# data[].attributes.headline
Addressing the Challenges of a Remote Workforce

# data[].attributes.subject
Addressing the Challenges of a Remote Workforce

# data[].attributes.attachment_link.readable_text
More than half of all American workers worked remotely at the height of the COVID-19 pandemic, and many still are. This sudden shift caused difficulties ranging from over-stretched IT systems to communication challenges to employees struggling to work while homeschooling children.

If organizations want to maintain and/or create additional competitive advantage, It is vital to address these challenges. The immediate need is to help teams be effective during the temporary changes caused by COVID-19, but these issues must also be solved as more teams move toward remote work in the long term. During the first half of 2020, workers with the option to work from home were 33% less likely to lose their jobs than those who could not work remotely. And companies that supported remote work maintained better productivity and business continuity than those whose teams could not work from home.

In a recent report by Adam Ozimek, Chief Economist at Upwork, more than half of the managers surveyed said that they expect their workforce will be more remote in the future. The Indicator podcast from NPR recently interviewed Adam about his findings.

Remote work has been growing slowly over the past decade. But most managers do not have experience with it, and many processes and management tools aren't designed for remote teams. The sudden shift to remote work during the pandemic forced managers and teams to rapidly adopt very different ways of working.

Many managers reported that the remote work "experiment" has gone better than they expected, but their teams still struggle in several areas. The Upwork survey found that 30% of teams suffered from difficulties in communication, 30% felt reduced team cohesion, and 23% of teams were less organized. These issues make sense, because remote work takes away many of the informal human-to-human processes and communication channels that teams rely on when they work in the same office together.

How can HighGear help? Workflow automation is a superb tool for organizing work and streamlining communications, especially when it is difficult to use traditional techniques like physical whiteboards, face-to-face meetings, and informal conversations. A no-code platform like HighGear allows each team to quickly replicate their old casual processes into a cloud-based system that can be accessed from anywhere at any time. With those processes in place, status is easily visible, communications are much easier, and lost tasks are a thing of the past.

HighGear ensures that workers are accountable for and aware of their upcoming work so they can plan effectively. Awareness and accountability are always essential for high-performing teams, but they become even more essential in this period of rapid change, high stress, and never-ending communication obstacles.

# data[].attributes.attachment_link.title
Addressing the Challenges of a Remote Workforce

# data[].attributes.attachment_link.description
More than half of all American workers worked remotely at the height of the COVID-19 pandemic, and many still are. This sudden shift caused difficulties ranging from over-stretched IT systems to communication challenges to employees struggling to work while homeschooling children.

# data[].attributes.headline
How Swift Systems used HighGear to pass their audits

# data[].attributes.subject
How Swift Systems used HighGear to pass their audits

# data[].attributes.attachment_link.readable_text
When we first began to offer HighGear in the cloud, we also owned a data center operator, and managed services provider called Swift Systems. That team had built a robust set of compliance policies and controls originally based on the NIST 800-53 standards, with extra elements added across time to address additional standards and protocols such as DIACAP, PCI, and HIPAA. To verify that those extensive operational and security controls were properly implemented, an outside auditor conducted annual SSAE-16 Type II audits.
Technical teams and compliance experts must do a lot of work to define their policies and implement procedures to enforce those policies. But they often overlook the effort required to track activity and prove compliance, which makes the auditor's visit one of the most dreaded and painful experiences of the year. To avoid this pain, Swift Systems had to build a process management system that would track their IT work with less overhead, making it easier to prove compliance at audit time. Naturally, they turned to HighGear.

At the end of the first audit, the auditor reported "Our examination team was very impressed by the deployment of Swift's customer hardware and infrastructure in relation to their managed services, and particularly the functionality and reporting capabilities of the HighGear application. We felt that the attestation process was aided and simplified by the user-friendly nature of the system." Swift Systems' data center manager said "HighGear helped Swift Systems data center pass the SSAE-16 audit with flying colors. The fact that HighGear was the system of record was fundamental in allowing the auditor to easily identify and examine all change control requests for the past 12 months. I was able to pull that information up easily in a search, export it into a PDF quickly, and pass it off to the auditors. I can't even imagine how companies that don't have HighGear get through this process."

Here are some examples of policies that Swift Systems implemented and how they tracked compliance.

Backups

Reliable on-site and off-site backups are vital to ensure that customer data will not be lost in case of a server failure or natural disaster. Just as important is a reliable and fast system for restoring those backups when you need them. Disaster recovery experts commonly say that "if you haven't tested your restore process, you don't really have backups."

To ensure that backups were reliable and available, Swift Systems had automated backup scripts, email notifications about failures, and a monthly process to manually test the restore system. The restore test work was automatically assigned to an engineer each month by way of a HighGear recurring task. After they reviewed the backup logs and finished their restore tests they would record the evidence of their results in the task and close it.

During the audit process, the auditor would pick several random dates and request proof that the restore tests succeeded on those dates. Swift Systems easily opened the HighGear tasks that contained the restore tests and showed the results of the tests, to include a non-repudiated audit-trail showing the automatic assignment, the timely completion of the work (and by whom it was completed), and if called for the review and sign-off steps as well.

Electronic and physical access control

Because the data center contained sensitive data for HighGear and many other customers, Swift Systems had strict rules about which people were allowed access to the facility and the procedures for escorting authorized visitors.

Electronic access control was also vital, to ensure that attackers could not access the data center network or its management servers. Each administrator had a dedicated account on the management domain, and network devices like routers and switches had long, complex passwords that were stored in an access-controlled and encrypted password manager.

