João Barata

Paulo Rupino Da Cunha

Luís Abrantes

Dealing with Risks and Workarounds: A Guiding Framework

Keywords: information systems, participative enterprise modeling, risks, workarounds, rISk-arounD, ISO 9001:2015

We present rISk-arounD, an enterprise-wide framework for modeling risks and workarounds in conformity with ISO 9001. The mode of inquiry is the canonical action research (CAR), conducted in a metalworking company. Our contribution suggests that (1) risks and workarounds should be jointly considered to model uncertainty in organizations, (2) participative enterprise modeling can assist process improvement and regulatory compliance, and (3) it is also necessary to address informal "shadow" practices in enterprise models. Moreover, we discuss how to adopt CAR to promote a culture of participative enterprise modeling. This framework can help organizations in their transition to the new 2015 version of ISO 9001, which endorses process oriented approaches and risk-based thinking as top priorities.

Introduction

"Only those who will risk going too far can possibly find out how far one can go" (T. S. Eliot, Preface to Transit of Venus: Poems by Harry Crosby, 1931). In organizational practice, people can be tempted to work around the official procedures basing their decision on a risk-benefit analysis [START_REF] Alter | Theory of Workarounds[END_REF][START_REF] Röder | Workaround Aware Business Process Modeling[END_REF]. When it happens, a breach occurs between the "formal" modeled system and the reality, which may hoist other, unforeseen risks. Therefore, managing uncertainty is a major concern of organizations and we argue that it can be addressed with participative enterprise modeling [START_REF] Stirna | Participative enterprise modeling: Experiences and recommendations[END_REF].

ISO 9001 is a worldwide standard to implement a quality management system [START_REF]ISO: ISO 9001 Quality management system -Requirements[END_REF]. Its revised version is expected to be published by the end of 2015 and one of its major changes is the inclusion of risk-based thinking [START_REF]IAF: Transition Planning Guidance for[END_REF]. ISO 9001 suggests a process approach and documented information to ensure process visibility, problem prevention, and system auditability [START_REF]ISO: ISO 9001 Quality management system -Requirements[END_REF]. The lack of adherence between the designed processes and the run-time processes is a frequent cause of nonconformity in quality audits, requiring measures to guarantee compliance by reducing process friction [START_REF] Antunes | MUVE IT: Reduce the Friction in Business Processes[END_REF]. Risk-based thinking involves anticipation of undesired events that affect reality and its models of expected behavior [START_REF] Sadgrove | The Complete Guide to Business Risk Management[END_REF], ultimately raising improvement opportunities [START_REF] Alter | A general, but readily adaptable model of information system risk[END_REF].

The importance of risk management is growing and there are several reasons to explain the fact, for example (1) regulatory pressure; (2) customer requirements; (3) public image; and (4) management attitudes, that are becoming more professional to integrate risks in their strategies and operations. Moreover, risk is a key topic in the research agenda of information systems (IS), business process management (BPM), and enterprise modeling [START_REF] Alter | A general, but readily adaptable model of information system risk[END_REF][START_REF] Zur Mühlen | Integrating Risks in Business Process Models[END_REF][START_REF] Suriadi | Current Research in Risk-aware Business Process Management -Overview, Comparison, and Gap Analysis[END_REF]. Risks are entangled in BPM [START_REF] Zur Mühlen | Integrating Risks in Business Process Models[END_REF], however, "there is still a lack of research which investigates the management of risks during process execution, the exploitation of post-execution data for the purpose of risk analysis and the enablement of an integrated formal reasoning of risks in process models" [START_REF] Suriadi | Current Research in Risk-aware Business Process Management -Overview, Comparison, and Gap Analysis[END_REF].

Workarounds are alternative procedures to the official process, which can result from a mismatch between people expectations and actual practice [START_REF] Ferneley | Resist, comply or workaround? An examination of different facets of user engagement with information systems[END_REF], receiving increased attention in IS [START_REF] Alter | Theory of Workarounds[END_REF][START_REF] Röder | Workaround Aware Business Process Modeling[END_REF][START_REF] Malaurent | Reconciling global and local needs: a canonical action research project to deal with workarounds[END_REF]. According to [START_REF] Röder | Workaround Aware Business Process Modeling[END_REF], organizational employees utilize workarounds in business processes according to a risk-benefit analysis, being perceived as process improvements if the efficiency gains outweigh the exposure resulting from process violation. A recent study presented by [START_REF] Malaurent | Reconciling global and local needs: a canonical action research project to deal with workarounds[END_REF] addresses the informal, unexpected, and undesired workarounds that the users of a multinational company had put in place. The authors suggest that canonical action research (CAR) is an appropriate approach to deal with the problem [START_REF] Malaurent | Reconciling global and local needs: a canonical action research project to deal with workarounds[END_REF].

The literature about risks and workarounds is vast [START_REF] Alter | A general, but readily adaptable model of information system risk[END_REF] and the two concepts are interrelated [START_REF] Röder | Workaround Aware Business Process Modeling[END_REF], however, they are typically studied independently [START_REF] Alter | Theory of Workarounds[END_REF][START_REF] Alter | A general, but readily adaptable model of information system risk[END_REF]. There is a lack of models built specifically for small and medium enterprises (SMEs), which often adopt rudimentary risk management practices and lack a risk-aware culture [START_REF] Popescu | Considerations on integrating risk and quality management[END_REF][START_REF] Aureli | The Current State of Risk Management in Italian Small and Medium-Sized Enterprises[END_REF][START_REF] Islam | Risk determinants of small and medium-sized manufacturing enterprises (SMEs) -an exploratory study in New Zealand[END_REF]. Moreover, there is a shortcoming of practical cases and insufficient research in run-time risk management [START_REF] Suriadi | Current Research in Risk-aware Business Process Management -Overview, Comparison, and Gap Analysis[END_REF], which can be affected by changes that process participants decide to perform to the formal process model. These open issues led us to set the goal of developing a guiding framework to deal with risks and workarounds [START_REF]ISO: ISO 9001 Quality management system -Requirements[END_REF][START_REF]IAF: Transition Planning Guidance for[END_REF], fostering risk-based thinking in the scope of ISO 9001.

We organized the remainder of the paper as follows. Section 2 presents the literature review. Next, we present the research approach, that is the canonical action research [START_REF] Susman | An Assessment of the Scientific Merits of Action Research[END_REF]. Section 4 details our CAR cycle in a metalworking SME. In section 5, we discuss the results according to the principles suggested by [START_REF] Davison | Principles of canonical action research[END_REF] to ensure rigor and relevance in CAR. Finally, we present the conclusions, the study limitations, and the opportunities for future research.

Literature Review

Risks and Workarounds

A definition for risk includes (1) a probability that the actual outcome of an event will differ from the expected outcome and (2) the impact associated with that outcome [START_REF] Holton | Defining risk[END_REF]. Kaplan [START_REF] Kaplan | Risk Management and the Strategy Execution System[END_REF] suggests a three-level hierarchy of risks. Level 3 is the most detailed and consists of the operational and compliance risks [START_REF] Huemer | Aligning Risk Management and Compliance Considerations with Business Process Development[END_REF] that emerge from business processes (e.g., information security and privacy, regulatory issues).

