“Governance is like a diet: everybody thinks it’s a good idea, but hardly anybody does it well and nobody is successful.  Effective IT governance starts with understanding the strategic direction of the larger organization and then having a clear IT strategy—that people buy into—that aligns with that.” —University CIO

The topic of IT governance has always been one of great importance to the successful operation of the corporate technology function.  But in today’s environment it is even more critical for driving strategic opportunity for the business.  Well-designed and executed enterprise IT governance makes roles, responsibilities, and paths to execution transparent and creates the platform for generating business value.  Forward-thinking CIOs are exploring ways to take IT governance to the next level—to enable their businesses to pull ahead in this hyper-competitive, global business environment and position IT in a leadership role delivering technology-enabled innovation.  They are also experimenting with relaxing governance standards to foster innovation in high-growth areas of the business, by allowing the business to take responsibility for the added risk.

Center CIO members across industries and geographies shared their insights on the obstacles and opportunities that exist for CIOs in establishing or evolving their IT governance models and mechanisms in order to cement IT’s role as a strategic business partner.  The following themes emerged from the qualitative research:

• Integration between enterprise IT governance and the larger organization’s governance structures is critically important
• Strategic alignment and cost control are the two biggest benefits of mature IT governance
• CIOs are working hard to figure out how to create new aspects of IT governance to support today’s business needs: innovation, speed, and agility
• Change management is the single biggest challenge when introducing new aspects of IT governance
• IT governance processes must be transparent and inclusive

Read this white paper to gain peer advice and insight on approaches that CIOs are implementing to take a leadership role in IT governance and deliver benefits to the business.

If you do not see the file below, click here.

Harvey Koeppel and the Center for CIO Leadership were the hosts for the Virtual Roundtable, which focused on the ongoing education of CIOs, by providing real life examples from industry leaders from all facets of the industry.  Today’s session - Next Generation IT Governance continued to prove that Harvey has the right pulse on the industry and ongoing CIO needs. There were several key take-aways that surfaced from the conversation.

Leaders from Cranfield and Yale Universities led the group in a discussion regarding the need for IT Governance and in how to structure decision-making and create accountability when forging down the IT Governance path.  Having transparency and a framework for effective communications, aids in changing the organization’s behaviors that are necessary to implement successful IT Governance programs.  Another facet of the model is the need for companies to co-exist in a collaborative environment and to have a set of metrics and scorecards to promote the current state of the organization.

The speakers and participants shared their perspectives on this very important topic. How are you looking to evolve IT Governance and enable your businesses to succeed and thrive in this-hyper competitive environment?

Sue Bergamo

CIO

BTE Consulting

Carlos Francavilla, Director, BITCompany, Argentina.

Business & Technology Advisor, more than 25 years of working with IT to enable business transformations.

The Center for CIO Leadership has requested CIO members and other industry experts to answer three questions regarding predictions for the CIO in 2012.  Here are my answers to these three questions.

What are your predictions for the top 3 CIO priorities for 2012?

1. Using IT to attract and retain customers.
   Innovation and transformation of existing and new products will be used to satisfy the very fast change in the behavior of customers who are becoming more IT savvy, global, and connected – any time, any place, and with any gadget.
   The CIO will need to combine their knowledge of the entire value chain and processes of the company with the unique awareness of technology's capabilities to push the company beyond merely what is has been and toward what it must become.
   What does this mean?  IT is not aligning with the Business; IT is part of the Business.
   Do you present budget proposals for IT, or budget proposals for growth and innovation and bigger customer engagement enabled by IT?
2. Technology Diversity.
   The old days of a central IT Organization dictating and imposing which Technology is the right to use is gone forever.
   Consumerism of IT will become a reality and the IT Organization needs to be flexible and support any device that the market is producing, and that the people in the organization will choose to buy and bring to the enterprise.
   This process starts at the Board and includes all the people in the organization.  Today which technologies to use is becoming a business and a personal decision, IT must transform itself to be an “advisor” to people in the organization about the capabilities and the risk of the technology diversity and prepare the IT operations to understand this new reality and support it.
3. People Skills.
   The central IT unit with a focus in Technology is leaving room for an IT Organization with more people closer to the rest of the company and the CUSTOMERS.
   Do you have the right people for this this job?  Do you have an IT Organization with a lot of certifications in any international standard or framework for IT that are in the market? Would you be proud of the culture of the IT Organization?
   Prepare the IT people to be an “Advisor” and work head to head with all the other departments in the company.  Think for a moment, with which Business Unit do you work more closely, today?  Operations?  Marketing?  Finance?  You guessed it; Operations will be the answer in more than 60% of the IT Departments!
   Your Department needs new skills far beyond the comfort zone of the IT people, prepare for this transition, embrace the challenge and be proud of your people. 

