ENTERPRISE VALUE:

GOVERNANCE
OF IT INVESTMENTS

The ING Case Study

BASED ON C O B I T®
 VAL IT
The IT Governance Institute®
The IT Governance Institute (ITGITM) (www.itgi.org) was established in 1998 to advance international thinking and standards in
directing and controlling an enterprise’s information technology. Effective IT governance helps ensure that IT supports business
goals, optimises business investment in IT, and appropriately manages IT-related risks and opportunities. The IT Governance
Institute offers original research, electronic resources and case studies to assist enterprise leaders and boards of directors in their
IT governance responsibilities.

Disclaimer
The IT Governance Institute (the “Owner”) has designed and created this publication, titled Enterprise Value: Governance
of IT Investments, The ING Case Study (the “Work”), primarily as an educational resource for chief information officers,
senior business and IT management. The Owner makes no claim that use of any of the Work will assure a successful
outcome. The Work should not be considered inclusive of any proper information, procedures and tests or exclusive of other
information, procedures and tests that are reasonably directed to obtaining the same results. In determining the propriety
of any specific information, procedure or test, chief information officers, senior business and IT management should apply
their own professional judgement to the specific circumstances presented by the particular systems or information
technology environment.

Disclosure
Copyright © 2006 IT Governance Institute. All rights reserved. No part of this publication may be used, copied, reproduced,
modified, distributed, displayed, stored in a retrieval system or transmitted in any form by any means (electronic, mechanical,
photocopying, recording or otherwise), without the prior written authorisation of the IT Governance Institute. Reproduction of
selections of this publication for internal and noncommercial or academic use only is permitted and must include full attribution
of the material’s source. No other right or permission is granted with respect to this work.

This publication includes tables and figures developed by, and used with the permission of, SeaQuation Investment Research.
Copyright © 2006 SeaQuation BV.

IT Governance Institute
3701 Algonquin Road, Suite 1010
Rolling Meadows, IL 60008 USA
Phone: +1.847.590.7491
Fax: +1.847.253.1443
E-mail: info@itgi.org
Web site: www.itgi.org

ISBN 1-933284-34-X
Enterprise Value: Governance of IT Investments, The ING Case Study
Printed in the United States of America

2 IT GOVERNANCE INSTITUTE
THE ING CASE STUDY
ACKNOWLEDGEMENTS
THE IT GOVERNANCE INSTITUTE WISHES TO RECOGNISE:
The ITGI Board of Trustees
Everett C. Johnson, CPA, Deloitte & Touche (retired), USA, International President
Abdul Hamid Bin Abdullah, CISA, CPA, Auditor General’s Office, Singapore, Vice President
William C. Boni, CISM, Motorola, USA, Vice President
Jean-Louis Leignel, MAGE Conseil, France, Vice President
Lucio Augusto Molina Focazzio, CISA, Colombia, Vice President
Howard Nicholson, CISA, City of Salisbury, Australia, Vice President
Bent Poulsen, CISA, CISM, VP Securities Services, Denmark, Vice President
Frank Yam, CISA, CIA, CCP, CFE, CFSA, FFA, FHKCS, Focus Strategic Group, Hong Kong, Vice President
Marios Damianides, CISA, CISM, CA, CPA, Ernst & Young LLP, USA, Past International President
Robert S. Roussey, CPA, University of Southern California, USA, Past International President
Emil D’Angelo, CISA, CISM, Bank of Tokyo-Mitsubishi, USA, Trustee
Ronald Saull, CSP, Great-West Life and IGM Financial, Canada, Trustee
Erik Guldentops, CISA, CISM, Belgium, Advisor, IT Governance Institute

The Development Team

Georges Ataya, CISA, CISM, CISSP, Solvay Business School, Belgium
Jac Cuypers, Ernst & Young, Belgium
Steven De Haes, University of Antwerp Management School, Belgium
Erik Guldentops, CISA, CISM, University of Antwerp Management School, Belgium
Gary Hardy, IT Winners, South Africa
Gerrit Koning, SeaQuation, The Netherlands
Cormac Petit, IBM Institute for Business Value, The Netherlands
Michael Schirmbrand, CISA, CISM, CPA, KPMG, Austria
Eddy Schuermans, CISA, PricewaterhouseCoopers, Belgium
John Spangenberg, SeaQuation, The Netherlands
Dirk Steuperaert, CISA, PricewaterhouseCoopers, Belgium
John Thorp, CMC, ISP, The Thorp Network, Canada
Chris Tiernan, Grosvenor Consultancy Services, UK
Alfred Van Gils, CISA, Philips, The Netherlands
Erik van Heijningen, RA, ING, The Netherlands
Paul Williams, MBCS, FCA, Paul Williams Consulting, UK

The ITGI Committee

William C. Boni, CISM, Motorola, USA, Chair
Jean-Louis Leignel, MAGE Conseil, France, Vice Chair
Erik Guldentops, CISA, CISM, University of Antwerp Management School, Belgium
Tony Hayes, FCPA, Queensland Government, Australia
Anil Jogani, CISA, FCA, Tally Solutions Limited, UK
John W. Lainhart IV, CISA, CISM, IBM, USA
Michael Schirmbrand, CISA, CISM, CPA, KPMG, Austria
Eddy Schuermans, CISA, PricewaterhouseCoopers, Belgium
Ronald Saull, CSP, Great-West Life and IGM Financial, Canada

The Expert Reviewers

Gary Bannister, FCMA, CPA, BP, USA
Sushil Chatterji, Edutech Enterprises, Singapore
Vincent Courtois, IT Financial Analyst, National Bank of Belgium, Belguim
Urs Fischer, CISA, CIA, CPA, Swiss Life, Switzerland
John Lainhart IV, CISA, CISM, IBM, USA
Nick Robinson, Ernst & Young, USA
Jan van Puffelen, Unisys Nederland NV, The Netherlands

ITGI is pleased to recognise its affiliates and sponsors

ISACA chapters
Bindview Corporation
CA

IT GOVERNANCE INSTITUTE 3
 VAL IT
ITGI WOULD LIKE TO ACKNOWLEDGE:
Fujitsu, whose generous sharing of its many years of experience with enterprise value
management contributed significantly to the development of the Val IT management practices

ING and SeaQuation for sharing their experience and for their major contribution to the
development of the Val IT management practices. ING, originally through its IT performance
measurement and investment management workflow and since 2005 as SeaQuation, a wholly
independent company, has done substantial investment research into IT and enterprise value.

The following organisations support Val IT as good practice for governance of IT-related business investments:

4 IT GOVERNANCE INSTITUTE
TALIT
VHE ING CASE STUDY
TABLE OF CONTENTS

1. THE VAL IT INITIATIVE ...............................................................................................................................................6

2. VAL IT INTRODUCTION ................................................................................................................................................7

Goal of Val IT.............................................................................................................................................................7

The Need for Val IT ...................................................................................................................................................7
A New Perspective .....................................................................................................................................................8

3. THE VAL IT FRAMEWORK ...........................................................................................................................................9

Val IT Principles.........................................................................................................................................................9
Val IT Processes .......................................................................................................................................................10

4. CASE STUDY—INVESTMENT PORTFOLIO MANAGEMENT AT ING .............................................................................12

The IT Dashboard.....................................................................................................................................................14
IT and Shareholder Value .........................................................................................................................................14
Managing the IT Investment Portfolio .....................................................................................................................14
Inventory of the Portfolio .........................................................................................................................................15
Payback Period of the Portfolio................................................................................................................................16
Net Present Value of the Portfolio............................................................................................................................16
Balancing Risk and Return ......................................................................................................................................18
Putting It Into Practice .............................................................................................................................................19
Value Proposition .....................................................................................................................................................20

5. ANALYSIS OF THE ING CASE STUDY .........................................................................................................................21

Elements of Val IT Illustrated by the Case Study ....................................................................................................21

ING’s Application of Val IT Management Processes...............................................................................................22
Practical Considerations for Small and Medium-sized Businesses .........................................................................23

6. REFERENCES .............................................................................................................................................................25

7. APPENDIX—GLOSSARY ..............................................................................................................................................26

IT GOVERNANCE INSTITUTE 5
 VAL IT
1. THE VAL IT INITIATIVE
This document forms part of the Val ITTM initiative from the Control Objectives for Information and related Technology
IT Governance Institute. The initiative is intended to respond (COBIT®),1 also from ITGI, provides a comprehensive
to the need for organisations to optimise the realisation of framework for the management and delivery of high-quality
value from IT investments. information technology-based services. It sets best practices
for the means of contributing to the process of value creation.
The initiative has drawn on the collective experience of a team
of practitioners and academics, existing and emerging Val IT now adds best practices for the end, providing the
practices and methodologies, and research to develop the means to unambiguously measure, monitor and optimise the
Val IT framework. The work of the team has been reviewed realisation of business value from investment in IT. Val IT
and further enhanced by a broader group of global advisors, complements COBIT from a business and financial perspective
including the organisations that have chosen to endorse the and will help all those with an interest in value delivery
work of the initiative. from IT.