Each month a HighGear task instructed the Facility Security Officer to review the sign-in sheets and video recordings to ensure that they matched and that no unauthorized people had entered the facility. Another task required them to review the audit logs for the management domain and key infrastructure devices.

Because the results of each review task were required to be captured and recorded before the task was closed, it was easy for the auditor to review a complete report of all the review activities and zoom in to specific details as needed. Many companies find that this process requires hours of digging through paper or disparate electronic resources and files to prove compliance, or that they don't have the records needed to prove compliance at all. Using HighGear, Swift Systems was able to easily prove compliance with their review policies in minutes.

Change management

It is impossible to keep a production data center stable and secure if multiple people are making changes without coordination. A change management process is essential to ensure that various changes don't conflict with each other or introduce systemic problems. But if it takes too long to approve changes, the team's productivity will suffer.

To ensure thorough change control without unnecessary productivity loss, Swift Systems also used HighGear. Whenever a change was needed, an engineer would plan and document it properly, and then create a formal change request task in HighGear. A simple workflow would send the change request to the proper reviewers (configured to follow automated rules according to responsibility domains) and wait for the appropriate systems owners to approve the change, or request clarifications. If a request went unanswered, HighGear would send reminders to everyone before escalating it to the Facility Security Officer. Once the review process was complete and approvals were granted, the workflow would create an Engineering Work Order task and assign it to the original engineer. They could then complete the approved work, record their notes, and close the work order.

This simple workflow quickly routed and processed a high volume of changes every year, while keeping everyone aware of the status of requests and helping the team maintain high productivity. Some changes were flagged as risky or incomplete, and the iterative discussion and review process made them significantly safer when finally approved.

When the auditor asked for a report of changes made, there was no need to hunt through email archives or old documents. The team simply ran their change control report which listed every change with its requestor, description, and change date. The auditor selected a random sample for more analysis and was impressed by the level of detail recorded in each change. They were even able to use the HighGear audit trail to see which person approved each change, and how long they took to review it!

Vulnerability scanning

Even with the most careful change control and system engineering, undetected security issues can make a system vulnerable. A key tool for catching unknown issues is an automated vulnerability scan. Swift Systems had a quarterly HighGear process that assigned an engineer to run an enterprise-grade security scanner on all the servers in the data center. They then reviewed the results and created work orders to address any issues that were identified. Finally, they saved the scan reports, and any evidence needed to prove resolution, into the HighGear task itself and closed it.

Auditing these quarterly scans was easy, because they contained all the information about which servers had been scanned, who performed the scan, and the results of the scan and any remediation work completed.

Security incident reporting

Whether by good policy and practice, or extraordinary luck, Swift Systems never experienced any security incidents during the time we operated that company, nor while we remained their client after the sale. But even if you never need it, it is critical to have a clear process for reporting security incidents. Several email addresses were setup as receptacles for internal and external security, vulnerability, or abuse reports. These were routed through a triage and reporting process that assured that security and vulnerability reports were quickly routed to the right individuals or roles, and that abuse reports were routed to the team or role that "owned" the system the report was related to. While there were not any security reports that turned out to be real issues, being able to show an auditor that any possible issues had been tracked and triaged made getting through audits much faster. Numerous valid Abuse reports did come in, such as customers who were sending out spam, or customer owned BGP equipment that was incorrectly configured and sending bad data to other routers on the Internet, and likewise these reports flowed through that system generating traceable action reports and audit-ready records.

If you would like to explore how HighGear could help your team track work in a way that exceeds the needs of compliance and audit requirements of various types, please contact sales@highgear.com.

# data[].attributes.attachment_link.description
Technical teams and compliance experts must do a lot of work to define their policies and implement procedures to enforce those policies. But they often overlook the effort required to track activity and prove compliance, which makes the auditor's visit one of the most dreaded and painful experiences of the year.

# data[].attributes.headline
Easily integrate HighGear with other apps using Zapier

# data[].attributes.subject
Easily integrate HighGear with other apps using Zapier

# data[].attributes.attachment_link.readable_text
HighGear version 8.6 brings exciting new capabilities to business analysts that empower them to integrate HighGear with other systems more easily and in more sophisticated ways.

The first of these capabilities is a versatile new REST API. Representational State Transfer, or REST, is the industry standard best practice for web-based APIs and improves the integration experience over other approaches such as SOAP. Clients writing custom code to integrate their HighGear instance with other systems they use, such as an ERP system, will find REST easier to learn and simpler to work with. REST also has better support in a wider variety of languages and is a more prevalent software development skill.

In addition to the new REST API, HighGear 8.6 also deeply integrates with Zapier, a powerful, no-code cloud integration platform. As we planned our integration strategy, we want to support no-code integration for business analysts that need to quickly integrate their workflows with tools such as . Zapier provides this via a catalog of 2,000+ apps that can be chained together to create flexible and powerful integrations that can automate any aspect of your business process.

# data[].attributes.attachment_link.title
Use Zapier to easily integrate other apps into your workflow!

# data[].attributes.attachment_link.description
HighGear version 8.6 brings exciting new capabilities to business analysts that empower them to integrate HighGear with other systems more easily and in more sophisticated ways. The first of these capabilities is a versatile new REST API. Representational State Transfer, or REST, is the industry standard best practice for web-based APIs and improves the integration experience over other approaches such as SOAP.

# data[].attributes.headline
Crossing the digital transformation divide: overcoming embedded manual processes

# data[].attributes.subject
Crossing the digital transformation divide: overcoming embedded manual processes

# data[].attributes.attachment_link.readable_text
At your place of work, does it feel like your workflow processes are working for you, or are you working for them? If workflows require extra steps because of counter-intuitive manual systems, then the answer might be that you are working for your processes, not the other way around.

