You’re not alone. Project cost overruns are common.
Statistics will tell you that over 85% of projects go over budget. But why? What are the mechanics behind project cost overruns and project schedule delays? Plenty of talented and experienced professionals engage in dialog about this very topic every day, and try to arrive at conclusions about how to stop projects from going over budget. In this article, I’d like to shed some light on the underlying workings as to the root causes of cost overruns and schedule delays. In order to tackle the problem of how to eliminate overruns, it’s important to understand the main reasons why they happen.
Obviously, there’s no one-sentence answer to these questions since every project is unique and the influences that trigger overruns can vary tremendously.
Luckily, however, there’s been quite a bit of research and experimentation around this exact problem — since it is a pervasive issue that so many businesses, large and small, struggle with. As a result, there have emerged some key factors we can point to that are the major contributors to projects going over budget and suffering schedule delays.
A lot of project managers and business owners have their own theories; and after a good deal of listening and reading, many will have you believe that it all comes down to one thing: Project Changes. Technically speaking, project changes are arguably the biggest contributor to projects going over budget and blowing schedule deadlines, but for the purposes of this discussion, let’s leave Change and Change Management out of it. I’m saying that because I don’t believe changes are truly the root cause of cost overruns. I believe that if you approach a project anticipating that things will change throughout the project — and you have good mechanisms and methodology to track and account for change — Project Changes aren’t really the root of the problem and should not result in a project cost overrun. (Click here to read about making the best of Project Change).
Let me repeat that another way:
Project Changes may alter the original budget and schedule, however, if you have appropriate tracking and change-management processes in place, they shouldn’t result in a project cost overrun. They’ll just shift the size and duration of the project.
That’s all fine in theory, of course, and I know that in reality nothing works quite that smoothly; but rarely does anything in a project work as smoothly as originally planned. The changes and addendums that get added and removed to a project should be viewed as merely extensions of the original plan. Therefore, your ability to handle change management is directly related to your ability to plan and negotiate on the fly. So, yes, if you can’t do this very well, it’s going to lead to some serious cost overrun and schedule delays. My take on it is that if you’re ok with looking at it that way, it’s truly the controls, planning and estimating pieces that are the root of the change-management dilemma.
So, leaving Change out of the equation, what then causes project cost overruns and schedule delays?
First, it’s key to understand that cost overruns and delays don’t just suddenly happen: they in fact happen all the time, every day in every phase, mostly in small incremental chunks. They happen in Planning, Execution, Close-out and Reflection phases along with every stage within those. To get to the bottom of why, let’s look at the four major triggers for cost overruns and schedule delays, which I’ll explain in more detail further below:
1. Inaccurate Estimates
2. A lack of real-time visibility and control
3. Poor methods to determine project progress
4. Insufficient historical information
These four items relate directly to the major phases of a typical project: Planning, Execution, Close-out and Reflection.
So, let’s talk about the first one, Accurate Estimating. This is probably the most obvious culprit since if you’re running a $10-million project that was estimated to be a $7-million project, well you’re pretty likely screwed to come in on budget and on schedule. Overly optimistic estimates and those done in a hurry are common. Project estimators that rely a little too much on gut-feel without documenting and qualifying their numbers can also cause estimating snags. I’m a believer in gut-feel, by the way — my only qualifier on that is with the communication and transparency around quantifying where those gut-feel numbers come from. I’ll get to that more when discussing the value of good historical information.
The second item, real-time control, is easily the most insidious of the four. It’s all about having accurate, up-to-date information about what’s going on in the project. Of course, part of this control thing is covered by the old-school methodology of being physically present on the job-site. The even bigger control factor, however, really boils down to project tracking. When you track all your labor, equipment, materials, subcontractors, suppliers, etc., you’re able to view daily reports on everything that’s happening on your project. You’re empowered with a wealth of information, which is the ultimate key to ‘control.’ You don’t have to wait until the end of the month to find out what happened weeks ago and that currency of information becomes the critical element of managing successful projects. Here’s an interesting fact: when something goes wrong on a project, the size of the impact it will have on cost and schedule is exponentially related to how fast you can apply corrective action. In other words, every day that goes by without fixing a problem that’s occurred on a project will accelerate the budget impact.
I hate to say it, but real-time control is also about keeping your suppliers and subcontractors honest. If you don’t have a good tracking and control system in place, getting over-charged and double-invoiced is going to be a huge contributor to project cost overruns.
The third item, determining Project Progress, is also a nasty contributor to cost overruns during the execution phase. If you don’t constantly take the pulse of where you’re at with your project, how can you possibly know if you’re on budget or on schedule? You may have spent 50% of your budget, but if you’re only 30% complete, you might have a pretty big problem. The earlier you can find out that you’re facing a potential cost overrun in your project, the more chance you’re going to have to correct it.
Having agreed-upon project progress milestones and sign-off is absolutely vital to being able to control costs and get paid. This is partly covered early on during the planning and negotiation phases when you’re defining what it means to be finished, but it obviously has to also be viewed as a continuous evaluation during the life of the project. Being able to seamlessly close-out a phase, level, task and the project as a whole enables you to stop spending money and squandering valuable time. You need to do regular forecasts on your project to get a financial and schedule picture of how far along the project is, and whether you’re ready to achieve closure on any piece of the project. Again, I know this all sounds great in theory; but the thing is, if you don’t do it, that’s where the insidious overruns creep gradually and dangerously into your projects.
