PUBLICATION

Holistic Framework
for IT Governance
Charles Popper
January 2000

Program on Information
Resources Policy
Center for Information Policy Research
Harvard University

The Program on Information Resources Policy is jointly sponsored by Harvard

University and the Center for Information Policy Research.
Chairman
Anthony G. Oettinger

Managing Director
John C. B. LeGates

Charles Popper is managing director and chief technologist for Orama Partners, a new
boutique investment bank that serves high-tech start-up companies. From 1991 to
1999, he was vice-president for Corporate Computer Resources and chief information
officer at Merck & Co., and before joining Merck, he was a partner in the management
consulting practice of Deloitte & Touche.

Copyright 2000 by the President and Fellows of Harvard College. Not to be reproduced in any form
without written consent from the Program on Information Resources Policy, Harvard University, Maxwell
Dworkin 125, 33 Oxford Street, Cambridge MA 02138. (617) 495-4114
E-mail: pirp@deas.harvard.edu URL: <www.pirp.harvard.edu>.
ISBN 1-879716-59-3 P-00-1

Acknowledgements
The author gratefully acknowledges the following people who reviewed and commented critically
on the draft version of this report. Without their consideration, input, and encouragement, this study
could not have been completed:

Bernard Abramson
Victor A. DeMarines
Daniel J. Gadler
Paul R. Garvey
Lee Gruenfeld

Charles Hartwig
Susan E. MacReynolds
Bernard Plagman
John T. Toth

These reviewers and the Program's Affiliates, however, are not responsible for or necessarily in
agreement with the views expressed here, nor should they be blamed for any errors of fact or interpretation. I would like to thank, in particular, colleagues at Merck and Co., Inc., for their advice and encouragement, and those at Deloitte Consulting, who helped shape many of the ideas expressed in this report,
although of course I remain fully responsible for the concepts discussed here. I am also grateful to
ProSight, Inc., and to John Cimral, the company's president and chief executive officer, for support in
the preparation of this report.

Contents

Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i
Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v
Chapter One

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Chapter Two

Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2.1 Three Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2.1.2 The Value/Cost Relationship . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1.3 Operational Excellence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Chapter Three

The Scope of IT Management. . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Chapter Four

Managing the Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

4.1 Techniques for Improving Business-IT Alignment . . . . . . . . . . . . . . . . . . . . . . 7

4.2 Describing and Managing the IT Portfolio and the Value/Cost Relationship. . 10
4.3 Product-Service Management and Operational Excellence. . . . . . . . . . . . . . . 13
4.3.1 Implications for the Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.3.2 Promoting Operational Excellence . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.4 Costs and Benefits of Infrastructure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
4.5 Implications for Outsourcing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.6 Implications for Virtual Corporations and the Internet Economy . . . . . . . . . . 18
4.7 Implementing the Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Chapter Five

Whose Governance Framework Is It? . . . . . . . . . . . . . . . . . . . . . 20

5.1 What Senior Business Managers Get . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

5.2 What Mid-Level Business Managers Get. . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5.3 What Senior IT Managers Get . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5.4 What Project and Product-Service Managers Get . . . . . . . . . . . . . . . . . . . . . . 21
5.5 What Everyone Gets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Chapter Six

Beyond the Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Acronyms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Figures

Figure 1

Overiew of Value/Risk Relationship . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Figure 2

Operation Scorecard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Executive Summary
The challenge of governing an enterprise's Information Technology (IT) function, although of
interest within the IT community for years, has recently become a concern of senior business management. Strategic alignment of IT with the business is now being emphasized, as well as approaches to
management of the IT portfolio, yet efforts so far have not attained the alignment and integration senior
management want. An approach to management of IT is needed that is inclusive-with a scope that truly
reflects the range of activities and responsibilities of IT-and specific. This report offers such an approach
to IT as a holistic framework that addresses three primary objectives: (1) it fosters strategic and tactical
alignment of IT with the business; (2) it relates the cost of IT to the value brought to the business; and
(3) it supports a drive toward operational excellence.

Chapter One
Introduction
The challenge of governing an enterprise's information technology (IT) function has been a
subject of great interest within the IT community for many years, and it has recently become an issue of
concern for senior business management as well, especially the evolution of IT from a purely administrative support function into a key component of the overall business strategy. The Internet revolution, in
general, electronic business, or "e-business" in particular, places unprecedented stress on the contribution of IT to business.
Earl and Feeny posed the question, "Is Your CIO [chief information officer] Adding Value?" and
suggested a framework that would include the following: IT involvement in the business imperatives; a
focus on the information services (IS) development efforts; a contribution directly to the business
beyond administrative support applications; establishment of a track record of solid IS performance; and
establishment of IS-business executive relationships.1 For Earl and Feeny, the core concept was the need
for a vision of IT that could be shared by business and IT leaders.
In 1997, in "The Real Problem with Computers,"2 Shrage reviewed books by Strassmann 3 and
Davenport4 and concluded that, as Strassmann claims, "more money has been wasted on computerization
than has been created by it." 5 Shrage endorsed Davenport's focus on the organizational impact of technology, rather than on technology itself. Shrage concluded that information systems will pay off but
only if their design and management are based upon the culture and politics of the enterprises they are
intended to support.
In 1998, Bensaou and Earl examined "The Right Mind-Set for Managing Information
Technology," in which they contrasted the approaches to management of IT of U.S. and Japanese companies. 6 They suggested seriously considering the Japanese principles, which include the following: (1)
focussing on the strategic instinct of senior business managers, rather than formal strategic alignment of
IT and business strategies; (2) judging IT investments on the basis of their ability to improve operational
performance; (3) selecting appropriate technology whether or not it is state-of-the-art; (4) integrating the
business with IT through managerial rotations; and (5) ensuring that systems are designed to exploit the
knowledge and experience of employees.

