6 CIO Tools for Managing IT Risk

“The consequences of not managing risk have hit Americans square in the jaw.”-- Government Executive magazine, March 2009

Too often CIOs see themselves very literally as managing IT. What they need to do is manage risk along with all of the other key leadership issues such as innovation, information-sharing, collaboration, and so on.

Context

The IT environment today is part of a larger social, political, and economic context that is more fraught with risk than ever. The mortgage meltdown, the financial crisis, job losses, volatility in commodity prices (e.g. oil), and so much more—it seems like it will never end. I would add that recently we had birds collide with an airline in NY, satellites that collided in space, and submarines that collided from France and the U.K. Oh, let’s not forget Russia’s invasion of Georgia and the terrorist attacks in India in November that killed at least 173 and wounded 308 and the Asian Tsunami in 2004 that killed over 225,000 people from 11 countries.

This is scary beyond belief!

Is G-d punishing us, teaching us, ignoring us?

Expectations

Whatever is going on, people are crying out for help--they are praying, and they are also turning to their government for “recovery” (as in the Recovery Act), “bailout” (as in taxpayer bailout), “relief” (as in the Troubled Asset Relief Program). The CIO is operating in an environment in which risk management is increasingly something that the average citizen expects from their leaders (and IT is not immune):

--“Citizens are increasingly calling on government to prevent bad things from happening and to ride in to help when they do.” (Donald Kettl).

--“American want life to be less risky…[and so] without realizing it, federal officials are risk managers at their core.”

--“The public, not only demands that the government manage the consequences of risk, but that it deals with problems before they turn into catastrophes. Merely reacting to risk is eroding the people’s trust in government.”

Challenges

While risk management is clearly a critical need, it is also more difficult than ever, for the following reasons:

--Pace and impact—“the problem now is the rapid pace of the challenges—that whatever it is that happens punishes and punishes instantly.”

--Scope—“’we obviously don’t want to get to a state where the government is running everything.’ But with no clear definition of the limit, the number of public risks the government should manage appears endless.”

In my opinion, cost is a huge factor as well. Just the financial crisis so far has cost us trillions of dollars and added to our debt probably for generations to come, and at a time when we are already on the brink with unfunded social security and Medicare liabilities for the baby boomers that are quickly nearing retirement and is feared will overwhelm the system. How much more financial burden can the system take before there are dire consequences?

Framework

There are no easy answers to these trying times or to how we manage the incredible risk that we seem to face virtually every day. However, there are three common approaches to risk management set forth by Moss:

--Reduce it (or eliminate it, if possible)

--Spread it

--Shift it

We often reduce risk, by having a backup plan (such as in IT having backup and recovery), and we mitigate risk by spreading or shifting it (such as through insurance policies or government social programs, and so forth).

6 Tools for CIOs

These lessons in risk management are critical to professionals in information technology, a field that is always in rapid transition with changing products, skill sets, and practices and where the scope of IT impacts almost everything we do (from online finance, health IT, e-commerce, robotics, and more). And where the price of keeping up with Jones in technology is does not come cheap to any organization these days.

In IT, where more than half of projects are over budget or behind schedule and many end up cancelled all together, we need to manage project risk. Here is a suggested toolkit for CIOs to do so:

--First, we need an architecture plan to ensure that we are aligning to business requirements and complying with technical requirements. This helps reduce the risk that we are doing IT the “wrong” way.

--Second we need to have sound IT governance to manage the selection of our investments, the control of cost, schedule, and performance, and the evaluation for lessons for the future. This helps reduce and spread the risk that we are doing the “wrong” IT investments.

--Third, we need solid project management to guide projects from initiation through close out in a defined, repeatable, and measureable way. This helps reduce the risk that we doing projects the “wrong” way.

--Fourth, we need robust IT security that protects our data from manipulation, interception, interjection, or other malice. This helps reduce and spread the risk of our IT working “wrong”.

--Fifth, we need adept customer relationship management so that we are fully engaged with our customers in building solutions that meet their needs and solves their business problems. This helps spread and shift the risk that we are managing our IT customers the “wrong” way.

--And sixth, and not least, we need to focus on our human capital to ensure they have the leadership, motivation, tools, and training to perform at their peak. This helps reduce and spread the risk of human error.

Together, these six CIO tools are the keys to the kingdom when it comes to managing IT risk and we can never take risk management for granted.

6 CIO Tools for Managing IT Risk

Lessons from Space for CIOs

There are no CIOs in space. At least not yet. Someday, as we colonize space, there will be. And information technology will be more important then ever as communications, information sharing, collaboration, and new ways of doing things enable people to live and work in distances that are now just the realm of science fiction.

As I read about space tourism in MIT Technology Review, January/February 2009, I realized there are already lessons for CIOs from space travel even in its nascent stages.

• Modernize, as needed—as technologists, some erroneously think that everything has to be swapped out and modernized every few years (for example, many organizations are on na 3 year refresh cycle—whether they need it or not!), but the Russian space program teaches us differently. They modernize, not on a fixed time, but rather as needed. They work by the principle “if it’s not broken don’t fix it.” Here’s an excerpt: “You can look at the original Soyuz, and the same physical design—same molds, even—appear to have been used throughout its history…But anything that has ever gone wrong or failed, they fix. Or if there is some new technology that comes along that would be of significant benefit, they change it also. Isn’t this a novel principle that we can adapt for sound IT investment management?


