What Every CEO Should Know and Do about IT

A leading researcher, Prof. Joe Peppard, has collaborated with the internationally renowned consultant and author John Thorp to publish a very good article, What Every CEO Should Know and Do about IT.
Their research reveals that, while most investment in IT failed to deliver expected value, CEOs still haven't properly understood their own role in effecting the realization of benefits even when they see IT as core to their 'real' business. Organisations with CEOs who do 'get it' generate superior returns from their IT investments. Those that don't, after rounding up the usual suspects, go on to keep repeating the same mistakes.

Indeed most CEOs have no idea about what is going on and what to do about it; they just want someone to sort out their IT. The Chief Information Officer (CIO) is sometimes empowered - whatever that means - to get on with it, but they can only change what they can control; and that is the delivery of IT not how IT will be used - that is properly the responsibility of business managers.

One unsurprising finding is that executives at all levels are unsure what a CIO is and what to expect of them. What is astounding is that 64% of CIO's have a significantly different perception than the CEO and their CxO colleagues of the CIO role.

The article lists a number of principles of value creation (Box 1), that are all important, but I would add one more, that I believe to be the most critical:

Until CEOs understand the need and accept accountability for clearly articulating the roles, authorities and accountabilities of their managers for business appropriate supply and use of IT and the realization of benefits, it ain't gonna happen.

The article usefully restates how to go about applying these principles. It is not as intimidating as it seems: the CIO can be accountable for facilitating the process so long as it is recognized they do not have the authority nor accountability to lock in the changes needed in the system of business to bring about the expected outcomes. Only a role with overall authority and accountability across the business - the CEO or maybe the COO - can do this and hold managers accountable.



Update 2/8/12:
Broken link changed to now refer to an original blog post by Prof. Peppard; this contains instructions for accessing the article.

Owners Deserve a Better Deal

Drucker said, "In every single business failure of a large company in the last few decades, the board was the last to realize that things were going wrong." In fact the owner was the last to realize.

Protecting the interests of the owner and ensuring that the owner achieves the goals for their investment, ethically and transparently, is the fundamental purpose of corporate governance. By extension, this is also the purpose of corporate governance of IT.

"Top management must take charge if profits are to result" - John Garrity, 1963

Boards of directors and business leaders, over the last 50 years, have failed to ensure that IT related investments create value, despite these investments being responsible for up to 50% of capital expenditure for businesses worldwide.

Consider Cranfield University's study of IS/IT investment appraisal processes of large UK firms (described in Ward and Daniels, "Benefits Management"):

• Only 30% of investment appraisals have adequate involvement of business managers
• Just 10% consider the implications of business changes
• Only 25% of decision makers understand the business case
• Not surprisingly, just 27% of projects deliver the benefits that justified the investment.

If managers are not doing their job then neither are the directors, whose job it is to make sure that management does its job.

"In law, all directors are responsible for the stewardship of the company’s assets. All directors, therefore, whether or not they have executive responsibilities, have a monitoring role and are responsible for ensuring that the necessary controls over the activities of their companies are in place - and working." - Report of the Committee on the Financial Aspects of Corporate Governance, Sir Adrian Cadbury, London, 1992 ("The Cadbury Report").

An effective system of corporate governance allows owners to direct and control the organization within a framework of effective transparency and accountability. It enables the owners to provide input into the organization's overall strategy and direction and receive assurance that the organization is growing in value, fulfilling its responsibilities to stakeholders, and limiting risk exposure to tolerable levels. It is the enabler of improved business performance.

After 50 years it is time to re-frame governance of the use of IT in these terms. We must start using language and concepts that business leaders at the very highest levels readily understand and can adopt. 

The ISO/IEC 38500 standard provides guidance for doing that. It is a business leaders’ framework, free of jargon, for managing risk and maximizing the value of IT. Business leaders that follow its guidance give owners assurance that managers are doing their job.