As the initiative evolves, it will include a number of types of This case study, Enterprise Value: Governance of IT
research activities, publications and supporting services Investments, The ING Case Study, describes how ING, a
grouped around the core Val IT framework described in this global financial service company based in The Netherlands,
document, as illustrated in figure 1. manages a portfolio of IT investments and analyses ING’s
approach in the context of the Val IT framework.
Figure 1—The Val IT Series
The guide and examples shown are applicable to all
Technique enterprises, addressing all of the aspects that should be
Guides contained in any IT investment appraisal. The guidance is not,
however, intended to be prescriptive and should be tailored to
En chan
aly al

Ex
An piric

ter ge
sis

fit the enterprise’s management approach. Small and medium-

pri
Em

sized enterprises can adapt the templates to be simpler to

se

Val IT create and maintain, but in all cases the model adopted should
Framework cover business alignment, cost and benefits (financial and
Be

lue ity

non-financial), and risks, as these play a major role in every

nc

Inf mun
e
hm

nc

investment analysis of every enterprise.

m
ark

Co
ing

Research Other documents in the series are available from the ISACA
Cases
Framework Bookstore, www.isaca.org/bookstore.
Supporting Publications
Services

1
COBIT, from the IT Governance Institute, is an internationally accepted standard for IT management processes. The latest edition,
COBIT® 4.0, was released in December 2005.

6 IT GOVERNANCE INSTITUTE
THE ING CASE STUDY
2. VAL IT INTRODUCTION
Goal of Val IT Effective application of the principles, processes and practices
The goal of the Val IT initiative, which includes research, contained in Val IT will enable organisations to:
publications and supporting services, is to help • Increase the understanding and transparency of cost, risks
management ensure that organisations realise optimal and benefits resulting in much better informed management
value from IT-enabled business investments at an decisions
affordable cost with a known and acceptable level of risk. • Increase the probability of selecting investments that have
Val IT provides guidelines, processes and supporting the potential to generate the highest return
practices to assist the board and executive management • Increase the likelihood of success of executing selected
in understanding and carrying out their roles related to investments such that they achieve or exceed their potential
such investments. return
• Reduce costs by not doing things they should not be doing
While applicable to all investment decisions, Val IT is and taking early corrective action on or terminating
primarily targeted at IT-enabled business investments: investments that are not delivering to their expected potential
significant business investments in sustaining, growing or • Reduce the risk of failure, especially high-impact failure
transforming the business with a critical IT component, • Reduce the surprises relative to IT cost and delivery, and in
where IT is a means to an end—the end being to contribute so doing increase business value, reduce unnecessary costs
to the process of value creation in the enterprise. The end and increase the overall level of confidence in IT
and the means are represented by the ‘FourAres’2 as illustrated
in figure 2. The Need for Val IT
The level of investment in IT is significant and continues to
Specifically, Val IT focuses on the investment decision (are increase. Few organisations could operate for long today
we doing the right things?) and the realisation of benefits without their IT infrastructure. Yet, while there are many
(are we getting the benefits?). COBIT, the generally accepted examples of organisations generating value from investing in
international standard for control over IT, specifically focuses IT, at the same time, many executives are questioning whether
on the execution (are we doing them the right way and are we the business value realised is commensurate with the level of
getting them done well?). investment. It is no surprise, then, that there is an increasing

Figure 2—‘Four Ares’

The strategic question. Is the investment: Are we Are we The value question. Do we have:
• In line with our vision doing getting • A clear and shared understanding of the
• Consistent with our businesss principles the right the expected benefits
• Contributing to our strategic objectives • Clear accountability for realising the benefits
• Providing optimal value, at affordable cost, at an
things? benefits? • Relevant metrics
acceptable level of risk • An effective benefits realisation process

The architecture question. Is the investment: The delivery question. Do we have:

• In line with our architecture • Effective and disciplined management, delivery
• Consistent with our architectural principles Are we Are we and change management processes
• Contributing to the population of our doing them getting • Competent and available technical and business
architecture the right them done resouces to deliver:
• In line with other initiatives way? well? – The required capabilities
– The organisational changes required to
leverage the capabilities

2
As described by John Thorp in his book The Information Paradox, written jointly with Fujitsu, first published in 1998 and revised in 2003.

IT GOVERNANCE INSTITUTE 7
 VAL IT
demand from boards and executive management for generally right governance and management processes are in place to
accepted guidelines for investment decison making and optimise the creation of value. Ensuring that value is
benefit realisation. obtained from IT-enabled investments is an essential
component of enterprise governance. It involves selecting
IT-enabled business investments, when managed well within investments wisely and managing them as an asset or
an effective governance framework, provide organisations with service throughout their life cycle.
significant opportunities to create value. Many successful
organisations have created value by selecting the right COBIT provides a comprehensive framework for the
investments and successfully managing them from concept management and delivery of high-quality information
through implementation to realising the expected value. technology-based services. It sets best practices for the means
Without effective governance and good management, IT- of contributing to the process of value creation. Val IT now
enabled business investments provide an equally significant adds best practices for the end, thereby providing the means to
opportunity to destroy value. unambiguously measure, monitor and optimise the returns,
both financial and non-financial, from investment in IT. In a
The message is clear. IT-enabled business investments can preliminary analysis4 undertaken for ITGI, SeaQuation found
bring huge benefits. Indeed, a study carried out within global that the intelligent application of processes as defined by
financial services group ING3 indicates that IT-enabled COBIT and Val IT can help enterprises significantly improve
business investments offer the opportunity to deliver greater the return on their investments. It is not enough, however, to
returns than almost any other conventional investment. This simply have the processes in place. There is empirical
research, carried out in mid-2004, indicated that, in evidence that it is increasing process maturity, as defined by
comparison to more traditional investments such as the Capability Maturity Model (CMM),5 in combination with
commercial real estate, publicly traded equities and sovereign economies of scale and scope, that has the most significant
bonds, the return on a well-balanced portfolio of IT-enabled impact on value creation in terms of total shareholders’ return,
business investments can be expected to be significantly capital efficiency or return on assets. These findings are
higher. However, the result of getting it wrong can be further supported by a recent McKinsey study6 that found that
significant, including catastrophic financial losses and IT investments have little impact unless they are accompanied
competitive disadvantage. by first-rate management practices, and those companies that
combined good management practices with IT investments
A New Perspective performed best of all.
A key lesson to be learned from the experiences mentioned
earlier and many others is that IT investment is no longer Val IT complements COBIT from a business and financial
about implementing IT solutions. It is about implementing perspective and will help all those with an interest in value
IT-enabled change. Business value is generated by what delivery from IT. It has relevance to all management levels
organisations do with IT rather than by the technology across the business and IT, from the CEO and the C-suite to
itself. This implies greater complexity and greater risk than those directly involved in the selection, procurement,
traditionally has been the case. The management practices development, implementation, deployment and benefits
that traditionally have been applied are no longer sufficient. realisation processes. Val IT contains essential guidance for all.
There is a clear incentive for management to ensure that the