According to [START_REF] Kaplan | Risk Management and the Strategy Execution System[END_REF], level 3 risks are more predictable and related to standard operation procedures. Level 2 includes strategy risks; for example, environmental, customer relations, human resources, and IT related risks [START_REF] Kaplan | Risk Management and the Strategy Execution System[END_REF]. At level 1 are the global enterprise risks that may occur due to most improbable events, usually called "black swan", which reveal the most adverse consequences for the firm's survival [START_REF] Kaplan | Risk Management and the Strategy Execution System[END_REF]. They should also be tackled by managers, for example with scenario planning and meetings [START_REF] Kaplan | Risk Management and the Strategy Execution System[END_REF]. Alternatively, the risk model proposed by [START_REF] Nist | Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach[END_REF] separates the IS, recognizing (level 1) the organization; (level 2) the mission and business processes; and (level 3) the IS. Although the literature offers contributions for process oriented risk models [START_REF] Zur Mühlen | Integrating Risks in Business Process Models[END_REF][START_REF] Popescu | Considerations on integrating risk and quality management[END_REF][START_REF] Sadiq | Modeling Control Objectives for Business Process Compliance[END_REF], an enterprise-wide risk framework must consider distinct layers, for example the strategic and the cultural [START_REF] Kaplan | Risk Management and the Strategy Execution System[END_REF], at all levels of the organization [START_REF] Popescu | Considerations on integrating risk and quality management[END_REF]. Consideration for compliance risks and operational risks should be integrated during the design-time and at run-time of business processes [START_REF] Huemer | Aligning Risk Management and Compliance Considerations with Business Process Development[END_REF]. Dealing with both types of risks involves the definition of objectives, business rules, and internal controls [START_REF] Kaplan | Risk Management and the Strategy Execution System[END_REF]. What if the process is not followed as designed? Workarounds can be seen as a change or deviation from an existing (formal) work system to overcome the problems that are preventing the achievement of the desired goals [START_REF] Alter | Theory of Workarounds[END_REF]. In IS, workarounds may take place as a discrepancy between the information technologies (IT) expectations and the actual practices [START_REF] Ferneley | Resist, comply or workaround? An examination of different facets of user engagement with information systems[END_REF], resulting in the creation of alternative ones and "shadow applications" [START_REF] Handel | Working around official applications[END_REF] by the users. On the one hand, workarounds may be used to solve misfits, deficiencies, or identifying opportunities to improve the IS [START_REF] Malaurent | Reconciling global and local needs: a canonical action research project to deal with workarounds[END_REF]. On the other hand, workarounds may create difficulties for IS adoption, leading to redundancies in data and applications [START_REF] Handel | Working around official applications[END_REF], potential nonconformity with policies, inefficiencies or hazards [START_REF] Alter | Theory of Workarounds[END_REF], becoming a source of emergent risks or an amplification of the initial risks. The IS may even be seen as "'scapegoats', as managers can blame the IS for not preventing workarounds" [START_REF] Röder | Why Managers Tolerate Workarounds -The Role of Information Systems[END_REF].

The studies presented by [START_REF] Alter | Theory of Workarounds[END_REF][START_REF] Zhou | CPOE workarounds, boundary objects, and assemblages[END_REF] identify workarounds that are sporadic and disappear, while others can persist over time and become the standardized formal practice. In the latter case, people consider the alternative practice more appropriate for their needs, learn with the experience, and produce a change. The breach between formal practices supported by IT and real practices may increase, requiring a timely identification of these cases and the redesign of the IS. According to [START_REF] Halbesleben | Work-arounds in health care settings: Literature review and research agenda[END_REF], workarounds should not be confused with errors and mistakes. In fact, workarounds depend on the organizational culture [START_REF] Gallear | An Empirical Investigation of the Channels that Facilitate a Total Quality Culture[END_REF] and in the existence of open discussions that are able to exploit their potential for process improvement [START_REF] Halbesleben | Work-arounds in health care settings: Literature review and research agenda[END_REF]. Although some models point to the need of identifying process configurations that minimize risks [START_REF] Zur Mühlen | Integrating Risks in Business Process Models[END_REF], they do not consider the full potential of workarounds for risk identification.

Risks and Workarounds in Enterprise Modeling

Enterprise modeling is "an activity where an integrated and negotiated model describing different aspects of the enterprise is created" [START_REF] Persson | An Explorative Study into the Influence of Business Goals on the Practical Use of Enterprise Modelling Methods and Tools[END_REF], comprising sub-models that can focus on different dimensions, for example, people, processes, and IT. The objective of enterprise modeling is to develop a business or to ensure its quality [START_REF] Persson | An Explorative Study into the Influence of Business Goals on the Practical Use of Enterprise Modelling Methods and Tools[END_REF], for example, for strategy development, business process (re-)redesign, procedure communication, and IS requirements identification, ensuring that the model fits reality [START_REF] Stirna | Participative enterprise modeling: Experiences and recommendations[END_REF]. Enterprise models deal with two types of uncertainty: "One uncertainty is in the values of key parameters, which are uncertain because of a lack of knowledge and a natural variability. The second uncertainty is in the structure of the model itself. Model uncertainty relates to whether the structure of the model fundamentally represents the system or decision of interest" [START_REF] Holmes | Regulatory models and the environment: practice, pitfalls, and prospects[END_REF].

Information systems include different interrelated dimensions, namely the context, people, process, IT, and information/data [START_REF] Barata | Modeling the Organizational Regulatory Space: A Joint Design Approach[END_REF][START_REF] Barata | Five Dimensions of Information Systems: A Perspective from the IS and Quality Managers[END_REF]. Therefore, IS modeling is a complex endeavor that tries to simplify various aspects of reality, integrating social and technical aspects [START_REF] Baxter | Socio-technical systems: From design methods to systems engineering[END_REF]. Risks and workarounds are two important parts of the organizational practice that affect the IS. As we recognize the important contributions that addressed each of these parts separately [START_REF] Alter | Theory of Workarounds[END_REF][START_REF] Röder | Workaround Aware Business Process Modeling[END_REF][START_REF] Alter | A general, but readily adaptable model of information system risk[END_REF][START_REF] Zur Mühlen | Integrating Risks in Business Process Models[END_REF][START_REF] Malaurent | Reconciling global and local needs: a canonical action research project to deal with workarounds[END_REF], we argue for the opportunity to achieve synergies in their combination.

Risk modeling has been studied in the context of SMEs, for example by [START_REF] Ojala | Risks and risk management in ERP Project-cases in SME Context[END_REF] for ERP implementation. According to [START_REF] Ojala | Risks and risk management in ERP Project-cases in SME Context[END_REF], risks must be modeled according to the different lifecycle phases of the project. Other authors studied risk management in the lifecycle of BPM from design to post-execution; for example [START_REF] Suriadi | Current Research in Risk-aware Business Process Management -Overview, Comparison, and Gap Analysis[END_REF], arguing that "most approaches [for design-time phase] do not provide principles or guidance to support risk-informed business process models" [START_REF] Suriadi | Current Research in Risk-aware Business Process Management -Overview, Comparison, and Gap Analysis[END_REF]. A model of IS risk was proposed by [START_REF] Alter | A general, but readily adaptable model of information system risk[END_REF], considering the facets: (1) goals and expectations; (2) risk factors and other sources of uncertainty; (3) the operation of the work system whose risks are being managed; (4) the risk management (contingency management) effort; (5) the possible outcomes and their probabilities; (6) the impacts on other systems; and (7) the resulting financial gains or losses. In [START_REF] Kim | Framework for Analyzing Critical Incident Management Systems (CIMS)[END_REF] a framework is presented for analyzing incident management systems, providing guidance for IS risk assessment factors in critical systems.

Workaround modeling has been addressed, for example, by [START_REF] Nadhrah | A normative method to analyse workarounds in a healthcare environment: motivations, consequences, and constraints[END_REF], who compared the formal processes and the workarounds, including the dimensions of (1) motivation; (2) constraints; and (3) consequences. The Workaround Process Model and Notation (WPMN) is a solution proposed by [START_REF] Röder | Workaround Aware Business Process Modeling[END_REF] to combine workarounds in business process models. The model contains different constructs for the representation of workarounds, context analysis (risk-benefit, situational factors, business rules), and the workaround impact. WPMN has potential synergies with compliance and risk model proposals, for example [START_REF] Zur Mühlen | Integrating Risks in Business Process Models[END_REF][START_REF] Sadiq | Modeling Control Objectives for Business Process Compliance[END_REF]. Nevertheless, we could not find in the literature an enterprise-wide framework with the purpose of integrating risks and workarounds, not restricted to the process level, addressing the different lifecycle phases of risk-based thinking.