Consider the Benefits

John Garrity was the first to observe that, in firms with the highest returns on IT investment,  executive management dedicate their time to system projects in proportion to the cost and potential of the systems. They:

• Evaluate the plans for these systems; 
• Make the major IT decisions;
• Monitor and follow up on the results achieved.

In 2006, Dr Raymond Young, Macquarie University, analysed a variety of authoritative literature and reasoned (in "What is the ROI for IT Project Governance?") that currently:

• Overall Return on Investment (ROI) for IT related projects is 30%
• 2/3 of projects deliver no benefits whatsoever
• Overall, every effective dollar of IT investment is producing four dollars of tangible financial benefit to offset the failed and challenged projects. 

Dr Young further reasoned that improved IT project governance practices would ensure that more projects either realized their promised benefits or get put out of their misery. Doing so would:

• Increase overall ROI for projects to between 135% and 240% 
• Increase national GDP by between 1.6% and 3.1% (for Australia).

When governance considers the whole IT investment portfolio, the benefits are even more substantial. MIT Center for Information Systems Research found that the top five percent of firms, in terms of "IT Savvy," earned an average of $250 for each dollar invested in IT infrastructure in the year following the investment. (Weill and Aral, 2005).

These studies highlight that the way most organizations govern their IT investments is denying their owners, and the national economy, a considerable opportunity to create value. Business leaders and stakeholders that elect to do something about it stand to reap huge rewards.

"To remain competitive in a changing world, corporations must innovate and adapt their corporate governance practices so that they can meet new demands and grasp new opportunities." - OECD Principles of Corporate Governance, 2004

Governance of Programmes and Portfolios for Strategic Success

Project management success does not mean project success. There is an important distinction:

• Project management success occurs when the project deliverables are on-time, within budget and according to specification;
• Project success, on the other hand, occurs when the overriding strategic benefits are realized - after all, this is the reason projects are undertaken.

A Cranfield University study reported in 2006 that only 27% of projects deliver intended benefits, supporting earlier studies that suggested that fewer than 10-20% of projects ever deliver the expected benefits and 30-40% of projects are implemented without any discernable benefits whatsoever.

The limitations of project management must be understood to understand why so many projects do not succeed. Two key limitations are that:

1. Many benefits cannot be realized until after the project has ended yet benefits realization must be actively managed; and
2. Project management methods were designed to address the development of new products or assets, not "soft" initiatives, such as as organizational, business process and behavioural change.

A research paper by Raymond Young, Paul O'Conner and Simon Poon, Goverance of Programmes and Portfolios for Stategic Success - Implications from a study of the State of Victoria, demonstrates these issues very well. The paper reports on the results of a study commissioned by the Victoria Auditor General's Office (VAGO) in Australia to evaluate the role of projects within the Victorian public sector and to evaluate the appropriateness of the Victorian Investment Management frameworks:

"The Victorian public sector was expected to be at the forefront of practice but the study suggested billions of dollars are invested in projects with few of the expected strategic benefits being realized."

For example:

"A 2009 VAGO audit of literacy and numeracy found that 10 years of effort by the Victorian Education Department had only lifted literacy in the early childhood years and numeracy had actually declined. There seems to be a similar pattern for Health services where waiting times appear to have remained either static or increased...Our conclusion is that although the Victorian Investment Management frameworks focus on benefits, the emphasis is to ensure an asset is aligned to a benefit rather than the actual realization of a benefit and there is no focus on realizing higher order strategic goals...The high level strategic goals have been clearly defined and relatively stable for at least 10 years. If one of the best performers did not have the tools to help it achieve its strategic goals, what are the implications for the rest of us?"

The paper asserts that the Victorian Investment Management frameworks, though considered to be world class, are inadequate for achieving strategic goals:

"Their strength is that they emphasize a portfolio approach to choosing projects and using benefits as the selection criteria for investment rather than simply focussing on on-time on-budget delivery. Their weakness is that they are directed mainly at asset investments and do not focus on soft-projects even though the majority of project expenditure appears to be on soft-projects...The crucial deficiency seems to the absence of meaningful linkages to programme management."

