Operating Model Transformation and Change Management

Introduction

Investment banking operations are being reshaped by regulation, digitisation, market fragmentation, cost pressure and rising client expectations. Activities that were once performed by locally organised teams are increasingly delivered through global process platforms, shared services, specialist utilities, cloud technologies and managed service providers. Transformation is therefore not simply an information-technology project. It is a redesign of how an institution creates value, controls risk, allocates accountability and serves clients.

An operating model describes the way an organisation combines people, processes, technology, data, governance and external providers to execute its strategy. Operating model transformation is the deliberate movement from a current state to a more effective target state. Change management is the structured process through which people, behaviours, roles and organisational capabilities are aligned with that target state.

In investment banking, transformation must preserve market integrity, client service, regulatory compliance, operational resilience and control effectiveness. A cheaper process is not necessarily a better process if it creates settlement failures, weakens surveillance or increases conduct risk.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the components and design principles of an investment banking operating model.
2. Diagnose process, control, technology and organisational weaknesses.
3. Apply process reengineering, Lean methods, shared services, outsourcing and utility models.
4. Construct a transformation business case and implementation roadmap.
5. Design testing, migration, vendor-governance and operational-resilience arrangements.
6. Develop an organisational change plan that addresses stakeholders, skills, culture and adoption.
7. Evaluate the risks, limitations and ethical implications of operating model transformation.

1. The Operating Model as a Strategic Architecture

A useful operating model connects strategy to execution. Its principal dimensions are:

A target operating model (TOM) should not be designed as an isolated organisational chart. It is a coherent statement of how capabilities will operate in the future. A robust TOM normally specifies:

• strategic objectives and scope;
• end-to-end processes and service boundaries;
• decision rights and accountability;
• information and data ownership;
• application and infrastructure architecture;
• workforce, location and sourcing choices;
• control points and risk ownership;
• service-level measures and management information;
• transition states and implementation dependencies.

Design principles

Common design principles include standardisation before automation, ownership of end-to-end outcomes, risk-based control, elimination of unnecessary hand-offs, reuse of common platforms, transparency of data and resilience by design. Principles must be explicit because transformation involves trade-offs. For example, a single global process may reduce cost but fail to accommodate a legally necessary local variation. The appropriate objective is controlled standardisation, not uniformity at any cost.

The three-lines model remains relevant. The first line owns operational execution and controls; the second line provides risk oversight and challenge; the third line independently assesses the adequacy of governance and controls. Transformation must preserve these distinctions even when activities are centralised or outsourced.

2. Diagnosing the Current State

Transformation begins with evidence rather than preferred solutions. Current-state assessment should combine document review, process observation, interviews, data analysis, control testing and technology assessment.

Process architecture and value streams

A value-stream view follows an outcome across organisational boundaries. For an equities transaction, the stream may include order receipt, execution, allocation, confirmation, affirmation, settlement, asset servicing, reconciliation and reporting. Mapping only individual departments can hide delays and duplicate controls.

A process map should identify:

• trigger and completion condition;
• inputs, outputs and customers;
• systems and data used;
• roles and hand-offs;
• decision points and exceptions;
• controls and evidence;
• volumes, cycle times and failure rates.

Performance diagnosis

Useful indicators include straight-through-processing rate, exception rate, aged breaks, settlement fails, manual touchpoints, rework, queue time, control deficiencies, complaints and unit cost. Averages alone can mislead. Distribution, peak volumes and tail events are important because operational risk often materialises during stressed conditions.

Capacity can be approximated as:

where N is the number of available employees, h is scheduled hours per employee, a is the availability factor after leave and absence, and p is productive utilisation. The units are transactions or cases per period if productivity is measured in transactions per productive hour. This is a planning approximation, not a guaranteed output: complexity, skills, queueing and peak demand may reduce realised capacity.

A process with high manual effort is not automatically a transformation priority. Prioritisation should consider value, risk, client impact, feasibility and strategic relevance. A simple weighted score can support discussion:

where V, R, C and F are normalised scores for value, risk reduction, client impact and feasibility, and the weights w_v, w_r, w_c and w_f sum to 1. The score is a decision aid, not an objective truth; the scoring definitions and governance must be documented.