Looking back on a completed project (or even a partially completed project) to examine where things went well and where things didn’t go so well is an indispensable part of running consistently successful, profitable projects. Otherwise, you’re doomed to repeat the same mistakes over and over. A project retrospective is more than just having a big group-hug with your team and your subcontractors (although, a little love-collateral can help keep the peace and smooth any hiccups). A reflection is also about examining the numbers, and using that information to feed future projects. First, however, you need to actually have those numbers — and the metrics, and the reports — and this means you need to have executed on project tracking and earned value management during the execution phases of your project.
Insufficient historical information plagues many businesses trying to run profitable projects. Sadly, it’s often the case that very little data is collected during a project, so very little is known about what happened. All that’s typically available to many project managers is the summary totals contained in the corporate ERP. This is only marginally helpful, as it’s missing so many crucial details that help planners and estimators get better at their job. Equally tragic is when information is tracked, but it’s stored in a series of spreadsheets. As we all know, the reporting and metrics you can achieve from spreadsheets is terse, vague and time-consuming to obtain.
We’ll talk more about this in upcoming articles. I hope this has been helpful. Please leave a comment and let me know what you think!
Don't forget to leave your comments below.
Chris Ronak draws from over 20 years working with project-based businesses in management, project management and consulting positions. He is currently the CEO and founder of 4castplus, a web-based software solution that delivers full project cost management, estimating, forecasting and real-time tracking to keep complex projects on budget and on schedule.
Companies often struggle to maintain a good balance between their market activities and their product development efforts. The fact is – most new products are not ready for prime time. This circumstance leads to products that deliver less value than anticipated or fail altogether. This inability of organizations to effectively bring products to market often creates a significant drag on companies’ ability to innovate and compete in today’s rapidly changing marketplaces.
There are a significant number of reasons why it’s so challenging to effectively bring products to market. Some are external, such as changing market conditions or shifting customer needs. However, many problems result from internal challenges such as overstretched contributors, the wrong mix of skills, poorly understood processes, and misalignment between the core team members in the value creation process.
Professions such as business analysis and project management have boundaries and roles that are well understood. Both have their bodies of knowledge, process groups, and foundational knowledge areas. In contrast and ironically, the product management profession spans 70 years but has yet to fully codify its body of knowledge. The resulting lack of clarity on the responsibilities and boundaries of a product manager often contributes to many of the internal inefficiencies and missed opportunities we see within today’s organizations.
There is often tremendous internal confusion regarding the role, span, and scope of a product manager. Ambiguity in the responsibilities of this role leads to dissonance and tension as the key stakeholders in the value creation process – project managers, business analysts, and lead engineers – struggle to understand what to expect from product management. Given the profession’s historical fragmentation and lack of a solidified standard, where does one look? What are the boundaries of the role and how can we work together more effectively?
Perhaps the best way to start is by defining the role of a product manager and illustrating the product management life cycle. Product managers are responsible for creating and sustaining value throughout the entire life cycle of a product. The focus on creating and sustaining value is what makes product management unique.
This product management life cycle© model is the property of The Association of International Product Marketing and Management (AIPMM)©.
The product management life cycle is composed of both stages and phases that chart the course of a product from its conception, the Conceive phase, to its ultimate withdrawal in the Retire phase. The stages and phases are concurrent activities. This framework is universal; it applies equally well to products or services.
Now that we’ve defined the role of a product manager and illustrated the life cycle, we can drill down a bit further and examine why business analysts and product managers are perfect partners.
Effective product managers spend a significant amount of time in the market gathering requirements, monitoring trends, examining competitive activity, and evangelizing their product. Product managers are also expected to distill market information into actionable requirements and channel these requirements to the team developing the product. A product manager’s job increases in complexity as the organization grows. Product managers get stretched thinner and thinner by the ever-increasing volume of internal and external demands.
When this happens, product managers naturally turn their efforts toward either market-facing or product development activities. Although product managers are skilled at both, they typically prefer one over the other and allocate their time accordingly. Many pick market-facing activities. This bias toward one or the other, and the demands that company growth place on a product manager, ultimately causes the organization to feel the need to add a business analyst, or someone with similar skills, to the team. The new team member is tasked with helping facilitate, communicate, analyze, and recommend business solutions as well as translating high-level requirements created by the product manager into implementable requirements. This need for translation necessitates a collaborative partnership between a product manager and business analyst.
The pairing of a strong business analyst with a market-facing product manager can result in a perfect partnership. The product manager assumes responsibility for guiding the product successfully through its life cycle and interfacing with the market. In concert with the product manager, the business analyst drives the effort to turn high-level market requirements into requirements that are implementable within the constraints and capabilities of the organization. Factors such as people, processes, and technology are all key considerations for success.
This division of labor leads to improved harmony with the principles on the core team of product managers, project managers, business analysts, and lead engineers. Most importantly, it places the right people in the right roles to create value for the organization, customers, and stakeholders.
