NTXISSACSC4 - Hacking Performance Management, the Blue Green Game

@NTXISSA#NTXISSACSC4

HackingPerformanceManagementTheBlueGreenGame

Dr.BrandenR.WilliamsDirector

UnionBank8October2016


A quick poll(Write your answers down)

Beforewestart…


• 1.Performancemeasures:• a.Havelittleornoimpactonbehavior• b.Haveamoderateimpactonbehavior,butarenotamajorfactor• c.Determinehowindividualsbehave


• 2.Itismostimportantthatperformancemeasuresshould:• a.Accuratelyreflectpastperformance• b.Correctlyinfluencefuturebehaviors


• 3.Performancemeasurementshouldfocusonthedepartmentlevelandencourageoptimaldepartmentalperformance.• a.True• b.False


Game Theory Primer:The Prisoner’s Dilemma

AQuickPrimer

Source:https://youtu.be/t9Lo2fgxWHw

StaySilent(Cooperate) Confess(Defect)

StaySilent

(Coo

perate)

(-1,-1) (-3,0)

Confess

(Defect)

(0,-3) (-2,-2)

PrisonerBob

Priso

nerA

lice


COMMON QUIPS ABOUT PERFORMANCE MANAGEMENT


• Kerr(1975)arguesthatformalrewardsystemsshouldpositivelyreinforcedesiredbehavior,andnotconstituteanobstaclefortheorganizationanditsemployeestoovercome.

• JohnsonandKaplan(1987)exposetheinherentflawsoftraditionalmanagementaccountingsystemsanddescribedysfunctionalbehaviorsfromtraditionalperformancemeasures.(ManagementAccounting)

• KaplanandNorton(1992,1996)furtherhighlighttheweaknessesoftraditionalmeasurementsystemsthatleadtoinappropriatebehaviorssuchasshort-termthinking,lackofstrategicfocus,failuretoreinforcecontinuousimprovement,andtheresultingsuboptimalsystemperformance.(BalancedScorecard)

CopiedandformattedfromUmble &Umble (2012).


• Goldratt (1990)wrote“Tellmehowyoumeasureme,andIwilltellyouhowIwillbehave.”AND“Ifyoumeasuremeinanillogicalmanner,donotcomplainaboutillogicalbehavior.”(TheGoal)

• Chenhall andLangfield-Smith(2007)arguethattheeffectivenessofperformancemeasurementsystemsdependsonhowtheyimpactindividuals’behavior.

• RadnorandBarnes(2007)suggestthatperformancemeasurementsystemsshouldpromoteappropriatebehaviors.

CopiedandformattedfromUmble &Umble (2012).


Any examples of poor performance management?

Beforeweplaythegame…


And now, on to the game!


RULESLet’splaytheBlueGreengame(Umble &Umble)andwinsomecoffee!

SplitintoFOURTEAMS.

Electamanager!

Ifadepartmentcannotreachaconsensusonthecolorofchiptosubmit,themanagerisauthorizedtomakethefinaldecision

Teamwiththebestscorewins!

Everymemberofthewinningteamwinsa$5STARBUCKSGIFTCARD!

Yes,theyactuallywork,andI’mnotmessingwithyou.


THE BLUE-GREEN GAME

Five rounds of play.

Notes:• Points DOUBLE in Round 3• Points TRIPLE in Round 5

DistributionofChips NumberofPointsWon/Lost

4Blue,0Green Each departmentwins1point

3Blue,1Green Blue DepartmentsGreenDepartments

Lose1pointWin 3points



1Blue, 3Green Blue DepartmentsGreenDepartments


0Blue,4 Green Eachdepartmentloses1 point


Round 1

Submitachip!


SCORING






Lose2pointsWin 2points


Lose3pointsWin 1point



Round 2

Submitachip!


SCORING








Lose3pointsWin 1point



Round 3

Submitachip!


SCORING


4Blue,0Green Each departmentwins2points







0Blue,4 Green Eachdepartmentloses2 points


Round 4

Submitachip!


SCORING











Round 5

FINAL ROUND

Submitachip!


SCORING











AND THE WINNER IS….

Eachgroupannouncetheirpoints


A quick poll(Write your answers down)

Havethingschanged?