Processes are only one of the dimensions of the IS and there is a need to consider a strategic dimension in risk approaches [START_REF] Kaplan | Risk Management and the Strategy Execution System[END_REF], as presented by [START_REF] Strecker | RiskM: A multi-perspective modeling method for IT risk assessment[END_REF] in the scope of IT risks. Moreover, there are problems in current business process models in what regards capturing all the information that is required to audit risks [START_REF] Carnaghan | Business Process Modeling Approaches in the Context of Process Level Audit Risk Assessment: An Analysis and Comparison[END_REF]. Similarly, dealing with workarounds requires understanding people motivation, risk analysis, the consequences for other process activities, and the context involved [START_REF] Röder | Workaround Aware Business Process Modeling[END_REF]. We acknowledge the integration of risks and workarounds in the work presented by [START_REF] Röder | Workaround Aware Business Process Modeling[END_REF], however, the authors do not address risks that emerge from the informal workflows.

To overcome these difficulties, the study conducted by [START_REF] Malaurent | Reconciling global and local needs: a canonical action research project to deal with workarounds[END_REF] selected activity theory as the focal theory for their research, characterized as a cross-disciplinary framework for analyzing forms of human practice.

Research Approach

We considered Action Research [START_REF] Susman | An Assessment of the Scientific Merits of Action Research[END_REF] and Design Science Research [START_REF] Hevner | Design Science in Information Systems Research[END_REF] as two suitable approaches, because both allow the design of a new artifact or solution and to test it in practice. Action research is an approach that simultaneously aims at improving a problematic situation in the target organization and contribute to the body of scientific knowledge [START_REF] Susman | An Assessment of the Scientific Merits of Action Research[END_REF][START_REF] Davison | Principles of canonical action research[END_REF]. Since our work aimed at solving concrete organizational issues in a client setting [START_REF] Susman | An Assessment of the Scientific Merits of Action Research[END_REF], we considered that it was more aligned with the dual goal of action research.

There are multiple forms of action research [START_REF] Baskerville | Diversity in information systems action research methods[END_REF], usually represented in a cyclic combination of phases. We followed one of the most used and well documented forms that is the canonical action research (CAR), characterized by five phases of Diagnosing, Action planning, Action taking, Evaluating, and Specifying learning [START_REF] Susman | An Assessment of the Scientific Merits of Action Research[END_REF].

Rigorous action research is seen as one of the solutions to improve the relevance of IS, by solving real world problems [START_REF] Vries | Rigorously relevant action research in Information systems[END_REF]. To ensure rigor and validity, there are five principles that we must consider in CAR [START_REF] Davison | Principles of canonical action research[END_REF]: Principle of the Researcher-Client Agreement; Principle of the Cyclical Process Model; Principle of Theory; Principle of Change through Action; and Principle of Learning through Reflection. The next section describes the findings of our CAR cycle. Afterwards, we discuss those results according to each of the five principles above, adopting the structure selected by [START_REF] Malaurent | Reconciling global and local needs: a canonical action research project to deal with workarounds[END_REF] for the discussion of their CAR project.

4

Framework Development "Thinking is easy, acting is difficult, and to put one's thoughts into action is the most difficult thing in the world" (Johann Wolfgang Von Goethe).

Client-system Infrastructure

Our client is a small metalworking company founded in 1947. Its activity is conducted in the fields of mechanical engineering and industrial maintenance. Its market is mostly local, with the majority of their customers within a 100 km range. Quality is a priority to the company. ISO 9001 [START_REF]ISO: ISO 9001 Quality management system -Requirements[END_REF] certification is seen as a competitive advantage that distinguishes them from low cost players in the sector. Moreover, they have demanding customers regarding compliance to environmental and safety risks. The lack of resources that characterize SMEs [START_REF] Islam | Risk determinants of small and medium-sized manufacturing enterprises (SMEs) -an exploratory study in New Zealand[END_REF] is a reality in our setting. However, the adoption of an enterprise-wide risk modeling is not an option; it is vital for the conformity to standards [START_REF]IAF: Transition Planning Guidance for[END_REF] and for the company survival.

Diagnosing the Setting

The CAR diagnosis started with semi-structured interviews [START_REF] Myers | The qualitative interview in IS research: Examining the craft[END_REF] involving the top manager, the chief financial officer, and the quality manager. We also used data gathering techniques of document collection and observation [START_REF] Myers | The qualitative interview in IS research: Examining the craft[END_REF] to understand the organizational processes and the current risk management practices.

According to the quality manager "a customized industrial IS is critical for our company's future and to comply with our audits". The top manager considered that flexibility and informality were competitive advantages; nevertheless, they also bear a higher possibility of nonconformity with the strategy and with formal practices. There were other concerns, namely (1) the lack of human resources, requiring that any methodologies be lightweight; (2) the need to redesign business processes and the underlying IT; and (3) the barriers for change that were constantly raised by the older staff. The company managers had no experience with enterprise modeling methods and tools. Their processes were designed and described in semi-structured word processor documents, which is usual in ISO 9001 certified SMEs.

We also conducted a literature review during this Diagnosing stage. Each publication was coded using the Mendeley free reference management tool and discussed with the company managers. It was during the discussion and the comparison with practice that workarounds emerged. One of the company's problems were the misalignments between: (1) formal processes (quality procedures) and actual practice; (2) IT and process support (high volume of paper and disconnected support spreadsheets); (3) market demands and staff competences (most of them were in the company since its foundation and have low IT competences and a high resistance to change); (4) regulations and business processes; and (5) insufficient information quality for decision-making needs. According to the company managers, frequent workarounds multiplied the risks and potential nonconformity in quality audits.

Our comprehensive joint diagnosis provided the foundations to our action plan, presented in the next section.

Planning our CAR Action

We prepared an overall action plan with two main objectives. First, it was necessary to identify the main dimensions to address in risks and workarounds (agreed by their stakeholders), and provide support for communication and learning in the organization [START_REF] Bernus | Enterprise models for enterprise architecture and ISO9000:2000[END_REF]. Although workarounds have been studied regarding IT and business processes [START_REF] Alter | Theory of Workarounds[END_REF][START_REF] Malaurent | Reconciling global and local needs: a canonical action research project to deal with workarounds[END_REF][START_REF] Yang | Workarounds in the use of IS in healthcare: A case study of an electronic medication administration system[END_REF], it is possible to workaround other dimensions of an IS, including organizational hierarchies (people), company policies and regulations that shape its context, or required information/data of a given system. Our model should be multidimensional. Second, we had the purpose of assisting SMEs in the ISO 9001 transition to the new 2015 version. Therefore, ISO 9001 principles and suggested approaches, for example the PDCA [START_REF]ISO: ISO 9001 Quality management system -Requirements[END_REF], should be a part of our proposal. It was also our intention to make the framework and related models suitable for audits, because they are frequent in ISO 9001-based quality management systems. Our solution required artifacts and routines [START_REF] Barata | Modeling the Organizational Regulatory Space: A Joint Design Approach[END_REF][START_REF] Pentland | Designing routines: On the folly of designing artifacts, while hoping for patterns of action[END_REF] to assist practitioners in its adoption.

Moreover, we wanted to apply participative enterprise modeling in our action, not merely to model systems but to design the underlying framework itself.

Our overall plan for this CAR cycle is inspired in the ISO 2 [START_REF] Barata | ISO2: A New Breath for the Joint Development of IS and ISO 9001 Management Systems[END_REF] approach, originally proposed for the joint development of IS and ISO 9001-based quality management systems. First, we conducted a literature review to create (1) a frame of reference about the problem domain. Then, we (2) diagnosed organizational practice to identify the company policies, initial risks, and potential workarounds. Next, we (3) defined the framework vision, followed by (4) its main components and the dynamic of the model for the purpose of creating change. The sequent step involved the (5) sourcing of tools such as risk matrices, process models and related procedures, and IT adaptations. Afterwards, it was time for [START_REF] Antunes | MUVE IT: Reduce the Friction in Business Processes[END_REF] adoption in practice to respond to risks and workarounds. Finally, we (7) studied the changes that occurred with the introduction of the new framework and opportunities for future work.