The extreme example of someone working for a broken manual process, rather than the process working for them, is an employee whose entire job is what many in the business world call 'duct-taping'. A duct-taper's job is to perform tasks (think reminding people to send a report or routing work around the office or setting up a call for a manager and an upset client) that make a broken system work. These tasks are also known as 'workarounds'.

These workarounds are normally meant as a temporary solution to a broken process. They're only supposed to exist until the company finds a better solution. However, solutions often never come to fruition and employees start spending a whole lot of effort on something that could be fixed by simply switching to a different system.

With a simple switch, a duct-taper's entire job could be elevated to more productive tasks and projects that ideally give them a higher sense of job satisfaction and dramatically increase their value and contribution to the team.

The typical culprits and how they stick

The types of broken processes that unnecessarily drain our time include things like routing work from person A to person B, reminding people to send status updates, escalating task X if event Y happens, assuring that all of account X's work is taken care of by employee Y, and other processes that should and could happen automatically.

In our custom Forrester study that we commissioned in May 2020, 80% of business analysts and managers say they spend too much time on manual processes. With such a high number claiming this issue, it begs the question, 'how did this happen?' You'd think that in 2020, with the infinite number of SaaS products, CRMs, ERPs, and other systems that we would have collectively graduated from manual processes, but the opposite is true.

Maybe the problem is that business processes are too sticky. Even if something is extremely inefficient, businesses will stick with it as long as it 'works'. It's like forming a bad habit that you can't kick, even if you know there is a much easier way.

It's easy for managers to ignore these kinds of problems. They may seem not very urgent, but over time, the amount of effort and money wasted on inefficient systems will add up to a glaring amount. If that dollar amount of wasted money was printed in large red font on quarterly reports, things would be different, but in most organizations it is likely unknown or at least not given much thought.

Critical information ends up siloed and unsecured

The problem with manual processes is not just that they waste time compared to automated workflows or more efficient processes. There is also the problem of data sharing and security.

Excel spreadsheets are one of the best examples of where not to store critical information. According to our custom Forrester report, 77% of teams manage critical information in spreadsheets. In most cases, spreadsheets must be emailed back and forth to be shared. Information cannot be looked up and exists in a silo of an individual's hard drive. They're also often not backed up or password protected, leaving them open for leakage and loss.

Lack of version control is another common issue that leads to critical information loss. Our study showed that 78% of teams lose critical information due to lack of version control in files and reports. Even with online systems like Microsoft Office 365, many users don't have version control turned on nor do they know how to use it. If they do use it, reverting to an older version doesn't paint the full picture of exactly what was changed or lost.

Manual processes are ripe for human error. Companies can't depend on processes that are purely stored in people's heads. When people leave a company, go on vacation, or get busy with other work, these processes start to fall apart. Also, when a company grows and the demand increases, these manual processes do not scale efficiently. These are problems that technology has already solved. In fact, software/SaaS systems solved these problems years ago. So why are so many companies still dealing with them?

New tools aren't always the right tools

Another very telling response we got from our study was that 67% of analysts and managers have the tools for digital transformation but they are too challenging to implement. This is one of the main reasons why companies get stuck with embedded manual processes to begin with.

You can't solve a problem with a new tool if it isn't the right tool. You'll either only solve a part of the problem or create an entirely new problem by using the wrong tool. Either way, you'll likely end up with more manual processes (workarounds) until you deploy a tool that can easily help your team get 100% of the job done within the system.

This problem is rarely overcome by just forcing employees to implement systems that don't really address their needs. A better way is to enable them to create their own systems. But how does an employee create their own automated workflows if they aren't a software developer? The answer: No-code application platforms.

No-code platforms allow employees, managers, or business owners to create the exact processes, forms, and other tools they need without doing any coding. By designing their own forms, workflows, dashboards, and lists, they get it right from the start without the need for workarounds or other 'fill in the gap' measures. This both increases the value of the system and avoids the risk of manual processes being created to fill those leftover gaps.
In our next article, we'll go deeper into how no-code platforms can help businesses make their processes work for them, instead of the other way around.

# data[].attributes.attachment_link.title
Crossing the digital transformation divide: overcoming embedded manual processes

# data[].attributes.attachment_link.description
At your place of work, does it feel like your workflow processes are working for you, or are you working for them? If workflows require extra steps because of counter-intuitive manual systems, then the answer might be that you are working for your processes, not the other way around.

# data[].attributes.headline
Crossing the digital transformation divide: building the right tools with no-code platforms

# data[].attributes.subject
Crossing the digital transformation divide: building the right tools with no-code platforms

# data[].attributes.attachment_link.readable_text
In our last article we talked about how manual processes can become embedded in an organization, causing huge yet unseen losses through wasted time and energy. In this article we'll talk about how to fix all of that by enabling people to build the right tools on their own.

In our custom commissioned study from Forrester, we discovered that 67% of analysts and managers have tools that are supposed to help them manage their workflows, but they're too hard to get started with. If these tools were actually the right tools for the job, it would not be challenging for a company's embedded innovators to get started with them, especially because they're motivated by how much time and effort these manual processes are costing them.

The right solution does not require coding

Programmers are not usually the ones doing the work they're programming software for, and that disconnect can often leave gaps in software functionality. There is no way a software company can know exactly what fields, forms, and workflows their customers will need. Even if the vendor provides the ability to configure the software, it usually is only 'configurable' up to a certain point. Often, the lack of configurability leads end-users to a roadblock that forces them back into 'workarounds' or manual processes.