3. Process Reengineering and Lean Methods

Business process reengineering seeks substantial redesign rather than incremental improvement. It asks why work exists, whether activities can be removed, and whether the process should be organised around the client or transaction outcome rather than departmental boundaries.

Lean methods focus on customer value and the reduction of waste. Common forms of waste in operations include waiting, unnecessary movement of information, duplicate entry, over-processing, defects, excess work in progress, avoidable hand-offs and underused expertise. In a post-trade process, examples include rekeying trade details into multiple systems, waiting for email approval, and investigating breaks caused by inconsistent reference data.

Important Lean techniques include:

• Value-stream mapping: visualises material and information flow, elapsed time and work content.
• 5S: organises the workplace and standardises procedures; in digital operations this includes controlled work queues and documentation.
• Root-cause analysis: distinguishes symptoms from causes, using methods such as the five whys and cause-and-effect analysis.
• Kaizen: promotes iterative, employee-led improvement.
• Standard work: defines the safest and most repeatable way to perform a task.
• Poka-yoke: introduces mistake-proofing, such as validation rules that prevent an invalid settlement instruction.
• Control automation: embeds preventive or detective checks in workflow rather than relying on informal review.

Lean is not synonymous with headcount reduction. Removing capacity without removing demand, risk or complexity merely shifts pressure to another team. Sustainable improvement removes non-value-adding work while retaining adequate control and resilience.

Automation and process design

Automation should follow process simplification. Automating a defective process can increase the speed of error production. Suitable candidates often have stable rules, high volume, structured data and measurable outcomes. Processes requiring judgement, negotiation or rapidly changing regulatory interpretation may need human oversight.

Artificial intelligence can assist classification, document extraction, anomaly detection, service support and knowledge retrieval. However, model governance must address explainability, data quality, bias, privacy, human review, access control, model drift and record retention. A human-in-the-loop arrangement should specify when a decision must be reviewed, who is accountable and how overrides are recorded.

4. Shared Services, Outsourcing and Managed Utilities

Shared services

A shared-service centre consolidates common activities for multiple business units or legal entities. It may be captive, separately governed within the group, or operated through a hybrid arrangement. Typical activities include reconciliations, reference-data maintenance, reporting, payments support, client onboarding and selected controls.

Benefits include standardisation, scale economies, specialist capability and consistent management information. Risks include distance from the business, excessive centralisation, concentration risk, service deterioration and unclear accountability. A shared service must have a defined service catalogue, process ownership, escalation route, funding model and control framework.

Outsourcing

Outsourcing transfers performance of an activity to an external provider, but it does not transfer the institution’s ultimate responsibility for regulatory compliance, client outcomes or operational resilience. Due diligence should assess financial stability, competence, information security, subcontractors, location, data handling, business continuity, audit rights and exit feasibility.

A sound outsourcing decision compares more than price. It evaluates total cost, control quality, resilience, implementation risk, strategic flexibility and the consequences of provider failure. Critical or important functions generally require enhanced oversight, documented impact tolerances, tested continuity arrangements and credible exit plans, subject to applicable jurisdictional requirements.

Managed utilities

A managed utility provides common infrastructure or processing to several institutions, often using standardised data and operating procedures. Utilities can reduce duplication and improve market consistency, particularly in know-your-customer processes, reference data, post-trade processing and regulatory reporting. They can also create systemic concentration: a common failure may affect many participants simultaneously. Governance therefore requires strong access controls, transparent rule changes, resilience testing and participant accountability.

Sourcing decision framework

The decision should distinguish activities that are core differentiators, control-sensitive, scale-driven or commoditised. A sourcing matrix can consider strategic differentiation, confidentiality, regulatory sensitivity, process maturity, provider capability and concentration risk. Activities with immature processes are usually poor candidates for immediate outsourcing because unresolved defects become contractual disputes rather than disappearing.

5. Building the Transformation Business Case

The business case translates an operating-model proposal into an investment decision. It should contain a baseline, options, benefits, costs, risks, dependencies, timing and measurement plan.

Relevant cost categories include discovery, design, software, licences, integration, data remediation, recruitment, training, migration, dual running, vendor transition, severance, control enhancement and contingency. Benefits may include reduced manual effort, lower error cost, avoided regulatory remediation, improved capacity, reduced run cost, faster client service and improved resilience. Benefits should be assigned to accountable owners and measured against a credible baseline.