How will 2012 be different from 2011 for CIOs and IT?

The convergence of the Internet, Web 2.0, and mobile technologies has created a disruptive shift in business.  The era of Business-to-Person (B2P) communications driven by all social (social media, social networks, and social influence) things has emerged as a new model for engagement.

In today’s global environment;

• One billion people connected to Internet
• Four billion have mobile phones with data capable smart phones now providing over 50% of new phone sales
• More than four hundred million people are sharing billions of pieces of content and experiences each week via online exchanges

Social Media have changed the way we do business (customers, partners, prospects, and employees).  We use social media as a platform for discussion of ideas, experiences, and knowledge-exchange. A s we enter the era of business-to-person (B2P) customer relationship systems, those organizations that harness Web 2.0 technologies and platforms to enable B2P communications will be the winners.

As a CIO and leader of an IT Department, are you embracing this disruptive shift?  Are you sharing with your colleagues what you know most, technology capabilities and how to use them in this new Social Media World?

2012 will differ from 2011 in a way that if we as a CIO couldn’t move the Company fast enough in that direction, others will be doing it.

Come on, tweet now with the CMO and other CxO colleagues and start working together to transform the company processes to this Business to Person communication.

Your Board and CEO will be glad to approve your investments when you walk together to the corner office and talk about this transformation.

What business shifts are you expecting in 2012?

Uncertainty will be the word of 2012 and the CEO and Managers will be looking for ways to defend the company against this threat and/or taking advantage of this world in recession.

Are you applying IT to enable the business so that you and your colleagues find the answers?

Are you helping the company to choose the right strategy?

According to Mckinsey, are you thinking about your decisions being better for a company’s competitive position, trying to influence, or even determine, the outcome of crucial and currently uncertain elements of an industry’s structure and its conduct?  Or is a wiser course to scope out defensible positions within an industry’s existing structure and then to move with speed and agility to recognize and capture new opportunities when the market changes?

IT can enable companies to change the structure of entire industries and/or gain speed and agility to companies.  Are you ready for these business shifts?

Are you enabling that your company play and win in the Champions League of your Industry?

A quick search of IT job sites reveals many postings with the key  words “IT governance” or “governance of IT.” Clicking through the  descriptions reveals a wide range of requested duties and experience,  much wider than is typical for a head of application development,  security or finance. Due to my exposure to a wide range of enterprises  and service on several industry standards and practices committees, I’m  often asked, “What makes a good IT governance leader?”

This  post offers a few insights from what I have seen across countries,  industries, business-IT models, IT organization models and enterprise  sizes.

To  begin, let’s level set on what “IT governance” is about. Governance, in  general, has a variety of rather wordy legal, human resource-ish and  academic definitions. A more simple, outcomes-focused definition is “Getting  the right information to the right people at the right time to make the  right (or at least better) decisions with accountability.” The “better” is because there is a cost/benefit in gathering more decision information. Managing that balance is crucial.

Governance  purely exists only with the board of directors. However, as a practical  matter, it is often delegated. In this context, two requirements are  generally necessary – 1) clear charter from the board or higher level governance body and 2) that the people involved are acting in the interest of the enterprise as governors -- in contrast to daily management silos. These people  (governors) represent the various business line, functional and  geographic units that fund (especially those who own P&L) and  leverage IT to generate risk-return balanced value for the  enterprise (or achieve mission in governments). This value should be  very demonstrable, having impact on ability to launch products, acquire,  expand and satisfy customers. It should be able to be measured by  investors (whether shareholders or an acquiring firm).

Because  of the requirement to act in the interest of the enterprise, balancing  across silos, the preferred term is often “enterprise governance of IT.”  This helps guard against the tendency to use “IT governance” to mean  managing the IT shop or the CIO’s staff meeting.

The  enterprise governance of IT leader is therefore often principal advisor  (strategic, financial, operational) and secretary (coordinator,  facilitator, catalyst, peacemaker) to this governance body. Thus, key  expertise includes:

• Business skills 
  • Business strategy (competitive, market, industry, economic)
  • Business products and processes
  • Financial (portfolio management, investment risk-return analysis, capital budgeting, make/buy)
  • Risk-return management (across financial, project and operational areas)
  • Strong  knowledge of industry best practice (e.g. ISACA’s Val IT, Risk IT,  COBIT or academic research such as from MIT Sloan Center for Information  Systems Research)
  • Technology (directions, trends, competitive advantage, cost/benefit implications)
  • Broad exposure to IT operations (not necessarily that deep, but enough to interlock with needs)
• Inter-personal skills 
  • Independent, executive presence
  • Collaborator seeking common ground
  • Facilitator understanding each governor’s perspective
  • Curious, questioning
  • Negotiator with eye on shared objectives
  • Calming influence
  • Leverages by nature, doesn’t get bogged down reinventing the wheel
  • Personally committed to key governance measures – informed, transparent, agile and accountable

Some  of these attributes, such as negotiating, significantly increase in  importance with federated organization models or the more dissimilar the  business lines. Technology trend skills are more important the more  dependent the enterprises’ offerings are on technology for  differentiation in the market. Others shift with the intensity of  competition, riskiness of business initiatives or complexity of business  operations.