The organization did not intend to buy an IT modeling platform and the mere description of risks would be a disappointment for the managers expectation. Our plan was to foster a culture of participative enterprise modeling [START_REF] Stirna | Participative enterprise modeling: Experiences and recommendations[END_REF][START_REF] Gallear | An Empirical Investigation of the Channels that Facilitate a Total Quality Culture[END_REF] in the organization, as a basis for risk-based thinking required by ISO 9001:2015 revision.

Action Taking: Proposing and Testing the rISk-arounD Framework

Figure 1 presents the framework that we built to deal with risks and workarounds. We named it the rISk-arounD framework.

Fig. 1. The rISk-arounD Framework

The enclosing dashed line represents the dynamic of risk-based thinking in ISO 9001. Based on the sources of uncertainty (e.g., events, variability, mishaps) and certainty (e.g., quality principles, strategy, formal process maps) that are represented on the left of the model, the organization must identify the risks at three distinct levels (on the top of the figure), evaluate their local and broader impacts, including risks and opportunities to change (on the right), and respond with the focus on improvement (on the bottom). The internal part represents the aspects that must be addressed for dealing with risks and workarounds in IS [START_REF] Röder | Workaround Aware Business Process Modeling[END_REF][START_REF] Antunes | MUVE IT: Reduce the Friction in Business Processes[END_REF]. A workaround can be based in a riskbenefit evaluation [START_REF] Röder | Workaround Aware Business Process Modeling[END_REF] emerging from an existing friction in the business process [START_REF] Antunes | MUVE IT: Reduce the Friction in Business Processes[END_REF]. Modeling must address five interrelated dimensions of (1) Context, (2) People, (3) Process, (4) IT, and (5) Information/data [START_REF] Barata | Modeling the Organizational Regulatory Space: A Joint Design Approach[END_REF]. The dark circles specify the main literature references for each component of the framework. Table 1 presents practical examples of certainty/uncertainty models that can be used for each dimension. Workarounds to improve efficiency; Misfit between "static" process maps and the dynamic of real practice; IT

The "official" IT portfolio, for example, an ERP;

The "unofficial" applications sourced by process users (e.g., parallel spreadsheets); Information/ Data The organizational databases; Statutory reports.

Information/data quality issues; Omitted information/data. Table 1 presents examples of models for the "formal" organization in the second column. Conversely, the rightmost column presents models of uncertainty (by risks/workarounds) that may influence the organizational goals. The examples were created, during our CAR cycle, in different formats including matrices (for black swan and risks affecting quality principles), organizational charts (e.g., alternative circuits of the official organigram), and process maps.

Figure 2 exemplifies an operational and compliance model. It is an extract of the organizational process map for the provisioning and metal component maintenance of our organization.

Fig. 2. Modeling workaround risks at process level

Each process in the figure has two lanes as suggested by [START_REF] Röder | Workaround Aware Business Process Modeling[END_REF], to specify the formal process according to ISO 9001 requirements and the informal aspects, which represent the potential workarounds and its associated risks.

The risks identified at process level were included in a main risk list and each one evaluated from 1 to 5 as proposed by [START_REF] Kaplan | Risk Management and the Strategy Execution System[END_REF]. Finally, actions were defined to accept (e.g., check insurance for "black swans"; change process to adopt the workaround), mitigate (e.g., minimize risk/workaround probability), or avoid the risk/workaround. For the example in Figure 2, (1) the product expedition now requires a quality report that is shipped with the product, after production manager's validation and (2) the task inspection (on the right) becomes integrated in the IT platform used to record timesheets. In some cases, actions were aimed at eradicating workarounds (e.g., required fields in the IT platform), in other cases, the organization accepted them but acted to mitigate the risks (e.g., double checking quality control procedure).

Evaluating

The purpose of this CAR step is to evaluate the consequences of action taking in the organizational setting [START_REF] Susman | An Assessment of the Scientific Merits of Action Research[END_REF], and comparing them to project objectives and expectations. It was a joint evaluation conducted by researchers and practitioners.

The new models that were developed addressing distinct levels of uncertainty [START_REF] Kaplan | Risk Management and the Strategy Execution System[END_REF][START_REF] Barata | Modeling the Organizational Regulatory Space: A Joint Design Approach[END_REF] were considered by the client organization as an advance when compared to the previous practice of identifying risks based on the ISO 9001 (official) process maps. First, it was simpler to communicate risk-based thinking for the ISO 9001:2015 transition. The framework suggests that risks and workarounds are dynamic and require a continuous (cyclic) effort. Second, it goes beyond traditional business process flowcharts (1) addressing strategic and cultural aspects of enterprise-wide risk management, (2) framing informal processes in risk-based thinking, and (3) highlighting actions to address risks and also opportunities (e.g., reduce process friction to address the workaround practice).

Similarly to risks, it is required to anticipate workarounds and their possible consequences. Interestingly, it was an enjoyment to the CAR participants when they were asked to think, express, and deal with ways of "going around" the formal system. We found three main benefits: (1) increased transparency about the organizational practice; (2) anticipation of formal process risks that can trigger a workaround decision by process participants; and (3) reflection about the risks raised by the workaround execution. The combination of declarative and operational process modeling approaches can provide a more efficient representation of allowable workarounds.

The participants considered that the project exceeded their expectations and should continue involving other workers. Moreover, it was considered that the framework has the potential to contribute for adherence of process documentation (expected model) and practice (executed model), as required by ISO 9001 standard. Nevertheless, due to the participatory nature of the proposed approach, it is necessary to identify potential bias and treats to trustworthiness of the participants' statements. For example, the team structure, the sense of hierarchy, and individual goals can influence the participants' evaluation of risks and workarounds.

Discussion

Recalling the five principles suggested by [START_REF] Davison | Principles of canonical action research[END_REF] to frame our discussion:

 Principle of the Researcher-Client Agreement

The client and the researchers agreed that CAR was an appropriated approach to create a new framework and address the organizational problem of risks and workarounds. The steps of CAR were explained to the company managers, ensuring that they followed them appropriately [START_REF] Susman | An Assessment of the Scientific Merits of Action Research[END_REF][START_REF] Davison | Principles of canonical action research[END_REF], independently of the physical presence of the researchers in the setting. We established weekly goals to simplify team coordination, for example: "identify how model A can be integrated with model B"; "identify potential workarounds for process C". Finally, the organization approved a scientific publication of our results.

 Principle of the Cyclical Process Model

Based on the time constraints of our project, we considered that one CAR cycle was appropriate to propose and test the enterprise-wide framework. We also agreed that it was interesting to conduct a second cycle including process participants. Although we concluded that the guiding framework would be suitable for that second cycle, new challenges emerge to: [START_REF] Alter | Theory of Workarounds[END_REF] promote the open debate about workarounds that occur in the organization (and managers may not be aware of); (2) train process participants about rISk-arounD; (3) make them aware of the potential risks of workarounds; (4) allow them to suggest process improvements that may avoid, mitigate, or accept risks/workarounds; and (5) foster a culture of participative enterprise modeling in the entire organization.

 Principle of Theory

Theory has an important role in CAR to guide the research and to allow discussion of the findings [START_REF] Davison | The Roles of Theory in Canonical Action Research[END_REF]. The creation of a theoretical frame of reference allowed us to promote a shared understanding about CAR and the recommendations for participative enterprise modeling. Moreover, it provided us the starting point to integrate and improve existing models that were independently built for risks and workarounds. It was an opportunity to compare the gaps between models and practices, according to the managers' perspective and literature guidance.