1. M. J. Earl and D. F. Feeny, "Is Your CIO Adding Value?" Sloan Management Review (Spring 1994), 11-20.
2. M. Shrage, "The Real Problem with Computers," Harvard Business Review (September-October 1997), 178-188.
3. P. A. Strassmannn, The Squandered Computer: Evaluating the Business Alignment of Information Technologies (New
Canaan, Conn.: The Information Economics Press, 1997).
4. T. H. Davenport, with L. Prusak, Information Ecology: Mastering the Information and Knowledge Environment (New York:
Oxford University Press, 1997).
5. Shrage, 183.
6. M. Bensaou and M. Earl, "The Right Mind-Set for Managing Information Technology," Harvard Business Review
(September-October 1998), 118-128.

-2These are all excellent ideas. Despite them, however, and despite earlier efforts to develop guiding principles for IT management, business in general still does not derive the benefit it needs from its
spending on IT. Most businesses have not yet attained the level of business-IT alignment and integration
desired by senior management. Too often, business leaders lack any clear understanding of how IT could
contribute to the success of their business; even more often, they cannot reconcile the growing costs of
IT with their perception of the value received.
IT management needs to be both inclusive-with a scope that truly reflects the potential contribution of IT-and specific. For such an approach to be meaningful to business managers, it will need to go
beyond attractive concepts to specific, business-related measures, or, for the mathematically inclined,
metrics. This report offers such a holistic IT governance methodology.

Chapter Two
Objectives

2.1 Three Objectives

There are three primary objectives for the proper management of IT: (1) alignment of the IT function with business, strategically and tactically; (2) a value/cost relationship, in which the cost of IT is
clearly related to the value it adds to the enterprise; and (3) "operational excellence," that is, the delivery
of IT projects and services with high quality, high efficiency, and predictable levels of service, all of
them to be described and measured in business terms.

2.1.1 Aligning the IT Function with Business

More than a clear description of how well IT is aligned with the business at a particular time,
what is needed is an ongoing dialogue between business and IT at many levels in order to determine
how alignment can be maintained and strengthened. The objective is to assure senior management of an
alignment that can be maintained as the business strategy evolves. Even were management processes in
place that would ensure the alignment of new systems with key business initiatives, a way is needed to
ensure that, as time goes on, business needs continue to be addressed. Formal methods for accomplishing this objective are discussed in Chapter Four, yet the informal communication patterns that underlie
successful business-IT alignment1 ought not be underestimated. A method can deal only with what is
known; finding ways to "know what we don't know" is another important element (see Chapter Six).

2.1.2 The Value/Cost Relationship

Senior business management need to overcome its discomfort with continual increases in IT
spending, which seem often to perturb the environment (for example, the move from mainframes to
personal computers and to client-server computing, or for achieving Y2K compliance) without adding
actual business value. The critical questions to which management wants answers include: What are we
spending money on? How does the level of spending relate to the level of service and to the value generated for the enterprise? How do these spending levels compare with those of other companies, especially companies recognized as best practitioners? How can a company be sure that the value/cost relationship will endure-that is, that costs will not grow more quickly than value? Management will be able
to apply its strategic instinct to IT only if it can understand the value/cost relationship of IT as clearly as
it understands this relationship elsewhere in the enterprise.

2.1.3 Operational Excellence

IT projects and services need to be delivered with "operational excellence," that is, with high
quality, high efficiency, and predictable levels, all of which need to be described and measured in
business terms.
1. In the phrase business-IT alignment, business precedes IT because IT supports the business, but the responsibility for
aligning a business and the IT function is shared equally by business management and IT management.

-4Senior management need to be confident that IT-based services will be reliable and predictable.
Service levels will need to be specified carefully and the results monitored. The productivity of major
activities will need to be measured, and a serious commitment made to continuing improvement. The
objective of operational excellence may appear obvious, yet shortfalls, real or perceived, can quickly
undermine the overall credibility of IT. The resultant breakdown in trust and communication may preclude achieving strategic alignment of IT with the business.

Chapter Three
The Scope of IT Management
In the 1990s, major enterprises have increasingly emphasized business-IT alignment, in particular,
focussing considerable attention on IT development projects. This is understandable, because such projects can indeed advance the capabilities of an enterprise. When the IT function is not well aligned with
the needs of the business, then the need for strategy to improve the alignment generally results in several
such projects. Their potential impact, along with the significant investment required, demands their good
management. Management of IT development projects is therefore an important component of the management of the IT function as a whole.
In reality, however, in most enterprises the budget for IT projects represents only 25 to 35 percent
of the total IT budget. To manage IT properly, and, in particular, to address the second objective, the
value/cost relationship, the IT management methodology needs to be focussed on the other IT components, typically operational components, which can be categorized in various ways. Some companies
distinguish the operation of business applications, such as support for research and development, manufacturing and distribution, and marketing and sales, from utility applications, such as payroll and even email. Others companies distinguish applications from infrastructure. These categories may be convenient, but they do not result in a management paradigm that addresses the primary objectives laid out in
Chapter Two.
A better alternative would recognize that all operational and support services represent the production phase of an IT project. For example, were a company to decide to strengthen its focus on customers through its national sales force was central to its business strategy, then an IT project might be
initiated to develop a sales force automation system that provides sales representatives with the detailed
data and tools needed to support the strategy in the field. But the project would not end when the application was coded, tested, and delivered to the sales force. It would still be necessary to operate and support-that is, to manage-the system, in order to ensure collection of accurate and relevant data, which then
needs to flow in a reliable manner to the sales force. And the system would need to be maintained and
upgraded as new requirements evolve. (For a discussion of how to manage the categories of major
enhancements that add functionality as well as minor enhancements and routine maintenance, see the
end of section 4.1.) In surprisingly short order, the one-time cost of project development and its implementation would pale in comparison with the cost of operations and support. This is also true of
accounting systems, supply chain management, and enterprise resource planning (ERP) systems, payroll
systems, and e-mail.
What framework should be used to manage all these operational activities? If possible, it should
be one that mimics what company already uses to manage IT projects. If that framework has been successful for developing and managing an IT strategy that aligned the enterprise's business with its IT
function, then the concepts and business value metrics of that framework could continue to be used to