The reality is that product managers are often faced with the nearly impossible challenge of spanning the market and the multitude of development activities. And like project managers who steer complex and interdependent initiatives, product managers who want to succeed must rely heavily on influence and shared organizational objectives while interfacing with customers and coordinating the activities of a myriad of internal stakeholders. Many product managers get stretched to the breaking point trying to be jacks of all trades and end up struggling against unrealistic expectations.
By pairing business analysts with product managers at key points throughout the life cycle of a product’s development, organizations can optimize bandwidth, expertise, and interest-related challenges that allow both roles to do what they do best – create value.
Don't forget to leave your comments below.
Greg Geracie is the President of Actuation Consulting, a world-class provider of product management training courses and advisory services to some of the nation’s most well known organizations. Greg is also the author of the global best seller Take Charge Product Management© and the Editor-in-Chief of The Product Management and Marketing Body of Knowledge©.
David Heidt is a Strategic Advisor, Senior Project Manager, and Business Analyst with Enterprise Agility, a worldwide leader in strategy alignment, project portfolio management and business analysis. David is President of the Chicagoland Chapter of the International Institute of Business Analysis and a contributor to The Product Management and Marketing Body of Knowledge.
On every project there are things we know and things we don’t know – Knowns and Unknowns. Organizing your thoughts around those concepts can be a constructive approach to understanding a project as shown in the matrix below:
Things in our plan
Things we know we don’t know
The Known Knowns you handle via the plan, but what about those various flavors of Unknowns? How do you normally account for those things in the project? Often it’s with padding – estimates that include unidentified amounts of time and/or money just in case.
Let’s review how padding works: You ask your tech lead, Renee, for an estimate: “Excuse me, I need an estimate for that activity you’ll be doing.” Now Renee may be thinking to herself “That will take me about 40 hours.” But Renee doesn’t tell you that. She may very likely tell you “Um, that’ll take about 60 hours.”
Why would she do this and, more importantly, so what? First, she’s doing it to cover her Unknowns. And that is absolutely understandable. Stuff happens – Unknowns! So what’s the problem?
Padding undermines sound project management practice in three ways:
1. It undermines trust. The notion that it’s a good idea to under promise and over deliver may work once or twice, but over time padding undermines the trust between the PM and the team and the rest of the stakeholders. Honest questions should inspire honest answers. That’s how you foster partnerships.
2. Have closets, will fill. If Renee says 60 hours, she may very well take 60 hours and that’s opportunity cost. She isn’t able to be allocated to other efforts.
3. Padding undermines the opportunity to learn from our experience, which in many ways is the essence of why we seek to develop good project management habits. What you want to be able to do at the end of a project is turn around and look at the journey you took to get there and be able to take something away for next time.
If you pad estimates and quite possibly end up with nonsense for baselines, what do you learn from that? Certainly not as much as you could have had you started with meaningful estimates to begin with.
Let’s say Renee is thinking 40 hours, she tells us 60, and then she comes in at 50. What do you think? Renee’s a star! But what really happened? She was 25% over! If you are measuring against meaningless numbers, you don’t get much of a chance to make the PM journey a learning experience.
Importantly, the intention here is not to highlight Renee’s failures. Rather, the purpose is to identify and understand the Unknowns that derailed the work and consider how to avert those things in the future or plan for them next time.
This is all well and good, but Renee still has her Unknowns to contend with, so what might you do to partner with her to address those?
The better project management answer to Unknowns is contingency reserves, an amount of money in the budget or time in the schedule seen and approved by management. It is documented. It is measured and therefore managed. You draw from it where and when you need to and then learn from that, as well.
The purpose of the contingency reserve is not to 100% cover everyone’s Unknowns, but rather to reduce them to a level that is acceptable to the stakeholders. So maybe it’s 10% of the project total if stakeholders aren’t too risk averse and you feel bullish about what you know and don’t know. Or maybe it’s 40% on a project with highly risk adverse stakeholders and a big box of Unknown Unknowns.
Knowns we can plan for. The Unknowns? We have two choices for how to deal with those. Under the table with padding which precludes any discussion, measurement, or management of what contributes to the Unknowns. Or Contingency Reserve in which case we talk about them, document them, measure and manage them. Only one way really enables us to learn from them.
Don't forget to leave your comments below.
Andrea Brockmeier is the Client Solutions Director for Project Management at Watermark Learning. Andrea is a PMP® as well as Certified ScrumMaster. She has 20+ years of experience in project management practice and training. She writes and teaches courses in project management, including PMP® certification, as well as influencing skills. She has long been involved with the PMI® chapter in Minnesota where she was a member of the certification team for over eight years. She has a master’s degree in cultural anthropology and is particularly interested in the impact of social media and new technologies on organizations and projects.
Estimating is defined as an informed assessment of an uncertain event. For project managers, accurate estimates are the foundation for effective project planning and execution. There are many processes that have been developed to assist in the estimation process. Without proper estimating of project duration, cost, resources, risks and other parameters, it is impossible to implement proper alternatives and ultimately make timely and sound decisions.
There are five (5) main steps that an effective project management program engages to maximize success of projects which include: project planning; project baseline; reporting; change control; and project closure. Each of these steps rely upon accurate estimating and proper control to ensure project success. So what are some typical events that may impact the validity of your estimates?
- Poorly defined scope of work. This includes misinterpreted work elements, or the task granularity (detail) is not adequate for current phase of the project life cycle (PLC).