• Functional minimalism--for many organizations and individuals, there is a great desire to have the latest and greatest technology gadgets and tools. Some call these folks technology enthusiasts or cutting-edge. And while, IT is incredibly exciting and some missions really need to be cutting-edge to safeguard lives for example. Many others don’t need to have a closet with one of every software package, hardware gadget, or new tool out there. I’ve seen mid-size organizations that literally have thousands of software products—almost as many as people in the entire company! However, on the Russian Soyuz space vehicle, we see a different way. One space tourist noted: “It’s sort of a functional minimalism.” You don’t need tons of gadgets, just what is operationally necessary. CIO’s, as IT strategists and gatekeepers for sound IT investing, should keep this principle in mind and spend corporate investment dollars wisely, strategically, and with careful selection criteria. We don’t need one of everything, especially when half of the investments are sitting in a closet somewhere collecting organizational dust!


• Technology is 3-D—Our IT environment is still mostly stuck in a two-dimensional paradigm. Our user-interfaces, controls, and displays are still primarily flat. Of course, many have conceived of IT in a more real three-dimensional portrayal for example using 3-D graphics, modeling and simulation, holograms, virtual controls, and even virtual world’s in gaming and online. As CIO’s, we need to encourage the IT industry to continue rapid transformation from a 2-D to 3-D technology paradigm. As a corollary, in space where there is little to no gravity such as on the International Space Station, “It is cluttered, but then after a while you realize, well that’s true if you’re thinking in 2-D, but once your brain shift to 3-D, you realize that it isn’t.”


• Think strategic and global—The CIO and his/her staff gets lot of calls everyday based on operational issues. From simple password resets to the dreaded “the network is down.” When firefighting, it is easy to fall into a purely operational way of thinking. How am I going to get this or that user back up. But getting all consumed by operational issues is counterproductive to long-term planning, strategy, and monumental shifts and leaps in technology and productivity. One space tourist looking out the window in space summed it up nicely for CIOs (and others) to get perspective: “You’re out there in space looking back at Earth, and in a way, you’re also looking back at your life, yourself, your accomplishments. Thinking about everything you own, love, or care for, and everything else that happens in the world. Thinking bigger picture. Thinking in a more global fashion.” Maybe every CIO need a picture window view from the Internation Space Station to keep perspective?

Lessons from Space for CIOs

No Choice But to Change

It’s easy to get into a rut and just follow the status quo that we’re used to.

People do it all the time. It’s doing what we know. It’s comfortable. It’s less challenging. It feels less risky. It doesn’t “cause waves” with various stakeholders.

Don’t we often hear people say, “don’t fix it, if it ain’t broke”?

Here’s another more arrogant and obnoxious version of the anti-change sentiment: “don’t mess with perfection!”

And finally, the old and tried and true from the nay-sayer crowd: “we tried that one before.”

Unfortunately, what many of these die-hard obstructionists fail to acknowledge is that time does not stand still for anyone; “Time marches on.” Change is a fact of life, and you can either embrace it or make a futile attempt to resist.

If you embrace it and moreover become a champion of it, you can influence and shape the future—you are not simply a victim of the tide. However, if you resist change, you are standing in front of a freight train that will knock you out and drag you down. You will lose and lose big: Change will happen without you and you will be run over by it.

In short, it is more risky to avoid change than to embrace it.

Therefore, as a leader in an organization, as The Total CIO, you have an obligation to lead change:

• to try to foresee events that will impact the organization, its products/services, its processes, its technology, and its people.
• to identify ways to make the most of changing circumstances—to take advantage of opportunities and to mitigate risks, to fill gaps and to reduce unnecessary redundancies.
• to develop and articulate a clear vision for the organization (especially in terms of the use of information technology) and to steer the organization (motivate, inspire, and lead) towards that end state.
• to course correct as events unfold; the CIO is not a fortuneteller with all knowing premonition. Therefore, the CIO must be prepared to adjust course as more information becomes available. Sticking to your guns is not leadership, its arrogance.
• to integrate people, process, technology, and information; the CIO is not siloed to technology issues. Rather, the CIO must look across the enterprise and develop enterprise solutions that integrate the various lines of business and ensures true information sharing, collaboration, and streamlined integration and efficiency. The CIO is a unifier.
• to institutionalize structured planning and governance to manage change. It’s not a fly by night or put your finger up to see which way the wind is blowing type of exercise. Change management is an ongoing programmatic function that requires clear process, roles and responsibilities, timelines, and decision framework.
• to bring in management best practices to frame the change process. Change is not an exact science, but we can sure learn from how others have been and are successful at it and try to emulate best practices, so we are not reinvesting the wheel.

Change is a fact of life, even if it is often painful.

I’d like to say that maybe it doesn’t have to be, but I think that would be lying, because it would be denying our humanity—fear, resistance, apathy, weariness, physical and mental costs, and other elements that make change difficult.

But while the CIO cannot make change pain-free, he can make change more understandable, more managed (and less chaotic), and the results of change more beneficial to the long term future of the organization.

No Choice But to Change

It's Not The Systems, Stupid

Being a CIO is not just about information technology—IT is a service. The real job of a CIO is truly understanding the IT needs of their customers (those who actually carry out the mission of the organization) and leading the IT people to fulfill those needs.

In essence, the CIO leads his IT staff to deliver on the mission needs of the organization. So being the CIO is far from being just a technical job; it is very much a people job.

To deliver IT then, the CIO must understand how to effectively lead and motivate his people.

There is a terrific book on this subject called “What People Want” by Terry Bacon that identifies 7 primary needs of people in work relationships and particularly how an effective leader can fulfill those needs and in so doing build a high performing workforce.

