What is our primary use case?
We use BPMN for process design. We check our processes. There is the start event, then there are the tasks and steps as well as risks on the steps and controls. In the end, there is a result event of the process. There is a hierarchy model through the processes themselves to locate, classify, and build a whole tree off of the complete process design. So, we try to get the complete process model in all the layers. It is not only about flow diagrams. You also need the hierarchy system in the process design to get an idea of which business area it is, which products we handle there, etc. This is to get some kind of a systematic approach to a wide area of the complete company, e.g., which services are delivered from whom and how it is organized.
We separated the fields. We had some kind of internal control system, which was one use case for us. We had risk management and how to get a picture up of the actual risk evaluation. We had the policy management separated. We started process management. This is all integrated on the technical side and the tools' side. We tried to get the different solutions out of the one system to see them as different solutions with different responsible people with different roles behind them.
It fits all together, so there are no completely loose ends, where there is one philosophy and one architecture behind it. We managed to get it a little bit separated, but it has good connection process management, internal control systems, and a risk system. It is very well-integrated.
We are using Connect and ARCM. ARCM is the ARIS governance, risk, and compliance module to do workflow-orientated stuff, e.g., how much is your risk.
Another use case is value chain processes. These are in a hierarchy built up through the company and our business use cases since we have export and capital market services. At the bottom, we decided to use only a business process model notation (BPMN), which made it possible for us to integrate on this flow chart. This integrates risks and controls directly on a flow chart, making it easier for non-super process experts to get an idea of the steps, controls, and risk as well as how this all fits together to get a good overview at the starting point when working with these processes.
How has it helped my organization?
In normal, day-to-day business, when a process is drawn, our expert team can review the processes, risks, and controls. They can do that completely themselves on a technical level. There is a review step from the process expert to her/his boss, then it is approved and published. After that, we use the risk evaluation and control execution using ARCM Risk and Compliance Manager, where they can do everything with the risk, e.g., how much is our risk? How much is the risk now? They evaluate that and do a controlled execution. We use the ARIS APG programming to get the approval and publication processes.
Now, we have a fully automatic-supported risk evaluation each quarter. I only need to take the results and put them together for the board's report. That is a big improvement.
The implementation of the completely decentralized process management, meaning that business departments can simply document their processes and flowcharts to improve their businesses, is now in one system. They have a list of business applications that are used within the process documentation, where there is one list of organizational departments interacting within this process. It has everything that we normally would want to have if we use an integrated process management system that works fine. Therefore, we have possibilities that we did not have before.
What is most valuable?
If you ever tried to draw a picture in a browser app or with a cloud service, it is normally a painful death. ARIS works perfectly on diagrams in the browser, so I was excited. I like it because there have been so many bad experiences in the past with drawing or doing something in a browser. Normally, it's always painful because it's coded badly. With ARIS, it is really well-implemented. It's simple.
We only get emails if something went wrong or the semantic checks are integrated, which means you can't publish it. If there is the smallest mistake in it, then you can't publish it at all. It is only allowed to get the symbols which are permitted. Therefore, everything is perfect on the technical side, and on the control side, no mistakes are published. You can check the deep semantic process. For example, if it does not make sense, but it is formally correct. If it's correct on the technical side, but it does not make sense when you have to read it. That is the human interaction that you need. However, what is technically possible is implemented to get good results.
What needs improvement?
I had this decentralization mission where I had some friendly fights with the consultants of Software AG. My opinion was the business department should be able to publish their processes and do all their evaluation stuff in ARCM themselves. It has to be a one stop shop. I want a one stop shop to go from ARIS BPM to ARIS ARCM, because having everything go through that would be an improvement due to the inputs that we made with Software AG. They will make it possible that the trigger sent from BPM to ARCM will start their object generation. Although, they did something in SR 16 for our business needs, and that was great.
The process needs to be straight-through. This means, if the process experts say, "Okay, I'm finished. I sent the process to my boss," and the boss says, "Okay, it's great. The documentation is right," and they can give approval. Then, the process experts can click on it, and five minutes later, they will get the risk for the evaluation. After that, the process expert says, "Okay, it has this and those risks. We could lose this amount." So, they send it again for approval back to the boss. The boss reviews whether the risk evaluation is right, then it is approved. Finally, it is finished in one hour (in a best case scenario). The yearly process documentation can then be completed without the action of any central process management board.
For how long have I used the solution?
We have been using it since Autumn 2020, which is about a full year now.
What do I think about the stability of the solution?
It is a stable product.
We did one upgrade throughout the project. Now, we want to wait until the end of the year for SR16.
There is almost zero maintenance to maintain its design from a central process management or risk management team standpoint. Decentralized business departments can do their jobs all by themselves. Sometimes, there are questions, like, "Can you help me? I'm lost. What am I doing here?" For example, if you have new bosses in new jobs, then they do not know what to do.
In 2020, we did a lot of presentations, videos, and training. They had to do these on the training systems to evaluate risks and processes. We knew if they did not do it themselves, then they would learn nothing. If they did it themselves, then it was possible to learn to work with new tools. So, the normal maintenance should be really low.
What do I think about the scalability of the solution?
We have a concurrent license system. We have about 80 persons in-house decentralized in all the business departments who received their training. We have a lot of information, material, and how-to videos to ultimately support them so they can do the processes themselves. It is completely decentralized. Once finished, they can send it to their boss to approve it, then it is published. We have a central expert team in process management, who cares about how ARIS should be used.
