IT Governance

The discipline of IT Governance, a key aspect of overall corporate governance, has received increased attention over the last 10 years. This attention has been fueled by Y2K initiatives, the awareness that technology is core to every business, and the impact of the Enron collapse in 2000 with the resulting Sarbanes-Oxley legislation that mandated compliance requirements.

It’s important to remember that IT governance is not just about compliance; it’s about ensuring that IT has the best possible impact on the business. In this light, an IT governance strategy must be built on two pillars: producing value and managing risk.

The IT Governance Institute, which was founded in 1998, identifies the following objectives and requirements for IT governance:

• Alignment: For IT to be aligned with the enterprise and realize the promised benefits of information technology
• Value: For IT to enable the enterprise by exploiting opportunities and maximizing benefits
• Resource Optimization: For IT resources to be used responsibly
• Risk Mitigation: For IT-related risks to be managed appropriately

These objectives map tightly with what Project Portfolio Management (PPM) does, making PPM a required foundation for every IT governance initiative. In fact, PPM not only helps accelerate IT governance, but new on-demand approaches to PPM further simplify the process of getting IT governance done.

Innotas has seen many situations in which companies got lost trying to implement overly complex IT governance strategies, and unfortunately, in the process, ended up creating large bureaucracies and complex metrics that contributed little value to the organization. But finding the right balance between producing value and being compliant is doable.

Innotas has worked with companies that have made rapid progress in their IT governance initiatives by starting with a PPM implementation focused on a simple and pragmatic approach. These companies have been able to make measurable impacts on the business while implementing reasonable controls; adding layers of further sophistication only when and where they were really needed.

The Role of PPM in IT Governance

While PPM alone is not enough to meet all the requirements of IT governance, it is one of the most critical ingredients for a successful IT Governance strategy. PPM plays a pivotal role by enabling an organization to:

• Prioritize the IT portfolio of projects and applications according to business objectives and expected benefits
• Respond to changing conditions and new opportunities by being able to rapidly reallocate resources with a full understanding of the impact
• Know exactly what projects people are working on, enabling them to make clear business decisions on what the priorities are and how well resources are utilized
• Ensure that projects are delivered on time, on budget, and on quality
  The following table summarizes the capabilities required to meet the objectives of IT governance, and identifies whether each capability is part of the discipline of PPM and supporting applications, or if the capability is addressed by other disciplines and technologies. As you can see, PPM addresses a large majority of the capabilities required to meet IT governance objectives.

How PPM helps meet IT governance objectives

Next we are going to explore each of the four objectives of IT governance. We start each section with the questions that need to be answered to meet that objective and then we describe how PPM is leveraged to answer them.

Alignment

Are we doing the right things? Is what we are doing going to produce the best value for the organization?

These are fairly simple and basic questions, but answering them with confidence requires IT to take several steps to create a single IT system of record:

• Take an inventory of all current projects and applications
  • Not much can be prioritized without understanding what IT is working on, and what projects are in the queue
  • After taking a project inventory, companies often discover they are working on twice the number of projects they thought they were in their project inventory
• Create a standardized business case for project requests
  • Developing consistent metrics for expected value, cost, and risk allows an apples-to-apples comparison
• Understand business objectives
  • Know the organization’s priorities and how they are measured
• Understand how existing projects, applications, and proposed initiatives contribute to those objectives

These steps, or building blocks that PPM provides allow an organization to take a portfolio approach to managing what IT does and align it to the business.

Figure 1. Three IT portfolio scenarios showing breakdown between active projects, new project proposals, and sustaining or maintenance work.

Value

Is enabling a new proposed service more important than any of the projects we are already doing? What would be the impact of merging with Company Y – what do we have to put on the back-burner to get that done?

Prioritizing the IT portfolio is not just a once a year planning exercise; it’s an on-going process. Market conditions change and people come up with excellent new ideas, and there are never enough resources to accomplish everything on the list. While it’s always painful to disrupt a carefully balanced project portfolio, the job of IT leaders is not only to embrace change, but to drive it.

Effective IT governance requires that IT leaders look for great ideas and quickly assess how these ideas score against what is already on the plate and on the waiting list. This needs to be done in partnership with the business. A simple stage gate approach supported by a PPM solution is critical to implementing a standard process with established review and approval steps to filter out ideas that may be good, but do not match the objectives of the business.

Then the fun begins — sorting out where in the stack of priorities a new proposal belongs based on priority, budget, and resource availability.