3
ING Investor Relations, ‘IT Investment and Shareholder Return’, ING Shareholder’s Bulletin, volume 12, number 2, May 2004, ING Group,
The Netherlands, www.seaquation.com
4
SeaQuation Investment Research, IT and Enterprise Value—Empirical Evidence for Val IT, September 2005. The ITGI pilot study is based on a
sample of the current SeaQuation knowledge bases. The follow-up study will leverage the complete risk and return data repository of more than
2,500 investment projects, representing about US $15 billion, to identify the value drivers to optimise solutions delivery and risk-adjusted return
of IT-enabled business investments.
5
A future Val IT technique guide will provide more information on CMM and guidance on increasing maturity levels.
6
McKinsey & Co., ‘Does IT improve performance?’, The McKinsey Quarterly, June 2005

8 IT GOVERNANCE INSTITUTE
THE ING CASE STUDY
3. THE VAL IT FRAMEWORK7
Value is not a simple concept. Value is complex, context- Val IT consists of a set of guiding principles, and a number of
specific and dynamic. Value is indeed ‘in the eye of the processes conforming to those principles, which are further
beholder’. The nature of value differs for different types of defined as a suite of key management practices. The
organisations. For commercial or for-profit organisations, value relationship between these, and the linkage to COBIT, is
tends to be viewed primarily in financial terms and can be illustrated in figure 4.
simply the increase in profit to the organisation that arises from
the investment. For not-for-profit organisations, including the Figure 4—Relationship Amongst Val IT Principles,
public sector, value is more complex and is often non-financial Processes and Practices, and COBIT
in nature. It should be the improvement in the organisation’s Val IT supports the business goal of
Realising optimal value from IT-enabled business investments
performance against business metrics (which measure what
at an affordable cost with an acceptable level of risk
those whom the organisation exists to serve receive) and/or the
net increase in income that is available to provide those and is guided by
services, either or both of which arise from the investment. A set of principles applied in value management processes

that are enabled by

Figure 3 defines a number of terms that are used in the Key management practices cross-referenced to COBIT key
Val IT framework. While organisations may choose to use controls
different terms, or give different meanings to the terms, it is
and are measured by
important for the reader to understand how the terms are used Key outcome and performance metrics
in this publication.
Figure 3—Definition of Key Terms Used in Val IT
Val IT Principles
Value—The end business outcome(s) expected from an IT-enabled The Val IT principles are:
business investment where such outcomes may be financial,
non-financial or a combination of the two • IT-enabled investments will be managed as a portfolio of
investments.
Portfolio—A grouping of programmes, projects, services or assets
selected, managed and monitored to optimise business return (Note that • IT-enabled investments will include the full scope of
the initial focus of Val IT is primarily interested in a portfolio of activities that are required to achieve business value.
programmes. COBIT is interested in portfolios of projects, services
or assets.) • IT-enabled investments will be managed through their full
Programme—A structured group of interdependent projects that are both economic life cycle.
necessary and sufficient to achieve the business outcome and deliver
value. These projects could include, but are not limited to, changes to the • Value delivery practices will recognise that there are
nature of the business, business processes, the work performed by different categories of investments that will be evaluated
people, as well as the competencies required to carry out the work, and managed differently.
enabling technology and organisational structure. The investment
programme is the primary unit of investment within Val IT. • Value delivery practices will define and monitor key
Project—A structured set of activities concerned with delivering to the metrics and will respond quickly to any changes or
enterprise a defined capability (that is necessary but NOT sufficient to deviations.
achieve a required business outcome) based on an agreed schedule and
budget • Value delivery practices will engage all stakeholders and
assign appropriate accountability for the delivery of
Implement—Includes the full economic life cycle of the investment
programme through retirement, i.e., when the full expected value of the capabilities and the realisation of business benefits.
investment is realised, as much value as is deemed possible has been • Value delivery practices will be continually monitored,
realised, or it is determined that the expected value cannot be realised
and the programme is terminated evaluated and improved.
7
For more information on the structure and components of the framework, see the companion document in the Val IT series, Enterprise Value:
Governance of IT Investments, The Val IT Framework.

IT GOVERNANCE INSTITUTE 9
 VAL IT
Val IT Processes Investment Management (IM)
To obtain return on investment, the Val IT principles should be The goal of investment management is to ensure that an
applied by the stakeholders of the IT-enabled investments in organisation’s individual IT-enabled investment programmes
the following processes: deliver optimal value at an affordable cost with a known and
• Value governance acceptable level of risk by:
• Portfolio management • Identifying business requirements
• Investment management • Developing a clear understanding of candidate investment
programmes
Value Governance (VG) • Analysing the alternatives
The goal of value governance is to optimise the value of an • Defining the programme and documenting a detailed
organisation’s IT-enabled investments by: business case,8 including the benefits details
• Establishing the governance, monitoring and control • Assigning clear accountability and ownership
framework • Managing the programme through its full economic life cycle
• Providing strategic direction for the investments • Monitoring and reporting on programme performance
• Defining the investment portfolio characteristics
This publication describes how one organisation, ING, a
Portfolio Management (PM) global financial service company based in The Netherlands,
The goal of portfolio management is to ensure that an manages a portfolio of IT investments. The publication
organisation’s overall portfolio of IT-enabled investments is further provides an analysis of ING’s approach in the context
aligned with and contributing optimal value to the of the Val IT framework.
organisation’s strategic objectives by:
• Establishing and managing resource profiles To provide a context for the case study and the subsequent
• Defining investment thresholds analysis, the processes and key management practices
• Evaluating, prioritising and selecting, deferring, or rejecting provided by the Val IT framework are illustrated in figure 5.
new investments
• Managing the overall portfolio
• Monitoring and reporting on portfolio performance

8
For more information on the effective development and use of a business case, see the companion document in the Val IT series, Enterprise
Value: Governance of IT Investments, The Business Case.

10 IT GOVERNANCE INSTITUTE
THE ING CASE STUDY
Figure 5—Key Management Practices Supporting the Three Val IT Processes

VG1 Ensure informed and committed leadership .

VG2 Define and implement processes.
VG3 Define roles and responsibilities.
VG4 Ensure appropriate and accepted accountability.
VG5 Define information requirements.
VG6 Establish reporting requirements.
VG7 Establish organisational structures.
VG8 Establish strategic direction. Value
VG9 Define investment categories. Governance PM1 Maintain a human resource inventory.
VG10 Determine a target portfolio mix. (VG) PM2 Identify resource requirements.
VG11 Define evaluation criteria by category. PM3 Perform a gap analysis.
PM4 Develop a resourcing plan.
PM5 Monitor resource requirements and utilisation.
PM6 Establish an investment threshold.
PM7 Evaluate the initial programme
Portfolio concept business case.
Investment Management PM8 Evaluate and assign a relative score to
Management (PM) the programme business case.
(IM) PM9 Create an overall portfolio view.
PM10 Make and communicate the investment decision.
PM11 Stage-gate (and fund) selected programmes.
PM12 Optimise portfolio performance.
IM1 Develop a high-level definition of investment opportunity. PM13 Re-prioritise the portfolio.
IM2 Develop an initial programme concept business case. PM14 Monitor and report on portfolio performance.
IM3 Develop a clear understanding of candidate programmes.
IM4 Perform alternatives analysis.
IM5 Develop a programme plan.
IM6 Develop a benefits realisation plan.
IM7 Identify full life cycle costs and benefits.
IM8 Develop a detailed programme business case.
IM9 Assign clear accountability and ownership.
IM10 Initiate, plan and launch the programme.
IM11 Manage the programme.
IM12 Manage/track benefits.
IM13 Update the business case.
IM14 Monitor and report on programme performance.
IM15 Retire the programme.

