Has knowledge management missed the business continuity boat: A study of vulnerable university knowledge assets

Universities are knowledge banks for society and incubators for innovation. When disaster strikes a university, knowledge assets may not be fully protected. The proposed Knowledge Vulnerability Assessment framework identifies unprotected knowledge most at-risk during a disaster. This includes individual and group tacit knowledge, adaptations to routines and instrumentation, and collaborative relationships. To date, knowledge management may have missed the boat in university continuity planning, however, intensified participation in the future may protect and foster research and discovery (R&D)HAS KNOWLEDGE MANAGEMENT MISSED THE BUSINESS CONTINUITY BOAT? A STUDY OF VULNERABLE UNIVERSITY KNOWLEDGE ASSETS Roxanne Ward Zaghab Doctoral Student University of Maryland University College rzaghab@rx.umaryland.edu Organizational Learning, Knowledge and Capabilities Conference Making Waves Hull University, England April 12-14, 20112 Vulnerable University Knowledge Assets Roxanne Ward Zaghab HAS KNOWLEDGE MANAGEMENT MISSED THE BUSINESS CONTINUITY BOAT? A STUDY OF VULNERABLE UNIVERSITY KNOWLEDGE ASSETS ABSTRACT Universities are knowledge banks for society and incubators for innovation. When disaster strikes a university, knowledge assets may not be fully protected. The proposed Knowledge Vulnerability Assessment framework identifies unprotected knowledge most at-risk during a disaster. This includes individual and group tacit knowledge, adaptations to routines and instrumentation, and collaborative relationships. To date, knowledge management may have missed the boat in university continuity planning, however, intensified participation in the future may protect and foster research and discovery (R&D) knowledge assets. 1. INTRODUCTION Higher education institutions (HEI) are knowledge banks for society and engines for innovation. University innovations contribute to a supply chain of knowledge-related products (Teece, 1998; Lockett et al., 2008). Over the past 30 years, United States (US) universities have spun-off 4,000 new enterprises and worked with partners to generate 658 new technology-related products involving over 18,000 patent applications (AUTM, 2009). In 2007, research at US universities grew to a record $48.8 billion with government, industry, and international support (AUTM, 2007). More over, some research productivity is not reported in the AUTM university statistics, including collaborative alliances and sweat-equity arrangements where research resources may cross organizational boundaries but funding does not. In the last decade, continuity planning has emerged as a management practice to prepare organizations for natural, human and technological threats, and related unexpected events. By preparing for disaster and protecting highly valued people, facilities, information and technologies, universities theoretically reach an adequate level of risk reduction to ensure post-disaster operations (Ruettgers, 2003). US HEI are required by federal law to establish continuity of operations plans (McCluskey, 2007). Universities face a number of challenges when preparing continuity of operations plans including an open fluid environment, diverse beliefs and subcultures, and the balance between preparedness and rigid security controls (McCluskey, 2007). HEI have been responsive to policy mandates by establishing clear priorities— human lives, protected facilities, fortified information technologies, and plans for business recovery. The relationship between university continuity planning and preservation of knowledge resources has not yet been fully explored.3 Vulnerable University Knowledge Assets Roxanne Ward Zaghab 2. PURPOSE Imagine a wooden boat waiting in the Humber Estuary. In a devastating event, this boat is entrusted with Hull University’s jewels of knowledge and will carry this knowledge to safer shores. After the crisis subsides and the boat returns, will the essential ingredients of innovation be among the treasures on the boat? The question addressed by this paper is: If an unmitigated crisis occurred at this university today, what research and discovery (R&D) knowledge would endure and what would not perish? How would the loss of tacit knowledge impact the university’s capacity for innovation? Finally, what is the role for knowledge managers in addressing the identified knowledge vulnerabilities? This paper examines knowledge vulnerabilities at each step in the business continuity planning cycle. The Knowledge Vulnerability Assessment (KVA) 1 The following definitions have been adopted. is presented as a framework to highlight realms of unprotected knowledge assets which may be at-risk in many research-intensive institutions. This paper focuses on the knowledge lost or “invisible” to the university in the first step of continuity planning where assets are identified. These are the innovation-generating knowledge assets which fall outside the traditional university continuity plans. Traditional realms of coverage include: physical, human and information resources. ‘Knowledge management’ (KM) fosters the creation, accumulation, organization, reuse, retrieval, sharing, and transfer of knowledge in organizations (Alavi and Leidner, 2001; Liebowitz, 1999). ‘Discovery’ is the process of developing proprietary, closely-held, embodied knowledge on the research and discovery (R&D) unit level. These locally embedded knowledge assets have not undergone the evaluation and valuation process. “Disclosure” is a value-creating process for intangible innovations and discoveries. University inventors enter a process with patent and copyright attorneys to formalize their discovery. The disclosure process qualifies a discovery as unique (or redundant) and possibly market-worthy. Disclosure and the processes that follow assign a future potential monetary value on an innovation. 