Put yourself in the shoes of a small business administrator. Your business has a unique market, unique customers, specific regulatory requirements, and a specific internal process for getting things done. These processes have grown organically along with the business. As the administrator, you've got this process nailed down. However, with all of the floating requirements, there is no one software system that can address 100% of your workflow. You have to skip back and forth between multiple systems, spreadsheets, emails, and maybe even paper to execute your unique process. Imagine if you could take everything that you've nailed down to perfection over the years and put it all into one simple system that you could design and continuously enhance yourself. You would easily be able to eliminate manual processes and likely get rid of the need for multiple systems. That is the power that a good no-code platform provides. It puts the power of process improvement directly into the hands of the person who owns the process.

Software doesn't have to be complicated

When you break down a software solution into its component parts, it's really not all that complicated. Maybe if you're looking at the code it is but looking at it differently makes it much simpler. When you're building the software in a way that allows you to build it from its core parts (instead of code), you gain the power to easily create something that works for your needs, no coding required. This is a new model that is all about the end user who knows the job and the best way to execute it. This is putting the power in the user's hands to build the system they want, instead of buying one that is almost what they need, but not quite (or buying multiple systems where one should be able to work).

If you can draw workflows out on paper, you can create them in a no-code workflow platform. You never needed to be a programmer to perform your workflow. With no-code platforms, you also don't need to be a programmer to automate your workflow.

Kick starting your digital transformation

Going back to our study, it found that 67% of analysts and managers are holding back on their digital transformation because the tools they have are too hard to get started with. There is no good reason digital tools should make things more complicated, especially if the alternative is to easily design them yourself.

What people need to kick start digital transformation is having the right tools for rapidly defining and digitizing their processes, their way. They need something that works for them, not something they work for. In the past, this was an incredibly challenging process that could take years of custom development from software companies. But that is no longer the case.

No-code application platforms offer a clear path to overcoming the hurdles of digital transformation. They are the keys that can unlock better productivity and the elimination of slow, disjointed, and painful processes that many companies are unfortunately used to dealing with. Of course, making the switch to digital transformation takes resources.

In our next article, we'll show how no-code platforms actually help you free up more resources for creating organizational change.

# data[].attributes.attachment_link.title
Crossing the digital transformation divide: Building the Right Tools with No-Code Platforms

# data[].attributes.attachment_link.description
In our custom commissioned study from Forrester, we discovered that 67% of analysts and managers have tools that are supposed to help them manage their workflows, but they're too hard to get started with.

# data[].attributes.headline
Crossing the digital transformation divide: freeing up resources to make organizational change

# data[].attributes.subject
Crossing the digital transformation divide: freeing up resources to make organizational change

# data[].attributes.attachment_link.readable_text
When you ask the question, 'what is stopping digital transformation at my company?', you might be surprised by the answer. In many cases, it is those who are supposed to provide the 'resources' that are actually stopping progress from happening.

In our commissioned study from Forrester, we found some interesting facts around this topic. Business Analysts and managers were asked about obstacles that stop them from automating processes, here's what they said:

77%: resources for me to automate processes are unavailable
74%: help from my technical colleagues is not available
74%: training for me to automate processes is unavailable

Who's to blame for all of this?

What is really stopping digital transformation from moving forward? Often, you'll find that the resources that are designed to help are actually hurting. When you look at those survey answers, you can find a few 'culprits' to blame for holding these analysts and managers back.

The first culprit is the lack of technical help. You see that 74% said that help from technical colleagues is not available. However, this is not usually the fault of IT departments, in-house developers, or others whose job it is to provide technical help. They are often understaffed and overextended from managing the myriad of applications and data requirements they have. Even if analysts and managers have tools, they could technically use to automate workflow processes, the lack of availability from technical teams stops them from getting off the ground.

The lack of technical help and training that our survey respondents claim leads us to another question. Why did they need so much technical help to begin with? For that, the most logical place to look is within the systems and software that they have been asked to use.

Many Business Process Management (BPM) suites are not all that easy to set up, use, or maintain. They have complex requirements and configuring them often requires expert help. Essentially, to use them requires a good amount of help from IT and making changes to them almost always requires waiting in line for the experts. If the experts aren't available then using those systems is not going to be easy or even all that productive.

Simpler systems, such as task management apps, may not require so much technical help. They can be cloud-based and have quick and easy setup. However, with many of these systems the full-fledged functionality to truly capture a complex workflow is just not there. So, for many businesses, the trade-off is between impossible to manage systems that might work (if they could get the help they need), or easy to manage systems that don't do everything they need.

What if we were able to meet our needs without technical help?

No-code programming platforms offer the perfect solution for the ~75% of analysts and managers who cannot automate their process due to lack of resources. With the simple drag and drop creation of the fields, forms, and workflows that they need, the people who understand their processes best can now automate them with no outside help.

No-code solutions free up resources for digital transformation simply because less specialized resources are needed to make things happen. When end users can set up their own workflow automation, they no longer have to burden their software developers and IT departments.

Eliminating barriers, freeing up resources, without creating risk

By eliminating the barriers that stop businesses from automating their workflows, we free up resources at the same time. The reason for this is simple: It's the reliance on technical help to use challenging or unsatisfactory software programs that ate up those resources to begin with.

No-code platforms essentially cut out the resource drain on application development and IT experts by putting the power in the hands of the end users, without creating the risks typically associated with self-service innovation. In HighGear, end users are not creating risky standalone applications, instead they are configuring new managed pathways for work to flow through HighGear's existing platform.