IT GOVERNANCE INSTITUTE 11
 VAL IT
4. CASE STUDY—INVESTMENT PORTFOLIO MANAGEMENT AT ING
ING is a global financial services company headquartered in ING hurdle rates and profit targets. Unsurprisingly, ING’s
The Netherlands, with shares quoted on the exchanges of New total shareholder return is in the top quartile (number 2 of the
York (NYSE) and major capital cities in Europe. ING has a peer group, with total shareholder return of 76 percent).
presence in more than 60 countries and serves millions of ING’s superior performance is reflected by an alpha of
customers in mature and emerging markets. The +37 percent, i.e., total shareholder return of 37 percent above
‘bancassurance’ business leverages on the synergies of (life peer group average (source: Bloomberg). The shareholder’s
and property and casualty) insurance, retail and wholesale and and (institutional) investor’s appreciation of ING’s solid track
asset management. ING is ranked 13th in the global league record is indicated by strong growth in market capitalization
table of financial services companies. According to a February from €49 billion in 2004 to €65 billion in 2005. Consistently,
2006 analyst and press presentation, ING has posted strong the company credit ratings from Moody’s and Standard and
profit growth, driven by solid performance of the underlying Poor’s have a stable outlook and are in the range of the AA
business and a continued focus on improving execution and rating, indicating high investment grade quality. The ING case
investing for growth and value creation. The three growth study indicates the co-variance between ING’s superior
engines are ING direct, life insurance activities in developing business performance and the robustness of the IT governance
markets, in particular Central Europe and Asia, and the structure supported by innovative IT portfolio analysis
retirement services business in the US. All growth engines (investment fund management approach of enterprise IT)
continued to show solid growth in 2005. ING’s business in the combined with strong execution capabilities.
mature markets also made a solid contribution to profit
growth. The retail banking activities in Europe posted sharp IT is fundamental to ING group’s business execution and
increases, driven by growth in savings and mortgages. The consequently the executive board takes IT governance
wholesale banking activities showed top-line growth while responsibility extremely seriously. The strong management
continuing to benefit from low-risk cost in a favorable credit commitment is in line with the significance of IT in terms of
environment. Profit from the US life business grew strongly, income statement and balance sheet. ING has an annual IT
driven by asset growth and higher margins. ING continues to spend of about €2.5 billion—about 25 percent of total
focus the attention on controlling capital and operational operating expenditure and about 40 percent of net operating
efficiencies and has taken steps to further improve the cost to income. It employs about 15,000 IT staff, and invests around
(premiums) income in mature markets. €1 billion on IT-enabled capital programmes. Consistent with
ING’s drive to profit growth, IT focuses on contribution to
As a consequence, comparing full-year 2005 with full-year cost containment and value creation. The medium-term
2004, ING group underlying profit before tax rises planning (MTP) process of ING includes an IT section that
19.4 percent to €8,506 million, while earnings per share encourages both business owner and chief information officer
increased 22.7 percent to €3.32. Due to sharpened focus on to act as a chief investment officer (CIO as manager of the
execution, operational efficiency ratios improved sharply corporate investment fund) who carefully balances risk and
indicated by more favorable cost-to-income ratios for banking return in the portfolio of IT-enabled business investments.
and expense ratios for insurance (both expenses as a percent Treating IT as a responsibility or investment centre (rather
of assets under management, and expense-to-premiums ratio). than as a cost centre) increases the likelihood that IT will
There was profitable growth in all lines of business reflected contribute to the value creation process of the enterprise.
in embedded value of life insurance growing 22.9 percent
to €27.6 billion, embedded value profit growing with In recent Massachusetts Institute of Technology (MIT) (USA)
262 percent, (after-tax) risk-adjusted return on capital studies of more than 300 enterprises in 23 countries, the
improving from 16.4 percent to 18.8 percent. Reflecting ING’s researchers found that faster-growing and more agile firms
focus on strict pricing discipline, the internal rate of return for such as 7-11 Japan, United Parcel Service (UPS) and ING
the new life insurance business increased 13.2 percent from Direct had one characteristic in common: a portfolio approach
12.1 percent in 2004. All actual return ratios are well above to IT management with significant investment in the high-

12 IT GOVERNANCE INSTITUTE
 THE ING CASE STUDY
risk, high-return asset class.9 ING is widely considered to be its stakeholders. Central to the delivery of value, alongside
one of the leaders in IT portfolio management from a risk and other critical components, is information technology. ING, in
return perspective.10 For several years, many of the best its quest to maximise the business alignment of IT, has as its
practices described in Val IT have been in use within ING. In main IT decision-making body, the IT and Procurement Policy
particular, ING has embraced an IT governance structure that Board. This board, which meets at least six times each year, is
encourages active IT investment portfolio management. chaired by an executive board director and has amongst its
active membership a minimum of three further main board
In its IT governance tool kit are a detailed annual IT directors together with the general manager Group IT. This
dashboard that includes benchmarking of key IT cost and full and active involvement of such senior directors goes a
operational indicators against its own selected peer group and long way toward ensuring that IT and business matters are
the use of intelligent IT investment portfolio analysis to help properly considered and IT strategy becomes a fully integrated
optimise the risk-related return from its IT investments. part of business strategy, thus maximising alignment.

However, this IT governance tool kit would be ineffective The IT Leadership Council includes the CIOs from the major
without an IT management and governance structure that is business areas and from the major geographies who provide
best enabled to give it leadership and commitment. input and advice to the IT and Procurement Policy Board on
the many current IT issues and opportunities. This link
The overall IT management and governance structure is between the leadership council and the policy board is
shown in figure 6. important, as, to a great extent, it is the members of the
leadership council that have the prime responsibility for the
The executive board of ING has the ultimate executive implementation and execution of the IT strategy approved and
responsibility for the formulation and implementation of the led by the policy board—thus, joint ownership is essential.
group’s business strategy and for sustainable value delivery to

Figure 6—ING’s IT Management and Governance Structure

Executive Board
IT and Procurement
Policy Board

Information Risk Steering Committee IT Leadership Council

IT Standards and Strategic

Architecture Committee Infrastructure
Committee

Lines of Business

Retail Wholesale Insurance Insurance Insurance ING Direct

Banking Banking Europe Asia/Pacific Americas

Regional Infrastructure Group

9
Weill, P.; J.W. Ross; IT Governance: How Top Performers Manage IT Decision Rights for Superior Results, Harvard Business School Press,
USA, 2004
10
Curley, M.; Managing Information Technology for Business Value, Intel Press, 2004

IT GOVERNANCE INSTITUTE 13
 VAL IT
The setting of strategy is supported by ING’s medium-term • Will our IT investment portfolio deliver value to the business?
(three-year) business planning process, the annual IT road The IT dashboard process and its associated reporting are
map, and the findings from the annual IT dashboard and IT described in some detail in an article titled ‘IT Governance
investment portfolio analysis. The IT-related standards-setting and Corporate Governance at ING’, which appeared in
process is supported and enabled by subcommittees covering volume 2, 2004, of Information Systems Control Journal ®.
IT standards, IT architecture and strategic infrastructure. There This article is downloadable from the Journal archive at
is also a high-level Information Risk Steering Committee that, www.isaca.org/journal.
in recognition of the importance of security to the group,
reports directly to the IT and Policy Procurement Board with IT and Shareholder Value
its joint IT and business representation. Of course, ING recognises that IT in itself does not contribute
to business value. It is what is done with IT that has the
To ensure maximum business alignment and optimise potential to add to value creation within the business. Indeed,
resource sharing and the elimination of unnecessary from investment research conducted by SeaQuation, it is clear
redundancy or duplication, there are infrastructure groups and that IT investments, if properly aligned and well executed,
application forums within and across each of the six main have the potential to create more value than almost any other
business entities within ING, including ING Direct, Insurance category of conventional investment, including real estate and
Europe, Retail and Wholesale Banking, Insurance Americas, mergers and acquisitions.
and Insurance Asia/Pacific. This structure enables business
and geography-specific issues to be identified, managed and Figure 7 provides one output from the IT and finance research
governed whilst maximising communication and optimising programme: an overview of the investment characteristics (risk
costs across the group. and return potential, liquidity and residual value) of different
asset classes positioning IT-related investments.
This structure works for ING through the active involvement
of key directors and managers across the whole business and Related research focused on specific IT investment portfolios
through its structural alignment with the organisational within ING and review of the potential for value creation
structure of the business as a whole. This organisational clearly indicates that the return potential from the IT-related
alignment is as much a key factor for success as the alignment investments exceeds by a significant margin the returns
of the business and IT strategies. expected from other types of investment. This high return
outcome is based upon expected, rather than actual,
The IT Dashboard performance. To ensure that the intended value actually is
ING has had an established annual IT dashboard process for delivered there needs to be a reliance on robust and reliable
six years. The original purpose of the dashboard was to business cases and execution of the individual projects11
provide transparency on IT-related costs and selected IT professionally and according to plan. Of course, there also
operational performance indicators to assist the IT and needs to be a defined and workable process for tracking and
Procurement Policy Board and, through it, the Executive measuring the actual benefits realisation. All of these
Board of ING to fulfil their IT governance responsibilities. imperatives are fundamental components of Val IT.
The process has been designed to help answer key governance
questions such as: Managing the IT Investment Portfolio
• How much are we spending on IT? In the same way that a traditional equity investment portfolio
• Should we be spending more or should we be spending less? needs active management, so too does an IT investment
• How do our costs and operational performance compare portfolio. The traditional equity portfolio requires constant
with our peer group? monitoring to reduce earnings volatility and optimise risk-
• How does our IT spend impact our business performance? weighted performance. This involves making decisions on