A simple net-present-value model is:

where I₀ is the initial investment at time zero, B_t is benefit in period t, C_t is incremental cost in period t, r is the discount rate per period, and T is the evaluation horizon. Monetary amounts must be expressed in the same currency and time basis. The model assumes reasonably estimable cash flows and a consistent treatment of tax, inflation and residual value. Non-financial benefits, such as resilience or control quality, should not be forced into unreliable monetary estimates; they should be presented through additional decision criteria.

For example, suppose a transformation requires an initial investment of £6 million, produces net benefits of £2.5 million in each of years 1–3, and uses a 10% annual discount rate. Ignoring tax and residual value:

NPV = −6 + 2.5/1.1 + 2.5/1.1² + 2.5/1.1³

The present value of the benefits is approximately £6.21 million, giving an NPV of approximately £0.21 million. The positive result is modest, so sensitivity analysis is essential. If benefits are delayed, costs increase or adoption is incomplete, the conclusion may change.

Scenario analysis should include a base case, downside case and upside case. Particular attention should be paid to volume growth, provider pricing, migration duration, attrition, remediation effort, savings realisation and operational incidents. A business case that depends on immediate full savings while funding only partial implementation is not credible.

6. Target Operating Model Design

TOM design is an iterative process. A practical sequence is:

1. Confirm strategic outcomes and design principles.
2. Define scope, regulatory perimeter and affected legal entities.
3. Establish the capability map and prioritised value streams.
4. Design future processes, including exceptions and controls.
5. Allocate process ownership, decision rights and service boundaries.
6. Define data ownership, systems, interfaces and reporting.
7. Select location, workforce and sourcing arrangements.
8. Specify performance measures, risk appetite and governance forums.
9. Compare the target state with current capabilities and identify gaps.
10. Construct transition states rather than assuming a single leap.

The target should document what remains local and what becomes global. It should also identify non-functional requirements: availability, recovery time, recovery point, capacity, security, privacy, auditability and accessibility.

A RACI matrix can clarify who is responsible, accountable, consulted and informed. It should not be used to conceal multiple accountabilities. Each material outcome should have one clearly accountable owner, even if several parties perform or approve activities.

7. Implementation Roadmap, Testing and Migration

A transformation roadmap normally contains mobilisation, design, build, test, pilot, deployment, stabilisation and optimisation. Dependencies are often more important than calendar dates. For example, a new reconciliation platform may depend on data standards, interface availability, control design and user training.

A phased approach reduces risk:

• Pilot: test the model with a controlled product, region or volume segment.
• Wave deployment: migrate groups according to readiness and risk.
• Parallel running: operate old and new processes together for a defined period where reconciliation is feasible.
• Cutover: transfer authority, data and work queues under an approved plan.
• Hypercare: provide intensified support, monitoring and rapid issue resolution.

Testing should be risk-based and cover functional requirements, interfaces, data conversion, access controls, performance, resilience, security, regulatory reporting, operating procedures and user acceptance. Test evidence must be reproducible and defects classified by severity. A successful system test does not prove that the organisation can operate the process under peak volume or market stress.

Migration planning should address data profiling, cleansing, mapping, reconciliation, ownership, retention, archival, cutover timing and rollback. Critical reconciliations should compare source and target populations, balances, statuses and key attributes. Migration exit criteria should be defined before deployment, including acceptable defect levels, control sign-off, training completion and support readiness.

8. Vendor Governance and Operational Resilience

Vendor governance begins before contract signature and continues through exit. Governance should cover:

• due diligence and risk classification;
• contract scope, service levels and performance credits;
• information-security and privacy obligations;
• audit, access and regulatory cooperation rights;
• subcontractor approval and transparency;
• incident notification and root-cause analysis;
• business continuity and disaster recovery testing;
• data ownership, portability and deletion;
• change control and pricing transparency;
• termination assistance and exit testing.

Service-level agreements should measure outcomes rather than only activity. Relevant measures may include settlement timeliness, reconciliation completion, critical incident response, data accuracy and control performance. A target must be meaningful, measurable and supported by an agreed measurement method. Excessive reliance on penalties can encourage gaming; governance should also examine trends, near misses and root causes.

