Here’s a tale of two contracts.
- A project team develops a Java based application, and gets all worked up about installing software on third party machines of unknown configurations. They go to the legal department for a contract covering the liability issues involved in installing software. The result is a T&C statement interchangeable with every software EULA you’ve ever failed to read. Wider ranging business issues (e.g. ownership of information, liability) are completely overlooked.
- A business department has an ill-defined legal relationship with various third parties, and gets worked up to resolve this. They go to the legal department for a contract covering the liability issues involved with accepting goods. The result is a T&C statement about, oh, lots of things, all definitely business related. Other technical issues (e.g. availability, authorization, software requirements) are completely overlooked.
In both cases, the legal department provided exactly what was asked - a disclaimer that answered the risks that worried their immediate client. In neither case does the legal department raise other risks. The legal department is a service center, just like technical departments. They answer the questions put to them, and have limited capacity to seek out new questions. (In fact, the client would probably be resentful if the lawyer started forcing changes to products in use, since a) it’d be outside the product development life-cycle, and b) no one likes a visit from the auditors.)
The same thing applies to the technology service centers I’ve worked in. It’s extremely hard to get out of the engaged scope and into business process. Some of this is internal… projects generate a certain tunnel vision. But a good deal of it stems from the terms of engagement - when you’re engaged for a specific problem, a wide ranging investigation into underlying business issues is simply irrelevant.
Modeling a department along customer service lines hamstrings the ability of the department to actively engage… the model and mindset just doesn’t allow it. Of course, the Customer model is a reaction to the previous Priesthood model, where IT departments had complete control and no accountability, doling out new software as and when it choose.
Partnership is another model, but needs the department to be deeply invested in the particular business, so that they have the knowledge to identify opportunities when they arise. It sounds nice, but is going to struggle with the fact that you can’t be partners with everyone.
Another model is Federation. Each business has it’s own IT development team, which focuses on that single business. Meanwhile, there’s a central management team focused on long term standards, which manages support, standards, architecture, HR, skills building, and all the various bits that prevent the company IT fragmenting into separate operations.