11
Note that in this case study, ING uses the terms ‘project’ and ‘programme’ somewhat interchangeably. The reader should assume that in most cases a
project, as referenced in the case, meets the description of a programme provided earlier in the document and contains all the necessary initiatives
required to achieve a business outcome.

14 IT GOVERNANCE INSTITUTE
THE ING CASE STUDY
Figure 7—Overview of Investment Characteristics

SeaQuation: Wall Street Approach to Enterprise IT

Risk-Return Profile Various Asset Classes
Financing General Investments Return Risk Liquidity Residual Value Maximum Write Down
• Cash (money market) Lo Lo Hi Hi At market price
• Commodities (e.g., gold) Med Lo Hi Hi At market price

• Derivatives (hedging) Hi Hi Hi Depends Unlimited/(for put options)

• Private equity (e.g., Google) Hi Hi Lo Depends At market price
Balance Sheet

• Public equity (shares) Hi Hi Hi Med At market price

• Fixed income products Lo Lo Hi Hi No write down

• Collectibles (e.g., antiques) Med Med Lo Med At market price
Corporate Investments
• Real estate (office/factory) Med Med Lo Med At market price

• M&A (expansion policy) Med Hi Lo Depends At market price

• IT Investments Med Hi Nil— Nil At cost (TCO) > budget

PP&L
&L to Hi Sunk Cost

increasing or reducing individual stock holdings and, in What follows are examples of the typical metrics and reporting
particular, making disposals of non-performing investments. templates that are used by SeaQuation to support ING in
Precisely the same scrutiny needs to be applied to corporate managing the IT investment portfolio effectively. The graphics
IT investments. that follow are illustrative only. They do not contain actual
ING data.
‘Portfolio management helps overcome the
disconnect in communications between the business Inventory of the Portfolio
and IT communities. It is an excellent way to deal The first issue is to understand the size and shape of the total
with the perennial questions about IT value and IT portfolio. This is difficult in a globally diverse business such as
alignment with the business’. —Bill Rosser, Gartner ING. However, to ensure that the right resources are directed to
the right investments the process starts with a holistic view of
A key factor in active portfolio management is understanding the portfolio (see figure 8). For completeness, the inventory
the extent to which each project is likely to contribute to value of projects includes not only the currently approved projects
creation, remembering that circumstances change during the but also those that are intended by the business, but are not
life cycle of a project and those changes may impact certain yet through the approval process. This provides a more
assumptions in the original business case. As a result, ING has comprehensive view of the need for resources and
each business owner report to the portfolio manager on a management processes for proper monitoring and governance.
quarterly basis during the development phase, to update the From a governance and value perspective, the prime attention
financial, risk and other relevant components of the business is on the discretionary projects although total IT value is
case. This helps ensure that portfolio management and dependent upon satisfactory delivery of all projects. Non-
governance are performed on the latest, most up-to-date discretionary projects consume resources and often have to be
information. given priority to meet regulatory or other imposed deadlines,
so it is essential to understand the impact of these projects on
the delivery of the discretionary projects.

IT GOVERNANCE INSTITUTE 15
 VAL IT
Figure 8—Holistic View of the Portfolio (Example)
Do we know the size and shape of our IT investment portfolio?

Mandatory
# of projects: 150 (8%)
Intended but not yet Budget: € 50 m (3%)
approved
# of projects: 650 (37%)
Budget: € 200 m (10%) Discretionary
# of projects: 500 (28%)
Portfolio Budget: € 150 m (8%)
# of projects: 1750
Budget: € 2000 m
Mandatory
# of projects: 200 (13%)
Budget: € 250 m (7%)
Approved
# of projects: 1100 (63%)
Budget: € 1800 m (90%)
Discretionary
# of projects: 900 (51%)
Budget: € 1550 m (82%)

Payback Period of the Portfolio the cumulative cash flow line reaches the central neutral point.
At ING, it is taken a step further and the payback period is The graph is also used to compare the original expectations
monitored over the life cycle. Figure 9 shows the formal with the final outcome, showing at a glance the extent to
milestones in the typical S-curve indicating the economic which original expectations were actually met.
useful life of the asset:
1. Project initiation (after approval of the business case and Net Present Value of the Portfolio
acquiring the right to spend) For some years ING has used the cumulative net present value
2. Time to market starting after delivery of the functionality (NPV) graph illustrated in figure 10 to indicate value creation
upon project completion (and destruction) from its IT investment portfolio. It
3. Payback period (cumulative cash outflows in equilibrium demonstrates in a very visual way how the total portfolio is
with cumulative cash inflows) intended to deliver value.
4. Value creation (cash inflows outweigh cash outflows on a
cumulative basis—production of net gain) until the In this example, of almost 100 discretionary projects positive
retirement of the asset value is expected to derive from little more than 70 percent,
and fewer than 20 will deliver 80 percent of the positive value
Figure 9 illustrates (using a total portfolio view) how IT- of the portfolio. On the negative side, approximately 30
related investments at ING are seen in the form of a traditional projects appear to deliver zero or negative value.
S-curve over the total life of the investment. In the early stages
(the development and implementation phases), the investment This suggests two key actions to ING’s management:
usually results in negative cash flow but, as the resulting 1. Review all negative NPV projects to determine whether
application becomes implemented and matures, it starts to they should be cancelled, rationalised or rescoped.
repay the investment through the reduction of costs or the 2. Ensure that the ‘crown jewel’ projects are properly
enhancement of revenues. The timing and shape of the resourced and managed and really will deliver the value
S-curve vary according to the specific investments being intended. They may be ‘betting the farm’ on these projects.
modelled and the risk appetite of the corporate investor. On
the graph, the investment achieves payback at the point that

16 IT GOVERNANCE INSTITUTE
THE ING CASE STUDY
Figure 9—Payback Period and Value Creation (Example)

S-curve indicating cash flow movement over the investment life cycle
300

200

100
Cumulative Cash Flow

Initiation Net Gain (Value)

0
Retirement
100 Payback Period

200 Time to Market

(Project Completion)
300
Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4
2006 2007 2008

Figure 10—Net Present Value (NPV) of the Portfolio (Example)

How do our projects contribute to value creation?