Here are the primary people needs in relationships:

TRUST—“the most fundamental relationship need. Without trust, there will not be much of a basis for a relationship at all.”
CHALLENGE/GROWTH—“with rare exception, people are not content in trivial, boring, or stagnant jobs…they need to feel that their work is challenging and that they are developing their skills, capabilities, and possibilities.”
SELF-ESTEEM—"appearance, intelligence, talents, autonomy, integrity, awards, titles, positions, job responsibilities, memberships in special groups, acceptance or recognition.”
COMPETENCE—“people want to be expert at something.”
APPRECIATED—“feel pride in who they are and be genuinely accepted for what they contribute.”
EXCITED—“people want to be energized and enthused…it’s more fun than the alternative.”
RELEVANT—“contributing to something they believe in.”

You’ll notice that monetary compensation and benefits are not mentioned here, because that’s not what this is about. Yes, we all need to be able to pay our bills at the end of the month, but beyond that we have basic human needs (trust, challenge, self-esteem…) that are fundamental to people being effective on the job through their interactions with others.

And indeed, every leader can become a better, more effective leader by understanding these relationship needs and developing their abilities to genuinely help people feel fulfilled on these.

For the CIO, I think it is very easy—too much so—to focus on technology. The field is technically intriguing, quickly changing, futuristic, and fundamental to mission. Intentionally or not, the CIO can easily overlook the people that are behind the technical solutions—those that he/she depends on to really tech-enable the organization (it’s not the systems, stupid).

CIOs, take care of your hard-working and talented people—develop their trust, provide challenging work, grow their self-esteem, help them to mature their competences, appreciate them, inspire and excite, and show them they are contributing to something important. And you and they will be more than the sum of the parts and deliver IT solutions to the organization that will truly amaze!

It's Not The Systems, Stupid

Reflections On The Role of a Federal Chief Technology Officer

Had interview today with Federal News Radio on the role of the Chief Technology Officer.

Here are some key points:

1. The CTO is a subject matter expert on technology modernization, transformation and deployment of new technology in the agency.

2. The CTO is responsible to work with the lines of business and IT to ensure that technology is meeting the needs of customers, that enterprise architecture and governance are in place, and that agency is incorporating best practices from all sources into technology operations.

3. The CIO's focus is on the business while that of the CTO is technology. Everything the CTO does is to support the CIO to operationalize his or her decisions and those of the senior leadership team. The CTO also serves as principal advisor to the CIO on IT management best practices, so that these get incorporated into the decision process.

4. A federal CTO would be a positive development because it will give a more prominent voice to the nation’s technology needs.

If there had been more time I would have added that in my view, the most important issue for a federal CTO is to address the need to raise the technology competitiveness of the United States. Technology is our future and we need to be number one.

Reflections On The Role of a Federal Chief Technology Officer

The Perilous Pitfalls of Unconscious Decision Making

Every day as leaders, we are called upon to make decisions—some more important than others—but all having impacts on the organization and its stakeholders. Investments get made for better or worse, employees are redirected this way or that, customer requirements get met or are left unsatisfied, suppliers receive orders while others get cancelled, and stakeholders far and wide have their interests fulfilled or imperiled.

Leadership decisions have a domino effect. The decisions we make today will affect the course of events well into the future--especially when we consider a series of decisions over time.

Yet leadership decisions span the continuum from being made in a split second to those that are deliberated long and hard.

In my view, decision makers can be categorized into three types: “impulsive,” “withholding,” and “optimizers.”

1. Impulsive leaders jump the gun and make a decision without sufficient information—sometimes possibly correctly, but often risking harm to the organization because they don’t think things through.
2. Withholding leaders delay making decisions, searching for the optimal decision or Holy Grail. While this can be effective to avoid overly risky decisions, the problem is that they end up getting locked into “analysis paralysis”. They never get off the dime; decisions linger and die while the organization is relegated to a status quo—stagnating or even declining in times of changing market conditions.
3. Optimizers rationally gather information, analyze it, vet it, and drive towards a good enough decision; they attempt to do due diligence and make responsible decisions in reasonable time frames that keep the organization on a forward momentum, meeting strategic goals and staying competitive. But even the most rational individuals can falter in the face of an array of data.

So it is clear that whichever mode decision makers assume, many decisions are still wrong. In my view, this has to do with the dynamics of the decision-making process. Even if they think they are being rational, in reality leaders too often make decisions for emotional or even unconscious reasons. Even optimizers can fall into this trap.

CIOs, who are responsible for substantial IT investment dollars, must understand why this happens and how they can use IT management best practices, structures, and tools to improve the decision-making process.

An insightful article that sheds light on unconscious decision-making, “Why Good Leaders Make Bad Decisions,” was published this month in Harvard Business Review.

The article states: “The reality is that important decisions made by intelligent, responsible people with the best information and intentions are sometimes hopelessly flawed.”

Here are two reasons cited for poor decision making:

• Pattern Recognition—“faced with a new situation, we make assumptions based on prior experiences and judgments…but pattern recognition can mislead us. When we’re dealing with seemingly familiar situations, our brains can cause us to think we understand then when we don’t.”
• Emotional Tagging—“emotional information attaches itself to the thoughts and experiences stored in our memories. This emotional information tells us whether to pay attention to something or not, and it tells us what sort of action we should be contemplating.” But what happens when emotion gets in the way and inhibits us from seeing things clearly?

The authors note some red flags in decision making: the presence of inappropriate self-interest, distorting attachments (bonds that can affect judgment—people, places, or things), and misleading memories.

So what can we do to make things better?