- Lack of knowledge for internal project cost (typically inability to determine accurate crew cost, resource productivity rates, indirects, etc).
- Inflated Optimism. The proverbial rose colored glasses way of guessing project problems or events.
- Inadequate risk management. Ignoring risks and uncertainty will skew the estimates and expectations become unrealistic.
- Time pressure or unrealistic targets. This is a miscalculation of the time a project task will take and failure to communicate what is reasonably achievable.
- Adoption of inappropriate estimation methodologies.
- Failure to utilize historical data or lack of accurate, meaningful historical data. With so
- many factors that could possible cause estimate inaccuracies, what can be done to make
- Your estimates the most accurate?
- Educate your project team and organization on estimating and require the appropriate project team members prepare the estimate associated with their scope aspect of the project.
- Reach out to a subject matter expert (SME) with experience for scenarios.
- Incorporate peer reviews and estimate validation processes into your PLC.
- Incorporate Risk Management and contingency assessment /re-assessment throughout the PLC
- Encourage estimate review and validation after each phase of the PLC.
- Accurate and timely documentation of change requests.
- Research historical data on the project effort, schedule, cost, risk and resources for lessons learned and make appropriate adjustments. Statistical baselines should be and revised periodically.
- Use mock ups, trial runs, field studies or other simulations as a guide.
- Adequately define work scope and accurately track time against each task.
- Develop and maintain Basis of Estimate Document.
Project Estimation should consider validation of project performance as measured against the plan for purposes of evaluating estimate accuracy and ensuring proper methodology is utilized. Metrics based on comparison of project estimates and corresponding actuals should also be utilized when making decisions regarding estimates of remaining or future work. A sound risk management program should also be implemented and should capture risk occurrence for current and future reference. Estimates should include applicable adjustments relative to risk management policies where necessary. Proper incorporation of Risk management into the estimating process will reduce project uncertainties and will enable better estimates. Finally, estimation methodologies should provide a basis for developing performance metrics used to determine project health and provide capability to make informed decisions on contingencies. It is important to develop a consistent process that can be utilized (on a graded approach if necessary) in all phases of the PLC.
In conclusion, there is an unrealistic pressure to complete projects faster, cheaper and more efficiently. By developing and implementing these control points into the estimating process, you increase your estimate accuracy and improve the probability of delivering projects accurately and timely.
Don't forget to leave your comments below.
Josh Medica, CEO and President of Integrated Consulting. Josh’s passion and commitment to project excellence has established him as a project management/project controls industry expert. He transferred that passion and knowledge into executive level master training classes on all topics related to project management and project controls. Josh has facilitated risk workshops on projects ranging from id="mce_marker"0 MM to $2 BB . His dynamic and thought provoking presentation style has positioned him as a leading trainer/educator. His speaking circuit also includes house training for large EPC companies, engineering companies, and major oil companies across the globe.
During the nineties, we were shocked by the Chaos Report with stats that showed two thirds of projects were failing. After fifteen years and the introduction of new approaches including agile, project delivery has improved. However, there are still fundamental problems that have not yet been addressed.
Despite significant investments in technology and organizational change, companies fail to make the connection between strategy formulation and execution. This is evident as well at the government level where failure to implement strategy has the economy surfing in and out of recession. IT projects are a key component of implementing strategy, and the stats are dismal:
- Kaplan and Norton tell us that nine out of ten companies fail to implement strategy
- According to IBM, 40% of investment in IT is wasted
- Gartner puts this estimate at 20%, equivalent to $600B/year
- If we take IBM’s estimate, we are talking over one trillion dollars a year, wasted
If companies are failing to implement strategy and wasting fortunes in IT, there is clearly a problem in portfolio management. The mainstream practice uses a bottom-up approach:
- Put ideas through a “funnel” process, based on a business case that gets progressively elaborated
- Rank opportunities for investment based on their value, risk and alignment with strategy. This sometime involves complex multivariate analytic tools that few people understand or trust
- Select the top of the list for execution, all in a yearly cycle
- Confirm the benefits in the business case after delivery
While this approach is logical and sound, in many occasions leads to unexpected results:
- Business cases based on fiction and not used for decision making
- Executives that bring a last minute list of projects “on a napkin” that jump the queue and get approved
- The verification of benefits becomes an elusive task and just doesn’t get done
- Millions are invested and many times there is no clear idea of what the organization is trying to achieve
It isn’t surprising that portfolio management has not succeeded in helping companies implement strategy. The term portfolio comes from finance and leads to the root of the problem: the assumption that opportunities for investment are independent, and that each one generates measurable financial returns. Finance departments have dictated the need to come up with “hard numbers” and a rate of return for every project. This approach works well when projects represent incremental improvement of an existing system that is not changing significantly. As an example in manufacturing, a new press will cut scrap by 20%, you put the new press in and measure scrap, end of story.