450
Max NPV: € 400 m
400

350 - € 100 m
Cumulative NPV (€ m)

300
Total NPV: € 300 m

250

200 70% of projects

contribute to value creation
150
1 11 21 31 41 51 61 71 81 91 101
# Discretionary Projects (sorted by NPV)

IT GOVERNANCE INSTITUTE 17
 VAL IT
Balancing Risk and Return • There are some projects in the high-risk and positive-return
As discussed earlier, anticipated returns are always related to categories (BBB). Depending on the corporate appetite for
risk: the higher the risk, the higher the return that should be risk, this is probably fine as some high-risk projects are
generated. Figure 11 shows how the risk and return spread of likely to form part of any balanced portfolio.
the portfolio is visualised. Note that standard financial • The low-risk and negative-return projects (CCC) also
services credit risk indicators of AAA, BBB, CCC and DDD should be reviewed for their continued viability.
have been used as a common language with which the • Low-risk projects with positive returns (AAA) are fine in
users—in this case, financial services—are familiar. this analysis and need no further review.

From this example, management might make the following A similar visualisation used by ING to demonstrate risk and
observations: return in relation to hurdle rates is depicted in figure 12.
• A significant proportion of the portfolio is in the high- and
maximum-risk categories, but with negative anticipated ING adopted a typical investment banking perspective on IT
returns (DDD). Being discretionary rather than mandatory and used mainstream financial mathematics to calculate the
projects, this begs the question: why are they being Alpha (excess return on IT) and Beta (standard deviation of
undertaken at all? Review of these projects is advised. expected return based on loss statistics) of IT investments.
Perhaps the benefits have been understated and/or the risk The Capital Asset Pricing Model (CAPM) contributes to
overstated, or perhaps they should never have been approved determine the risk-adjusted yield of IT investments against
in the first place. the expected return of more familiar asset classes within the
corporate investment portfolio such as real estate, mergers

Figure 11—Quality of Portfolio Mix Based on Project Ratings (Example)

Risk-NPV Analysis Based on Investment Budgets

Ratings based
on bond market
AAA BBB classifications

AAA - Prime, best

+ quality
2% 15% 26% 2%
BBB - Higher risk,
good quality
Net Present Value

CCC - Speculative
0
DDD - High risk,
poor quality

- 3% 10% 30% 12% Risk Rating

1: Low risk
2: Fair risk
CCC DDD 3: Material risk
4: High risk

1 2 3 4
Risk Exposure

18 IT GOVERNANCE INSTITUTE
THE ING CASE STUDY
Figure 12—Balancing Risk and Return

Outperforming the Index—Efficient Frontier Analysis (Example)

70% Area of circle represents

proportion of IT budget at
each risk interval
60%
Expected Rate of Return

50%

40% Risk Rating

0: Zero risk
30%
Excess Return 1: Low risk
(Alpha) 2: Medium risk
20%
3: High risk
Efficient Frontier Underperforming
10% Risk Assets 4: Maximum risk
Risk-free
Rate: 2.5% Premium
0%
0 1 2 3 4

Fixed Income Common Stock Emerging Countries Private Equity

Risk-free rate is 2.5% based on current one-year Euro-denominated interbank deposits.

and acquisitions, total shareholders’ return of company stocks, Putting It Into Practice
commodities, private equity, hedge funds or governmental In looking at a complete IT project portfolio, care is taken to
bonds. The project finance approach provides the common ensure that project dependencies and links are taken into
denominator, enabling valid comparisons among the cost, account. For example, infrastructure changes (which may be
benefit and risk of each of these investment categories and defined as separate projects) may be needed to provide a
used to estimate the opportunity cost. Consistent with capital platform for a new customer relationship management (CRM)
asset pricing, the risk and return of IT-enabled business system. On their own, the infrastructure changes may not
investments are considered to be balanced if the return is deliver sufficient specific, quantifiable value, but without the
equal or greater than the sum total of the risk-free rate and the changes the CRM implementation will not be possible.
required risk premium based on the risk profile of the project. Therefore, relevant costs of the infrastructure need to be
The curve in figure 12 shows the efficient frontier indicating factored into the CRM project to obtain a complete and
the equilibrium between portfolio risk and return. reliable picture of the real, combined costs and benefits. ING
evaluates the portfolio in terms of a series of programmes,
each containing a number of linked projects, rather than as a

IT GOVERNANCE INSTITUTE 19
 VAL IT
collection of totally independent, stand-alone projects. Value Proposition
Active portfolio management includes, from time to time, The overall benefits accruing from the ING approach include:
cancelling projects due to actual or anticipated non- • Increased financial and risk transparency resulting in
performance. This is not always easy. Some of the issues and improved decision making on an investment portfolio with a
the way they are overcome at ING include: material P&L impact
• Projects develop a momentum of their own once approved • Reduction of false positives (over-optimistic business cases)
and underway. Experience shows that this momentum is not and false negatives (over-pessimistic business cases)
always cost-effective. Accordingly, processes are in place for resulting in more accurate project selection, safer
regular, independent and objective review followed by investments and reduction of opportunity cost
positive action. • Early identification of obsolete or non-performing projects
• Project cancellations are often seen as undesirable. ING resulting in significant cost savings and avoidance of future
instills a culture in which cancelling or rescoping a project budget overruns
as soon as it becomes apparent that it cannot be delivered • More disciplined (operational) risk approach resulting in risk
satisfactorily is seen as a sign of strong management and optimisation and a reduction of the need for costly
good governance. provisions (economic capital)
• The profit and loss (P&L) statement impact can be • Identification of quality (investment grade) projects from a
significant if the project under scrutiny is large and previous risk and return perspective resulting in more focused and
costs have been capitalised. Cancelling the project then leads increased investment in promising business opportunities
to these costs being written off in one P&L account hit. This (upside risk)
is not always a preferred measure from a short-term profit-
maximisation perspective, but it may be necessary for
financial prudence and regulatory compliance.

20 IT GOVERNANCE INSTITUTE
THE ING CASE STUDY
5. ANALYSIS OF THE ING CASE STUDY
This section reflects on the case study and discusses: describes the five focus areas of IT governance: strategic
1. How the case study illustrates the various elements of Val alignment, performance measurement, resource management,
IT described previously: risk management and, of course, value delivery. Without going
• The IT governance focus areas of Val IT into detail on the processes involved, the case study provides
• The principles of Val IT illustrations of some of the charts and reports used in the risk
2. How ING has applied Val IT’s management processes: management and value delivery focus areas.
• Value governance
• Portfolio management Val IT Principles
• Investment management Val IT consists of a set of guiding principles and a number of
processes conforming to those principles that are further
ING is a large, sophisticated and complex organisation in an defined as a set of key management practices. The Val IT
industry that is highly regulated and known for its IT intensity. principles, with corresponding references to the case study, are:
Not surprisingly, therefore, it has developed a number of • IT-enabled investments will be managed as a portfolio of
correspondingly sophisticated and mature processes for investments. The case study shows several examples of
managing its use of IT. Smaller and medium-sized firms or ING’s approach to managing its IT investment portfolio.
those in other industries may opt for somewhat simpler • IT-enabled investments will include the full scope of
processes. Using the example provided by the case study, the activities that are required to achieve business value. The
second part of this chapter considers some practical case study does not show the full scope, but it does illustrate
considerations for small and medium-sized businesses, some of the reports used by top management in reviewing
including: the sources of that business value.
1. The IT governance structure • IT-enabled investments will be managed through their full
2. Managing the IT investment portfolio economic life cycle. The case study shows some of the
• Inventory of the portfolio considerations in evaluating investments, but it does not, for
• Payback period of the portfolio instance, show performance achieved other than as a
• NPV of the portfolio prognosis based on revised budgets.
• Risk vs. return of the portfolio • Value delivery practices will recognise that there are
3. A general framework for IT governance different categories of investments that will be evaluated
• Key success factors and managed differently. This principle is illustrated in the
• Strategic alignment between business and IT case study.
• Value delivery practices will define and monitor key
Elements of Val IT Illustrated by the Case Study metrics and will respond quickly to any changes or
This case study shows several important—and probably deviations. This concept is illustrated in the case study.
unique—aspects of how a proposed portfolio of IT • Value delivery practices will engage all stakeholders and
investments is analysed and evaluated. For the sake of assign appropriate accountability for the delivery of
completeness, it is advantageous to review first the domains capabilities and the realisation of business benefits. This
and principles of Val IT to show where the case study principle is not part of the case study.
provides assistance. • Value delivery practices will be continually monitored,
evaluated and improved. The case study shows a moment-
IT Governance Focus Areas and Val IT in-time analysis of the IT investment portfolio, not the
A companion document to this one, Enterprise Value: processes for continuous monitoring, evaluation and
Governance of IT Investments, The Val IT Framework, improvement.