According to the authors of the article, we can “inject fresh experience or analysis…introduce further debate and challenge…impose stronger governance.”

In terms of governance, the CIO certainly comes with a formidable arsenal of IT tools to drive sound decision making. In particular, enterprise architecture provides for structured planning and governance; it is the CIO’s disciplined way to identify a coherent and agreed to business and technical roadmap and a process to keep everyone on track. It is an important way to create order of organizational chaos by using information to guide, shape, and influence sound decision making instead of relying on gut, intuition, politics, and subjective management whim—all of which are easily biased and flawed!

In addition to governance, there are technology tools for information sharing and collaboration, knowledge management, business intelligence, and yes, even artificial intelligence. These technologies help to ensure that we have a clear frame of reference for making decisions. We are no longer alone out there making decisions in an empty vacuum, but rather now we can reach out –far and wide to other organizations, leaders, subject matter experts, and stakeholders to get and give information, to analyze, to collaborate and to perhaps take what would otherwise be sporadic and random data points and instead connect the dots leading to a logical decision.

To help safeguard the decision process (and no it will never be failsafe), I would suggest greater organizational investments in enterprise architecture planning and governance and in technology investments that make heavily biased decisions largely a thing of the past.

The Perilous Pitfalls of Unconscious Decision Making

IT Planning, Governance and The Total CIO

See new article in Architecture and Governance Magazine on: IT Planning, Governance and the CIO: Why a Structured Approach Is Critical to Long-Term Success

(http://www.architectureandgovernance.com/content/it-planning-governance-and-cio-why-structured-approach-critical-long-term-success)

Here's an exrcept:

"IT planning and governance undoubtedly runs counter to the intuitive response—to fight fire with a hose on the spot. Yet dealing with crises as they occur and avoiding larger structures and processes for managing IT issues is ultimately ineffective. The only way to really put out a fire is to find out where the fire is coming from and douse it from there, and further to establish a fire department to rapidly respond to future outbreaks."

IT Planning, Governance and The Total CIO

Nanobots—Mobility Solutions Saves Organizations Money

Times are tough. The economy is in tatters. People have lost confidence, savings, jobs, and in many cases, even their homes. So, fear is pervasive among consumers, and they are cutting back on their spending.

And in an economy, where consumer spending drives 70% of the total economy, organizations are cutting back to save money too. One thing that they are doing is cutting facility costs and encouraging alternate work arrangements for staff such as teleworking, hoteling, and so forth,

The CIO is a major enabler for these alternate work arrangements and therefore for saving organizations money.

In teleworking, telecommunications is used for workers to link to the office, rather than have them actually commuting to work everyday, and in hoteling, workers have unassigned, flexible seating in the office, so their does not need to be separate office space allocated for every worker.

In these non-conventional work arrangements, IT creates for a far more mobile and agile workforce and this enables organizations to save significant money on costly fixed office space.

According to Area Development Online “as much as 50 percent of corporate office space goes unused at any given time, yet companies continue to pay for 100 percent of it. Yesterday’s ‘everyone in one place’ approach to workspace has become outdated in a business world where some types of work can be more about what you do than where you go.”

Moreover, “With laptops, cell phones, mobile e-mail devices, and high-speed Internet available on every corner — and the 70 million-strong Millennial generation entering the work force — some workers have little need to spend time at a desk in a corporate office. In fact, research group IDC expects 75 percent of the U.S. work force to be mobile by 2011.”

The Wall Street Journal, 15 December 2008 reports that “There’s a new class of workers out there: Nearly Autonomous, Not in the Office, doing Business in their Own Time Staff. Or nanobots for short…Managed correctly, nanobots can be a huge asset to their company.”

Here’s how to enable nanobot workers?

1. Robust technology—give them the access to the technologies they need to be successful; to stay connected and be productive. Remember, the technology has to provide telecommunications to overcome both the geographical distance as well the psychological distance of not having the social contact and face-to-face communication with management, peers, and even staff.
2. Clear performance expectations—It important to set clear performance expectations, since the nanobot is not planted in a cube or office under watchful management eyes. Without clear expectatiuons nanobots may either underwork or overwork themselves. Generally, “nanobots thrive on their driven natures and the personal freedom with which they are entrusted…while nanobots relish the independence that mobile technologies give them, they are painfully aware that their devices are both freeing and binding. In some sense, they set their own hours because of their mobile devices; in another sense, they can never get away from the business which follows them everywhere.”
3. Different strokes for different folks—recognize which employees are good candidates for each type of work arrangement. Some can be very successful working remotely, while others thrive in the office setting. Either way, enabling workers with a variety of mobility solutions will make for a happier and more productive workforce and a more cost efficient enterprise.

Nanobots—Mobility Solutions Saves Organizations Money

Improving Project Management and The Total CIO

IT projects are notorious for coming in late, over cost, and not meeting the customer’s needs.

CIO.com has an excellent article on ways to improve project management in an article entitled, “When Failure is Not an Option,” by Meredith Levinson (3 July 2008).

For organizations, good project management is a critical success factor!

“Project management is the number-one success factor for getting anything done in the organization. A firm’s ability to execute its strategy lies with its ability to manage projects,” according to Sam Lawler, the director of GlassHouse Technologies’ project management practice.

Yet, for years, organizations have faulted CIOs and IT departments with failed IT projects. As recently as 2004, a study by The Standish Group found that only 29% of IT projects “were completed on time, on budget, and with all features and functions originally specified.”

Project management methodologies work when business and IT work together as a team.