Figure 2. Balancing priorities across three IT portfolio scenarios by choosing projects and sustaining work based on value, priorities, objectives and departments.


Figure 3. Finding the right spot for each project.

Resource Optimization

Do we have the resources with the right skills to get this project done? When will they be available? What kind of people do we need to hire based on future plans? Should we outsource part of a project?

In the end it all boils down to people – getting and keeping the right people, and focusing them on the projects that allow them to make the best use of their time and have the biggest impact on the business.

PPM provides a clear understanding of where time is actually spent. It is amazing how finger pointing stops when a discussion is based on facts and not assumptions. Think of the typical scenario in which somebody from a business unit complains that IT is not doing enough for that particular business unit. That conversation will take a dramatically different tone when IT is able to show a PPM dashboard based on real-time data and explain that “Based on your demand and prioritization, 30 percent of your allotted IT resources/budget is being spent on projects X, Y, and Z; and 70 percent is being utilized to maintain and enhance applications A, B, and C. Would you like to change these priorities? Furthermore, project W is delayed because we do not have available software architects, but it could be started right away if you are willing to fund a consultant for that role.”

Figure 4. Tracking resource allocation by project and role comparing demand to staffed and unstaffed levels.


Figure 5. Managing resource capacity and utilization.

Risk Mitigation

Great idea, but do we have the infrastructure to pull it off? We can build it, but will they come? How reliable is the new vendor we need for this project?

Two projects may have the same potential value and both may be well-aligned with business objectives, but the risks and unknowns associated with each may be very different and should be factored into the prioritization process and made clearly visible to the stakeholders. It is also important to plan for the potential risks involved in a project and have a mitigation plan ready.
Then there are the operational risks: monitoring the execution of the project to ensure that it is on schedule, making sure that all planned resources are still available and not impacted by delays in other projects; tracking spending against budget; and closely managing requests for scope change.

These are all staples of a PPM solution.

Finally, the part nobody wants to talk about: did the project actually produce the value to the business that was expected? This is the ultimate risk from a business perspective, and tracking it results in much better future business cases and planning.

IT Governance for Business Value and Compliance

If you have an IT governance initiative in the works, don’t panic! Many companies have successfully implemented IT governance strategies without overwhelming the people involved or bringing IT to a standstill.

It is possible to both ensure that IT produces the best value for the business AND that IT meets internal and regulatory compliance requirements. By making project portfolio management a key element of your IT governance strategy, you will provide the right level of visibility and processes for managing the IT portfolio, its resources, and risks.

The Expanded Project Team

I am back from my journey to South East Asia. It is time to resume my little series on the rules of Lean Project Management. This third entry will discuss the nature of the project team and its composition. It is an invitation to expand the boundaries of a project team to include all project stakeholders. It is of course linked to the proper execution of the two other rules already discussed:

Rule 1 – The Last Planner rule. The one who executes the work is the one who plans the work: Expanding the project team means more last planners, the ultimate ones being those who have to materialise the project benefits once this project has delivered what it was intended to.

Rule 2 – The Track Promises rule: Do not track time (effort) or cost. Track small promises that you can see over time: Expanding the project team means getting each promise made by the last planner who has a stake in it and can really make it happen.

The current edition of the PMBoK still makes a difference between:

• The “project team.” Those directly involved in the realisation of the project deliverables (the issues and management of this team being treated in Project HR management), and
• The “project stakeholders.” Those affected by or able to effect the realisation of these deliverables (the issues and management of these “separate” groups being treated in Project Communication Management).

And the new version of the PMBoK, coming out soon, continues to support this paradigm. This way of discriminating among project players is one of the reasons for our low project success rates (29 %), as documented by the CHAOS Report. Merging those two groups into one, the expanded (or integrated) project team, is one of the main explanations for the high project success rates (85%) documented in the British Constructing Excellence program, mentioned before in other blog entries.

I have a very fresh example in memory to illustrate the need to change the conventional view on who is and who is not on a project team. During a project management maturity diagnosis I was making with a customer (a highly innovative manufacturing enterprise), I met the manager responsible for after sale customer service. He told me of his last experience with the introduction of a new product. Since he has nothing to do directly with delivering the new product for production, the main objective of their new product development projects, he was not considered part of the project team. He came across some technical documentation on the new product just before it went to pre-production, only to realise then that the product included the very same component that was causing 90 % of his customer complaints about a similar product already in full scale production and on sale. These complaints were resulting in major on site service costs and loss of recurrent customers.