Furthermore, the paper suggests that the innovations with the most potential to increase project success rates (portfolio management, programme management and project governance) are still too immature to gain widespread adoption:

• Project governance must be closer aligned with corporate governance principles so that top management provides the level of engagement projects need to succeed and have assurance that key governance issues are being addressed.
• Programme management has more potential to deliver strategic benefits but requires more flexibility to support strategic thinking and enable top management and programme management to engage in appropriate levels of questioning, feedback and dialogue.
• Portfolio management must be linked to programme management because strategic outcomes can only be achieved when a whole programme of change is undertaken (the programme then selects the individual projects that will contribute to outcomes).

This has significant implications for organizations that are counting on project management or project portfolio management to achieve IT project success. They need to consider how they will address these issues.

Val IT provides helpful guidance for the governance of IT investment portfolios. It is a coherent approach that can be used to complement existing practices and provides a set of principles, processes and practices for addressing the issues discussed here.

Leadership is seriously absent in governance

I gave a presentation to the NZ SAP User Group meeting this week. My topic was IT Value Management and my objective was to present the case for managing value from IT, rather than just managing IT, and to show the behaviours needed to achieve it and why this must start at the top.

Research by MIT's Center for Information Systems Reseach identified how firms successfully drive value from the use of IT and generate returns on their IT investments that are up to 40 percent greater than their competitors. These IT savvy firms have three obsessions:

1. Fixing what’s broken about IT. Behind a spaghetti IT architecture is a broken accountability framework and decision-making model (in other words, governance). There must be agreement and commitment on how the organization will operate and how resources will be focussed on enterprise initiatives rather than product silos. This determines the high level requirements for a digitized platform.
2. Building a digitized platform that standardizes and automates core data and processes. They start by identifying what is not changing and can be reused over and over again.
3. Exploiting the platform for profitable growth. Executive leadership leads organizational change to drive value from the new asset (the digitized platform).

For more about this, check out Weill & Ross' outstanding book for C-level executives, IT Savvy: What Top Executives Must Know to Go from Pain to Gain. (Businesses should hope their competitors do not read this book.)

On the eve of my presentation, a timely news article aired on national television that New Zealand’s governance bodies are increasingly out of touch with the organisations they are meant to guide. Dr Liliana Erakovic, of the University of Auckland Business School, says her studies on board processes and practices shows New Zealand has a problem with some under-achieving governors who are not prepared to offer leadership.

"Even more concerning is the lack of knowledge and understanding of major customers/suppliers, company dynamics, organisational processes and practices, staff and users within organisations - along with the absence of passion and some governors juggling too many board positions to be effective,"she says.

Contrast this with the three obsessions of IT savvy firms and you can see that under-achieving boards are a major barrier to a firm becoming IT savvy. Dr Erakovic's conclusions help explain the difficulty we have getting the subject of IT value management on the board agenda.

"Boards should be actively involved in the strategy formation of that organisation, yet many governors don’t know enough about the organisation and its major stakeholders, and are not active in enquiring about more information – sometimes because they simply don’t think it is their job to ask for information outside the board papers," says Dr Erakovic.

Strategic IT direction is a board responsibility. The Val IT governance framework provides useful guidance for boards and it can even be used to improve an organization's overall governance processes.
Behaviours must change at the highest levels if firms can ever hope to leverage IT to outperform their competitors. Strong, leadership commitment to strategic governance is needed to:

• Align IT decisions with business objectives so that the right investments are selected and managed throughout their full economic life-cycle;
• Monitor the performance of the IT portfolio;
• Ensure clear accountability for achieving benefits and the requisite business and IT-enabling changes.