There are various methodologies being employed to try to improve project’s success, such as PMBOK and ITIL. However, IT projects’ success depends on IT and business people working together to achieve results; if this partnership and collaboration doesn’t happen, then no PM framework will bring us the project success we desire. Our organization’s business people are critical to ensuring project success—they develop the business case, identify requirements/functional specifications, realign and improve business processes, and test technical solutions to ensure they meet mission and business needs.

No longer is it about tossing the proverbial hot potato to IT and then pointing fingers and assigning blame when something doesn’t work right. Instead, the business and IT people are on the same team, sharing accountability, and working toward the success of the project and the enterprise.

Performance measurement is a must:

Improved project management needs to be accompanied by measurement of project success and reporting on these to executive management. We can’t manage what we don’t measure. And we need transparency to senior management to ensure that everyone—business and IT—have “skin in the game.”

Further, there are trade-offs in project management between cost, schedule, and scope/performance. Changing one affects the others, so we need to manage projects harmoniously in this triad. If for example, a project is delayed or costs more, but delivers on added functionality requested by the business, then the project can still be a success. At the end of the project, success is defined by the business!

Improving Project Management and The Total CIO

Weapons or Troops and The Total CIO

Should the CIO focus on day-to-day operational issues or on IT strategic planning and governance issues?

From my experience many are focused on firefighting the day-to-day and putting some new gadget in the hands of the field personnel without regard to what the bigger picture IT plan is or should be.

In many cases, I believe CIOs succumb to this near-term view on things, because they, like the overall corporate marketplace, is driven by short-term results, whether it is quarterly financial results or the annual performance appraisal.

The Wall Street Journal, 30 October 2008, had an article entitled,
“Boots on the Ground or Weapons in the Sky?”—which seemed to tie right into this issue.

The debate is to which kind of war we should be preparing to fight— the current (types of) insurgencies in Iraq and Afghanistan or the next big war, such as potentially that with Russia or China.

Why are we facing this issue now?

“With the economy slowing and the tab for the government’s bailout of the private sector spiraling higher…lawmakers are signaling that Pentagon officials will soon have to choose.”

And there are serious implications to this choice:

“The wrong decision now could imperil U.S. national security down the road.”

The two sides of the debate come down to this:

Secretary Gates “accused some military officials of “next-war-itis,” which shortchanges current needs in favor of advanced weapons that might never be needed.”

In turn, some military officials “chided Mr. Gates for “this-war-itis,” a short-sighted focus on the present that could leave the armed forces dangerously unprepared down the road.”

From war to technology:

Like the military, the CIO faces a similar dilemma. Should the CIO invest and focus on current operational needs, the firefight that is needed today (this-IT-itis) or should they turn their attention to planning and governing to meet the business-IT needs of the future (next-IT-itis).

But can’t the CIO do both?

Yes and no. Just like the defense budget is limited, so too is the time and resources of the CIO. Sure, we can do some of both, but unless we make a conscious decision about where to focus, something bad can happen.

My belief is operations must be stabilized--sound, reliable, and secure—today’s needs, but then the CIO must extricate himself from the day-to-day firefighting to build mission capabilities and meet the needs of the organization for tomorrow.

At some point (and the sooner, the better), this-IT-itis must yield to next-IT-itis!

Weapons or Troops and The Total CIO

IT Governance and Enterprise Architecture

I came across an interesting IT Governance Global Status Report 2008 from the IT Governance Institute.

The study and report was conducted by PriceWaterhouseCoopers (PwC) was the third one of its kind—the first two conducted in 2003 and 2005. In this latest study for 2007, interviews were conducted with 749 CIOs and CEOs in 23 countries.

Here are some interesting findings from the study on how enterprises are fairing on IT governance and my thoughts on these:

Championed by—in most cases CIOs champion IT governance (40%), followed by CEOs (25%), and then by CFOs (9%).

Since CIOs are predominantly responsible for IT governance, they need to step up and elevate governance as well as its complementary function, enterprise architecture, and resource it as a priority for effectively managing IT investments.

Business management engagement—68% of respondents said that business management participates (42%), leads (14%), or is fully accountable (12%) for IT governance.

From my experience, often business managers are more engaged in IT governance than IT managers; we need to work with the all the SMEs (IT and business) to understand the importance of IT governance and encourage and engage them for their active participation.

Positive view of IT—“Non-IT people…have a much more positive view of IT” than do IT people. 72% of general management agree strongly on the value creation of IT investment versus only 46% of CIOs.

We need to explore why IT professionals have a more negative view of IT than our customers on the business side of the house have and to reconcile this. Is it just that we are professionally self-critical or that know more about our dirty laundry?

Importance of IT to overall corporate strategy—“93 percent of respondents answered that IT is ‘somewhat’ to ‘very important’ to the strategy.”

IT is important to the business achieving its strategic goals. We need to ensure sufficient time, attention, and resources are allocated to developing an IT strategy and enterprise architecture that aligns to and support the business strategy.

IT governance implementation—Only 52% are ‘in the process of’ (34%) or ‘have already implemented’ (18%) IT governance; however, another 24% are considering implementing.

We need to pick up the pace of IT governance implementation. IT governance is critical establishing and enforcing the IT Strategic Plan and enterprise architecture, to vetting IT investment decisions and sharing risks with project shakeholders, and providing oversight and due diligence to ensure successfully project delivery.