Operational resilience asks whether important business services can continue within tolerable disruption, not merely whether individual systems are available. Mapping dependencies across people, processes, technology, facilities and third parties helps identify hidden concentration. Scenario testing should include cyberattack, cloud outage, staff unavailability, data corruption, market stress and provider failure. Recovery plans must be executable, not merely documented.

9. Organisational Change Management

Transformation changes identity, authority, work content and career prospects. Resistance is therefore not necessarily irrational; it may reveal unaddressed risks, loss of expertise or poor design. Change management should begin during design, not after the technology is built.

A practical change architecture includes:

• stakeholder mapping by influence, impact and attitude;
• a clear case for change linked to client and control outcomes;
• executive sponsorship and visible decision-making;
• two-way communication and feedback channels;
• role and competency assessment;
• training, process simulations and job aids;
• local change champions and super-users;
• revised objectives, incentives and performance measures;
• support for redeployment, reskilling and fair redundancy processes;
• adoption measurement and reinforcement.

Communication should distinguish what is known, what is undecided and what cannot be shared. Overpromising creates distrust. Managers must be equipped to explain how roles, escalation routes and control responsibilities will change.

Adoption can be measured through training completion, proficiency assessments, usage data, error trends, exception volumes, help-desk demand and employee feedback. Usage alone is insufficient: employees may use a system while bypassing controls or maintaining unofficial spreadsheets.

Ethical change management requires respectful treatment of affected employees, transparent selection criteria, protection of personal data and avoidance of unrealistic productivity targets. Expertise should be captured before experienced staff leave, but knowledge transfer must not become unpaid or uncontrolled extraction of personal knowledge.

10. Governance, Risk and Control in Transformation

Transformation introduces risks during both transition and steady state. A risk register should identify owner, cause, event, consequence, controls, residual exposure, trigger and treatment. Typical risks include:

• incomplete requirements and scope expansion;
• poor-quality or unauthorised data;
• control gaps during parallel running;
• excessive dependence on key individuals;
• cyber and privacy exposure;
• model or automation error;
• vendor concentration and lock-in;
• employee attrition and loss of tacit knowledge;
• regulatory non-compliance;
• client disruption and reputational damage.

Stage gates provide governance discipline. Approval should require evidence that design, testing, training, continuity, legal review, risk assessment and operational readiness are complete. Independent assurance is especially important where transformation changes regulated processes, books and records, client assets, financial reporting or surveillance.

The control framework should distinguish preventive, detective and corrective controls. Automating a control does not remove the need to validate its logic, access permissions, data inputs, exception handling and change management. Control owners must understand what the system does and what it does not do.

11. Illustrative Case: Meridian Capital Markets

This is a fictional illustrative case. Meridian Capital Markets operates equities and fixed-income businesses in six jurisdictions. Trade confirmations and reconciliations are performed by local teams using different workflows. The firm experiences high exception volumes, delayed management information and inconsistent evidence of control performance. Senior management proposes a global operations utility.

Background and problem

The current model contains 11 booking and workflow applications, duplicated reference-data maintenance and substantial email-based escalation. Monthly settlement exceptions average 18,000, with a long tail of aged breaks. Managers cannot reliably compare unit costs because local teams use different definitions.

Analysis

A value-stream review identifies three primary causes: inconsistent static data, manual rekeying between systems and unclear ownership of exceptions. The review also finds that some local variations are legally necessary, while others are historical preferences. Outsourcing the whole process immediately would transfer unresolved complexity to a provider.

The transformation team therefore applies controlled standardisation. It defines a global process taxonomy, a common exception classification, central reference-data ownership and a minimum control standard. Local legal requirements are recorded as approved variants. The proposed target model contains a captive shared service for standard processing, local regulatory specialists for jurisdiction-specific activities and a managed platform for workflow and reporting.

Business case and solution

The investment is estimated at £9 million over two years. Benefits include reduced manual effort, lower error remediation, improved management information and avoided future platform costs. The business case uses conservative adoption assumptions and includes dual running, data cleansing and training costs. Benefits are released only after quality and control thresholds are achieved.