IT GOVERNANCE INSTITUTE 21
 VAL IT
To obtain return on investment, the Val IT principles should be considers different investment categories (VG9 Define
applied by the stakeholders of the IT-enabled investments in investment categories) and has different evaluation criteria for
the following management processes: each category (VG11 Define evaluation criteria by category).
• Value governance The evaluation criteria themselves are not discussed. The case
• Portfolio management study also shows how the target portfolio mix (VG10
• Investment management Determine a target portfolio mix) at ING is determined:
particular attention is given to the balance between risk and
While the case study shows some aspects of value return, and different hurdle rates are used depending upon the
governance, it is focused on portfolio management. The inherent risk and external factors such as the general trends in
processes in investment management for actually managing the market.
the start-up and running of the projects in the portfolio are not
shown. Portfolio Management
As already mentioned, this case study focuses on portfolio
ING’s Application of management. For that reason, it is appropriate to look at each
Val IT Management Processes section in the case study in turn and relate it to Val IT’s
Value Governance portfolio management process and its supporting key
The IT governance framework at ING, which is discussed management practices. Note that the practices concerning
previously, shows clearly how ING strives to ensure that the resource management and the development of the business
(business) leaders of the firm are informed and committed case (PM1-PM8) are not discussed. The charts shown in the
(VG1 Ensure informed and committed leadership)12 and the case study are all part of what is required for the portfolio
organisation structure is established to do that (VG7 Establish analysis and assessment practices (PM9-PM14). Of course,
organisational structures). ING’s IT dashboard is primarily a more detailed reporting on individual projects than is shown
communication vehicle to provide the necessary transparency here is required to perform the practices.
into IT for top management to enable them to make the right
decisions. All of the charts shown above are part of the All of the charts in the case study show the overall portfolio
process (VG2 Define and implement processes) for realising a (PM9 Create an overall portfolio view) and ways of looking at
clear and active linkage among the enterprise strategy, the that portfolio to be able to analyse it. They show how ING
portfolio of IT-enabled investment programmes that execute defines and differentiates its investment categories (VG9
the strategy, the individual investment programmes, and the Define investment categories) as well as how the first step in
business and IT projects that make up the programmes. the investment decision is made (PM10 Make and
communicate the investment decision). Once the categories are
There is also a brief discussion of the roles and clear, different evaluation criteria can be applied and the
responsibilities of senior management (VG3 Define roles and portfolio adjusted so that the target mix (VG10 Determine
responsibilities) defined in the governance structure, and it is target portfolio mix) at ING is achieved. These charts are then
possible to deduce something of who is accountable for what used in the remaining stages of portfolio management, which
(VG4 Ensure appropriate and accepted accountability). Most include:
important, there is some of the information required • PM11 Stage-gate (and fund) selected programmes.
(VG5 Define information requirements) and the kinds of • PM12 Optimise portfolio performance.
reports (VG6 Establish reporting requirements) that are used • PM13 Re-prioritise the portfolio.
to communicate essential characteristics of the IT investment • PM14 Monitor and report on portfolio performance.
portfolio to top management. The case shows how ING

12
This and succeeding references are to the key management practices outlined in the companion volume in the Val IT series, Enterprise Value:
Governance of IT Investments, The Val IT Framework, and illustrated in figure 5.

22 IT GOVERNANCE INSTITUTE
THE ING CASE STUDY
Investment Management In small to medium-sized businesses, just as at ING, reporting
As already mentioned, the case study does not discuss the to business management should be designed to answer the
management and monitoring of progress after the investment following questions:
decisions have been made. It does highlight, however, one • How much are we spending on IT?
aspect that is particularly poorly performed at most • Should we be spending more, or should we be
companies: retiring a programme (IM15 Retire the spending less?
programme) when it no longer meets its investment criteria or • How do our costs and operational performance compare
will no longer realise the originally envisaged business value. with our peer group?
The case study points out how ING looks at the overall • How does our IT spend impact our business performance?
portfolio and in so doing determines which categories of • Will our IT investment portfolio deliver value to the
projects need to be reviewed in depth for early retirement. business?

Practical Considerations for And, just as at ING, the risk and return of investments in the
Small and Medium-sized Businesses IT area need to be compared with risk and return of all
Governance Structure potential investments. IT is an enabler of and an integral part
ING has a fairly complex IT governance structure, reflecting of the business.
the complexity of the group and the nature of the business of
the group subsidiaries. This structure addresses the needs and Managing the IT Investment Portfolio
desires of the Executive Board for groupwide information and The case study shows examples of the kinds of metrics,
the desire to optimise IT investments across the group. The reports and graphical representations used by ING to
case study also reflects the regulatory environment in which effectively—and actively—manage and value the IT
financial services firms operate. These are considerations that investment portfolio. The sections below consider each
typically are not present—or are present only to a much in turn.
smaller extent—in small or medium-sized firms or in firms in
other industries. Inventory of the Portfolio
Here the small business has an advantage. It is significantly
A simpler governance structure is usually appropriate for easier to examine the inventory in a small business than in a
smaller companies with closer and more direct large, global and complex organisation such as ING. The
communication between the IT manager and the finance objective is to deliver a comprehensive view of the need for
manager and/or general manager. Especially important is the resources and management processes for proper monitoring
business responsibility (refer to ING’s leadership council) for and governance. Such an inventory—distinguishing
the implementation and execution of the IT strategy. Also discretionary and mandatory projects and encompassing
critical are the processes for ensuring that IT plans and proposed and current projects—should certainly be made.
budgets are fully integrated with business plans and budgets
and for reporting to business management on operational Payback Period of the Portfolio
targets and progress and the status of the realisation of In any business, it is crucial to keep track of the total cash
investments. While the business manager bears responsibility flow, so the projected cash flows of all current and proposed
for the IT strategy, it is incumbent upon the IT manager to projects need to be monitored for cash flow planning. The
ensure that adequate communication and co-ordination take format need not be the same but the cash flows of individual
place—the business is apprised of progress in IT, but also IT projects and the aggregated cash flow for the entire portfolio
is fully aware of any changes on the business side. Again, in a must be made clear.
smaller firm the process and reporting may be simpler than
ING’s medium-term business planning process, annual IT Net Present Value of the Portfolio
road map and dashboard, but they are no less crucial. These Just as with the cash flow, any business needs to be aware of
concepts are further developed here. the cumulative (projected) value of all investments. It also
needs a way of clearly distinguishing projects that are no

IT GOVERNANCE INSTITUTE 23
 VAL IT
longer expected to deliver value so that corrective measures and measures for considering risk. Smaller businesses should
can be taken. Not all businesses use NPV; some use other, also consider the risk of IT investment projects they
more or less sophisticated tools or analyses, but the basic undertake. A practical approach is to use a project risk
principle remains the same. ING’s graphical representation of checklist—usually a part of a project management
cumulative NPV is elegant and highlights clearly which methodology. There are many project management
projects contribute the most business value—and which methodologies and risk assessment checklists available in the
destroy value through their negative return. market. Such a checklist should primarily be used to make
sure that all risks are considered and appropriate risk
Risk-adjusted Return of the Portfolio mitigating measures taken. Just as important as the project
In evaluating financial investments, it is not advisable to risk is the business risk: the risk that the project will not
consider return without considering the associated risk. The realise the anticipated business benefits. In this, the risk needs
expected returns rise as the risk increases. IT investments are to be evaluated in the same way as for any other investment
no different. A company the size of ING in the financial proposal, and riskier projects may be expected to pass a higher
services industry and with highly sophisticated and mature hurdle rate.
management processes has relatively sophisticated processes

24 IT GOVERNANCE INSTITUTE
THE ING CASE STUDY
6. REFERENCES
Curley, M.; Managing Information Technology for Business Value, Intel Press, 2004

Finnerty, J.D.; Project Financing: Asset-based Financial Engineering, John Wiley & Sons, USA, 1996

Gartner, ‘The Elusive Business Value of IT’, August 2002

IBM Institute for Business Value, ‘Reaching Efficient Frontiers in IT Investment Management’, IBM Global Services, USA, 2004

ING Investor Relations, ‘IT Investment and Shareholder Return’, volume 12, number 2, ING Group, The Netherlands,
May 2004, www.seaquation.com.