Several studies adopted action research for enterprise modeling, providing contributions to understand the modeling process and the use of specific methods, for example [START_REF] Luebbe | Investigating process elicitation workshops using action research[END_REF]. However, few studies addressed the role of theory in CAR for the creation of high-level frameworks with the participation of organizational users. We advocate that theory can have a central role in participative enterprise modeling for: ─ Diagnosing. We provided a selection of articles about the problem domain to organizational managers, facilitating their active participation from early stages of the project. Interesting debates emerged when managers compared the papers' conclusions with their own experience. ─ Action planning. The understanding of the problem from a theoretical viewpoint facilitated our plan. Practitioners understood the requirements of the approach and the need of a gradual approach to the problem. Moreover, they realized the difficulty to achieve immediate results in risk-based thinking because we could not find a framework that included all the components required for our models. ─ Action taking. Theory guided our actions in practice. We must be aware that researchers are not always present in the research setting, therefore, it is important to empower all the practitioners with the theoretical foundations to conduct (and document) action appropriately, reflecting about the theory and daily practice. ─ Evaluating. The outcomes of this research were constantly evaluated by researchers and practitioners according to the lens of the literature review previously conducted. ─ Specifying learning: Sharing a guiding framework among enterprise modeling participants is an opportunity to (1) promote organizational learning (e.g., "now I understand why model A has the component B"; "now I see why our risk list was scarce and ineffective for process Z: the majority of risks were hidden in multiple workarounds") and (2) compare the advances with current practice. The opinion that managers had about scientific projects significantly improved after CAR, according to them, due to the possibility to combine their immediate interest with scientific advances.

 Principle of Change through Action

Action taking addressed risks and workarounds in the processes of the organization. Therefore, we improved the organization readiness for ISO 9001:2015. The major changes occurred in the organizational risk plans, in process maps, and in IT improvement. The new risks that emerged from the models evaluation resulted in changes to the production and commercial modules of the company's IT systems. Additional controls were included in IT and a new mobile app was developed to assist the component repair process illustrated in Figure 2.

 Principle of Learning through Reflection

The framework is a result of joint reflection by researchers and practitioners. We learned about the benefits of participative enterprise modeling and deepened the analysis of our findings in the current discussion section.

We found advantages in a layered approach to address risks and workarounds, not strictly addressing business processes (level 3 in [START_REF] Kaplan | Risk Management and the Strategy Execution System[END_REF]; level 2 in [START_REF] Nist | Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach[END_REF]), usually evaluated at the operational level and according to its "formal" description of expected sequence. ISO 9001 involves cultural aspects [START_REF]ISO: ISO 9001 Quality management system -Requirements[END_REF][START_REF] Gallear | An Empirical Investigation of the Channels that Facilitate a Total Quality Culture[END_REF] aiming at a culture focused on customer satisfaction, improvement, and involvement of people in quality efforts. Enterprise-wide modeling must address informal business processes and the overall principles of the organization to capture the complexity of routines [START_REF] Pentland | Designing routines: On the folly of designing artifacts, while hoping for patterns of action[END_REF].

Dealing with risks and workarounds is a continuous effort, not limited to a single modeling project. Moreover, there are social aspects that advise a gradual implementation of the framework in daily practice. An open discussion about workarounds and risks is not straightforward: we are also dealing with compliance issues when we acknowledge that reality does not follow the legal or standard procedure. A possible behavior would be to deny workarounds and assume that organizations always act according to what they think, trusting that they are always capable of doing the most difficult thing in the world. We argue that workarounds are natural elements in the "ways of working" [START_REF] Gallear | An Empirical Investigation of the Channels that Facilitate a Total Quality Culture[END_REF] of organizations and the rISk-arounD framework can contribute to finding improvement opportunities at different levels: global; organizational; operational and compliance. A culture of participative enterprise modeling can contribute to the progress of risk-based thinking.

Conclusions

We presented the development of an enterprise-wide framework to deal with risks and workarounds, capturing formal and (informal) "shadow" practices. The setting was an ISO 9001-certified metalworking SME that is preparing the transition for the new ISO 9001:2015 version. We discussed a scenario that aimed at (1) fostering a culture of participative enterprise modeling [START_REF] Stirna | Participative enterprise modeling: Experiences and recommendations[END_REF]; [START_REF] Röder | Workaround Aware Business Process Modeling[END_REF] with the creation of a guiding framework for risk-based thinking (and acting); (3) adopting it in practice with simple models. We used canonical action research that has synergies with participative enterprise modeling. It is necessary to consider five interrelated dimensions in an enterprisewide risk framework, namely context, people, process, IT, and information/data. We confirmed the benefits of integrating workarounds in risk-based thinking to overcome the limitation of formal defined processes, which can bias the analysis of potential risks to the "visible" parts of the models.

To our knowledge, rISk-arounD is the first guiding framework in the scope of ISO 9001:2015 (planned to be released in late 2015) that integrates risks and workarounds. However, there are limitations to take into consideration. First, the framework is inspired in specific references, other models could be used. Second, we propose a high-level representation that was considered suitable for this SME, but the scenario may differ in organizations with increased modeling maturity. Nevertheless, our results can provide guidance in the initial steps of risk modeling. Third, the artifacts were built with simple tools, accessible to all the project participants, however, the representation and visualization of models that result from the framework can be improved with IT support. Forth, the project team only included managers but other process participants can participate. Fifth, the positive results in this socio-technical setting must be cautiously evaluated due to the potential risk of the Hawthorn effect, suggesting that the observed participants behavior could be "related only to the special social situation and social treatment they received" [START_REF] French | Field Experiments: Changing Group Productivity[END_REF].

Future work can involve distinct sectors and more complex scenarios, for example in the highly regulated food industry, for which we already have planned interventions. It would be important to extend our study with additional standards, for example the ISO 31000. The rISk-arounD framework can be adopted to improve modeling methods and languages or to develop new models to deal with uncertainty. Although the rISk-arounD can provide methodical guidance on the steps and sources to integrated modeling of risks and workarounds, the development of new artifacts to assist organizational practice can improve the transferability of our results. A second CAR cycle will address these open issues and involve process participants in the reflection about their potential workarounds, risks, and consequences.

Table 1 .

 1 Examples of certainty/uncertainty models for each dimension.

	Dimension Models for certainty	Models for uncertainty
	Context	The principles that the	"Black swan" list;
		organization states in its
		quality policy;
	People	The company organigram;	Informal power structures; Informal
		Functions;	leaders; Individual goals;
	Process	Process models representing
		activities, roles, business
		rules,…;

Acknowledgements.

The authors thank the three reviewers for their comments and ideas to improve the paper. This work has been partially funded by European Regional Development Fund (ERDF), within the National Strategic Reference Framework (NSRF) -Mais Centro.


Rainer Schmidt
email: rainer.schmidt@hm.edu

Michael Möhring

Ralf-Christian Härting

Christopher Reichstein

Alfred Zimmermann

Sandro Luceri

Benefits of Enterprise Architecture Management -Insights from European Experts

Keywords: EAM, empirical research, benefit of EAM, use of EAM, enterprise architecture management, study, european experts, IT business alignment

Excellence in IT is a key enabler for the digital transformation of enterprises. To realize the vision of Digital Enterprises it is necessary to cope with changing business requirements and to align business and IT. In order to evaluate the contribution of Enterprise Architecture Management to these goals, our paper explores the impact of various factors to the perceived benefit of EAM in enterprises. Based on literature, we build an empirical research model. It is tested with empirical data of European EAM experts using a structural equation modelling approach. It is shown that changing business requirements, IT Business Alignment, the complexity of Information Technology infrastructure as well as enterprise architecture knowledge of Information Technology employees are crucial impact factors to the perceived benefit of EAM in enterprises.

Introduction

Enterprise Architecture is the organizing logic for business processes and IT infrastructure [START_REF] Ross | Enterprise Architecture as Strategy[END_REF]. It reflects the integration and standardization necessary for delivering goods and services [START_REF] Ross | Enterprise Architecture as Strategy[END_REF]. Enterprise Architecture Management [START_REF] Buckl | Enterprise architecture management patterns-exemplifying the approach[END_REF] aims at aligning business and IT. Service-oriented Enterprise Architecture Management and engineering [START_REF] Nurcan | Introduction to the Second International Workshop Service-oriented Enterprise Architecture for Enterprise Engineering[END_REF] target innovative enterprise architectures based on services and cloudcomputing.

One of the challenges to Enterprise Architecture Management is digitization. Digitization embraces the digital representation of data, the automation of processes, and the enrichment of products by services [START_REF] Schmidt | Digitization -Perspectives for Conceptualization[END_REF]. E.g, the majority (63%) of executives in a study from MIT Sloan Management Review said that the pace of digitization, the transformation to digital processes in their organization is too slow [START_REF] Fitzgerald | Embracing Digital Technology[END_REF].