Businesses failing to capture IT value

In this recent NBR article, which refers to a survey by ISACA and quotes John Thorp, one can identify at least five key issues that are preventing organizations from realizing value from their information system (IS) and information technology (IT) investments:

• The failure to establish a shared understanding of what constitutes value across the enterprise.
• The failure to focus on and measure the realization of benefits.
• The failure of business stakeholders to own the realization and measurement of benefits, and assign appropriate accountability for the changes needed to realize the benefits.
• The failure to adopt effective value delivery practices, such as Val IT, to manage IT-enabled investments as a portfolio of investments, to include the full scope of activities required to achieve business value, and to manage investments through their full economic life-cycle.
• The failure of boards and CEOs to accept accountability for the performance of their value delivery practices.

Organizations that persist with current value delivery practices cannot reasonably expect to achieve value from their IT-enabled investments, except by chance. In fact, they would problably do better if they gambled the investment in a casino! (A Cranfield Univerity study of the IS investment processes of large companies found that just 27% of projects delivered the benefits that justified the investment. This statistic has remained largely unchanged in 30 years despite the advancements in technology and IT professional practices - the things that IT can control.)

Introducing effective value management requires commitment to a change in behaviour and it is needed from the very top. John Thorp has more to say about this in his blog, Managing Change - The key to Delivering Value: "Individual board members and executives are being asked to change their behaviour – behaviour that they may feel has served them well in the past."

"It is difficult to get a man to understand something when his salary depends upon his not understanding it." - Upton Beall Sinclair, Jr. American novelist and polemicist, 1878-1968

Leveraging the Value of IT in Good Times and Bad

John Thorp's article, Leveraging the Value of IT in Good Times and Bad, published in IndustryWeek.com and discussed in his blog today, describes how between 20%-30% of current and new expenditures can be reduced or curtailed and the potential value of investments increased by two to three times. John's advice is for all business leaders:

• IT can no longer be managed as a black box because IT is now entwined in the business processes that make up an organisation's value chain and investments are not about IT but about change;
• Effective governance is needed to make the right decisions concerning investment in IT-enabled change, manage those investments throughout their full lifecycle so that they continue to create and sustain value, and letting go the ones that won't;
• ISACA's Val IT practices for value governance, portfolio management and investment management can be used selectively to improve the quality of decisions and reduce risk.

Val IT 2.0 is a new framework with supporting publications addressing the governance of IT-enabled business investments (see Getting Started With Value Management).

John Thorp is President of The Thorp Network (http://www.thorpnet.com/), author of The Information Paradox, and Chair of Val IT™ Steering Committee for ISACA.

The Conundrum of IT Management

I found a very good paper entitled "The Conundrum of IT Management" by Professor Joe Peppard, the Chair in Information Systems at Cranfield School of Management and one of the expert reviewers of the Val IT Framework. His paper succinctly explains why CIOs find it difficult to generate business value from IT investments and why organizations must not seek to merely manage IT but manage the delivery of business value through IT - "a subtle but profoundly different objective."

The paper compares the portrayal of the IT function as an island, separated from the rest of the organisation, to an island off the coast of North America: California. In 1705, Father Eusebio Kino sparked a raging fire of criticism by publishing a map showing it as part of the North American mainland. King Ferdinand of Spain, in 1747 eventually stepped in and declared, "California is not an island." Even the King couldn't change some minds though; DeVaugandy's maps of 1770 show California sitting off the coast of North America.

Prof. Peppard asks, "Is the orthodoxy that hindered the recognition that California as an island a reflection of the same myopia that is affecting how organizations currently choose to manage IT?" Research clearly indicates that IT cannot be managed as an island but must be fully integrated with the mainland. "Are managers navigating from a map that clearly is erroneous, but for whatever reason they still chose to follow despite all the evidence that it is inaccurate?"

"IT specialists can build the technical infrastructure and systems, but can never deliver the changes in organization processes, work practices and business models that will ultimately see the creation of business value."

"The key challenge they face is marshalling resources and people that are not under their direct control yet are fundamental to the delivery of business value. One CIO summed up this quest as "fighting against the tide" – attempting to come ashore but being pushed back by more powerful forces."