IT Governance Institute, Board Briefing on IT Governance, 2nd Edition, USA, 2003, www.itgi.org

IT Governance Institute, IT Governance Global Status Report, USA, 2004, www.itgi.org

IT Governance Institute, Optimising Value Creation From IT Investments, USA, 2005

Lutchen, Mark D.; Managing IT as a Business, John Wiley & Sons, USA, 2004

META Group, ‘Portfolio Management and the CIO, Part 3’, March 2002

Nolan, Richard; F. Warren McFarlan; ‘Information Technology and the Board of Directors’, Harvard Business Review, USA,
October 2005

Pieroni, W.; ‘IT and Shareholder Return in the Insurance Industry’, Best Review, 2002

Rinnooy Kan, Alexander; ‘IT Governance and Corporate Governance at ING’, Information Systems Control Journal,
ISACA, USA, volume 2, 2004

Ross, J.; C. Beath; ‘Beyond the Business Case: Strategic IT Investment’, Sloan CISR, October 2001

Ross, Jeanne; Peter Weill; ‘Six Decisions Your IT People Shouldn’t Make’, Harvard Business Review, USA, November 2002

SIM International Working Group, ‘Managing the IT Investment Portfolio’, October 2001

Standards Australia, ‘Corporate governance of information and communication technology’, AS 8015-2005

Thorp, John; ‘The Challenge of Change’, The CFO Project, MRI Research, 2003

Thorp, John; The Information Paradox—Realizing the Business Benefits of Information Technology, Revised Edition,
McGraw Hill, 2003

Tiernan, C.; J. Peppard; ‘Information Technology: of Value or a Vulture?’, European Management Journal, volume 22,
number 6, December 2004, p. 609-623

US General Accounting Office, ‘ITIM: A Framework for Assessing and Improving Process Maturity’, 2004

Weill, P.; J.W. Ross; IT Governance: How Top Performers Manage IT Decision Rights for Superior Results, Harvard Business
School Press, USA, 2004

Williams, P.; ‘Optimising Returns From IT-related Business Investments’, Information Systems Control Journal, ISACA,
USA, volume 5, 2005

IT GOVERNANCE INSTITUTE 25
 VAL IT
7. APPENDIX—GLOSSARY
Amortisation: The process of cost allocation that assigns the Change management: A holistic and proactive approach to
original cost of an intangible asset to the periods benefited. It managing the transition from a current to a desired
is calculated in the same way as depreciation. organisational state, focusing specifically on the critical
human or ‘soft’ elements of change. It includes activities such
Architecture: Description of the fundamental underlying as culture change (values, beliefs and attitudes), development
design of the components of the business system, or of one of reward systems (measures and appropriate incentives),
element of the business system (e.g., technology), the organisational design, stakeholder management, human
relationships among them, and the manner in which they resource policies and procedures, executive coaching, change
support the organisation’s objectives leadership training, team building and communications
planning and execution.
Balanced scorecard: The balanced scorecard, developed by
Robert S. Kaplan and David P. Norton, is a coherent set of Chargeback: The redistribution of costs to the units within a
performance measures organised into four categories. It company. Without such a policy, misleading views may be
includes traditional financial measures, but adds customer, given as to the real profitability of a product or service, as
internal business process, and learning and growth certain key costs will be ignored or calculated according to an
perspectives. arbitrary formula.

Benchmarking: A systematic approach to comparing an COBIT: Control Objectives for Information and related
organisation’s performance against peers and competitors in Technology, from the IT Governance Institute (ITGI), is an
an effort to learn the best ways of conducting business (e.g., internationally accepted IT control framework.
benchmarking of quality, logistical efficiency and various
other metrics) Economic Value Added (EVA): Technique developed by
G. Bennett Stewart III, and registered by the consulting firm
Benefit: An outcome whose nature and value (expressed in of Stern, Stewart, where the performance of the corporate
various ways) are considered advantageous by an organisation capital base, including depreciated investments such as
training and research and development, as well as more
Business case: Documentation of the rationale for making a traditional capital investments, such as plant and equipment, is
business investment, used to support a business decision on measured against what shareholders could earn elsewhere
whether to proceed or not with the investment
Hurdle rate: Required rate of return, above which an
Business process: A set of cross-functional activities or investment makes sense and below which it does not. Often
events that result in the delivery of a specific product or based on the cost of capital, plus or minus a risk premium,
service to a customer and also often varied based upon prevailing economic
conditions. Also known as required rate of return.
Business sponsor: The individual accountable for delivering
the benefits of an IT-enabled business investment programme Internal rate of return (IRR): The discount rate that equates
to the organisation an investment cost with its projected earnings. When
discounted at the IRR, the present value of the cash outflow
Capital expenditure: An expenditure that is recorded as an will equal the present value of the cash inflow. The IRR and
asset because it is expected to benefit more than the current NPV are measures of the expected profitability of an
period. The asset is then depreciated or amortised over the investment project.
expected useful life of the asset.

26 IT GOVERNANCE INSTITUTE
 T
VHE
AL IT
ING CASE STUDY
Life cycle: A series of stages that characterise the course of Project and programme: In this document, a differentiation
existence of an organisational investment (e.g., product, is made between the traditional use of the term ‘project’ and a
project, programme) new term ‘programme’, a term that is increasingly gaining
wider acceptance. While it is recognised that organisations
Modelling: Developing a simplified representation of a may choose to use different terms, or have different
system or phenomenon. Such representations may be static or definitions of those terms, in the interests of clarity the
dynamic, in which case behaviour of the system or following definitions are used in this book:
phenomenon under different conditions can be simulated. • Project: A structured set of activities concerned with
delivering a defined capability (that is necessary but NOT
Net present value (NPV): Is calculated by using an after-tax sufficient to achieve a required business outcome) to the
discount rate of an investment and a series of expected organisation based on an agreed schedule and budget
incremental cash outflows (the initial investment and • Programme: A structured grouping of interdependent
operational costs) and cash inflows (cost savings or revenues) projects that include the full scope of business, process,
that occur at regular periods during the life cycle of the people, technology and organisational activities that are
investment. To arrive at a fair NPV calculation, cash inflows required (both necessary and sufficient) to achieve a clearly
accrued by the business up to about five years after project specified business outcome
deployment should be taken into account.
Return on investment: A measure of operating performance
Payback period: The length of time needed to recoup the cost and efficiency, computed in its simplest form by dividing net
of capital investment. Financial amounts in the payback income by average total assets investment outlay
formula are not discounted. Note that the payback period does
not take into account cash flows after the payback period and Stage-gates: A point in time when a decision is made to
is therefore not a measure of the profitability of an investment commit funds to the next set of activities on a programme or
project. The scope of the IRR, NPV and payback period is project, stop the work altogether, or put a hold on execution of
the useful economic life of the project up to a maximum of further work
five years.
Val IT: The standard framework for organisations to select
Portfolio: A grouping of programmes, projects, services or and manage IT-related business investments and IT assets by
assets, selected, managed and monitored to optimise business means of investment programmes such that they deliver the
return optimal value to the organisation. Based on COBIT.

Value: Value is complex, context-specific and dynamic. It is

the relative worth or importance of an investment for an
organisation, as perceived by its key stakeholders, expressed
in financial and non-financial terms.

IT GOVERNANCE INSTITUTE 27
 VAL IT

28 IT GOVERNANCE INSTITUTE