-6organize and manage operational and support phases. In other words, the framework will need to provide for management of an integrated IT portfolio, which means both development projects and production activities.1
From an accounting perspective, spending on development projects is categorized as capital
investment and spending on production operations is categorized as an operating expense. Business
value is created by the development of an appropriate new functionality, which is then provided to the
business in a production environment of high quality. Neither the development phase nor the production
phase alone can create business value; both are necessary. What is needed, therefore, is a shared and
consistent approach to managing both the value and the cost of production.
Standard techniques for project management do call for a post-implementation phase, when the
operation of a new system is monitored. Its purpose is to ensure that a system functions properly and
that the anticipated business benefits are achieved. But this may not be enough. A post-implementation
phase ought to extend indefinitely, and management's focus ought to be on ensuring its continuing relevance and value to the business, as well as on efficient and reliable operations. Further, if management
makes the difficult decisions about the desired business results, defines how those results will be measured, and specifies desirable actual target costs, then the development plan will meet these goals.
Such a holistic approach offers another important benefit: completion of an IT project never in
itself adds value to the enterprise; value accrues only in subsequent operation of the system. Often, however, the focus of senior business management may be limited to a particular project, a limitation that
may well mask the value technology brings to the enterprise or, worse, mask its failure to bring any
value at all. If a system works well, it tends to become invisible; if it experiences failures and disruptions, IT takes the blame. An approach that would continue the focus of IT management smoothly from
project to operational service would avoid at least the obvious pitfalls.
The scope of an integrated, holistic IT management framework would incorporate both the project
and the production components. This approach would reflect, first, the total amount spent on IT and,
second, how ongoing operation of the system and applications achieve the projects' original business
purposes. The original intent of each system's value/cost relationship could be understood, monitored
throughout its life cycle, and applied to future projects.
The following chapters discuss the project and production aspects of IT governance. Because
these aspects are really opposite sides of the same coin, their management has much in common.
Elements that require unique methods and approaches are explained.

1. Here the use of the word portfolio is intended to reflect its use in the term "investment portfolio," meaning both set or
collection as well as investment. IT projects are investments, and the result is the total portfolio, not just the individual investments.

Chapter Four
Managing the Details

4.1 Techniques for Improving Business-IT Alignment

The first step in improving business-IT alignment is to identify the elements of business value that
are strategically and tactically important to the enterprise to which IT might make a significant
contribution.
Consider the example of customer focus mentioned in Chapter Three. Implementing the new
sales strategy would require, among other activities, training sales representatives, defining new performance metrics, and perhaps developing new rules for compensating sales representatives. The potential IT contribution would be a new system to collect information about customers and make it available
to the sales force for analysis of customers' needs and corresponding opportunities.
A second example would be a manufacturing company that wants to improve straight-through
manufacturing yields, thus reducing rework. To achieve this goal, the company might need a system to
schedule preventive maintenance, so that equipment would stay within specified operational parameters
and batches would meet all quality requirements.
As a final example, in today's Internet economy, new strategies erupt in response to new technologies. E-business has been, to use Clayton Christensen's word, a "disruptive" technology; it has enabled
start-up companies to develop rapidly into major retailing forces and to challenge the dominance of
incumbents still using traditional strategies. The strategic planning process will therefore also need to
include responsibility for this disruptive aspect of technology push.
In understanding a particular business's IT strategy, a traditional and useful distinction has made
between businesses whose basic business activity has been to provide information and information services and businesses that are merely supported by information services. The advent of the Internet and the
explosive growth of e-business have blurred this distinction, as several examples can illustrate:
Return policies and implications for customers and businesses: Amazon.com and other
Internet-based retailers have severely challenged traditional brick-and-mortar retailers. Some
have responded with independent Internet ventures; others have been more creative in developing synergies between their Internet- and store-based selling. One important difference between
these types of selling is the seller's policy regarding returns: A purely Internet retailer requires of
its customers the inconvenience of having to ship back returned goods, while most store-based
retailers allow customers to bring returned merchandise into any branch of the store. The latter
is a win-win situation: customers will find it more convenient, and the stores are provided with
an additional selling opportunity. The prerequisite for this win-win strategy, though, is an information system that integrates Internet and in-store customers.