• 1.Performancemeasures:• a.Havelittleornoimpactonbehavior• b.Haveamoderateimpactonbehavior,butarenotamajorfactor• c.Determinehowindividualsbehave


• 2.Itismostimportantthatperformancemeasuresshould:• a.Accuratelyreflectpastperformance• b.Correctlyinfluencefuturebehaviors


• 3.Performancemeasurementshouldfocusonthedepartmentlevelandencourageoptimaldepartmentalperformance.• a.True• b.False


What did we learn?

Let’sdebriefbeforethenextslides.


RESULTSSilospromotebadbehavior,allowingeachorganizationtoattempttomaximizetheirpayoffs.

Rationalplayersacttomaximizetheirpayoffs,evenattheexpenseofothers

Poortransparencyofgoalsandperformancepromotesbadbehavior

Giventheopportunity,individualswilltakeadvantageofpoorlyconstructedplans

Protip:TESTperformancemanagementsystemsafteryouconstructthem.Seewhatwouldhappenifyouaimtomaximizeaparticularpayoff.Rewardsystemsareeffective,attimestoadeterment!


TYING TO SECURITYOrganizationalmetricsareoftennotoptimizedtoallowemployeestocontributetoglobaloptimum.

Securitymetricofmostclosedvulnerabilities

Securitymetricofmostblockedattacks(whichissketchtobeginwith)

NumberofsystemsmovedintocompliancewithXstandard

• BetterOptions:

%ofsystemsthatmeetX

Lengthofsecuritypatchdeployment,byseverity


GAME THEORY FUNPeopleoftentakeaggressiveposturesthatleadtomutuallybadoutcomeseventhoughmutualcooperationismutuallypreferable.

Evenifeveryoneagreesthatanoutcomeiseveryone’sfavorite,theymightnotgetthatoutcome.

Closingroadscanimproveeveryone’scommutetime.

Everyonemightmimiceveryoneelsejustbecausetwopeoplechosetodothesamething.

Youshouldn’ttrytomaximizeyourscoreinWordswithFriends/Scrabble.

Asdrugtestsbecomemoreaccurate,theyshouldbeimplementedlessoften.

Source:https://williamspaniel.com/2014/05/25/game-theory-is-really-counterintuitive/


References• Chenhall,R.H.,&Langfield-Smith,K.(2007).Multipleperspectivesofperformancemeasures.

EuropeanManagementJournal,25(4),266–282.• Goldratt,E.M.(1990).Thehaystacksyndrome:Siftinginformationoutofthedataocean.

Croton-on-Hudson,NY:NorthRiverPress.• Johnson,H.T.,&Kaplan,R.S.(1987).Relevancelost:Theriseandfallofmanagement

accounting.Boston,MA:HarvardBusinessSchoolPress.• Kaplan,R.S.,&Norton,D.P.(1992).Thebalancedscorecard—measuresthatdrive

performance.HarvardBusinessReview,70(1),71–79.• Kaplan,R.S.,&Norton,D.P.(1996).Usingthebalancedscorecardasastrategicmanagement

system.HarvardBusinessReview,74(1),75–87.• Kerr,S.(1975).OnthefollyofrewardingA,whilehopingforB.AcademyofManagement

Journal,18(4),769–783.• Poundstone,W.(1992).Prisoner’sdilemma.NewYork,NY:Doubleday.• Radnor,Z.J.,&Barnes,D.(2007).Historicalanalysisofperformancemeasurementand

managementinoperationsmanagement.InternationalJournalofProductivityandPerformanceManagement,56(5/6),384–396.

• Umble,E.,&Umble,M.(2012).IllustratingtheImpactofPerformanceMeasurementSystemsonOrganizationalPerformance:TheBlue-GreenGame.DecisionSciencesJournalofInnovativeEducation,10(3),461–467.


That’sit,that’stheend!

@[email protected]

@NTXISSA#NTXISSACSC4@NTXISSA#NTXISSACSC4

The Collin College Engineering DepartmentCollin College StudentChapteroftheNorthTexasISSA

NorthTexasISSA(InformationSystemsSecurityAssociation)

NTXISSACyberSecurityConference– October7-8,2016 37

Thankyou

Internet

NTXISSACSC4 - Hacking Performance Management, the Blue Green Game