The problem exists when there is a strategy for transforming the business. As Porter states in his article What is Strategy: “While operational effectiveness is about achieving excellence in individual activities, or functions, strategy is about combining activities”. The key word, in Italics in the original, is combining, as it goes against the concept of independent opportunities for investment. In a transformational strategy, activities are represented by projects that deliver capabilities, which then interact to generate results and sustainable competitive advantage. In his article, Porter presents Southwest Airlines as an example of strategy. In a nutshell, in order to offer lower fares, SW offers no meals, baggage checking or seat assignment and operates short flights from small airports. This allows SW to reduce gate turnaround time and increase plane utilization. In addition, it uses only one model of aircraft to reduce maintenance costs. As a result, SW can offer lower fares than their competitors and point to point flights, and after more than 20 years they are still in the market and thriving. Talking about SW, Porter affirms: “Its competitive advantage comes from the way its activities fit and reinforce one another”.
In the case of Southwest, would it make sense to create a business case for “not checking luggage”? How much of the reduction in turnaround time at the gate can be attributed to this? Of course you can come up with a number, but it would be a guess and impossible to verify. Most importantly, in order for the strategy to work, all of the key components need to be in place, so creating business cases and prioritizing a list doesn’t work in this scenario.
The alternative I am proposing in this article is a “top-down” business case approach using a Results Chain model that captures the interactions between financial outcomes, business outcomes, capabilities and initiatives. This approach applies to organizations that are planning a transformation, as opposed to incremental improvement. The top-down business case estimates the benefits the organization will realize from transformation; incremental to the results it would obtain using the current business model. The difference between the transformed and the current scenarios generates a stream of benefits for the overall business case for transformation. These benefits are then propagated through the Results Chain based on the relative contribution of each outcome, capability and initiative. Sounds simple? It is; the elegant simplicity of this solution draws a parallel with the alternative provided by agile to the problem of creating a schedule for projects difficult to estimate, by eliminating the schedule and using relative estimates in points. Today most of us accept this drastic approach, which has proven effective in many situations; a simple solution for a complex problem.
Continuing with Porter, Figure 1 is my personal interpretation of the Southwest case study. The overall benefits of implementing the strategy are estimated in $100M, which are propagated from right to left, based on the relative contribution of each element. In the first propagation, 30% of the $100M goes to Revenue Increased, a financial outcome. These $30M are then propagated to Average fare reduced, a business outcome and from there to Average cost per seat reduced. A second flow starts from the right with $40M propagated to Variable Cost Reduced and from there to Average cost per seat reduced, which adds to the previous $30M for a total of $70M. What this is telling us is that 70% of the benefits are attributable to this business outcome and, as such, should be a focal point for the transformation.
In a similar way, investments for the initiatives are propagated from left to right, and $60M in investments are required to deliver the key business outcome Average cost per seat reduced, which has benefits of $70M, and this should yield a positive return on investment.
If you find this approach too complicated, there are tools that can handle the propagation and calculation of financial returns and allow you to concentrate on what is really valuable: translating the strategy into measurable outcomes, understanding (and not ignoring) their interrelations, identifying the capabilities to achieve those outcomes and the initiatives that will deliver those capabilities. The key for this approach is the identification of the proper business outcomes, which in essence “translate” the strategy into actionable and measurable results. All the fluff is removed from the strategy and the organization can focus on achieving those key business results and not just on delivering projects.
Going back to the business case, in this approach it makes sense only at the overall results level, by comparing the incremental benefits from transforming the operation and the investments to get there. The benefits and investments at each node in the Results Chain serve only as a reference to allocate and manage budgets based on the contribution of each element to the overall results.
This may appear as a simplistic solution. However, if we draw another parallel to agile, we find similarities in the fact that, as agile resolved the problem of predicting the future on a schedule based on hard estimates by eliminating the schedule and using relative sizing, this approach removes the need to come up with business cases for every project, and replaces it with relative contributions. Agile works well in projects that have high volatility and where hard estimates are impossible. Similarly, this approach works well in transformational strategy, where interactions make the estimate of benefits for individual projects impossible. In other words, the options are: create business cases based on fiction for those key projects that will transform the company, or look at the transformation with a holistic view, and manage the portfolio from the top.
By taking portfolio management to the next level of translating and executing strategy, this approach provides PMOs with the opportunity to reposition themselves in the organization and move towards a Strategy Management Office, as described by Kaplan and Norton, which focuses on execution of strategy. For consultants, this represents an opportunity to provide their customers with a fresh approach to implement strategy, and if nine out of ten companies are failing at this, and one trillion dollars are wasted every year just in IT, the business opportunities for everyone are significant, and this proposition does have a clear business case.
Don't forget to leave your comments below.
Fernando Santiago has over 20 years of experience as a project manager/director and PMO manager in Canada, the USA, Latin America and Europe. He is a solid practitioner, consultant and trainer in the areas of PPM and strategy implementation. Fernando leads P3M Consulting, firm that provides training, consulting and develops PPM software applications.
Part I: The Challenge and It’s Scale
A Project Management Office (PMO) leader gets a call from her boss who just found out that a recent web portal service delivered by one of her project teams has been compromised by an ever growing population of cyber attackers. If this was your project, how would you respond to a call from your PMO leader? What due diligence can you reference showing that you incorporated essential security practices in protecting a strategic business revenue generating asset? In USA Today, a title in the Money section of August 12, 2011 reads, “8M Web Pages Hacked, Mined”. If you think this could not happen to your projects, think again. Organizations and career professionals who manage and make decisions regarding existing and newly deployed strategic assets must take a different delivery approach to further minimize significant impacts that lead to lost revenue and front page news stories.