Implementation occurs in three waves. Wave one covers a lower-complexity equity product in two jurisdictions. Wave two adds remaining equities and selected reconciliations. Wave three addresses fixed income and complex local exceptions. Each wave requires data reconciliation, user acceptance testing, operational-readiness approval and a tested rollback plan.

Vendor governance includes quarterly resilience testing, subcontractor disclosure, audit rights, data portability and an exit playbook. A service-integration forum joins Meridian, the platform provider and the shared-service leadership team.

Outcome

After stabilisation, the pilot reduces manual touchpoints and improves exception ageing, but the first release reveals that some users created unofficial workarounds. The team responds by improving validation rules, clarifying decision rights and measuring adoption. The final operating model is therefore not judged solely by implementation on time; it is judged by sustainable control performance, service quality and user behaviour.

Learning points

1. Process standardisation should precede large-scale automation.
2. Local regulatory requirements must be distinguished from local preference.
3. Outsourcing does not eliminate accountability.
4. Pilot waves expose behavioural and data risks that design workshops may miss.
5. Benefits should be linked to quality and control gates, not headcount assumptions alone.

12. Limitations and Contemporary Developments

Operating model frameworks can create false confidence if treated as precise predictions. Cost estimates are sensitive to scope, demand and transition complexity. Lean tools may understate resilience needs, while excessive centralisation can reduce local responsiveness. Benchmarking can be misleading because firms classify transactions, exceptions and costs differently.

Current developments include cloud-based platforms, event-driven processing, distributed data ownership, digital identity, workflow intelligence and AI-assisted operations. These developments can improve scalability and insight, but they also increase dependence on data quality, integration architecture and third-party ecosystems. Generative AI introduces additional concerns about confidential information, inaccurate outputs, intellectual property, accountability and retention of prompts and responses.

Best practice is consequently becoming more evidence-based and control-oriented. Institutions are moving toward product and platform ownership, continuous testing, automated control monitoring, resilience-by-design and measurable outcomes. The strategic question is not whether an organisation has adopted a fashionable technology, but whether its operating model delivers reliable client outcomes with appropriate risk and sustainable economics.

Chapter Summary

Operating model transformation redesigns the relationship between strategy and execution. Its scope includes processes, organisation, technology, data, governance, sourcing and performance. Effective transformation begins with evidence-based current-state diagnosis and uses value-stream analysis to identify waste, risk and client-impact opportunities.

Process reengineering and Lean methods can remove unnecessary work, but simplification must precede automation and must not weaken controls. Shared services, outsourcing and managed utilities offer scale and expertise while creating accountability, concentration, data, resilience and exit risks. A credible business case includes complete transition costs, measurable benefits, scenario analysis and non-financial outcomes.

A target operating model defines future processes, ownership, data, systems, locations, controls and service measures. Implementation requires phased roadmaps, risk-based testing, disciplined migration, operational readiness and hypercare. Vendor governance must continue throughout the lifecycle. Change management aligns people, skills, incentives and behaviours with the new model. Finally, transformation should be governed as a business and risk programme, not merely as a technology deployment.

Key Terms

Operating model: The integrated arrangement of processes, people, technology, data, governance and sourcing used to execute strategy.

Target operating model: A documented design of how the organisation will operate in the future.

Value stream: The end-to-end flow of activities required to deliver an outcome to a customer.

Process reengineering: Fundamental redesign of work to achieve major improvements in performance.

Lean: An improvement philosophy focused on customer value and reduction of waste.

Straight-through processing: Automated processing with minimal manual intervention.

Shared service: A centralised internal service delivering common activities to multiple business units.

Outsourcing: Use of an external provider to perform activities previously or potentially performed internally.

Managed utility: A common external or industry platform providing standardised services to multiple participants.

Service-level agreement: A contractual or operational commitment defining service performance.

Operational resilience: The ability to continue important services within tolerated disruption limits.

RACI: A responsibility framework identifying who is responsible, accountable, consulted and informed.

Business case: An evidence-based justification for investment, including costs, benefits, risks and alternatives.

Net present value: The present value of future net cash flows less initial investment.

Migration: The controlled movement of data, processes, users or services to a new environment.

Hypercare: Intensified support and monitoring immediately after deployment.

