No two organizations are the same. While the outside world sees many similarities, there are always subtle differences in corporate culture, demographics, history, and market approach.
In several mergers, demergers, and an IPO, we’ve been confronted with the impact of organizational change on just one aspect of IT, namely Identity & Access Management (IAM). And that was already quite complex. Let’s leave personal emotions, battles for “kingdoms,” and positions aside for now!
What do we mainly see?
From a formal perspective, the first thing that strikes us is:
-
- Joiner–Mover–Leaver processes of two merging organizations are different;
- Other titles are used for functions;
- Wage structures or salary houses vary;
- Corporate cultures are different;
- Management organization or own infrastructure;
- Rights to environments and applications are distributed differently;
- The LDAPs are set up according to a different structure;
- Roles and groups are set up on the basis of a different line of thought or starting point;
- Different applications are used for (more or less) the same business process;
- There are often multiple employment relationships. One person works at two different organizational units, one person fills multiple positions, or, for example, multiple people fill a single FTE position.
In government and healthcare, we often encounter such complications and challenges. These are typically environments where there’s a lot of “dragging” between departments and organizations (or units), for example, after elections.
A decision must be made about the set of rights associated with multiple employment relationships: will they inherit both sets of rights in the event of a merger? If there is an overlap period, how long can it last, in a controlled manner? Is there a risk of segregation of duties violations during the overlap period, and what should we do in that case? What if an individual works part-time in both merging organizations, but in different positions? This last point seems unusual, but it occurs in more than half of the mergers and demergers we manage.
The stakeholders, owners and/or shareholders expect the merger or demerger to be arranged quickly and efficiently.
What can IAM do in this regard?
A well-designed IAM system stores a wealth of information about individuals/identities, groups, roles, rules, and organizational structures. This is an important set of basic information and essential for the controlled merger or demerger of organizations.
In our experience, it’s not possible to resolve the aforementioned complications within a few months, or sometimes even years. A transparent, manageable, and verifiable transition process is possible with the right resources.
We use IAM tools that recognize various formal, contextual, and informal organizational structures. These can be reported on to ensure control and even send notifications in the event of any violations.
Merged or divided organizations use temporary processes during the transition period. These processes must be manageable and verifiable (auditable) for all organizations and/or organizational units involved.
The organization(s) then remain in control while they come together or separate.
Mohammed Omar
Senior IAM Consultant