He immediately went to the CEO and had the pre-production phase stopped right there. The project team» had to go back to the drawing board, with an expensive prototype in the garbage bin and much rework to do in the very small time left to seize the window of opportunity for this new product. This mess would have been avoided very easily if this very important last planner had been integrated to the project team at the very start of its definition.

If you think that you must restrict the number of people in a project to those only involved in the direct realisation of deliverables, I hope that the little tale of disaster I just presented will have you refine your “need to know” and project team definition to include – as early as required – those who have to materialise the ROI on this project.

So LPM rule No. 3 is: “Expand the project team to include and integrate all significant stakeholders as part of the team as early as possible”.

Aim low – deliver high. There I’m done!

Actually it seems simple doesn’t it? But let me tell you where it can go very wrong:

• You never ‘aimed’ in the first place – so no one, especially you, knew what to expect.
• You ‘aimed’ – but you never communicated it to anyone. Whoops!
• You aimed nice and low and delivered way high – great but what kind of planner does that make you?
• You aimed well, you communicated the plan really well to start with but you never got back to the rest of us to tell us how it was going… therefore denying us an opportunity to adjust our expectations.

I tell anyone I work with, or who works for me, to keep talking to me. Tell me how you are doing. Tell me if you think it will be late, or over budget, or the wrong colour. Set my expectations correctly as soon as you can. The truth is that we will all mess up or get caught by circumstances beyond our control, at some point. I know that. But I want to know about it as soon as possible – not at the eleventh hour. Please! This way, you see, I can help, or get others to help. And at a minimum, I can adjust my stakeholder’s expectations.

This is the key to project success. If the original plan has to be adjusted, this is fine. The earlier the better. And the earlier, the better chance that the new plan becomes THE plan.
Bottom line is that no one wants to be surprised. No one.

And about the planning… don’t try to plan low and deliver high. It looks terrible to the well educated, and eventually it will get you where you don’t want to be. Ouch!

Plan the work and work the plan and find a simple, easy way to keep everyone in the project on top of the progress. No surprises!

I am writing this piece in late August, as leaves on one of my maples are starting to turn yellow and red. The tree may be panicking prematurely, fooled by the unusually cool August, but you cannot argue with the calendar. The summer is almost over.

Time is the only critical resource that cannot be replenished or substituted, and we all have only a finite supply of it. In fact, it may be the most precious resource of them all. Yet in business life, don’t you find that too often, you just want to exclaim: “people, stop wasting my time!”

Here are five small and simple habits we all should adopt to respect others’ time.

1. Out-of-office notices. First of all, thank you for at least setting one up. But listen to this: provide the name of a person who should be contacted if the matter is urgent and provide his or her contact information. Sounds trivial? Approximately half of out-of-office notices I receive lack this information.
2. Meetings #1. I know of a number of mid-level managers whose calendar is booked tighter than that of a presidential candidate. This is usually due to two reasons, neither of them acceptable: some feel that they have to grace every business meeting with their presence, while others believe that in order to achieve results, every breathing soul should be present in their boardroom. Stop it right now, whichever of the two sins you are committing! Spend time, and allow others to do so, on thinking and implementing.
3. Meetings #2. Always have a clear agenda for the meeting, don’t just drag people in to “brainstorm” or “be in the loop”. Once the decisions are made, you can apprise the rest of the world of them. On projects, always have a communication plan in place and follow it religiously.
4. Mode of communication. If you need something urgently, call. However, do not leave voice messages that are 10 minutes long, explaining the issue at hand and all minute details pertaining to it. In the beginning of my career, I worked for an earlier riser. By the time my colleagues and I made it to the office, usually around 8 a.m., our phone sets would be flashing with new messages, each being a long and windy walk through our leader’s thinking process. Some of them ended with something like “Actually, forget it.” Without fail, every single member of the team detested this habit, but why we never said anything is a mystery to me now.
5. Maintain Focus. Minute, trivial things always get in the way of more important tasks. It takes me 30 minutes to write a short article, like this one, if I focus on the task at hand. It may take a whole day if I choose to take phone calls immediately, reply to emails as soon as my mail application chimes, or browse the Internet. Learn to prioritize, maintain to-do lists and work on things that really matter, now.

I could list another five, ten or fifty time-savings tips, but I would like to practice what I preach and not take precious time from you and me.