Change champion: A local representative who supports communication, learning and adoption.

Control owner: The person accountable for designing, operating or evidencing a control.

Vendor concentration risk: Exposure arising when important services depend excessively on one provider or ecosystem.

Human-in-the-loop: A design in which a person reviews, approves or can override an automated result.

Review Questions

Short Answer Questions

1. What are the principal dimensions of an operating model?
2. Why should process simplification generally precede automation?
3. Distinguish a shared service from outsourcing.
4. What is the purpose of a stage gate in transformation governance?
5. Why is a credible exit plan important when outsourcing a critical activity?

Long Answer Questions

1. Explain how an investment bank should diagnose its current operating model before designing a target state.
2. Compare the benefits and risks of shared services, outsourcing and managed utilities.
3. Describe the components of a robust transformation business case.
4. Explain how testing, migration and hypercare contribute to a controlled implementation.
5. Discuss the role of organisational change management in sustaining operating model transformation.

Analytical / Application Questions

1. An operations process has high manual effort but low error rates and significant local regulatory variation. Using the frameworks in this chapter, determine whether it should be standardised, automated, outsourced or retained locally. Justify your answer.
2. A proposed transformation has a positive NPV but depends on a single cloud provider and aggressive staff reductions. Analyse the business case, identify the principal risks and recommend governance conditions for approval.
3. Design a phased roadmap for migrating a fragmented post-trade process into a global shared service. Specify readiness criteria, testing, data migration controls, vendor oversight and change-management actions.

Multiple Choice Questions with Answers

Question 1

Which statement best describes a target operating model?

A. A future-state design covering processes, people, technology, data, governance and sourcing

B. A list of software licences held by the operations function

C. A monthly report of operational errors

D. A contract containing only vendor pricing

Correct Answer: A. A future-state design covering processes, people, technology, data, governance and sourcing

Question 2

What should generally occur before large-scale process automation?

A. Immediate staff reduction

B. Process simplification and control assessment

C. Outsourcing of all exceptions

D. Removal of user acceptance testing

Correct Answer: B. Process simplification and control assessment

Question 3

Which activity is most characteristic of Lean improvement?

A. Increasing hand-offs to create specialist oversight

B. Identifying and removing non-value-adding work

C. Replacing all human judgement with algorithms

D. Measuring only annual revenue

Correct Answer: B. Identifying and removing non-value-adding work

Question 4

Which statement about outsourcing is correct?

A. Regulatory responsibility automatically transfers to the provider

B. Outsourcing eliminates the need for business continuity planning

C. The institution retains accountability for the outsourced activity

D. An outsourced process does not require performance measures

Correct Answer: C. The institution retains accountability for the outsourced activity

Question 5

In the NPV formula, the discount rate is used primarily to:

A. Convert future cash flows into present values

B. Calculate the number of employees required

C. Measure settlement accuracy

D. Determine the number of process steps

Correct Answer: A. Convert future cash flows into present values

Question 6

What is the main purpose of parallel running during migration?

A. To avoid reconciling old and new outputs

B. To compare and validate the new process before full cutover

C. To permanently maintain two uncontrolled systems

D. To eliminate the need for rollback planning

Correct Answer: B. To compare and validate the new process before full cutover

Question 7

Which item is most relevant to vendor exit planning?

A. Data portability and termination assistance

B. Office decoration standards

C. Employee social-event schedules

D. Unrecorded informal procedures

Correct Answer: A. Data portability and termination assistance

Question 8

What does a RACI matrix primarily clarify?

A. Currency exchange rates

B. Responsibility and accountability for activities and decisions

C. The probability distribution of settlement prices

D. Tax depreciation rates

Correct Answer: B. Responsibility and accountability for activities and decisions

Question 9

Why can a managed utility create systemic risk?

A. It prevents all standardisation

B. A common failure may affect many participating institutions

C. It always operates without technology

D. It cannot be subject to governance

Correct Answer: B. A common failure may affect many participating institutions

Question 10

Which is the strongest indicator of sustainable change adoption?

A. Attendance at one launch presentation

B. System usage combined with improved behaviour, control performance and outcomes

C. The number of project emails sent

D. The size of the transformation budget

Correct Answer: B. System usage combined with improved behaviour, control performance and outcomes