Current IT governance practices—Some of these include: “IT resource requirements are identified based on business priorities” (80%), “boards review IT budgets and plans on a regular basis” (72%), “IT processes are regularly audited for effectiveness and efficiency” (67%), “Central oversight exists of overall IT architecture (IT Architecture Board or Committee)” (63%), “IT project portfolio is managed by business departments supported by the IT department” (59%), “Some form of overall IT Strategy Committee exists” (58%), Standard procedures exists for investment selection (IT Investment Committee)” (55%).

IT governance best practices are well established through frameworks such as COBIT, ITIL, and ISO20K. We need to leverage use of these frameworks to develop our organization’s IT governance solutions and ensure this vital enterprise architecture enforcement mechanism!

IT Governance and Enterprise Architecture

IT Planning, Governance and The Total CIO

CIOs are consumed by day-to-day tactical/operational IT issues and firefighting IT problems, and as a result, there is a lack of focus on IT planning and governance—two of the biggest problems facing CIOs today.

ISACA, an organization serving IT governance professionals, conducted a survey consisting of 695 interviews with CEO/CIO-level executives in 22 countries, and published the results in IT Governance Global Status Report 2006.

Here are some of the amazing findings from this study.

Firefighting predominates: “Organizations are suffering from IT operational problems…only 7% of the respondents experienced no IT problems at all in the previous year…Operational failures and incidents…are mentioned by approximately 40 percent of respondents.”

IT’s alignment with Business is weak: Only 56% of the organizations surveyed “understands and supports the business users’ needs.”

Strategic Planning is underrated by CIOs: “More than 93 percent of business leaders recognize that IT is import for delivering organization strategy…Somewhat paradoxically, general management perceives the importance…slightly higher than does IT management.” In fact, in the public sector, IT was viewed as a commodity versus strategically by 47% of respondents!

IT governance is lagging: “CIOs recognize the need for better governance over IT,” to align IT strategy and manage risks. Yet, “when asked if they intend to do or plan IT governance measures, only 40 percent replied in the affirmative.”

Liza Lowery Massey, who previously served as CIO of Los Angeles, says in Government Technology, 9 July 2007:

“Establishing IT governance up front is the No. 1 thing I would do over in my career. IT governance is crucial to a CIO’s sanity.

Further, Liza wrote in Government Technology, 14 April 2008:

“Now when I help my clients implement IT governance, I see the benefits firsthand. They include shrinking your IT department’s to-do list, achieving IT/business alignment, putting teeth into policies and standards, and focusing departments on business needs rather than technology. My work life would certainly have been smoother had I set up governance to address these issues instead of trying to handle them all myself.”

CIO Magazine, 1 November 2006, has an article by Gary Beach, entitled “Most CIOs Fail to Convince Top Management That IT Can Transform Business.”

In this article, Gary notes that the rate of investment in IT is half the rate of corporate profit growth, and he asks why?

Certainly, the failure to align with business, and effectively plan and govern IT is hindering CIO’s ability to succeed.

The unfortunate result, as Andy McCue reported in Silicon.com on 26 April 2007, is that “CIOs and the IT department are in danger of being relegated to the role of support function because of a lack of vision and technology innovation.”

The answer is clearly for CIOs to “stabilize the patient” and get out of firefighting mode, and allocate sufficient time, attention, and resources to IT planning and governance. Only in this way will CIOs effectively align IT with business requirements, solve genuine business problems, innovate and transform the enterprise, and fulfill the strategic role that the business is looking for from them.

IT Planning, Governance and The Total CIO

Talent, Determination, and The Total CIO

To become a great CIO or a great anything, what is the driving factor—talent or determination?

Fortune Magazine, 27 October 2008, has a book excerpt from Talent is Overrated: What Really Separates World-Class Performers from Everybody Else by Geoff Colvin.

Often, as individuals we’re afraid that if we don’t have the inborn talent then we can’t really compete and certainly won’t succeed. But that isn’t true!

Here’s an interesting anecdote about Jeffrey Immelt and Steven Balmer. “One of them recalls, ‘we were voted two guys probably least likely to succeed.’” They played waste-pin basketball with waded-up memos at P&G before becoming CEOs of General Electric and Microsoft.

Research shows talent is not the decisive factor:

“In studies of accomplished individuals, researchers have found few signs of precocious achievement before the individuals started intensive training…Such findings do not prove that talent doesn’t exist. But they do suggest an intriguing possibility: that if it does, it may be irrelevant.”

So if innate talent is what makes for high achievement, what does?

The answer is…”deliberate practice” characterized by the following:

• Stretch goals—“continually stretching an individual just beyond his ir her current abilities.”
• Repetition—“top performers repeat their practice activities to a stultifying extent.”
• Feedback—“in many important situations, a teacher, a coach, or mentor is vital for providing crucial feedback.”
• No pain, no gain—“we identify the painful, difficult activities that will make us better and do those things over and over…if the activities that lead to greatness were easy and fun, then everyone would do them.”

So what do you do if you want to be a great CIO or successful in any professional endeavor?

• Set goals.
• Plan how to reach them.
• Observe yourself/self-regulate.
• Self-evaluate.
• Adapt to perform better.
• Repeat.

This is where determination comes in and makes the difference between success and failure.

“What you want—really, deeply want—is fundamental because deliberate practice is an investment. The costs come now, the benefits later. The more you want something, the easier it will be for you to sustain the needed effort.”

In any case, “the evidence…shows that the price of top level achievement is extraordinarily high…by understanding how a few become great, all can become better.”

Talent, Determination, and The Total CIO

The ABC Strategy and The Total CIO

CIOs have a number of options with respect to upgrading their enterprise’s information technology.