Project managers have been traditionally driven by on-time and on-budget performance metrics rather than also including security as a top priority metric for project management deliverables. This results in making an organization’s strategic assets easy targets for cyber attackers. Out of all data breaches investigated in 2010 by Verizon Business, 96% were avoidable. (Source: 2011 Verizon Business Data Breach Investigations Report). Cyber-attacks are real and will continue to target organizations of all sizes, regardless of the industry. Organizations and project managers must take a different approach in delivering cyber safe assets to the Internet. New organizational performance metrics for cyber safety will become mandatory in determining overall project and corporate success. Competitive advantage, in the age of cyber threats, will determine success for organizations and career professionals who take a proactive approach to cyber security.
This two part article has been written to begin increasing the level of awareness in organizations and career professionals such as project managers. These professionals need to start developing a security mindset and begin positioning proactive steps in delivering cyber safe solutions.
Cyber Security’s Emerging and Prevalent GAP
The expanding gap for organizations today starts with consumer driven markets and stakeholder pressure to offer differentiated services that grow the bottom and top lines of the business. In order to stay competitive, many new business and delivery models have leveraged the Internet, outsourcing, offshoring, cloud based services and mobility platforms that continue to outpace the reach of cyber security. A 2011 CIO cloud survey by CIO.com stated that 71% of enterprises had placed security among their top three concerns related to moving to the cloud. These strategic business decisions have created invisible windows that have opened gaps in making organizations easy targets for cyber attackers for the assets they deploy. The model has completely shifted to an open versus closed system, enabling an unprecedented level of access to sensitive information within companies and business partners today. Most organizations do not have the required visibility, knowledge, talent or capability to ensure cyber safe practices are incorporated throughout the planning, delivery and operating life cycles. Given the sophisticated techniques used by cyber attackers, organization and career growth will depend on how well companies and career professionals embrace their roles by enhancing their delivery competencies and skills.
Organizations have become more data-dependent. It has been estimated that just over the last two years, the data footprint used by organizations across the globe has doubled (Berkeley School of Info Management and Systems 2009). Although organizations and business leaders cannot disrupt services to customers, they can take the first step to make cyber security a strategic priority in the planning and delivery process. Acquiring new knowledge and having an informed mindset is the starting point in combating the new epidemic of cyber threats. Understand your current mindset by testing your knowledge today with the quick self-assessment below:
What Do the Numbers of Cyber Threats and Attacks Tell Us
Cyber threats and attacks are real and here to stay. The few statics we have shared below include just some highlights gleaned from thousands of breaches worldwide. Cyber Attackers may not always have a preference and consider no target too big or too small. These targets include projects, career professionals and organizations. One of the many statistics that directly applies to project delivery includes 6,253 new vulnerabilities discovered in 2010 (Published in Apr 2011, Symantec Internet Security Threat Report).
Many of these vulnerabilities go undetected during the project and software development lifecycle phases. Data theft reported last year due to these vulnerabilities being compromised has impacted on average 260,000 identities per breach. (ibid Apr 2011) Not only market pressure but rising legal precedence with new federal and state regulations has raised the stakes for all organizations and career professionals. The numbers over the past few years continue to show a rising trend of successful cyber-attacks with no end in sight. Organizations and career professionals can no longer afford being reactive and must take a proactive approach in delivering their strategic assets cyber safe.
Test Your Cyber Security Knowledge; Answer Yes or No.
- Do you know what you should track and trace throughout your project delivery regarding cyber security risks and threats?
- Do you know the difference between cyber threats and attacks?
- Do you know the techniques cyber attackers use to compromise organizations and assets delivered by projects?
- As the project leader, can you determine with little effort what data and records may have been exposed by a cyber-attack based on the project data you included in your project delivery plan?
- Do you know what your internal incident response team will ask of you?
- Can you validate to external auditors and investigators that you took the appropriate due diligence in delivering a cyber safe project?
- Do you conduct privileged penetration testing to determine if exploitable vulnerabilities may expose sensitive data used in your project solution to cyber threats?
Your response and understanding of these questions begins to illustrate the gaps you may have regarding the level of cyber safe practices in your project, business and career. If you answered “no” to one or more of these questions, you may have a project already at risk of being compromised by cyber attackers.
In the second part of this article, we will review our approach to assist career professionals such as project managers on how to begin delivering better cyber safe solutions and the value it delivers to project quality. Organizations that embrace and apply this new approach will begin to reposition cyber security as a business advantage instead of being reactive to the market causing significant financial loss and consumer trust impacts.
Don't forget to leave your comments below.
Eben Berry is President and Founder of Cyber Inspectors LLC. Mr. Berry formed a new venture enabling companies to have greater preparedness in responding to growing concerns with cyber-attacks. As a former CISO, his twenty three years of experience across Military, Fortune 1000 and non-profit organizations centered on business, technology and information security. He received his MBA from Northeastern University.
Ehsan Sabaghian is Sr. Director of Business Development at Cyber Inspectors LLC. After receiving his 2nd master’s degree in information technology management from Clark University, MA, Mr. Sabaghian joined Cyber Inspectors LLC. An information systems expert with extensive background in business management, he emerged as a strong change agent SME on many large IT projects.