1Housel and Bell (2001) propose a methodology to measure the returns knowledge brings to the firm. This method, termed knowledge-valued-added (KVA), shares the same abbreviation, “KVA”. The use of this abbreviation does not to imply a relationship between the two.4 Vulnerable University Knowledge Assets Roxanne Ward Zaghab 3. BACKGROUND 3.1.What is Innovation? Innovation is an improvement on existing processes and/or products. Innovation cannot stand alone (Berkun, 2010), rather it builds from existing sources of data, products, processes, knowledge and experiences (duPlessis, 2007). Nonaka and Takeuchi (1995) in their pre-eminent work describe the dialogue between tacit and explicit knowledge necessary to generate innovation in organizations. Van de Ven (1986) describes innovation as “the development and implementation of new ideas by people who over time engage in transactions with others within an institutional context (p. 591)”. Universities’ capacity to generate innovation lies in their banks of knowledge, well-resourced facilities, and a robust core of knowledgeable human resources (Secundo et al., 2010). Creation, codification and dissemination are the three central functions of innovation in organizations (Argote, 2005, Cardinal et al., 2001). These functions are punctuated by three processes in the university context: discovery, disclosure and transfer. Table 1 indicates the level at which each university process takes place. Discovery occurs at the R& D unit level. Codification involves both R&D units and university administrators in the disclosure process. Transfer of innovation occurs in a variety of structured and unstructured social interactions between R&D units and external knowledge alliance partners (Inkpen and Tsang, 2005). Table I. Innovative Function, University Process and Level of Activity INNOVATIVE FUNCTION UNIVERSITY PROCESS LEVEL OF ACTIVITY Creation Discovery Research and Discovery (R&D) Unit Codification Disclosure R&D Unit to University Dissemination Transfer R&D Unit to External 3.2.Creation—Discovery The knowledge creation process in universities occurs on the R&D unit level where a dialogue takes place between and amongst trusted scientists and their fellows, colleagues, lab teams and collaborators. Innovations emerge when an environment facilitates discovery through individual interaction with technology, instrumentation, and with other individuals in the unit and collaborators with the unit. Creation also involves manipulation of biological and intellectual research resources by members of the unit. An example of this is staff interacting with a genetic database or incubating certain cells for experimentation. In this manner discovery is locally embedded in the people and in the technology and routines of the universities as the source of knowledge (Argote, 2005; Argote and Ingram, 2000). Tacit knowledge is generated through experiences on the discovery team and embodied by team members (Saint-Onge, 1996). Working from a shared base of scientific knowledge, teams may integrate new discoveries into a new threshold of shared meaning on a tacit level. Innovation processes are highly social and difficult to identify, quantify and protect (Borghoff and Pareschi, 1997). Knowledge can be held in the mind, embedded in group processes, operationalized in procedures, and exemplified in the interaction between 5 Vulnerable University Knowledge Assets Roxanne Ward Zaghab data/information and human thought processes (Alavi and Leidner, 2001; Johannessen et al., 2001; Saint-Onge, 1996). Universities and governments deploy technology-intensive initiatives to foster innovation including: large-scale laboratories, seed funding and rsearch resource endowments (Markman et al., 2005). Knowledge repositories and libraries are also technologies which promote the interface between innovators and stores of knowledge (Bezhani, 2010; Kirkland, 2005). BioParks and incubators (Link and Scott, 2003) provide not only high-technology environments, but also geographically desirable conditions for knowledge-intensive interaction with collaborator. Facilities and instrumentation are but one piece in university capacity to generate innovation. 3.3.Codification—Disclosure Codification of innovation is complex. Because “learning is embedded in [group] the systems, structures, strategy, routines” (Crossan et al., p.529), disclosure involves capturing and formalizing the information that emerges in the discovery process. In HEI, codification is the process of disclosure, when R&D investigators and university officials begin a conversation to formalize discoveries by translating the innovation into terms understood outside the R&D unit. Explicit knowledge can be digitized, reduced to writing and shared with others (Cardinal et al., 2001). In parallel, the tacit knowledge accompanying an innovation is likely to be practical and closely-held. The contextual understanding of a group of inventors is tied to the processes around the codified discovery (Cavusgil et al., 2003; Inkpen and Tsang, 2005). The disclosure process involves highly experienced lawyers who coach faculty in the codification of all processes surrounding an intellectual property claim. This process of formalizing the discovery intends to identify the source of the innovation and the processes which are embedded in the socio-cultural scientific context at the discovery unit level. Translation is a key factor in the university disclosure process. 