1. Clayton Christensen, The Innovator's Dilemma (Boston: Harvard Business School Press, 1997), xv.

-8 Prescription medications and implications for patients and pharmaceutical businesses:

Pharmaceutical companies have generally mastered the art of marketing to physicians, but one
unmet challenge has been how to attack the problems of patients' compliance, that is, their faithfulness in taking all doses as prescribed, and persistence, that is, their continuing to take the
medication. The rates of both generally need to be higher in order to improve patients' health
and increase revenues to pharmaceutical firms. The Internet offers an opportunity to pharmaceutical manufacturers for communicating directly with patients in an effort to increase patients'
compliance and persistence. In this way, information services may graduate from back-room
support to a front-line impact on revenue.
Automobile industry and the effect of Internet sites: The automobile industry has been revolutionized by two kinds of Internet sites-those that provide detailed information on prices and on
dealers' costs and those that force dealers to bid for specific business. Dealerships are being
transformed into showrooms, and profits are being generated from services more than from selling. In this instance too, information plays a central role in the creation of health and economic
value.
Such examples have awakened many chief executive officers (CEOs) to the need to make IT a strategic
contributor to their business. As information increasingly becomes integral to business activities, the role
of IT expands-and this change is accelerating. The question then becomes how to align IT, strategically
and tactically with the business.
Typically, the first step is to identify both the main value-adding activities and the strategies that
would enhance them. Threats posed by emerging, disruptive technologies and then counter-strategies
also can be identified. Then opportunities can be identified to use information services to support the
new strategies. As these new information-related activities become the core of the IT portfolio, replacing
less strategic IT activities, the enterprise will move toward greater business-IT alignment.
For this effort to provide a practical benefit and not to descend into the superficial and irrelevant,
the metrics of business value desired for each activity also need to be identified. Ideally, these would be
metrics that the business unit and IT both can implement. Where the value is more strategic and therefore less easily measured, at least some joint commitment might be made to a periodic formal review of
the activities.
The second step is to ensure the appropriate involvement of senior management, with the goal of
informal dialogue and formal decisionmaking. Ongoing dialogue is necessary, so that senior management will fully understand the planned use and impact of technology on the business as well as to elicit
from management its guidance, feedback, and the "strategic instinct," whose importance is discussed by
Bensaou and Earl.2 Formal decisionmaking helps to ensure that critical decisions are fully committed to
by all groups in the enterprise. Finally, progress toward business value can best be assessed by senior
management.
2. Bensaou and Earl, 122.

- 9There are many proven techniques to accomplish these goals, and they all boil down to a few principles:
1. Senior managers will need to accept formal responsibility for strategic decisions regarding
information technology, through an existing management committee or, if necessary, through a
dedicated IT steering committee.
2. Agreed-on processes need to be developed to identify the decisions to be made; to collect,
analyze, and disseminate the data needed for informed decisions, and to make and communicate
the decisions. The decisionmaking processes should not, in principle, differ from processes used
in managing other aspects of the enterprise.
3. Senior managers need to be involved on a regular basis-not just after a project has fallen
through disastrously, but by setting priorities and establishing and revisiting strategies. The business world at the turn of the millennium is too dynamic for a strategy to be implemented by
remote control. The life cycle of a typical IT project often exceeds that of the underlying business strategy, making management's vigilance and participation are essential.
These few principles comprise a methodology, that is, an organized process, to perform strategic IT
planning as an exercise shared by IT leaders and senior business management. The deliverable of the
strategy consists of project definitions and project implementation plans, including specific resource
allocations, schedules, and committed business benefits that can be tracked and measured relative to predetermined targets. Although this report emphasizes formal methods, much effort, understanding, and
instinct derive from informal channels of communication. The challenge is to ensure that informal channels exist between business and IT leaders at many levels. And, given that a successful formulation of
strategy will need to reflect a clear understanding of the external environment, such informal channels
will need also to include outside contacts.
The term IT fluency has come into vogue to describe the need for dialogue among business and IT
managers. Actually, the IT fluency of business managers and the business fluency of IT managers both
need to be emphasized, because both are needed for business-IT alignment. Just as language is best taught
through immersion, that is, practice and repetition, so IT fluency can best be achieved through repeated
use. The framework for strategic IT management proposed here provides business leaders with the opportunity to develop IT fluency and provides IT leaders with the opportunity to develop business fluency.
After strategic planning has been completed, what remains is a process for managing its execution. The best ways to do this include the following elements:
division of projects into distinct phases;
definition of the decision toll gates or stage gates, which control transitions from one phase to
the next;
development of phase contracts, which lay out explicitly the commitments of management, to
supply required resources, and of project teams, to produce specified deliverables on time and
on budget; and

- 10 development of a process to maintain and fine tune the strategy itself and to recognize when
change in either business or technology warrants reconsideration or modification of the strategy.
When projects move into new phases and require increased investment or the commitment of new
resources, what has already been accomplished needs to be reviewed so that management and project
leaders can take a fresh look at the plans for the next phase and analyze in detail and reconfirm the project's role within the business strategy and its intended benefits. Senior management certainly need to
review such points of transition from one phase to another and to insist on interim reviews, whenever a
project team sees that the current phase contract may be at risk.
Another important practice would be to avoid projects so large that they take will years to develop
and implement. When possible, such projects are best divided into a sequence of smaller projects, to
reduce the risks involved in each and to hasten delivery of benefit and value to the business. This practice is consistent with considering all major enhancements to existing systems as new projects, which
are then required to pass through the full cycle of project justifications, approvals, and check points.
Finally, it is also good practice explicitly to define the core team-which is responsible for delivering the project-and the extended teams-which contribute the experience and skills necessary to the success of the project. These definitions would be part of the phase contracts, so that all critical elements
known to be needed for success would be committed at the outset.