The information presented in this article is intended as general advice. Specific advice would require a qualified organization to become familiar with the facts of you or your organization’s particular situation.
At crucial moments, well-timed executive decisions to steer projects and programmes are often in short supply. Subsequently, issues are left unresolved, key milestones are missed and the overall project delivery is delayed. Whilst it may appear that executive indecision is the main culprit behind the delay , it not the primary cause.
The root cause lies in how executive leadership is exercised in project steering committees. Normally, such committees are organized to encourage executives to provide guidance to project teams and participate in the resolution of issues amongst other responsibilities. However, this is usually done in a pluralistic manner as leadership is collectively shared amongst the executives. Figure 1.0 below shows a typical project hierarchy that consists of a project steering committee that has four C- level executives.
Figure 1.0 A typical Project Steering committee that exercises pluralistic leadership
In practice, this works fine for issues that are clear-cut to solve, as executive consensus is normally reached. But for more complex issues, executive agreement is at best painstakingly slow and more often than not, issues are deferred for the CEO’s input. The input can be either in the form of guidance consisting of principles, or a definitive decision thereby putting to rest any executive misgivings about solving the issue. Usually to obtain the CEO’s input requires the PMO together with the Project Sponsor to compete with other departments for a time slot with the CEO (predictably this can be an arduous wait, as CEOs are extremely busy people). The ensuing delay can very quickly bring the organization’s flagship project/programme to a complete halt, escalate costs, and squander opportunities to address competitors.
Another drawback of pluralistic leadership is that most solutions negotiated are often diluted to appease other executives. In the end, a compromise solution is reached, which neither addresses the problem, nor helps the project move forward. Its only achievement is that all the executives concur—not whether the solution is right, or wrong. Such resolutions render projects steering committees ineffective, deter Project Managers and Sponsors from escalating issues, and promotes a culture of indifference.
Yet, by making a small but significant change in the structure of the project steering committee, the aforementioned problems that plague traditional steering committees can be avoided. By the creation introduction of a ‘Project President’ in the steering committee, where the CxOs are demoted to subordinates, can engender an efficient mechanism to deal with issues quickly. Figure 1.1 below shows this new appointment of the Project President in relation to other executives.
Figure 1.1 The Project President and the Project Steering committee
To enable the Project President to discharge his/her responsibilities, the CEO must delegate all the powers related to project work. This implies that that the Project President must be able to overrule CxOs, interfere in their respective domains (within valid reason) and have a free rein to implement, or revoke decisions. As a consequence, the CxO’s are relieved of their collective leadership and the leadership is solely handed over to the Project President. In this new structure the CxO’s play an advisory role in decision making, whereby taking decisions is exclusively at the prerogative of the Project President. It also means that the Project President’s scope of work and stewardship encompasses all projects and programmes, and is not limited to one, or two initiatives i.e. the Project President may preside over several steering committees.
In the launch phase of the company, the CEO is the person entrusted with executing the role of the Project President. But soon after launch, the CEO usually hands over this responsibility to the CxOs collectively, without nominating a successor with all the powers of the CEO. Invariably, this pluralistic leadership exercised by the executives leads to the all too familiar problems mentioned earlier.
In practice, the best candidates amongst the CxO to perform the role of the Project President are the Chief commercial officer (CCO), Chief Operations Officer (COO) and the Chief Project Officer (CPO). However, the COO and CCO can become too pre-occupied with their day to day duties, and may not have enough time to execute the duties of the Project President. Therefore, the CPO is the natural candidate for this role, but in many organizations the CPO lacks the mandate and the support of fellow executives.
If company’s really want to improve their performance in the execution of initiatives and reduce time to market then they should take a serious look at restructuring project steering committees. By appointing the right person to play the role of the Project President, delivery of projects and programmes can be vastly improved.
Don't forget to leave your comments below.
Abid Mustafa is a seasoned professional with 18 years' experience in the IT and Telecommunications industry, specializing in enhancing corporate performance through the establishment and operation of executive PMOs and delivering tangible benefits through the management of complex transformation programs and projects. Currently, he is working as a director of corporate programs for a leading telecoms operator in the MENA region.
Have you ever attended a dining event where the host had a perfect understanding of his guests, knew just how to arrange the event and delivered a beautiful dining experience? Or, you may have attended several different kinds of special events at their invitation and they always seem to get it right.
The skills for setting the table for a dining event is not unlike the skills needed to deliver portfolio management to an organization. Three important skills will get you to the ideal portfolio management setting: 1) Your guests, their experiences and expectations; 2) the food and service costs; and 3) gathering guest taste feedback to make your next event even better.
Guests and their Experiences – Stakeholders and their Expectations
When you start to plan a dining event, you think about the guest list and consider palates and preferences. For instance, they may be frequent gourmet diners and have had broad exposure to different ethnic foods. There are also other considerations as you think about your potential guests: allergies, personalities, common interests, etc.
Similarly, when your organization starts to look at portfolio management as part of its service offering, you have numerous items to consider. You must understand your audience and stakeholders, and determine their level of understanding of portfolio management; it may be a common level of understanding or widely diverse. You also need to think about the company’s overall exposure to portfolio management, whether it’s rolled-up project reporting, idea intake or both. It’s also good to know if your company is a leader or follower, and what’s in it for them.