Because building workflows in HighGear is 100% visual, later enhancements, changes or corrections are done visually as well, typically by someone else in the same team. HighGear's approach significantly reduces the incidence of "solution boomerang", where end users build unmanaged and siloed solutions in generic no-code app generators, causing the maintenance and support of these applications to bounce back to IT. To make matters worse, the busy IT professionals usually lack the benefit of subject matter expertise, documentation or visual diagrams, especially after employee turnover.

If your business is finding itself stuck with unproductive, disjointed, or manual processes, switching to no-code solutions will empower your teams to create new and better processes without the hiccups and roadblocks that typically come with implementing a new system.

# data[].attributes.attachment_link.title
Crossing the digital transformation divide: Freeing up Resources to make Organizational Change

# data[].attributes.attachment_link.description
When you ask the question, 'what is stopping digital transformation at my company?', you might be surprised by the answer. In many cases, it is those who are supposed to provide the 'resources' that are actually stopping progress from happening.

# data[].attributes.headline
Are you discriminating against your digital workers?

# data[].attributes.subject
Are you discriminating against your digital workers?

# data[].attributes.attachment_link.readable_text
Robotic Process Automation (RPA) bots are ignored both when they make a mistake and when they get it right. That's leading to some major problems for businesses that rely on them.
Many businesses have come to rely on Robotic Process Automation (RPA) 'bots' to automate repetitive tasks, but not all of those businesses have thought things through.

RPAs are essentially the modern version of 'send keys' where you can program the computer to hit certain keys in succession to execute a task over and over again. The difference is that RPAs are web enabled, can do more complex actions, and can use machine learning to do it better. They work great for high volume tasks that would normally take too much of an employee's time. Popular RPAs include Microsoft's Power Automate and UiPath.

Not as simple as 'set it and forget it'

RPAs are specifically programmed to do a task the same way over and over, which is great, but that's also where things can go wrong. What if even the slightest change happens to the environment in which the RPA is working in? That could mean someone adding a row to a spreadsheet, using a different field name, or even changes that happen automatically as part of a software update.

Sometimes a change won't affect the RPA, but if it does it can throw the entire thing completely off. If things are off even a hair, the RPA could be 'fetching' the wrong piece of data or confirming whether or not work is complete based on the wrong field.

Worse, these mistakes are often missed for weeks before someone catches them. Sometimes it takes a client saying something like, "what happened to those financial reports my department was getting? It's been 3 weeks since we've seen one, and I just found out that we've blown our budget" for a business to notice the RPA is silently failing.

Stop ignoring your invisible robots

RPAs need to be managed like an employee. They should be checked on to make sure they're doing a 'good job'. Otherwise, they will keep making the same mistakes over and over again.

But why do these mistakes often get ignored for so long? With typical RPAs, you can set 'expectations' on what result you will receive. Imagine something like a valid range. If something is outside of this valid range, the RPA automatically sends an 'exception report' to a pre-set user.

So, what's the problem? The problem is that these exception reports are sent by email, usually to someone who manages the application rather than works in it. As we all know, emails are extremely easy to ignore, especially when we get 50-100 of them each day.

Think of your IT person's email inbox. It probably contains endless help desk tickets, back and forth emails, and notifications from various apps. It's extremely easy for an exception report to get lost in the noise, allowing the errors to keep repeating for weeks until someone notices them.

Even worse, in some cases the RPA thinks it has completed successfully and sends no error message at all. This can occur when pressing the tab key three times used to take you to a field with a check amount, and the RPA was to report the check amounts larger than $5,000, but now pressing the tab key three times takes you to the field that recorded the time the payment came in. Because that number will never be higher than $5,000 and there will be a number in the field, the RPA will never escalate the work or report an error. This is where you never find out about the problem until it grows big enough to get noticed by a human.

RPA "Control Towers" are not the answer

Many RPA vendors offer "Control Tower" technology that lets an IT professional monitor the activity of numerous RPA bots from a central location. These provide an excellent mechanism for discovering when an RPA has simply "crashed" or is signaling errors. This is significantly better than just sending out an email and hoping someone reads it, but it still assumes that the RPA bot is aware that it's having a problem.

As we mentioned in the last example, if the bot thinks it's doing just fine, so will the control tower. Additionally, the vendor control towers only support that same vendor's RPA bots. In the real world, most enterprise organizations end up deploying multiple RPA technologies. That's why you need a solution that can interact with bots that have "different personalities".

HighGear lets you manage RPAs just like they were a human employee

At HighGear, we firmly believe that you cannot just turn on your RPA and then ignore it while it 'works'. That's why we've built tools to connect with and manage RPAs as if they were another one of your employees.

HighGear watches the RPA to make sure it's doing the work correctly. RPA bots are assigned a task either through HighGear or through integration. HighGear then tracks the task's status, and if a corrective action becomes necessary, HighGear will automatically route the task to a human or team and send them an alert.

Instead of just getting an exception report in an email, HighGear keeps a running list of exceptions that can be actively managed and routed by specialists. You can also watch exceptions over time to find patterns and common mistakes and build new ways of solving them.

One of the nice things about this is that it's all color coded in an easy-to-use dashboard. The dashboard acts as a central hub to manage all your RPAs, regardless of which RPA vendor(s) you are working with. Finally, you can congratulate your digital workers for the all the green 'task completed successfully' boxes and quickly take corrective action on all of the red 'bot failed' boxes.