4.2 Describing and Managing the IT Portfolio and the Value/Cost Relationship
Developing an IT strategy that will move an enterprise toward business-IT alignment and initiating the active involvement of senior business managers is only the beginning. The longer range goal is
to institutionalize these successes within an ongoing management process. A proved technique to accomplish institutionalization is to focus on active management of the IT portfolio, which was developed initially as the set of projects necessary to bring IT into alignment with the business. Over time, needs,
opportunities, and priorities change, so that active management of the portfolio requires ongoing attention of senior management.
The first step in developing such an IT strategy is to find ways to characterize the portfolio that
business management will relate to easily. No single technique can succeed, but, rather, a collection of
techniques is needed to provide management with the understanding it seeks of how IT resources are
allocated.
Figure 1 shows various IT projects and activities in terms of the extent of business transformation
that the system enables and the risk (business or technical or both) of failure to achieve the desired
results. Projects in the zone to the left lead to evolutionary progress, that is, increased productivity and
other incremental benefits. But this zone still shows business as usual. Projects in the central zone can
bring the enterprise to a new height of performance but within the existing context, which, in

- 11 manufacturing, is thus called the "platform" zone. An example from the automobile industry is the introduction by Chrysler of its "cab-forward" line of cars, which brought new design and performance advantages but did not change the product in any fundamental way. Projects in the zone to the right can transform the business. Returning to the automobile industry, the development of a fully functional electric
vehicle that could go 300 miles on a single 15-minute charge would qualify as a breakthrough.
The vertical axis in the chart represents the increasing risk of project's failure; the higher the risk,
the higher the project (bubble) is placed. The chart is divided into a high risk zone (the upper band) and
a low-to-moderate risk zone. Risk assessment takes into account such elements as the use of a new,
unproved technology, the need to perform complex global deployment, the need for the business to
adopt new operational procedures, and the business's track record implementing projects. Each project is
represented by a bubble of a size proportional to the total resources it requires.
The value of such a chart depends upon the quality of the underlying data. Assessments of the
potential transformation of a business and of the risk and resources necessary for the project need to be
made by the project teams in conjunction with their management oversight committees. It is good practice for stage-gate meetings to review and confirm the assessments. Although ad hoc assessments may
be effective, some businesses may prefer formal methods based on decision theory.
Such charts can be interpreted in several ways. First, the location and size of the project bubbles
tell management very clearly how aggressive their portfolio is. Is there a strong prospect of fundamental
change, of breakthrough products and practices? Or, is the portfolio aimed at a gradual progress, that is,
business as usual? Neither approach is right or wrong, but management must decide to follow one or
another. The chart indicates where risks lie. Do projects with the greatest risks offer the most potential to
effect transformation? Are high-risk projects in the platform zone, and are these therefore the projects on
which the enterprise depends most? Well-planned portfolios will show some small projects in the upper
left zone, often called the research and development (R&D) zone. Ideally, these would represent new,
risky technologies piloted in safe, low-impact areas, so that follow-on projects can be in the high-impact
zone to the right but below the high-risk line.
By considering such a chart, senior business and IT management may agree on an intelligent portfolio that will balance risk and return and reflect the desired aggressiveness of the business strategy.
Of course, this view would not be the only one. Other views might represent allocation of the
enterprise's resources according to its business strategies or by business segment-line of business, geography, or any other category the business uses to measure performance. Another view could illustrate
how well IT investments are being targeted to the strategic processes that create value and competitive
advantage.

Figure 1
Overview of Value/Risk Relationship
These views, taken together, would allow management a better understanding of how to achieve a
balanced portfolio along any of these dimensions-evolution to transformation; value, risk, and allocation-in particular, to achieve a strong link to strategy. Finally, another view of the portfolio could be
constructed to address its value to the business by focussing on financial metrics, such as net present
value weighted by the probability of technical and commercial success. Cooper, Edgett, and
Kleinschmidt's Portfolio Management for New Product3 offers excellent examples of such approaches in
the general context of product development. Other current research (by the MITRE Corporation) for
example,4 explores a combination of decision analysis methods and tools with balanced scorecarding to
achieve increasingly precise results.
Given tools useful for characterizing the portfolio, the next step would be to clarify the processes
for managing the it. Active involvement of senior management would be critical but ought not be allconsuming. An annual review would be needed, typically as part of the general annual planning cycle. In
addition, reviews would be prompted by events, such as the opportunity to add a significant new project
or to deal with projects that miss their contracts. Other triggers might include external business events
that precipitate a reevaluation and possible revision of the business strategy and, therefore, of projects
3. R. G. Cooper, S. J. Edgett, and E. J. Kleinschmidt, Portfolio Management for New Products (Reading, Mass.: Perseus Books,
1998); see Chapters Two through Four, 23-105.
4. Personal communication to the author from Paul R. Garvey and Susan E. MacReynolds, July 30, 1999.

- 13 implementing it. The committees of senior management (see section 4.1) which manage projects though
their check points would be well placed to deal with the implications for the portfolio of their decisions
on projects. Proper preparation will be key-to create good decision packages (background documents,
distributed prior to committee meetings) that lay out both clear choices for management and fundamental decisions management must make on allocating resources. Typically, the first goal would be to rebalance resources within the previously fixed budget; adjusting the overall budget may become necessary.
Decisions may also need to be made on the allocation of specific resources, such as individuals with
unique experience and skills, among several projects competing for their services.
These important decisions will need to be based on the real needs of the organization (for example, the relative strategic value of the competing projects), rather than on political factors (for example,
an attempt to allocate limited resources evenly across all business units so that everyone will be equally
unhappy). Using different tools to describe different projects can be very helpful in these situations. If,
for example, two projects compete for a scarce resource, then analyzing their relative risk profiles as
well as their potential business value makes it possible to see the overall impact of alternative decisions
and select the one best for the enterprise.