Because we use it within a concurrent license system, everyone within the group can read the publications of errors and do risk evaluation at the same time. We now have 15 to 30 people (out of 500) who can use it at the same time.
How are customer service and support?
The help desk of Software AG is great. We had some problems. This happens in projects, where you do something stupid, then it does not fit together. The data is not useful. You try to do some test cases and put something in the system to determine how it works. The support was always really professional. The software developers and help desk did a really good job. I am really a fan of Software AG because they are a very competent business partner.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
Before, we used Casewise from London for centralized process management. That was our old tool, which wasn't bad, but it was only for three heads in the central team. It limited us completely. Then, they were bought by erwin in New York, and erwin is on the data governance side. Casewise was now a small part of a big company and wasn't being developed or improved as ARIS is. Therefore, it was quickly clear to us that we would go with ARIS.
We started with the idea at our company in February 2019. We got in contact with Software AG around June 2019 to do some kind of proof of concept, learn about the design, the idea, and philosophy, e.g., how to solve such problems and how to get process management within a fully integrated tool.
Before, we had Excel lists and some types of Visio diagrams, which were put together based on the process description. That wasn't okay. We always had to do it on a central basis, take the documentation, work it through and give it back.
This solution was really an improvement on the efficiency of our process management, documentation for end-to-end development, business processes, and business departments, who complete freedom and empowerment to do it themselves. That was a big improvement.
Luckily, we had Software AG implement the ARIS Connect platform, the web-based platform, with this broad possibility to use it in a concurrent way. In 2017, that was what we wanted. We wanted the system to be used by the business experts and leaders in the business units in a decentralized manner.
How was the initial setup?
When you start the solution, you eliminate every useless variant that you do not need, then it is really simple. At the starting point, you need to learn how the philosophy of the solution works. You need to deal with the solution as if you are taking a normal car through the woods. You can't normally. You have to think, "Okay, what is it built for? How is this model designed?" You then need to get in contact with the design and philosophy. After that, you can do a good job. It is a big mistake to say, "No, they have to code everything around our old company stuff because we always did it that way. So, we need to stay with the old way." Then, you are lost and will never have any kind of success.
At the start of the project, we set up some testing and development implementation. It took us one to two weeks for our IT and Software AG's IT to get it up and running. Before we were productive, we had to edit the publication database as well as all the backups, restore processes, and all that stuff in a production environment. We also had to put brain power in it. That was for part one and two of the processes (installation and implementation), which both took one to two weeks. That was net five to 10 consultant days or IT expert days to get up this step in performance and excellence. The implementation was about two days.
What about the implementation team?
We put a lot of brain power and personnel power into the project. We also had consultants who supported us very well through the coronavirus pandemic. Therefore, we had the chance to implement it quickly.
Go with a consultant. In every solution, e.g., ARIS, there are a lot of consultants with experience over the years. Many companies bring in their experience to provide general solutions for general problems, since these problems are not individual to a company.
From the mid-2019 to Autumn of 2020, we always had support consultant days remotely or a consultant who visited us to develop the method as well as do all the processes and risk management stuff, which have to be customized.
We only worked with Software AG, who integrated the consultants, e.g., IDS software developers. They brought them to us because we needed to implement some improvements on the ARIS ARCM governance, risk, and compliance model. We did their multi-object handling, which means you can approve 20 risks with one click. So, it marks all the risks on the list as okay, pulls them through, and then they are finished, which we loved. There were also some user interface optimizations for mass objects.
What was our ROI?
We have seen ROI. The quality has improved enormously. You do not always get faster because if you want to improve quality, then you have to sit in, think about and work with it. Therefore, you need a good tool.
The management board really likes it because it is well-adopted by employees with no problems using it.
Which other solutions did I evaluate?
On our evaluation list, we also looked at Signavio Process Manager, but there were so many differences. They were millions of miles between ARIS and Signavio Process Manager. Therefore, we did not think about which tool to take. It was completely clear that we should get ARIS because it was the best solution for us.
What other advice do I have?
The process could be so simple. The question for the business units is always, "Okay, let's think about this." If the process is what we brought into ARIS, then how can we make it better? They shall use their brain and time to improve and think about their business. ARIS is only a tool. They should not be focused on, "Oh, how can I work with this tool? I'm so confused." Everything should not go into the tool. They should use their brain and energy to think about their business.
We are still developing our process management method. We are still using it, but we are also improving it to get it more integrated, have more detail, and have process management be more connected with our internal control system.
It was hard to do process management on a yearly cycle on an annual basis. It was helpful for us to have ARIS as a tool for this, but we also learned that it is a really complex job to do process management through the year on such a high quality level. You have to think about a lot of questions. These are all processes approved every year. All the stuff seen is, "Okay, I have to do that, and I have to do that. I have to check that they looked it through for the first half of the year. Then, they have to do the rest in the second half of the year." All this gets operationalized. With this tool, we now had process lists that we could deal with.
You need a clear aim to reach for and it should not be too big. You should separate it in some way. If you want to do more than one thing, then handle it as if you want to reach for aim one, two, and three. This makes it easier than doing big bang projects where you never get to an end.
Separate your aims and focus on them. For example, we started with different starting times. In September 2020, we started risk management. In November, we then started with the internal control systems. Step by step, we are now pulling our process management up. We are still improving on the methods.
This solution has been my baby the last three years, so I would rate it as 10 (out of 10) because I gave everything to make it the best.
Which deployment model are you using for this solution?
On-premises
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.