# data[].attributes.attachment_link.title
Are you discriminating against your digital workers?

# data[].attributes.attachment_link.description
Robotic Process Automation (RPA) bots are ignored both when they make a mistake and when they get it right. That's leading to some major problems for businesses that rely on them. Many businesses have come to rely on Robotic Process Automation (RPA) 'bots' to automate repetitive tasks, but not all of those businesses have thought things through.

# data[].attributes.headline
Security Process for Open Source Components

# data[].attributes.subject
Security Process for Open Source Components

# data[].attributes.attachment_link.readable_text
Free and open-source software (FOSS) is software that is distributed with a license that allows users to run the software for any purpose as well as to study, change, and distribute it freely. Often, a particular piece of software is available open-source at no cost, but the company that maintains it charges a fee for support or for more advanced features that are not open-source.

Some FOSS is a complete application that can be installed and run on its own. But many sub-components are released as FOSS, and are embedded in other applications. For example, many web applications use a framework like AngularJS to streamline their user interface code, or a database like PostgreSQL to store their users' data.

Using FOSS components can accelerate the development of new products, and can also make software more secure and robust by increasing the number of people contributing to each component. In fact, the foundations of the Internet are built on open-source software and standards!

How HighGear Uses FOSS

At HighGear we use third-party components (both closed-source and open-source) frequently but judiciously. If we can create better functionality or an easier user experience by writing everything ourselves, we do that. HighGear uses many well-known open technologies, like React, C#, and CKeditor, as well as smaller components that fill specific needs. We choose our tools and components (whether FOSS or commercial) based on many factors, including security, reliability, quality, performance, and the trustworthiness of the teams that maintain them. When we find a tool or component that lets us deliver value to our customers faster, we are happy to do that.

We also contribute improvements back to the FOSS components we use. That is one of the great strengths of open-source software: when one user fixes a problem or adds a feature, all other users can take advantage of that improvement.

The Risks of Using FOSS

As you can see, FOSS has many benefits for HighGear and its users. But there are some risks that must be carefully managed. The most well-known is the "viral license". Many FOSS components use the GNU GPL or a similar license that require all users of the software to release all of their own source code under the same FOSS license. One well-known example is Tesla, who have been forced to release the source code for some parts of their autopilot systems. As a commercial product, HighGear must be careful to comply with the license terms of every dependency we rely on. This is also important to our customers, who want to be sure that we won't be entangled in a lawsuit over license violations.

All software includes a risk of security vulnerabilities. In some ways FOSS is safer than closed-source software, because more people can review the code and fix problems. But on the other hand, it is easier for attackers to find vulnerabilities in open-source software, because they can simply read the source code and look for problems. Overall, it seems that closed-source software and FOSS have roughly the same risk of security issues.

A risk that is unique to smaller FOSS projects is that of the malicious maintainer. Commercial software providers and large FOSS organizations have the resources and the incentive to vet their employees/contributors before allowing them to write code. But smaller FOSS projects are often resource-constrained and happy to accept help from anyone who offers it. This has led to a number of cases where an attacker gained the trust of a small but widely-used FOSS project and then quietly inserted malicious code into that project. In one example, a commonly-used component called "event-stream" was modified to secretly steal users' Bitcoin wallets when they logged in to an app called Copay. Thankfully, the attack was detected before it could be targeted at any other applications that used the component.

A final factor that makes all of these risks harder to manage is the way that many FOSS projects depend on other projects, which in turn have their own dependencies. This means that using one FOSS component can cause tens or hundreds of unexpected software modules to be downloaded. This makes it difficult to keep track of all the licenses, security patches, and maintainers that are involved in a product's codebase.

How HighGear Mitigates the Risks of FOSS

The foundation of our risk mitigation plan is automated dependency management and auditing. We use Sonatype Nexus to monitor all our dependencies, enforce our policies, and scan for security vulnerabilities. To enable us to verify that our software complies with our legal and security policies, Sonatype traces the dependencies we rely on and produces a Bill of Materials (BOM) report. This report lists every component used anywhere in HighGear's dependency graph, no matter how small.

To ensure that we don't accidentally use a component that carries a viral license, our management team maintains a list of approved FOSS licenses. This list is used to validate each new component that we consider adding to our software, as well as any components they depend on (and things those dependencies depend on, and so forth), and it is also used to set policies in Sonatype.

In addition to security vulnerabilities listed in the National Vulnerability Database published by NIST, Sonatype's Release Integrity system also uses AI and ML to automatically block dependency attacks relying on malicious code injection. This system allows us to detect and block security problems even before the vulnerabilities are published.

If any component or dependency is found to have a non-approved license or a security vulnerability, an alert is immediately raised and the HighGear software cannot be released until it is resolved. Sometimes the resolution is as simple as installing a new patch with a security fix. In other cases a fix is not yet available, and we must find a way to mitigate the problem until a fix is released. If the problem remains un-fixed, we may submit a fix back to the component's maintainers ourselves, or replace the vulnerable component with a different package that is not vulnerable.

It is not enough to react to problems after they occur. To proactively avoid problems, our product management team also reviews all new FOSS components that are suggested to be added to HighGear. We consider the component's value proposition, license, history, activity level, the background of its maintainers, and its compatibility with our existing technical stack. Only components that show clear benefits and low risk are used in HighGear.

What is Next?

The security and reliability of FOSS software has been a top concern for IT departments and business leaders for 15+ years, but their concerns focused on the visible software: operating systems, office suites, etc. The security of the components hidden inside purchased software has been mostly ignored until recently. Fortunately, many vendors saw this emerging need and have built Software Composition Analysis and Open Source Governance products that are now mature and widely available. We expect that like HighGear, other software vendors will begin to use these products in conjunction with defined policies and processes to mitigate the risks of their FOSS dependencies. As this practice spreads the result will be increased security and trust, which is essential for the software industry and its customers.