3.4.Dissemination—Transfer Research and development is an expensive process requiring investments in facilities, technologies, human resources and partnerships. To gain a return on investment, the resulting discover must successfully reach the marketplace as a new product (Teece, 1992). The knowledge and facility-intensive nature of R&D universities presents HEI as valuable partners early in innovation and discovery (Cavusgil et al., 2003; Johnston et al., 2010). University-industry partnerships can help discoveries move from laboratory into a product pipeline where the monetary value is determined. In fact, university innovations, in practice, are monetized when commercial viability is confirmed. Universities are key contributors to innovation through knowledge alliances and other forms of open innovation (Lichtenthaler, 2011). Strategic knowledge alliances can help generate and harvest knowledge (Grant and Baden-Fuller, 2004) but partnerships also add complexity to the exchange and transfer processes. Cultural conflicts arise around trust and differences in organizational decision making. Tacit knowledge transfers require stronger ties whereas codified knowledge and trust are more independent (Nonanka, 1991). Which6 Vulnerable University Knowledge Assets Roxanne Ward Zaghab innovation has value, when, how and why to develop and transfer innovation are all culturally-guided decisions (Choo, 1996). Knowledge transfer is a key component in university knowledge alliances. Transfer is the active intent to communicate innovation from the source to the recipient context (Argote and Ingram, 2000). The embedded nature of innovation requires tacit knowledge be available for transfer along with codified knowledge. People, routines, and technology hold university knowledge (Szulanski, 2000) and advocate transfer of these “reservoirs” to facilitate transfer of innovation to a new context (Argote and Ingram, 2000). Innovations are standardized for the knowledge transfer process (Argote, 2005), and then must be assimilated into the recipient organization (Nonaka, 1991; Zahra and George, 2002). Because tacit knowledge must accompany codified knowledge, the failure to fully integrate interpersonal and technical aspects of innovation will results in an incomplete transfer of the innovation from the university source to the recipient (Johannessen et al., 2001; Szulanski, 2000). 4. CONTINUITY PLANNING CYCLE AND VULUNERABILTIY ASSESSMENT Business continuity planning has its roots in information systems architecture; and these roots have had a lasting influence on the lens through which universities approach continuity. Continuity planning is a stepwise process which involves identification, valuation, decision making, and protection of assets. Asset-based protection is the commonly accepted continuity planning approach (Ruettgers, 2003). Asset identification and valuation is the first step in continuity planning. Recoverable assets and other intangibles are identified in this step which may ensure the growth or continuity of the organization (DeVargas, 1999). Information security is the systematic process of identifying assets, valuing assets, assessing likelihood, evaluating the impact and taking action to reduce information loss. A variety of mechanisms can be used to capture relevant assets. Classification and identification of assets are requisite in an asset-driven business continuity system. In the second step an asset must be valued before threats are assessed for highly-valued assets. The difficulty arises when valuable knowledge assets are locally held. Their value is undetermined. Thus when using the DeVargas asset-based framework, uncodified and undisclosed knowledge-assets on the discovery unit level may be eliminated from the business continuity planning in step one—These discoveries will not even reach the second step of planning. Some work-in-progress are “invisible” to the institution’s primary protectors of assets: information technology, facilities and maintenance, and human resource offices. Vulnerability assessments contribute essential information, and they aid decision makers in assessing shortcomings and establishing priorities for action (Ruettgers, 2003). Current perspectives vary in how to approach organizational vulnerability assessment, but all assessments converge in the decision-making and priority setting process. In fact, Vidalis’ (2004) work has helped risk assessment mature from an IT-centric to an information-7 Vulnerable University Knowledge Assets Roxanne Ward Zaghab centric point of view. This paper adopts the knowledge-centric viewpoint in business continuity planning. 