To overcome such challenges, a number of frameworks have been developed such as TOGAF [START_REF] Blevins | TOGAF Version 8.1. 1 Enterprise Edition: A Pocket Guide[END_REF], Archimate [START_REF] Lankhorst | The Architecture of the ArchiMate Language[END_REF], SEAM [START_REF] Wegmann | Systemic Enterprise Architecture Methodology (SEAM)[END_REF] and ARIS [START_REF] Scheer | ARIS-business process modeling[END_REF]. They are supported by a plethora of tools [START_REF] Matthes | Enterprise Architecture Management Tool Survey[END_REF]. Using them, different stages of maturity can be achieved. To formalize these stages, models as described in [START_REF] Ross | Enterprise Architecture as Strategy[END_REF] and [START_REF] Schekkerman | Extended Enterprise Architecture Maturity Model Support Guide (Version 2.0)[END_REF] have been developed.

Despite the ongoing research in academia, the benefits and the use of Enterprise Architecture Management are still a topic of lively discussions (cf. related work section). According to the current literature, there is a gap of research on different influencing factors on the perceived benefit of Enterprise Architecture Management in enterprises as well as a multivariate analysis of it. Therefore, this paper will present insights on the contribution of the perceived benefit of Enterprise Architecture Management that are collected from 126 experts via an empirical model driven research approach and multivariate data analysis based on a structural equation model.

The paper proceeds as follows. In the following section, the research model and the background are described. Then, the research methods and data collection are defined. Finally, we present and discuss the insights obtained from the data collected as well as a section for related work.

Research Model and Background

According to the current topic and challenge of the use and benefit of EAM [START_REF] Boh | Using enterprise architecture standards in managing information technology[END_REF], we explore the impact of different influencing factors regarding the perceived benefit of EAM. In general, the perceived benefit of EAM can be defined as the individual observed benefit of Enterprise Architecture Management in companies (or organizations) from the viewpoint of an EAM expert. Therefore, we develop in this section a theoretical research model with testable hypotheses according to general empirical research guidelines [START_REF] Ang | Research Design for Business & Management[END_REF] [START_REF] Mcburney | Research Methods[END_REF] regarding the current literature [START_REF] Cooper | Synthesizing research: A guide for literature reviews[END_REF].

Changing Business Requirements

Business requirements often change because most organizations compete in dynamic and rapidly altering environments (e.g. need for modification of strategies, business models as well as business processes, etc.) [START_REF] Kennerley | Measuring performance in a changing business environment[END_REF]. The question how to assure the ability of IT to cope with changing business requirements is a topic that received attention in research and practice [17] [8]. Therefore the question, whether Enterprise Architecture Management contributes to the ability of IT to cope with changing business requirements is a subject of high relevance. In consequence, we created hypothesis 1:

Hypothesis 1: Frequent changes of business requirements positively influence the perceived benefits of EAM.

IT Business Alignment

IT Business Alignment is the application of Information Technology in an appropriate and timely way [18] [19]. IT Business Alignment is a crucial topic for IT-management [START_REF] Wegmann | The Systemic Enterprise Architecture Methodology (SEAM). Business and IT Alignment for Competitiveness[END_REF]. The use of Enterprise Architecture Management for the alignment of business IT has been proposed by a number of authors such as [START_REF] Wang | A method of business and IT alignment based on Enterprise Architecture[END_REF] [22] [START_REF] Boucharas | The contribution of enterprise architecture to the achievement of organizational goals: Establishing the enterprise architecture benefits framework[END_REF]. The alignment of business and IT is considered mature, if IT and other business functions adapt their strategies to each other [START_REF] Luftman | Assessing business-IT alignment maturity[END_REF]. The question how organizations improve and achieve a mature alignment of business and IT has been identified as a key subject in management [START_REF] Luftman | Assessing business-IT alignment maturity[END_REF]. Yet, it is not discovered how IT Business Alignment influences the perceived benefit of EAM (from the point of view of European experts). Based on this finding, we created hypothesis 2:

Hypothesis 2: The alignment of Business and IT positively influences the perceived benefits of EAM.

EAM Frameworks

Enterprise Architecture Frameworks [START_REF] Lankhorst | State of the Art[END_REF] provide both means for the specification of architecture components and tools for planning and solving problems [START_REF] Shah | Frameworks for enterprise architecture[END_REF]. Therefore, Enterprise Architecture Frameworks [START_REF] Schekkerman | How to Survive in the Jungle of Enterprise Architecture Frameworks: Creating Or Choosing an Enterprise Architecture Framework[END_REF] [25] [START_REF] Urbaczewski | A comparison of enterprise architecture frameworks[END_REF] are an important concept of Enterprise Architecture Management. Their support for the concerns of CIO's has been already investigated in [START_REF] Lindström | A survey on CIO concerns-do enterprise architecture frameworks support them?[END_REF]. In [START_REF] Boh | Using enterprise architecture standards in managing information technology[END_REF], two questions are discussed: first how governance impacts the use of EA standards and how EA standards support the integration and sharing of IT. Nevertheless, an empirical investigation of this interesting research question did not take place so far. Therefore, we created hypothesis 3:

Hypothesis 3: The use of EAM frameworks has a positive impact on the perceived benefits of EAM.

IT Landscape Complexity

IT landscapes [START_REF] Wittenburg | Building an integrated IT governance platform at the BMW Group[END_REF] are proposed as a mean for Enterprise Architecture Management in order to create integrated IT governance platforms [START_REF] Wittenburg | Building an integrated IT governance platform at the BMW Group[END_REF]. Their visualization is thus an current theme of research [30] [31]. Tackling IT landscape, complexity is an important means for the reduction of IT cost [START_REF] Mattern | Fighting complexity in IT[END_REF]. According to systems science, complexity can be defined by the number of components and relations as well as the heterogeneity of relations and components [START_REF] Simon | The architecture of complexity[END_REF] [START_REF] Widjaja | Heterogeneity in IT Landscapes and Monopoly Power of Firms: A Model to Quantify Heterogeneity[END_REF]. Depicting the IT landscape using enterprise architecture may consequently help to identify areas that are driving cost due to their high complexity [START_REF] Akella | IT Architecture: Cutting costs and complexity[END_REF]. To discover the influence on the perceived benefit of EAM, we created the hypothesis 4:

Hypothesis 4: The complexity of the IT landscape positively influences the perceived benefit of EAM.

EAM Knowledge of IT Employees

The role of IT employees within Enterprise Architecture Management has been addressed by [START_REF] Hoogervorst | Enterprise architecture: Enabling integration, agility and change[END_REF]. The communication of enterprise architectures has been identified as an important theme of research in [START_REF] Lankhorst | Communication of Enterprise Architectures[END_REF]. In general information systems knowledge is very crucial for developing competitive, successful enterprises [START_REF] Laudon | Managing Information Systems: Managing the Digital Firm[END_REF]. To explore the impact of enterprise architecture knowledge of Information Technology employees to the perceived benefit of EAM, we created hypothesis 5:

Hypothesis 5: EAM Knowledge of IT employees influences the perceived benefit of EAM.

Figure 1: Research model

In order to examine the impact of the specified factors on the perceived benefit of Enterprise Architecture Management, participants had to respond to our questions related to the hypothesis in our model (see also Figure 1) within the online-based survey on a one to five Likert scale (5: very important; 4: important; 3: neither... nor; 2: unimportant; 1: very unimportant) [START_REF] Allen | Likert scales and data analyses[END_REF]. The questions related to the hypotheses are listed in the following table :   Table 1: Applied questions according to the hypotheses

Perceived benefit of EAM (How high is the benefit of Enterprise Architecture Management for enterprises?) IT Business Alignment (How important are IT Business Alignments (balancing business and IT goals) for EAM?) EAM Frameworks (How important are EAM frameworks to implement EAM in general?) IT landscape complexity (How important is EAM to manage the IT landscape complexity?) EAM knowledge of IT employees (How important is EAM knowledge of IT employees?)

Changing business requirements (How important is EAM to react to changing business requirements?)

In addition, there are further questions related to the descriptive analysis as well as check questions to ensure a high quality of the study (cf. data collection section).

Research Methods

To investigate our research model, we used a quantitative research approach [START_REF] Newman | Qualitative-quantitative research methodology: Exploring the interactive continuum[END_REF]. In general a quantitative research approach is applied to test the confirmation or disconfirmation of hypotheses [START_REF] Newman | Qualitative-quantitative research methodology: Exploring the interactive continuum[END_REF]. Based on empirical data we want to confirm or disconfirm our hypotheses defined in the last section. A web-based survey is one method to collect quantitative empirical data [START_REF] Lee ; Liebenau | Information systems and qualitative research[END_REF]. According to the next section, we collect these data via the internet from leading European experts.

For analyzing a theoretical model, different approaches like correlation and variance analysis as well as structural equation modeling etc. can be used. To test our hypotheses (theoretical causal model) with the data sample of the web-based survey (empirical data), we chose a structural equation modelling approach (SEM). SEM is a further development of multivariate analyses according to get more details about the analysis of different relations [47] [48]. In general, there are two parts of an SEM [49] [48].

First, the measurement model validates the latent variables. Second, the structural model analyses the relationships between the variables and the model. To visualize the relations between different impact factors (variables), a SEM can be built via several approaches (e.g. AMOS, Lisrel, SmartPLS) [START_REF] Wong | Partial Least Squares Structural Equation Modeling (PLS-SEM) Techniques Using SmartPLS[END_REF]. Because of special requirements through EAM experts (limited data set), we chose SmartPLS. Single item sets are allowed and often used by SmartPLS [START_REF] Ringle | A critical look at the use of PLS-SEM in MIS Quarterly[END_REF]. Furthermore, path significances are calculated via Bootstrapping [START_REF] Wong | Partial Least Squares Structural Equation Modeling (PLS-SEM) Techniques Using SmartPLS[END_REF] [52] [START_REF] Chin | The partial least squares approach to structural equation modeling[END_REF] based on our empirical sample.

Data Collection

To test our developed hypotheses, we conducted a quantitative research model using a web-based online survey [START_REF] Rea | Designing and conducting survey research: A comprehensive guide[END_REF]. Before implementing the online survey in the German language via the open source software LimeSurvey [START_REF]LimeSurveythe free and open source survey software tool ![END_REF], we pretested our questionnaire to ensure a high quality of research standard by removing potential ambiguities.

The revised survey finally started in December 2014 and finished in March 2015.

During the period of 4 months, we received a sample of n=263 different IT experts from Central Europe. Regarding the different participants, we only addressed IT experts with knowledge and experience in Enterprise Architecture Management by contacting them partly formal via email, phone, or letter and partly informal using personal networks.

In addition, the first question in our survey proved the expertise of the respondents in EAM by asking whether the respondent has knowledge and/or experience in EAM or not. Experts that stated to have no knowledge and/or experience in EAM were selected and were no longer taken into consideration. We only asked IT experts, because a previous pre-study in 2014 showed that other experts from outside the Information Technology field cannot well answer to our specific EAM questions. Furthermore, expert surveys are very often used in information systems research (e.g. [START_REF] Friedrich | Discussion and Validation of a CRM System Selection Approach with Experts[END_REF] [57] [START_REF] Schmidt | Big Data as Strategic Enabler -Insights from Central European Enterprises[END_REF]) and can control bias e.g. via cross-checking [START_REF] O'keefe | Validation of expert system performance[END_REF].

After data cleaning, we obtained a final sample of n=126 IT experts having a special expertise in EAM of about 7.56 years on average. Only 1 participant has a work experience with less than 1 year while most of the experts have an EAM work experience of far more than 5 years (see Figure 2): Furthermore, for 44% of the experts (n=56) the size of the enterprise is not decisive for the use of EAM. In contrast to this, 56 % (n=70) define that the size of the enterprise is very important for the use and implementation of EAM.

For the majority of the experts (n=124, 98%) EAM is not only useful for a special industry sector but can be implemented in various industries.

EAM work experience (in years)

After this descriptive analysis, our hypotheses (cf. section II.) are tested in the next section via multivariate analysis.

Results

We tested our empirical data with our research model via structural equation modelling (SEM). Therefore, we used SmartPLS 3.1 [START_REF] Ringle | SmartPLS 2.0 (beta[END_REF]. According to the research method section, we followed the guidelines of SEM to calculate and analyze our model. After SEM modelling and analyzing, we got the following results: According to hypothesis 1 (Frequent changes of business requirements positively influence the perceived benefit of EAM) the frequent change of business requirements has a positive impact on the perceived benefit of Enterprise Architecture Management, because of a positive path coefficient (+ 0.253) of our SEM. Therefore, hypothesis 1 can be confirmed. Based on these results, enterprises have a higher benefit of EAM if they are placed in a dynamic environment with frequent changes of business requirements. The positive impact can be explained also by the theory of transaction costs [START_REF] Williamson | Transaction-Cost Economics: The Governance of Contractual Relations[END_REF]. Studies based on this approach indicate, that information systems, which are aligned with the enterprise strategy, are able to raise business processes to a higher level of efficiency and to generate economies of scale [START_REF] Wigand | Information, organization and management: Expanding markets and corporate boundaries[END_REF]. In that context EAM can help to manage this complexity.

IT Business Alignment is a very important challenge in many enterprises or other organizations [START_REF] Wegmann | The Systemic Enterprise Architecture Methodology (SEAM). Business and IT Alignment for Competitiveness[END_REF]. Our study explores the influence of IT Business Alignment to the perceived benefit of EAM via hypothesis 2. Regarding the results of our structural equation model, we can support hypothesis 2 (The alignment of Business and IT positively influences the perceived benefit of EAM.). The path coefficient (+ 0.206) shows a positive significant influence. Therefore, the benefit of EAM is very huge by implementing a high degree of IT Business Alignment. According to the literature, a high degree of IT Business Alignment is recommended [START_REF] Luftman | Achieving and sustaining business-IT alignment[END_REF]. Thus, EAM should be very important for enterprises.

The impact of enterprise architecture frameworks to the perceived benefit of EAM is discovered in hypothesis 3. Unfortunately, the results are not significant according to table 2 (p > 0.05). Therefore, hypothesis 3 (The use of EAM frameworks has a positive impact on the perceived benefit of EAM.) cannot be confirmed. One reason of this result could be the variance of the data generated by the disagreement of the different experts asked according to this question about EAM frameworks. Another explanation could be various foci of numerous frameworks. That causes a different understanding of EAM frameworks.

The growing Information Technology infrastructure complexity in organizations and enterprises is a very important topic to the daily business of many CIO's [START_REF] Weill | IT savvy: what top executives must know to go from pain to gain[END_REF]. Our research tries to find out, if there is a positive link between the IT landscape complexity and the perceived benefit of EAM. According to our SEM analysis (path coefficient: + 0.218), we can support hypothesis 4 (The complexity of the IT landscape positively influences the perceived benefit of EAM.). In relation to our analysis, we recommend enterprises to use EAM if they have a high complex IT landscape. Therefore, enterprises can better manage complexity from the point of view of the experts asked. This point can also help by acquiring (e.g. Merger & Acquisition transactions) new companies (and their IT landscape) [START_REF] Giacomazzi | Information systems integration in mergers and acquisitions: A normative model[END_REF].

Finally, hypothesis 5 explores the impact of enterprise architecture knowledge of Information Technology employees to the perceived benefit of EAM. Based on our data we can confirm hypothesis 5 (EAM Knowledge of IT employees influences the perceived benefit of EAM.), because of a positive path coefficient (+ 0.164) of the SEM. According to these results, enterprises should train their IT staff with EAM basics and fundamental skills to get a higher benefit of EAM. This could be a sustainable way to ensure a good EAM implementation.

All values of our structural equation modelling analysis are described in the following table: [START_REF] Chin | The partial least squares approach to structural equation modeling[END_REF]. The path coefficients of hypotheses 1,2,4,5 are significant (p < 0.05 according to table 2). Only the path coefficient of hypothesis 3 is not significant (0.936 > 0.05). Furthermore, single item sets are allowed by using the SmartPLS SEM approach as well as often used in research [START_REF] Ringle | A critical look at the use of PLS-SEM in MIS Quarterly[END_REF]. For single item sets there is no need to calculate metrics like Cronbachs Alpha [START_REF] Ringle | A critical look at the use of PLS-SEM in MIS Quarterly[END_REF].

Related Work

Enterprise Architecture Management has been the theme research in a number of areas.

A very broad view on the state of the art in Enterprise Architecture Management can be found in [START_REF] Winter | Investigating the Stateof-the-Art in Enterprise Architecture Management Methods in literature and Practice[END_REF]. A broad and thorough overview on enterprise architecture concepts and principles presented in [66] [67]. To provide a formal foundation for Enterprise Architecture Management, a meta-model is used in [START_REF] Braun | A Comprehensive Enterprise Architecture Metamodel and Its Implementation Using a Metamodeling Platform[END_REF]. In [START_REF] Wissotzki | Development of an enterprise architecture management capability catalog[END_REF] the context of Enterprise Architecture Management is described and challenges for it are identified.

Directly related to our work are the following papers. A literature review is conducted in [START_REF] Niemi | Evaluation of enterprise and software architectures: critical issues, metrics and practices[END_REF] to identify the benefits of Enterprise Architecture. It is supplemented by interviews with seven practitioners from five organizations. Factors for the success of Enterprise Architecture Management in the financial industry are investigated in the empirical analysis in [START_REF] Schmidt | Outcomes and success factors of enterprise IT architecture management: empirical insight from the international financial services industry[END_REF]. The impact of Enterprise Architecture standards on the sharing and the integration of IT resources is investigated in [START_REF] Boh | Using enterprise architecture standards in managing information technology[END_REF].

Digitization and enterprise architecture is the theme of the following papers. In [START_REF] Andersson | Reinventing IT to support digitization[END_REF] the impact of digitization on enterprise IT is analyzed and shifts from efficiency to speed in implementing change is identified as central requirement. In [START_REF] Fitzgerald | Embracing Digital Technology[END_REF] three areas of transformative effects of digitization are identified: improvement of customer experience, operational improvements and business model change. In [START_REF] Hirt | Strategic principles for competing in the digital age[END_REF] the phases of transformation by digitization are analyzed and drivers for digitization are identified.

Beneath these approaches, a number of other researches exist in relation to the investigation presented here. An empirical analysis on the design of Enterprise Architecture Management is presented in [START_REF] Aier | Understanding Enterprise Architecture Management Design-An Empirical Analysis[END_REF]. The relationship of changes in enterprise architecture and business models is investigated in [START_REF] Iacob | From enterprise architecture to business models and back[END_REF]. A relation between Archimate [START_REF] Lankhorst | The Architecture of the ArchiMate Language[END_REF] and the business model canvas [START_REF] Osterwalder | Clarifying business models: Origins, present, and future of the concept[END_REF] is established. Kluge, Dietsch and Rosemann, design a value realization model for Enterprise Architecture in [START_REF] Kluge | How to realise corporate value from enterprise architecture[END_REF]. They identify service quality and actual use as factors for Enterprise Architecture success. The question whether enterprise architecture frameworks give support on managing IT, is discussed in [START_REF] Lindström | A survey on CIO concerns-do enterprise architecture frameworks support them?[END_REF]. The use of an scorecard to depict the strengths and weaknesses in the EA realization is developed in [START_REF] Pruijt | The Enterprise Architecture Realization Scorecard: A Result Oriented Assessment Instrument[END_REF]. A comparative study of methods to measure the effectiveness of enterprise architecture is given in [START_REF] Morganwalp | Enterprise architecture measures of effectiveness[END_REF]. An examination of the organizational factors influencing EAM Challenges is described in [START_REF] Hauder | An Examination Of Organizational Factors Influencing Enterprise Architecture Management Challenges[END_REF]. A catalog of capabilities in Enterprise Architecture Management is developed in [START_REF] Lankhorst | State of the Art[END_REF].

Challenges of Enterprise Architecture Management are identified in [START_REF] Schmidt | Towards a Framework for Enterprise Architecture Analytics[END_REF]. A framework for the support of Enterprise Architecture Management with Advanced Analytics is introduced. In [10] a number of tools for the support of Enterprise Architecture Management are compared. The visualization of Enterprise Architecture Management models is discussed in [START_REF] Schaub | Towards a Conceptual Framework for Interactive Enterprise Architecture Management Visualizations[END_REF].

Conclusion and Discussion

Enterprise Architecture Management is a widely discussed topic and a challenge for practice and research. It plays a crucial role in implementing the vision of digital enterprises. Our paper explores the impact of different important impact factors regarding the perceived benefit of EAM in enterprises. Therefore, we build an empirical research model based on the literature and test it with empirical data of European EAM experts via a structural equation modelling approach.

According to our research, we got interesting insights of different impact factors to the perceived benefit of EAM in enterprises. Changing business requirements, IT Business Alignment, Information Technology infrastructure complexity, as well as enterprise architecture knowledge of Information Technology employees are very important impact factors to the perceived benefit of EAM in enterprises. Nevertheless, one impact factor (EAM Frameworks) could not be significantly explored.

There are different implications according to our research results. First, we contribute to the current information systems research by constructing and testing a new model of the perceived benefit of Enterprise Architecture Management. Our model can help researchers to get a deeper understanding in the benefit of Enterprise Architecture Management in enterprises. Therefore, current approaches of the benefit of information systems can be adapted based on our results. Second, important impact factors, how the perceived benefit of EAM can be explained and influenced, are defined and validated.

Practical users and managers are able to work with our model to prepare EAM decisions by checking their individual instance of the different impact factors to get a recommendation of the perceived benefit of EAM according to their individual enterprise. Employee EAM trainings, good IT Business Alignment etc. can be a good chance for well implementing EAM in enterprises. Therefore, enterprises can go a sustainable as well as very competitive way.

There are some limitations according to our research. First, we only asked experts from Central Europe. There could be other results according to other countries with a different Information Technology use and structure (e.g. BRIC states). Furthermore, there might be some more influencing factors which were not taken into consideration within our quantitative approach. In addition, there are general limitations of a quantitative research method via a web-based survey, according to the literature [45] [82]. A qualitative research approach might probably investigate more influencing factors. Finally, one of our paths is not significant (refer to EAM Frameworkshypothesis 3).

Therefore, future research should enlarge the sample according to the experts asked and involved countries. Furthermore, more domain-specific factors (e.g. in highly complained environments) should be discovered. Current models of the use of

Figure 2 :

 2 Figure 2: EAM Work Experience Circa 84.2 % of the experts are male, only 15.8 % are female. The average age of our EAM experts is 42.54 years. The majority of the experts are from the industry (ca. 90 %). Only ca. 10% (n=13) are researchers in the field of EAM. According to the following figure, the benefit of EAM is important (> 90 %) for most of the experts asked:

Figure 3 :

 3 Figure 3: Benefit of EAM

Figure 4 :

 4 Figure 4: Results of our Research model and empirical data via SEM

Table 2 :

 2 SEM Coefficients, Significance

	SEM Path	Path Coefficient	T Statistics	P Values (Significance)
	EAM-Frameworks  perceived benefit of EAM	0.006	0.080	0.936
	Enterprise architecture
	knowledge of Information Technology employees 	0.164	2.017	0.044
	perceived benefit of EAM
	IT Business Alignment  perceived benefit of EAM	0.206	2.157	0.032
	Information Technology
	landscape complexity 	0.218	2.719	0.007
	perceived benefit of EAM
	changing business
	requirements  perceived	0.253	3.170	0.002
	benefit of EAM

information systems can be adopted and qualitative research approaches can be implemented to get a deeper insight. Future research should use our model to improve and communicate the current understanding of the use of EAM in organizations.