Back to your dinner plan. It’s time to think through the kind of menu you want to create and your end goal with the event. You may want to feed a large group in a short period of time, or create an intimate five-course fine-dining experience for a special occasion.
For your company’s efforts, you’ll determine what type of portfolio management to deliver and its overall purpose. You’ll work on the list of considerations, including the type of decisions your team supports – whether you’re a reporting team, audit team, if you’re helping align work to a company strategy, whether you support a chargeback system and more.
Understanding who is sitting at your table – whether it’s a dining table or a portfolio meeting table – will ensure a higher satisfaction rate when the experience is over and coffee is served. The team’s types of services and deliverables will depend on the functions your team will support. Knowing whether you serve the management team, the business team, the project teams, the resource managers or all of the above will determine the number and types of settings at your portfolio table.
Cost of Food and Labor – Portfolio Management Cost of Control
When planning a restaurant dining event, the chef needs to look at the cost of the meal as well as the cost of serving (or delivering) the meal. He considers the cost of ingredients versus the price for the meal, then determines the value and worth of the ingredients. For instance, serving fresh versus frozen can mean a lot to the quality of the overall meal.
Knowing which type of portfolio management your team will deliver, how much status reporting and what kinds of trending to collect for decision-making are just a few of the cost inputs to effectively run your team. You also need to consider the time it will take for idea intake, estimating at an idea level and balancing your portfolio forecasts. In addition, rolled-up status reporting and understanding how project change requests impact your current portfolios will impact your services.
Next is the type of table setting you’ll use. A buffet may work best if you’re serving large amounts of people and using a small serving staff. For a more formal affair, you may go all out with multiple forks and knives, cloth napkins, wine glasses, water glasses, a centerpiece, a chef, a sous chef, servers and bussers. You make sure you have the right venue, equipment and staff to execute the event and create the experience you desire for your guests. There is a cost of service associated with the type of menu you set, as well as your operational costs for space and equipment.
In addition, portfolio teams must account for the time needed to operate under organizational services or functions. These include, for example:
- Auditing or quality checks
- Phase gate reviews
- Collection of measure and metrics/reporting/trending
- Governance meetings
- Project health facilitation
- Portfolio idea management
- Portfolio change control – balancing portfolios
- Project staff augmentation or project rescues
- Center of excellence (process and tool ownership)
Portfolio teams also determine which resources are needed for the team (in terms of people, processes and tools). Depending on the functions or services, you may need "super PMs,” financial analysts or program managers. You then locate which tools and processes will best enable your team. The cost of running an organization is called the cost of control. The level of this cost of control may depend on the risk tolerance level of your organization. General industry standards, depending on the portfolio management service offering, can run between 15–25% of total project spending. 
“How was your Meal” or “Is this Working?”
There’s a wide set of expectations around the dining experience. Informal, fast-food or buffet diners may not hesitate to tell their hosts how they feel, and yet these diners know they have little impact on changing the long-term results. A fine-dining experience may not include a server that solicits feedback, but results can be gathered by what is left on the plate at the end of each course. Either way, both types of dining experiences want repeat customers.
Whether your portfolio team is in place to manage idea intake, project health escalations or quality checks, or to manage the financial aspects of your portfolio, continuous feedback will help to refine the kinds of services, functions and deliverables (reports) that will help make the portfolio management offering better. Depending on your organization’s culture, you may solicit formal or informal feedback. The results should be a validation of what’s working and adding value, and what could be done better. What you do with the results is what will bring back customers to your portfolio table.
Ensuring that you have a follow-up process for any of the services your portfolio team offers will lend legitimacy and credibility. Just like you don’t want to eat off of dirty plates and torn table cloths, stakeholders want accurate reports, timely meetings and follow up to unanswered questions. Continuing to ask, “Is this helping you to make decisions?” or “Does this incite the correct behavior?” will help keep the table clean and ensure repeat customers.
Don't forget to leave your comments below.
Cindy Lee Weber is a highly motivated, dedicated and passionate project management professional experienced in both corporate and small business cultures. Her focus on maturing best practices, while providing practical solutions has been applauded time and again by clients.
Cindy believes in measuring success and provides strategic foundations for delivering on-time and on-budget implementations. She consistently leads large improvement efforts for clients, including detailed process improvement for governance, portfolio management process improvement, and process documentation and refinement. Her expertise includes: project management, project management office, portfolio management, project and portfolio framework and methodology, project management training programs, solutions implementation, and measures and metrics.
Cindy is a certified Project Management Professional (PMP) and an active member of the Project Management Institute’s Minnesota chapter
Controlling projects is a good thing. Controlling people is not. What does it mean to control projects, not people, and when have you crossed the threshold from controlling the project to micromanaging the people?
When you start telling people how to do their jobs instead of focusing on the results they create is usually an indication that you have stepped beyond the bounds of project control and into the realm of people control.
Creativity and innovation are magic wands. They endow projects with enhanced performance and new profit-making results. They spark creative genius and the potential for creating wealth.
Most innovation springs from a conscientious search for new opportunities. These opportunities exist both within and outside a project, organization or industry. Innovation opportunities within a project include: