERM’s best practices.