4.3 Product-Service Management and Operational Excellence

Once the elements of business value have been identified, the business value needs to be
expressed with precision, by transforming qualitative measures into quantitative ones and by setting
thresholds and targets.
In the example from manufacturing used in section 4.1, the goal was to improve straight-through
manufacturing yields and to reduce rework, and the approach was to implement a system to schedule
preventive maintenance of the equipment in the factory. Many methods of measurement could be used,
but because measurement drives performance, the desired metric will be one that plant personnel understand and, thus, the one most likely to result in improved performance. Also important, too many metrics
should not be used, in order to keep everyone's focus upon the objective. Finally, it is important to recognize that improperly defined and implemented metrics are liable to result in undesirable and even
counterproductive behavior.
For simplicity, assume that the chosen measure is the yield-that is, the ratio of products with
acceptable quality to all products produced. The baseline performance must be measured, and a new target selected. If yields are currently 80 percent, then a new target of 90 percent for the next twelve
months might be reasonable. By setting a specific target, it becomes possible to calculate the financial
benefit of the program intended to improve the yield.
The example of a strategy to improve customer focus (see Chapter Three) posited a new customer
information system to support the sales force in the field. In such a case, metrics may be less obvious

- 14 than in the case of manufacturing yields, but they are just as important. Possibilities include assessments
of customer satisfaction obtained from surveys and revenue per sales representative. Again, the best metrics are those that will make sense to the business executives responsible and to the people and systems
being measured.
As a last example, consider a global human resources application intended to provide information
to management about the skills and experience of the work force. Presumably, the data will be used to
support individual development throughout the company and would result in locating qualified workers
for potential promotion. An appropriate metric might therefore be the ratio of external hires to internal
promotions for the jobs supported by the system. Such a metric is straightforward to implement and simple to convert into financial benefit; data on the average cost of an external hire are readily available.
But there is no reason to be restricted to quantitative evaluations. Some situations are best evaluated qualitatively, by senior management or even a board of directors, so long as there are clear guidelines for how evaluations are made so these can be both consistent and fair.
So much for the business value part of the equation. What about the cost and performance, for
example, of a preventive maintenance system? This part may require several metrics, which together
comprise a service contract for the production system. Cost must include the depreciation, lease, and
maintenance cost of IT equipment; of minor enhancements and bug fixes and other required changes
(mandated by law, for example) to both hardware and software; of labor (operators, data-entry clerks,
etc.); and of telecommunications. If the scope of the system-that is, the list of the manufacturing equipment to be maintained-changes only gradually, then using total cost as the metric is appropriate. If the
list changes rapidly, then a volume adjustment will be required and unit costs are more relevant. The
final composite metric could be expressed as two graphs: the trend in yield over time and the trend in
unit system cost (that is, total system cost divided by product volume).
In addition to the cost metric there must be a service metric. What is the promised schedule of
system availability? A system to manage maintenance does not require availability seven days per week
and 24 hours a day, as, for instance, a banking system does, but it must be available when factory personnel need it. The service metric therefore should measure the ratio of actual availability to promised
availability. In some situations, service metrics can be more complex, with different components for
availability in prime time or nonprime time. Another possible metric is the duration of outages (how
many less than one hour, four hours, 24 hours). It may be wise to separate the collection and analysis of
data from reporting, so that unanticipated issues may be examined on an ad hoc basis and supplementary
reports issued.
The point is not to construct a set of academically interesting metrics. Each metric should be tied
directly to business performance. If the system to manage maintenance will be used one morning a week
to schedule that week's maintenance activities, and if data entry of the previous week's actual activities

- 15 requires only one day for data entry, then the service metrics should correspond to only these needs. If
accessing maintenance records at any time is important, however, then a different service contract is
justified.

4.3.1 Implications for the Organization

Two implications for the organization need to be taken into account:
As the organization develops the service metrics, a formal organizational structure can be
defined that would be responsible for the service and its performance. This structure could be
expressed as product management or service management, and appointing a product or service
manager would be useful. The tightly focused responsibility and accountability that would result
might well have a very positive effect on performance.
Except for infrastructure applications (such as e-mail), operating a system for business users
requires both business and technical activities and therefore requires both business and technical
expertise. In a financial application, for example, all data flowing through the system must be
validated to ensure accuracy, completeness, and consistency; this is an accounting responsibility.
The technical aspects must be run properly-to fix bugs, prepare and install minor enhancements,
and accomplish upgrades at the right time-which may be accomplished by good coordination of
the business and IT departments. What may be best, however, is to create a new, hybrid productmanagement organization, which would include all the required skills within the one department, whose mission would be to provide all the support and operational services required by
the business users. Creating such a hybrid department makes it easier to develop joint business
and IT metrics for the new operational service. The expanded goal can then be not just data processing but also a value-added information service.