"In posing the question, 'how can the management of IT be improved', the solution inevitably leads down a route that is inappropriate. The task is not to 'manage IT', but to understand the role that IT can play in the production of business value and to therefore manage the delivery of this value through IT. "

"Focusing improvement efforts within the IT function and is premised on a belief that "the problem" lies there. However, in posing the question as to how the value the organization derives through IT can be improved leads to an altogether different response."

Prof. Peppard points out that the genesis of this problem can be traced back to how organisations have been structured and managed into functional silos, though a process-oriented approach would better capture how the work is actually performed.

Research by Cranfield University's Information Systems Research Centre identified six information competencies that all organizations must possess if they are to have any chance of IT investments delivering value:

1. Business Strategy: Creating and communicating strategy for the organization and defining the role of IT;
2. Defining the Information Systems Contribution (IS Strategy): Translating business strategy into processes, information and system investments and change plans that match the business priorities;
3. Defining the IT Capability (IT Strategy): Translating business strategy into long term information architectures, technology infrastructure and resourcing plans that enable the implementation of the strategy;
4. Supplying IT: Creating and maintaining an appropriate and adaptable information, technology and application supply chain and resource capacity;
5. Delivering Solutions: Deploying resources to develop, implement and operate IS/IT business solutions, which exploit the capabilities of the technology;
6. Exploiting IS/IT Investments: Maximizing the realization of benefits through the effective use of information, applications and IT services.

"Seeking to improve the performance of the IT function is likely to achieve little. A central question must be, how do you begin to develop these six competencies?

"For far too long 'IT' has not only been portrayed as an island, but also managed as one; at many organizations it has been designed and positioned as such."

The paper's key points are:

• Traditional organizational structures, authority patterns, processes and mindsets make IT difficult to manage and actually contribute to the IT-business divide
• The knowledge resources needed to successfully deliver value are distributed throughout the organization, presenting a challenge for the CIO for its integration and coordination.
• With the CIO having little or no jurisdiction over all required knowledge, its deployment will therefore be fragmented
• The conundrum of IT management is how to generate value through IT without having access and authority over necessary resources.
• To deliver value from their organization’s IT investment, more engagement is needed from executives and users from right across the organization. [I suggest, it would be helpful not to wait 42 years for an edict from the King to reinforce this.]
• CIOs are attempting to influence people and decisions as well as encourage involvement and actions that do not fall into their realm of authority and are wrestling with aspects of the organization that can encourage behaviours contrary to creating value.

"IT is not an island, but a part of the mainland. Until this fact is acknowledged and recognized on the organizational map, organizations will continue to struggle to generate value through IT. Equally, the challenge is not to manage IT, but to generate value through IT." - Professor Peppard.

District Health Board software push

I read with interest an article in New Zealand's Computerworld about the NZ Health IT Cluster’s questioning of a Request For Information (RFI) issued by seven District Health Boards (DHBs) for a single patient management system and citing the challenged NHS NPfIT project as a reason to be cautious of this approach.

A point overlooked in this debate is the role of effective governance in the health sector. The article points out that there has been a failure to achieve interoperability through architectural standards, that the RFI is pre-empting the update of the national health IT strategy, and that a single IT system is already deemed to be the only solution– these are significant governance issues. What is going to be done differently to ensure that health sector, or even the DHB collective’s, IT-enabled initiatives will be successful in creating (and not eroding) ongoing value?

Reading the background on the RFI, it is very clear that the health boards place an emphasis on an IT solution, rather than how IT will be used, to deliver benefits. In the absence of sound governance, will anyone even be held accountable for realizing the claimed benefits? Experience and research has proved time and time again that technology is only part of the equation and that desired outcomes can only be achieved with full consideration of the required changes to the business model, business processes, organisational structures and culture, the way people work, and the involvement and commitment of all stakeholders. These are the areas where DHB collaboration must occur and it must be addressed as part of a whole programme of change within a structured and integrated governance framework.

Typically IT drives these initiatives when the clinicians won’t and that should be seen as a red flag — just as it was for the ill-conceived NHS NPfIT project. IT has the potential to improve health care but IT alone will not solve the problem of adoption. A survey found that only 62% of doctors think NPfIT will improve patient care and only 20% of consultants had a card to use electronic records. A US survey of physicians' adoption of outpatient electronic health records found only 13% adoption rates. How can the claimed benefits be achieved given these adoption rates?

Research by the IT Governance Institute is very clear on how organisations successfully create value from investments in IT-enabled change – there is:

• Strategic, leadership-sponsored commitment to IT governance—to align IT decisions with business objectives and to monitor performance with clear accountability for achieving benefits
• Recognition that IT is not just about implementing technology—it is about unlocking IT-enabled business change
• A structured approach to the governance of IT-enabled investments, based on proven practices for doing the right things, the right way, getting them done well and getting the benefits.

The Information Paradox

John Thorp's book, "The Information Paradox", is about the conflict between widely held belief that investment in IT is a good thing and the reality that this, all to often, cannot be demonstrated. My own experience as a CIO affirms the challenges and experiences described in the book. It gives valuable insight into what needs to change to realize value from IT investments and how to go about it. The book describes the Benefits Realization Approach in terms of three fundamentals and three necessary conditions aimed at changing the way people think and manage. It extends this approach with the concept of Enterprise Value Management to stress that the major effort and challenge that organisations must face is implementing not technology but change.

The three fundamentals of the Benefits Realization Approach are:

• a shift from project management to program management to produce clearly identified business results;
• a shift from free-for-all competition for resources to disciplined, strategic portfolio management; and
• a shift from traditional methods of tracking project delivery to full cycle governance to turn concepts into realized benefits.

The three necessary conditions are:

• activist accountability that includes the concept of ownership;
• relevant measurements linked to contribution to outcomes and to lines of accountability;and
• proactive management of change that is visibly led by senior management.

This book was a key source for many of the concepts used in the IT Governance Institute's Val IT framework.

I suggest these works support another paradox: the conflict between the widely held belief that IT alone is responsible for achieving value from IT investments and the reality that 80% or more of the change needed to achieve this value rests with those who hold this view.

Some hard hitting quotes below from the book demonstrate the challenges faced by CIOs:

"Management thinking has failed to understand the implications of the evolving role of IT in business and how critical IT decisions will affect elements of the overall business system beyond technology."

"The persistence of the industrial-age mind-set leads to what we call 'silver bullet thinking' about the capabilities of IT - and, more specifically, about the power of IT alone to deliver business results. Organisations rush to purchase IT 'silver bullets' in the form of customised business solutions, enterprise application packages and other ready-to-wear IT solutions in the naive belief that they come neatly packaged and stamped benefits inside.' ... the magic bullet theory does not tell us who should aim and fire the gun."

"An industrial-age management practice that encourages silver bullet thinking is the use of one-off business cases to support IT investment decisions."

"Another facet of silver bullet thinking is that most, if not all, of the delivery and implementation focus is on the IT project, with blind faith that any other required changes will fall into place."

"Decisions are generally made in the environment of a competitive free-for-all among stand-alone IT projects, each championed by an executive sponsor interested in pushing his or her pet project....the result is that too many IT decisions are made with no greater chance of success than the average gambler in a casino."

"Tough questioning is critical to get rid of silver bullet thinking and lose the industrial-age mind-set that is proving extremely costly to organisations."

"Senior business sponsors must take ownership of the program and accept clear accountability for delivering benefits."

"... in the case of enterprise application packages, our experience suggests that of the work involved in delivering benefits, 80 to 95 percent lies in the areas of organisation, processes and people - on the business side."

"CIOs will have to leave behind some familiar roles - like chief magician of information technology, and honourable head scapegoat!"

"Business sponsors must join CIOs in leaving behind some outdated roles...that of senior cheerleader, who waves magic pompoms internally as the IT team performs more miracles."