Military Technology Magazine, Volume 12, Issue 8 has an interview with David Mihelcic, the CTO and Principal Director, Global Information Grid, Enterprise Services Engineering, at the Defense Information Systems Agency (DISA).

In the interview, Mr. Mihelcic describes the Adopt, Buy, and Create (ABC) strategy of General Croom:

Adopt—“we want to focus on using technologies that are mature to meet our needs. Our first is to adopt something that’s already in existence” in the enterprise.

Buy—the second choice is to “buy services and products that are readily available in the commercial space.”

Create—“only as a last resort do we create capabilities from scratch.”

The ABC strategy is valuable to CIOs in that is provides a continuum of options for obtaining technologies to meet requirements that starts with adopting existing platforms, which is the most conservative, trusted, and often economical. If we can’t adopt what we already have, then we proceed to buy the technologies we need—this is potentially more risky and expensive in the short term. And finally, if we can’t readily buy what we need, then we create or develop them (usually starting with research and development)—this is the most risky and immediately expensive option.

However, I would suggest that we need not follow this continuum in sequence (A, B, then C) in all cases.

While creating new capabilities is generally expensive in the short term, it can lead to innovation and breakthroughs that are potentially extremely cost effective and strategically important in the longer term. The development of new capabilities often yields competitive advantages through performance improvements. Also, innovations can provide for new revenue sources, market growth, and cost savings. Often the enterprises that are the strongest in their industries or segments are those with a capability that others just can’t match. In fact, I would argue that our nation’s own technological advances are a critical component to maintaining our military’s worldwide superiority.

Therefore, while the ABC Strategy is a good continuum for understanding our technology refresh options, I would advocate that we use the A, B, C’s with agility to meet our needs for innovation and global competitiveness.

The ABC Strategy and The Total CIO

Balancing Strategy and Operations and The Total CIO

How should a CIO allocate their time between strategy and operations?

Some CIOs are all operations; they are concerned solely with the utility computing aspects of IT like keeping the desktops humming and the phones ringing. Availability and reliability are two of their key performance measurement areas. These CIOs are focused on managing the day-to-day IT operations, and given some extra budget dollars, will sooner spend them on new operational capabilities to deploy in the field today.

Other CIOs are all strategy; they are focused on setting the vision for the organization, aligned closely to the business, and communicating the way ahead. Efficiency and effectiveness are two of their key performance measurement areas. These CIOs are often set apart from the rest of the IT division (i.e. the Office of the CIO focuses on the Strategy and the IT division does the ops) and given some extra budget dollars, will likely spend them on modernization and transformation, providing capabilities for the end-user of tomorrow.

Finally, the third category of CIOs, balances both strategy and operations. They view the operations as the fundamentals that need to be provided for the business here and now. But at the same time, they recognize that the IT must evolve over time and enable future capabilities for the end-user. These CIOs, given some extra budget dollars, have to have a split personality and allocate funding between the needs of today and tomorrow.

Government Technology, Public CIO Magazine has an article by Liza Lowery Massey on “Balancing Strategy with Tactics Isn’t Easy for CIOs.”

Ms. Massey advocates for the third category, where the CIO balances strategy and operations. She compares it to “have one foot in today and one in tomorrow…making today’s decisions while considering tomorrow’s impacts.”

How much time a CIO spends on strategy versus operations, Ms. Massey says is based on the maturity of the IT operations. If ops are unreliable or not available, then the CIO goes into survival mode—focused on getting these up and running and stable. However, when IT operations are more mature and stable, then the CIO has more ability to focus on the to-be architecture of the organization.

For the Total CIO, it is indeed a delicate balance between strategy and operations. Focus on strategy to the detriment of IT operations, to the extent that mission is jeopardized, and you are toast. Spend too much time, energy, and resources on IT operations, to the extent that you jeopardize the strategy and solutions needed to address emerging business and end-user requirements, and you will lose credibility and quickly be divorced by the business.

The answer is the Total CIO must walk a fine line. Mission cannot fail today, but survivability and success of the enterprise cannot be jeopardized either. The Total CIO must walk and chew gum at the same time!

Additionally, while this concept is not completely unique to CIOs, and can be applied to all CXOs, CIOs have an added pressure on the strategy side due to the rapid pace of emerging technology and its effects on everything business.

Balancing Strategy and Operations and The Total CIO

The Enlightened Enterprise and the Total CIO

The Total CIO is responsible for the strategy, operations, and governance of everything IT.

The strategy ensures that we are doing the right things and doing them the right way. It’s the CIO’s vision, goals, and objectives for developing IT solutions that meet business requirements.

The operations is providing for core IT functions like voice and data communications, information, applications, infrastructure, security, and so forth,

The governance is how we make decisions about IT. Through good governance we enhance visibility of IT requirements and projects, enable better communication and vetting, share risks, and prioritize, authorize, and control IT investments.

Architecture and Governance Magazine, Volume 4, Issue 2, has a good article titled “Bringing IT Governance from Theory to Action.” (by Davin Gellego and Jon Borg-Breen)

The problem is complexity:

“Even as technology has simplified and become almost invisible to most audiences, the complexity of maintaining technology is reaching a breaking point for information technology organizations…little time is invested between the lines of business and IT to communicate corporate goals and how technology can support these goals. The mandate is simply ‘do more with less.’”

The solution is governance:

Lines of business and IT can no longer work in their respective vacuums. This new interconnectedness means that what affects one now affects all. If problems are no longer confined to one functional area, solutions can’t be either. IT governance defines accountability and decision making and simplifies the challenges of consolidation, outsourcing, and increased visibility—ensuring IT expenditures deliver real business value.”