4.3.2 Promoting Operational Excellence

Achieving broad-based operational excellence means going beyond individual operational
services (such as running financial systems, supply chain systems, personnel systems) to all the services
provided by the information technology infrastructure. Two points are important:
the overall budget for IT operations and support must be divided into a set of defined
products and services, so that all IT costs can be mapped to valuable business services; and
all the services must achieve the desired level of efficiency, productivity, and
reliability.
In the portfolio view, the productivity of the total organization is the sum of the parts, so examining the
parts from the perspective of the business could indicate where to focus for future improvement. In a traditional budget presentation, IT costs might be divided into such categories as mainframe operations,
server operations, desktop services, data communications, voice communications, and so on, with each
area claiming some productivity improvements that prove difficult for senior management to follow and
accept. If, however, the categories are business-oriented products and services (described in

- 16 section 4.3), then productivity could be related directly to business results. The most useful examples
would be trends in the cost per financial transaction, cost per personnel action, cost of supply-chain
management, and so on. The value side of the equation would show metrics of the time to do the monthly close, the ratio of internal promotions to external hires, the incidence of outages in the supply chain,
and so on.
The result of this approach would be only a few metrics but these would be compelling for senior
management. Connected to business activities that senior management understand, they would follow a
pattern: for each activity there would be one or two value metrics, a cost metric, and one or two service
metrics. These could all easily be grouped into a management dashboard, so to speak, which might
indeed guide the organization toward operational excellence, as illustrated in Figure 2. The dashboard is
only the instrument panel; the management tool is an overall production system portfolio that represents
the ongoing linkage of IT systems to the business.

4.4 Costs and Benefits of Infrastructure

The techniques described thus far are for establishing the value/cost relationship for business
application services. Establishing them for the enterprise's technical infrastructure is a bigger challenge,
because many elements of the technology infrastructure do not map directly to business services and, as
a result, a significant portion of the IT budget may remain mysterious and difficult to justify to
management.
The approach used here is to recognize that the technical infrastructure requires careful strategic
planning and investment decisionmaking and therefore needs to be managed in the same way as the
business applications. All infrastructure development projects would be governed by the same methodology as business applications-with a steering committee and phase contracts and reviews. The steering
committee, in this case, would consist of senior IT executives and representative senior business executives to ensure that proposed projects would receive both technical and business analyses. Projects
would flow from an infrastructure strategy, and would all have strong business justifications.
Like application projects, infrastructure projects lead to operational services, which would be
managed by the same kind of product-service management framework as the business applications. Not
all services would have direct business-value metrics, so the services would be selected to reflect those
that the business will recognize as important. For example, e-mail and remote access for travelers are
usually considered important to the business, while mainframe and network operations generally are
invisible. Including the cost of the latter elements with the services they support would seem helpful,
using reasonable rule-of-thumb allocations. (The level of precision for the data should be appropriate to
driving the allocations in order to balance the effort and cost of collecting and analyzing data with the
value received from an enhanced understanding of the infrastructure portfolio.)

Figure 2
Operation Scorecard
Finally, it is important also to develop compelling ratios and best-practice benchmarks to put the
overall cost of the infrastructure into perspective. An example is a comparison of the growth of the cost
of infrastructure to the cost of the business application services supported. The goal, clearly, is that infrastructure costs should grow more slowly. Relative improvement, however, may not be persuasive; management may seek to understand performance on some absolute scale. For this reason, external benchmarks may be helpful. Comparisons to other companies in the same industry might illustrate the effectiveness and efficiency of the IT infrastructure; comparisons to companies in other industries regarded as
IT leaders might also prove helpful to management. Benchmarks are difficult to establish rigorously,
especially in today's dynamic turn-of the-century business world. Comparisons that exploit informal
external channels of communication (see section 2.1.1) may be more effective, especially when accomplished by direct contacts among business leaders.

4.5 Implications for Outsourcing

Benchmarking can be transformed from an academic to a very practical exercise by establishing a
free-market economy where internal IT services will compete against external outsourcing providers.
The issue of outsourcing IT departments and services has been hotly debated since the 1980s.
Some companies outsource their entire IT organizations, while others selectively outsource specific
functions, and still others do not outsource any IT activities. The intention here is not to debate the

- 18 merits of outsourcing but, rather, to note two factors fundamental to the decision to outsource: (1) the
conclusion that the enterprise's internal IT organization has failed to achieve the value/cost relationship
that management desires; and (2) the expectation that the outsourcer perform this task better.
In most cases, the data to support these assertions are sorely lacking. The holistic framework for
IT governance proposed here can help to develop the metrics appropriate to supporting the necessary
analysis of potential areas to outsource. The same tools and metrics can be used for internal and external
IT service providers, creating an opportunity to benchmark these services continuously and regularly.
The framework would be very useful in management of outsourcing relationships and contracts and to
attain the necessary combination of cost, service levels, and quality.

4.6 Implications for Virtual Corporations and the Internet Economy

The Internet-based economy presents new challenges and opportunities for IT governance.
Enterprises face the challenge of integrating Internet-based services into their business models, to generate a need for further IT applications and new technology components. The business value of such new
systems needs to be analyzed, and all of this is occurring at a speed businesses have never faced before.
An even greater emphasis, therefore, falls on techniques to create and maintain business-IT alignment,
and better management of the total IT resource is needed. To compete in Internet time, decisions need to
be sharper, clearer, and quicker than ever before, resource allocation must be better, and execution better
and faster.
The Internet economy is reinforcing the trend toward the virtual corporation, with more interdependent business processes developing among companies and an increasing use of the Internet to coordinate and share information. A framework for shared management will be critical to the success of virtual
corporations. The proposed framework addresses these needs through its comprehensive coverage of IT
activities, rigorous management of IT projects, and the metrics-based approach to business application
services: these tools may provide a basis for well-thought-out, manageable, and enforceable contracts
among business partners.
Internet-based tools are very accessible to business users, a notion that supports increasingly
decentralized or outsourced IT development and deployment (similar to the exploding internal use of
such tools as Microsoft's Excel, Access, and PowerPoint). Succeeding as a business on the
Internet requires a coherent, consistent business strategy, rather than only a collection of uncoordinated
departmental initiatives, leading to the conclusion that business management has a strong need for a
management framework for such efforts.

