Professional Monitor: In association with (ISC)2
Professional Monitor: In association with (ISC)2

Managing expectations and supporting employees during a period of organisational change can only enhance the ability to cope with the associated uncertainty. This is especially true when one company merges with another and the uncertainty may be prolonged and extreme, forcing production output to decrease while key staff look to opportunities elsewhere. The ability to address this – while seeking to merge teams of different operational and cultural backgrounds, policies, standards, procedures and systems providers – dictates the strength of the new operation. With companies generally seeking to integrate and/or standardise security operations across varied business and regional units, the tactics involved are broadly relevant.

Peter Drabwell, CISSP, assistant vice-president IT Risk with Credit Suisse and a member of the (ISC)2 European Advisory Board has been responsible for building several multi-national information security teams within the telecoms and banking sectors. Whatever the situation, he says; the results should foster improved communications, diplomacy and working practices.

“Having a clear strategy and ensuring that key people are on board at an early stage is essential. Even in a merger situation, in addition to legal challenges, substantial effort is invested in due diligence before anything is agreed, including gap analysis, identification of key systems, people, interactions and processes,” he says.

Drabwell advises taking advantage of the climate for change that is created. “Where two functional areas merge and their respective solutions for a particular area, are deemed inadequate, the opportunity to investigate a third way in a period where the appetite for change is expected is too good to miss.

“The same goes for team members and skill sets – in the midst of a merger, the opportunity to review employee capabilities and suitability, providing training in key areas where required, is high,” he adds, although he warns about the influence of dominant business units: “While it is inevitable the combination of redundant activities will be required, the acquiring firm must not take a preferential position at the risk of discarding considerable assets from other areas.”