The traditional organizational paradigm was silos. Everyone works for their particular unit, division, line of business and so on. Each is functionally and organizationally independent. Each develops their own strategy, products and services, customer base, and so on. Each has their own profit and loss statement. Working with other divisions, conducting joint product development, sharing information or ideas, cross-selling, and other collaborative efforts are discouraged, shunned, minimized, and looked at with suspicion. It’s every line of business or man for themselves. A unit that is not “producing” gets disciplined, downsized, reorganized, spun off, or otherwise eliminated. A division head that isn’t meeting their targets is toast! (Interestingly enough, people traditionally work in a “division”—that very word connotes separation, distinctiveness, and divisiveness.)

The enlightened paradigm is cross-functional. Everyone works for the enterprise. Each unit of the enterprise is part of a functional whole. The whole is greater than the sum of the parts. Collaboration, integrated product teams, working groups, information sharing, cross selling, corporate brand, interoperability, standards, component re-use, and other unifying activities are encouraged, taught, mandated, recognized, and rewarded. Performance measures take into account not only how your division is doing, but how it is contributing to overall mission of the organization. The goals of each individual and unit are aligned to the enterprise.

In the enlightened enterprise, The CIO is not running “the IT division,” but rather is providing IT services and solutions to the enterprise. In this paradigm, the CIO requires a structured and mature governance process, so that all stakeholders have a voice at the table and can influence the decision process and ensure more successful project delivery. IT governance provides for a consistent, collaborative decision process. Governance bring business and IT subject matter experts together to communicate, make visible, align, share risks, vet, prioritize, and issue decisions.

“The most successful enterprises engage in both business and IT in investment decisions. IT governance strengthens and clarifies the connection between corporate goals and IT initiatives. And with both business and IT aware of the strategic benefits of a given initiative, the initiative has a far greater chance of company-wide adoption and success.”

In the enlightened enterprise, “no line of business or IT department is an island. What affects one, affects all.” And in this environment, it is The Total CIO who can reach out across the enterprise bringing a unifying IT strategy, a sound, reliable, secure, and cost-effective operations platform, and a governance process to communicate, make visible, share risks, and make better decisions through the participation of all the pertinent IT stakeholders.

The Enlightened Enterprise and the Total CIO

Political Capital and the CIO

Leaders wield power through many means: formal authority, control of scarce resources, use of structures, rules, and regulations, control of decision processes, control of knowledge and information, control of technology interpersonal alliances and networks, and so forth. (Images of Organization by Gareth Morgan).

But one often-neglected factor when it comes to power is likeability, sometimes known as political capital: the late President Ronald Reagan was the epitome of this.

“Political capital is primarily based on a public figure's favorable image among the populace and among other important personalities in or out of the government. A politician gains political capital by virtue of their position, and also by pursuing popular policies, achieving success with their initiatives, performing favors for other politicians, etc. Political capital must be spent to be useful, and will generally expire by the end of a politician's term in office. In addition, it can be wasted, typically by failed attempts to promote unpopular policies which are not central to a politician's agenda.” (Wikipedia)

Every leader (including the CIO)—whether in the public or private sector—manages to get things done in part through their political capital.

For the CIO, this means that while their job is certainly not a popularity contest, they cannot effectively get things done over the long term without rallying the troops, having a favorable image or degree of likeability, and generally being able to win people over. It’s a matter of persuasion, influence, and ability to socialize ideas and guide change.

The CIO can’t just force change, transformation, modernization. He/she must expend political capital to move the organization forward. The CIO must make the case for change, plan and resource it, train and empower people, provide the tools, and guide and govern successful execution.

The Wall Street Journal, 4-5 October 2008, has an editorial by Peggy Noonan that touches on the importance of political capital:

“Young aides to Reagan used to grouse, late in his second term, that he had high popularity levels, that popularity was capital, and that he should spend it more freely on potential breakthroughs of this kind or that. They spend when they had to and were otherwise prudent…They were not daring when they didn’t have to be. They knew presidential popularity is a jewel to be protected, and to be burnished when possible, because without it you can do nothing. Without the support and trust of the people you cannot move, cannot command.”

Certainly if the President of the United States, the most powerful position in the world, cannot execute without political capital, then every leader needs to take note of the importance of it—including the CIO.

Lesson #1 for the CIO: effective leadership requires political capital duly earned and wisely spent.

Political Capital and the CIO

Why a New Blog Called the Total CIO?

As you all know, I have been leading and promoting the concept of User-centric Enterprise Architecture for some time now.

After hundreds of blog posts and numerous articles, interviews, and speeches, I believe it is time to expand the core principles of User-centric EA to encompass all that a CIO can and should do to implement best practices that facilitate total mission success.

Thus, the concept of the "Total CIO".

• The Total CIO is mission-driven. He or she never compromises on delivering IT solutions that meet business requirements. In today's world this means capturing and managing customer requirements, synthesizing business and IT for effective strategy as well as efficient tactical implementation.
  
• The Total CIO is holistically minded. He/she employs best practices from various disciplines (IT, business process reengineering, human capital, etc.) to move the mission forward through infomation technology. This quality speaks to innovation, expansiveness, and thinking outside the box without ever losing sight of the goal.
• The Total CIO is customer-centric. He/she focuses on making it easier for people to use technology. That means he/she is focused on helping people deliver on the mission. This means that rather than speaking in jargon and creating shelfware, he/she delivers useful and usable information and technology to benefit everyone from the CEO to front-line personnel.

I look forward to your comments and input.

Why a New Blog Called the Total CIO?