4.7 Implementing the Framework

There are two aspects to successful implementation of the proposed IT governance framework.
The first is both behavioral and procedural. The disciplines involved in managing programs and projects

- 19 must be accepted, and new practices of management and reporting must be adopted. Both are best done
gradually, starting with a few important and visible projects and then expanding to the rest of the enterprise. Managers, project and product-service leaders, and project teams will need to be trained in the
new methods, but training is not in itself sufficient. A valuable supplementary technique is to assign
coaches-internal or external consultants expert in the particular methodology-to work closely with the
teams as the new processes are adopted.
The second aspect is automation of data collection, and this aspect is more important than might
be assumed. Relying upon ad hoc, manual methods to collect and process data, with support from standard productivity tools, is certainly possible, but if more effort is expended on data collection and correction, then less time and fewer resources are available for the analysis and decisionmaking needed to
manage the portfolio and its projects. Systems that automate these processes allow the information collected and analyzed to flow to all those in the enterprise who can benefit from it. Such applications are
just beginning to emerge, several of which address parts of the framework and at least one that has been
announced automates the complete framework. 5

5. For example, ProSight's eIT-enabler; see URL: <www.prosight.com>.

Chapter Five
Whose Governance Framework Is It?
For any framework for management to work well, it needs to serve many constituencies, and this
is true for the IT management framework proposed here, which has as one critical objective the fostering
of alignment of IT with the business. Intended to facilitate communication between business units and
IT groups, the framework needs to be viewed by each group as "its own."
In addition to horizontal communication, the framework will also need to facilitate vertical communication (that is, within both the IT and business communities). Within the particular business, midlevel management, who tend to be technically savvier than senior management and therefore more comfortable with technical solutions, may be able to explain upward in the management chain how the systems it has commissioned and implemented can enable a business strategy. Within IT, senior leadership
need to communicate to project teams and operational units how new and existing systems relate to
business activities and strategies. In most enterprises, such communication occurs at best sporadically,
that is, when events (usually negative) prompt it. The holistic IT management framework creates a
process for ongoing (and therefore regular) communication to support the three primary objectives stated
at the outset (see Chapter Two).

5.1 What Senior Business Managers Get

For senior management, the most important benefit would be the business improvement that
results from their knowledgeable participation in IT decisionmaking. For this to occur, senior management need to have a context defined for them and to have specific, discrete choices framed, which they
can evaluate and to which they can respond. Then they will not only be more comfortable with the role
and value of IT within their enterprise but also will themselves contribute to the future development of
IT strategies and the allocation of resources to IT projects and activities.

5.2 What Mid-Level Business Managers Get

Mid-level managers, who depend on IT, often feel isolated on several fronts. Considered "technocrats" by senior management, they may be viewed as less than full business managers. They may even
feel trapped, because although they depend on technical systems, they are not sure that the IT function
will receive the resources needed to meet service commitments. And they may not have complete confidence in the competence of the IT operations and support groups.
The first real win for mid-level managers combines the IT governance management framework
and tools with which to communicate with senior management, to convince them that their combined
business-IT resources are being managed effectively. The second win is to help mid-level managers
communicate with peers in IT, to ensure that business services for which they are responsible will meet
commitments.

- 21 -

5.3 What Senior IT Managers Get

For senior IT managers, the framework enables two communication channels: communi-cation
with senior business managers and communication with the IT staff. The main benefit for senior IT managers is support for a clear focus on important strategic and operational issues. In turn, such support may
enable senior IT managers to enhance their own contributions to the enterprise considerably.

5.4 What Project and Product-Service Managers Get

The difficult task of project and product-service managers is to provide certain services on time,
on budget, with high quality, and reliably. Such managers often feel themselves under siege and rarely
believe they have the necessary resources or the informed support needed from senior management. The
proposed framework would help them to explain these issues to senior management? and to develop
realistic "service contracts" to which they can commit themselves and deliver against.

5.5 What Everyone Gets

The final benefit extends across the business and IT functions. Facilitating communication about
how IT contributes to the business across the levels and functions of the business will improve coordination and cooperation. Managers will learn more about other efforts within the enterprise that may affect
them and will communicate with the sponsors and leaders of those efforts. As a result, synergy will
increase, duplication of effort will be reduced, and the effectiveness of project delivery will grow.

Chapter Six
Beyond the Framework
The holistic framework for IT governance proposed here addresses the three primary objectives
discussed in Chapter Two: it fosters strategic and tactical alignment of IT with the business; it relates
the cost of IT with the value brought to the business; and it supports a drive toward operational excellence. The framework accomplishes this through a combination of measures, descriptive techniques,
and-most important-the full involvement together of business managers and IT managers.
The main purpose of the framework is to focus on both the business-IT alignment and on the IT
value/cost relationship. Another necessary focus is on the limits of the framework: the unknown
unknowns. One way to compensate for these is to develop the informal communication channels, within
and outside the enterprise, that tend to fill them in. The holistic framework for IT governance can assist
by encouraging the development of new relationships among business and IT leaders, which, in time,
may result in richer, more effective informal channels.
A wise consultant once observed that all skilled workers use tools, but not everyone who wields a
hammer and saw can pretend to be a carpenter. A framework is only a tool and will be effective only if
used properly.

Acronyms

AP
AR

accounts payable
accounts receivable

CEO chief executive officer

CIO chief information officer
ERP

enterprise resource planning

HR

human resources

IS
IT

information services
information technology

R&D research and development

SLA

service level agreement