SBI CIO SK Mishra on Requirements for Bringing Change with IT in a Large Organization:

The largest commercial bank of India, SBI has more than 21,000 branches, 30,000 ATMs, and presence in 33 countries across the globe. In India itself, SBI reaches out to the most far flung geographies. Given its reach, any action that the bank performs has an adverse impact on the country's population itself. And in order to take any action for the customers it serves, implementing the right IT projects is imperative.

Rolling out large scale IT initiatives for a behemoth like SBI is a task in itself, and one of the biggest hurdles would become user resistance. And yet, the bank has been doing it successfully year after year, and reaping benefits.

That's why, PCQuest has been recognizing SBI year after year for the various IT initiatives it has taken. This year, based on the five project nominations we received, we feel that the bank deserves a special award for the tremendous change management it has brought in its working culture.

Interview: S K Mishra, CIO, SBI

What are the essential requirements for bringing in change with IT in a large organization such as yours?

Change, upgradation, continuous improvement-these are some essentials for sustainability in today's competitive environment for any organisation. Awareness of the changing technological environment is a must, and continuous upgradation in the IT environment of the organization catalyses the business aspirations. An integrated IT architecture for transaction systems and information management is already in place in State Bank of India. Change management is performed on all applications in a controlled manner. Risks associated to the changes are always managed to an acceptable level and all critical changes are always tested in a non-production environment. In our Bank all application groups have a Change Control Committee (CCC). The CCC identifies all changes and approves them before implementation and ensures that all changes are compliant with the statutory, legal and regulatory requirements. Any change before approval is analysed for its need, impact, priority and security implications by the CCC.

How do you identify the challenges that merit rolling out an IT initiative in your organization?

Right from the initiation phase of any project, we list out the potential challenges which we as a team will face during the project implementation. When it comes to State Bank of India, the humongous scale and diversity of operations itself pose a big challenge. The external environment, organizational barriers, what's worked well in the past are some of the important aspects we keep ourselves abreast with.

As the project work starts, we continuously review the "health" of IT projects and also identify gaps in requirements, staffing needs, end-user training plans and change management initiatives that might threaten the success of a systems implementation, software upgrade or new hardware roll-out. We also ensure that all the project documentation is complete and there is no gap between users' requirements and what IT thinks that users need. Each IT vertical in the Bank has robust Performance Monitoring capability for monitoring, trouble shooting and resolving problems related to their area. We have regular metrics of performance monitoring which are in use for monthly and yearly performance review. Risk assessment procedure of the Bank follows a zero-tolerance approach for the first time for new systems/applications.

In this approach, all the threats and vulnerabilities a particular asset may be exposed to are identified and appropriate controls are selected to mitigate them and reduce the risk to acceptable levels. Afterwards, Risk assessment procedure follows an ongoing approach for existing systems/applications. This approach takes into account all existing controls and their effectiveness in terms of residual risks and assessment for new vulnerabilities and controls required.