Conclusion

FOSS is an essential part of the modern technical landscape, but it also carries risks that are not fully mitigated by traditional security policies. At HighGear we have implemented policies, processes, and automation to mitigate those risks. Our customers expect us to provide a trustworthy enterprise-grade solution, and we will deliver that. Do you have any questions about our processes? Suggestions about how we can make it even better? Please comment below.

# data[].attributes.attachment_link.title
Security Process for Open Source Components | HighGear

# data[].attributes.attachment_link.description
What is FOSS? Free and open-source software (FOSS) is software that is distributed with a license that allows users to run the software for any purpose as well as to study, change, and distribute it freely.

# data[].attributes.attachment_link.readable_text
Most of us know about broken processes because we've lived them. It doesn't feel good to fill out that extra form with the same information you already put in the last form or wait 8 days for approval from someone on vacation...but beyond annoyance, what do these broken processes cost?
To answer this question, we're going to borrow a term from the construction industry.

The 'soft costs' of doing business

In construction, costs are divided into two categories: soft costs and hard costs. Hard costs are the costs of actually getting the work done, mainly labor and materials.

Soft costs are considered indirect costs that don't go towards getting the work done but are necessary anyways. This can include insurance premiums, legal fees, and other 'extra' costs that get tallied onto the project.

If you were to break down the costs of conducting your business into hard costs and soft costs, how would you do it?

For most companies, hard costs would be the work that goes into creating and delivering products and services to customers (what they get paid for). Soft costs would cover administrative tasks, project management, human resource management, and other 'extra' costs that are necessary to conduct business but don't go directly towards delivering products or services.

Essentially, the soft costs support the hard costs so that business can run smoothly. But what happens when the soft costs start getting out of control?

When soft costs increase, hard costs increase too

When soft cost processes become broken, slow, or just plain dysfunctional, it affects hard costs too. For example, if you're a sales rep and you have to manually remind your manager to approve quotes 9 times a day, it's going to reduce your ability to actually sell products and services. Through workflow automation, companies can improve ROI on hard costs by removing bottlenecks that stem from repetitive work that raise soft costs.

Some examples of the soft costs of broken processes include:

Reduced productivity from time spent doing things in a harder than necessary way.

Time wasted in meetings talking about what went wrong yesterday, trying to figure out whether we took care of the thing that went wrong the day before, making plans to regain customer confidence, or trying to assign blame when people fall into the traps created by broken processes.

Overly frequent check-ins as broken processes often lack the automation and transparency to ensure that people know whether or not things are getting done.

Just like in the sales rep example, all of these broken processes lead to more time and energy being spent in areas that don't directly contribute to product/service delivery, customer satisfaction, and profits. The downward spiral continues as broken processes create more dissatisfied customers, leading to more time spent dealing with support issues and further decreases in sales.

Of course, soft costs are necessary and will never go away, but they can be reduced by improving processes.

Reducing soft costs with no-code workflow automation

Processes don't break so much as they break down. Often, they deteriorate over time as workarounds become permanent or people give up trying to fight the system and improve. It's also common for 'outdated' processes like relying on spreadsheets and paper-based systems to outlast their useful years simply out of habit.

The people who are best equipped to fix these processes are the people who execute them every day, that is if they believe they also have the power to fix them. This is the beauty of no-code workflow automation software like HighGear. In HighGear, employees can become 'citizen developers' and create workflows to do things the way they should be done. HighGear's workflow software empowers employees to create and own processes that drive their organizations forward.

With easy-to-use tools for creating custom fields, workflows, forms, tasks, reports, and more, the people who do the work can finally design how the work gets done, no coding required. This also includes time-savers like automatically 'routing work' for approvals and check-ins and reminding process contributors of what's waiting for them, making the status of tasks and projects visible in real-time, and other productivity boosting tools that reduce the amount of time spent on 'soft cost' activities - all of which produce significant ROI.

Get buy-in by showing off the ROI

Sometimes, an organization's digital transformation agents face an uphill battle when it comes to reducing soft costs. It can be hard to convince people to change entrenched processes especially with IT professionals in short supply, but with HighGear, a strong business case can be made.

When presenting HighGear to your organization, it's easy to make a case for the investment by showing off the high ROI you get from reducing the soft costs that have been holding you back for far too long.

# data[].attributes.attachment_link.description
When soft cost processes become broken, slow, or just plain dysfunctional, it affects hard costs too. For example, if you're a sales rep and you have to manually remind your manager to approve quotes 9 times a day, it's going to reduce your ability to actually sell products and services.

# data[].attributes.headline
How Financial Services Companies Can Overcome Their Unique Digital Struggles

# data[].attributes.subject
How Financial Services Companies Can Overcome Their Unique Digital Struggles

# data[].attributes.attachment_link.readable_text
Financial services firms deal with certain issues and demands more than nearly any other industry. While these pressures come from a place of regulating and watchdogging for the public good, they can lead to struggles and anxieties when simply trying to conduct business.

Some of the most daunting difficulties the financial services industry faces includes:

Constantly changing demands

Competitive pressures

Large numbers of transactions

Heavy audit requirements

Complying with these requirements while rising to meet the demands and competitive pressures often pushes financial services companies into a hodgepodge of home-grown or half-baked 'solutions' that can leave everyone involved feeling overwhelmed. After decades of trying to keep up with new demands, a typical firm's solution stack may now include multiple sets of manual processes, databases, and spreadsheets for the same work - with no standardization or automation for thousands of repeatable tasks.