5. CONCEPTUAL FRAMEWORK Continuity plans intend to protect university resources. BCP is a process undertaken by the institution to guide university assets in the event of disaster to ensure their protection in university business and knowledge management systems. Knowledge assets must “fall” within the business continuity cycle to ensure protection (Botha and VonSolms, 2004; DeVargas, 1999) . Currently university continuity plans set human, technical, information and physical resources as the highest priorities which is consistent with federal, state, and local government regulatory requirements (McCluskey, 2007). Figure I sets forth a five-step asset-based business continuity planning cycle including: 1) identify and characterize assets; 2) evaluate assets for value to the institution; 3) assess asset- specific risks and plan to address risks; 4) implement the protection strategies; and 5) evaluate and improve the continuity plan. The sequential process of continuity planning is challenging as it requires that an asset be identified before it is included in valuation (step two) and risk assessment plan (step three). Similarly, an organization cannot knowingly protect (step four) an asset that is not in the plan. Thus inclusion of research and discovery knowledge assets in HEI must be involved in step one in order to be protected in step five. In our example, knowledge must purposefully be placed on the boat in the Humber Estuary in order to be protected from whatever terror or natural disaster is to be avoided at Hull University. 8 Vulnerable University Knowledge Assets Roxanne Ward Zaghab Universities are limited in the resources available to protect their people, facilities, technology and information. Items of value to the university are given protection under the business continuity plan. Organizations determine value based on financial and marketplace considerations and cultural factors. Thus, even if assets are identified in step one they may not be a priority in step two due to lack of present value. As illustrated in table II below, each step of the continuity planning process is met with challenges for tacit knowledge. Disclosure marks a change for the R&D team. While the research may continue to develop, the disclosed activity signals a point of full disclosure. The codification process on the university level (as opposed to the codified practices on the unit level) is undertaken in earnest. The value of the disclosed work is largely dependent upon the history of previous discoveries by the R&D Unit. University priority setting around research in progress is also complicated by the distance between innovators and university official. Top-down university decision-making to protect priority knowledge assets is incongruent with the nature of locally-held tacit knowledge. The evaluation and process improvement step of continuity planning precludes inclusion of local knowledge generating units. Table II. Asset-based Approach to Continuity Planning: Gaps and Challenges Step Gaps Challenges One-Identifying Assets Invisibility Embodied, closely-held and difficult to capture knowledge is invisible to university knowledge management systems. Two-Valuating Under-valued Once disclosed, intangible knowledge assets are novel and lack evidence from the market about actual or potential value. Value is embedded locally with locally held-knowledge. Three-Assessing Risks and Planning to Address Risks Incongruent Centralized decision-making regarding locally-held assets is incompatible with the understanding of the need to protect this knowledge. Four-Protecting Implementation Level University strategies involve primarily organization-wide policies, routines, and data capture systems. Embedded knowledge is vulnerable on the discovery unit level. Five-Evaluating and Improving Inclusion University decision making and leadership evaluation teams may lack the involvement of innovators and knowledge managers to ensure relevance of plan. 5.1.Framework for Knowledge Vulnerability Assessment The author proposes a conceptual map of traditionally protected university knowledge assets (human, physical, and information resources) and the realms inside and outside traditional business continuity protections. See figure II.9 Vulnerable University Knowledge Assets Roxanne Ward Zaghab Human resources, information resources and physical resources are priorities for protection under asset-based university continuity plans. University priorities are responsive to stakeholder requirements including a complexity of federal, state, and university system policies, regulations, and related procedures. To protect human resources, universities establish required organizational policies and undertake implementation to “watch over” the health and well-being of their employees in the case of emergency. During disaster, the universities provide shelters, evacuation plans, and public health facilities. Many institutions provide preventive programs such as first-aid training and employee immunization. With the exception of technology safety breaches, disruptive events are location-based. From sprinkler systems to biohazard containment, universities have facility plans for a range of potential emergencies. Teams of qualified facilities engineers and maintenance staff attend to the physical plant preparation for emergency. Figure II. Map of Knowledge Asset Vulnerability University Asset-based Continuity Planning Approach Information ResourcesHuman ResourcesPhysical ResourcesGAP: Non-equity partnerships are often not negotiated or documented in Univ SystemsGAP: Laboratories may have been customized to reflect improvements to scientific processes. GAP: Sponsored Projects linked inventory of space may overlook technical equi