As digital transformation races forward for the financial services industry, it is no surprise that efficiency and productivity are the main focus. According to a recent Forrester Survey, 75% of financial services companies report 'Increasing efficiency and productivity through technology' as a driver for digital transformation, making it number one out of all survey responses.

From our experience helping financial services companies address efficiency and productivity demands through digital transformation, we've identified common struggles these companies face.

'Big Bang' transformations that blow up in a company's face

The financial services world is full of many different business processes that 'emerge' as the need to meet a new demand or requirement arises. These processes are largely unplanned and gradually roll out over time, leading to the 'hodgepodge' of processes and solutions we spoke of earlier. One way many ambitious IT leaders seek to overcome this issue is to create a 'Big Bang' solution for everything.

A Big Bang solution seeks to blow up every process a company has in the hopes of starting from a more efficient square one. While a great idea in theory, this usually ends up being too big of a bang, resulting in a 'big boom' instead. The combination of employee pushback to new processes, too much simultaneous change, and the huge implementation costs involved often leads to months or years of wasted time as resources get spent trying to rebuild everything into something that often doesn't work.

Projects this large are 'too big to fail', so the problem evolves as more time and resources are poured in to address the fallout from the big boom.

New solutions don't play well with old friends

Financial services companies operate in 'non-homogenous' environments, meaning that there are many different systems used for different processes. Some of these legacy systems are extremely outdated and exist in tight data siloes. This makes it exceptionally difficult for new systems to integrate and interoperate with them - often leading to situations where data sharing is next to impossible.

With new systems hamstrung by the inability to access the data they need, business functionality suffers, and the progress of digital transformation is delayed. In many of these situations we see business users sticking with obsolete platforms - even when newer more modern technology is available.

Over-dependence on IT

With this overwhelming mix of business processes scattered across different systems, it's harder than it should be to fix problems. Because of this, and the high degree of process auditability required in this industry, financial service employees cannot fix many issues on their own, so they rely on IT, who is usually terribly busy.

The dependence on IT to fix and maintain a large mixture of legacy systems leads to a 'you WILL wait' reality when it comes to solving issues identified as pressing by corporate business users. IT is often simply overloaded with a long list of help desk tickets, maintenance issues, and highly prioritized customer-facing requirements. It's easy for them to lose sight of solving important internal business problems, that matter to the bottom line, as they arrange their own overwhelmed lists and customer-facing priorities ahead of internal process improvement requests.

The three keys to building better financial services systems

When attempting to overcome the many pressures and demands put on their systems, financial services companies can focus on three key areas for success: autonomy, auditing, agility.

Auditing: In order to meet heavy audit pressures and regulations, incredibly high standards must be ensured for any new business process. This includes practices like permanent, unchangeable audit trails and detailed transaction histories.

Agility: The problem with many legacy financial service systems is their inability to quickly adapt to change. Successful systems need to support quick modifications and deliver adaptable and changeable processes - giving organizations the ability to both plan and react.

Autonomy: Applications should give business users the power they need to solve problems as they arise. This includes solving issues that they would have turned over to IT to solve in legacy systems.

HighGear offers the leaders of financial services organizations the technology they need to decentralize solving business problems without sacrificing auditing and security or placing an additional burden on IT. This puts power into the hands of the business user, giving them more autonomy and agility while still maintaining the highest standard of auditing.

Financial services companies use HighGear to create workflow related digital transformation solutions that overcome the pitfalls of legacy systems and build upon these three keys to success.

Moving from manual systems to automation for thousands of recurring tasks

A global investment management firm deployed HighGear across their entire organization. Before HighGear, they relied on spreadsheets, emails, and even post-it notes to capture data for thousands of recurring tasks including client reports, RFPs, regulatory processes, onboarding new clients, setting up new funds, internal audits, and other document and report generation tasks.

Using HighGear, they automated the processes around paydown from compliance-heavy investment funds. Reporting, auditing and regulatory compliance, and massive checklists were all automated to streamline this constantly changing process.

This automation enabled them to monitor, capture, and analyze all the data they needed for these engagements - drastically speeding up the process. They were also able to centralize client facing work under HighGear. Now, 80% of their workforce uses HighGear to manage their work and automate workflows.

Autonomy Unleashed: Streamlining a global investment operation

One of the world's largest hedge fund managers employed HighGear's no-code visual workflow designer to empower non-technical users to define their own business processes without IT involvement. They were able to get completely out of spreadsheets and optimize 1,500 daily repeatable tasks that were previously distributed amongst several legacy systems, including spreadsheets and email.

Initially, they focused on daily audits and reconciliation to quickly develop and deploy an effective solution. Then they streamlined their ability to prove compliance with internal operating procedures and complex financial industry regulations using HighGear's non-repudiable audit trail.

In the end, they merged three separate lines of business into a single shared services team and consolidated three sets of processes, databases, and spreadsheets under one system. Non-IT staff within the business unit made all of these changes themselves.
To learn more about the impact HighGear had on streamlining their digital transformation, see our Case Study, 'Streamlining Global Investment Operations with No-Code Workflow Automation'.

# data[].attributes.attachment_link.title
How Financial Services Companies Can Overcome Their Unique Digital Struggles

# data[].attributes.attachment_link.description
The financial services world is full of many different business processes that 'emerge' as the need to meet a new demand or requirement arises. These processes are largely unplanned and gradually roll out over time, leading to the 'hodgepodge' of processes and solutions we spoke of earlier.