Finally,  there are points to delete from the job description or include only as  liaison points – compliance, control or audit. These are not only  incidental to the focus on driving and balancing risk-return value, but  also often bring in personal attributes that are “square peg in round  hole” relative to other requirements.

Armed  with this information, you can create a more focused job description,  screen, interview, hire and then – crucially – enable your governance  leader for success.

I know this topic will be controversial and there will be a lot of CIO's who disagree.  However, just hear me out.  I realize that there are some companies that demand chargeout from their central CIO function.  One good example would be the diversified conglomerate who conducts many different businesses and each one has a complete and separate  P&L and they live or die based on bottom line results.  I would also include functions within a company that are completely discrete from other company functions such that they share very little centralized company functions.

I would argue that in most other cases, charging out IT costs make very little sense.  It would be no different than charging out the services of the central finance department.  I guess I would concede that if finance is charged out than it would be ok to charge out IT.

Here are my reasons for not charging out IT:

1.  It creates the image that IT is not part of the company strategy but rather a utility that can be contracted for by any department.  I believe that the IT resource needs to be tied directly to the strategic aims of the corporation.  It should not be tied to the whim of a department head.

2.  Most companies decide to chargeout because central management does not want to be in a position to decide what should be automated.  I would argue that that is the job of top management.  With IT costing from 2% to 10% of revenue, it must be managed.  This is the role of the IT steering committee. If a steering committee composed of the officers of a company manage the automation agenda, then there is no need to chargeout.

3.  Another reason to chargeout is to fully burden a particular department so that their expense line represents their actual cost.  This approach is very dangerous in a innovative environment where a new idea could have great potential but cannot get traction due to the great startup expense.  If each department must stand on its own, innovation could be stifled.  Again, management could control this situation.  However budget scrutiny oftentimes causes such ventures to be minimized.

4.  In a non-chargeout environment with a strong steering committee,  each project being proposed is measured against the strategic plan of the company and is discussed with a company view not a departmental view.  In this environment, I would argue that scarce IT resources are better utilized.

5.  In a chargeout environment,  all expenses must be carefully recorded so that precise charges per user can be determined.  In addition, some measure of usage must be developed to assess proper overhead expense.  As a result of this rather subjective process, each department gets assessed  a charge each month that can change based on many arcane factors within the IT department such as vendor cost increases, unanticipated maintenance costs, outages, etc.  As a result, there are oftentimes discussions with users each month when the charge is finalized especially if the charge will affect the departmental incentives.  These are difficult discussions with our users that we are trying to serve and prove the value of IT.  All in all, a very contentious environment.

6.  Since each department stands on its own, they can decide to keep the internal department honest and get an outside quote and compare the internal quote to the outside one.  This process can easily lead to rogue applications since outside vendors can easily reduce overhead expenses in order to get a new client.  This does not happen in a non-chargeout environment since costs are retained in IT.  And guess who users come to when rogue applications go bad: Internal IT!

7.  There are certainly downsides to a non-chargeout environment.  The biggest one is for IT.  Since all costs remain in IT, the CIO must defend IT's expenses each year especially when costs are going up.  IT can make the argument that its costs are going up because the steering committee has approved an increase in staff due to a major project commitment.  However, there is oftentimes a collective amnesia to these factors especially in tough times.

8.  On the other side, a non-chargeout environment enables management to easily see the total corporate expense for IT.  This expense line must be managed by top management since it is so significant.  IT can operate at any level and it must be controlled by the company to be sure that expenses are in line with corporate needs and capacity.

9.  Another downside can be that users in a non-chargeout environment can think IT is free and try to develop frivolous applications.  I would say that a strong IT steering committee composed of the company officers would eliminate that risk since the user officer must defend the project against all other requests.

I would love to know what you think.  It would be good to get a dialog going to flesh out this very important governance issue.  I'm sure that there are a lot of CIO's struggling with this decision that could use your wise counsel.

Each year, the Center team conducts interviews with  CIO members to collect, analyze and synthesize insights, advice, best practices and input on key business competency areas for CIOs to excel as business leaders.   In 2011, we are focusing on three key themes that CIOs have told us represent areas of challenge, opportunity and leverage for making an impact on the enterprise:

• Analytics: a Tool for Customer Centricity
• Security and Risk Management
• Next Generation IT Governance

We spend a few months on each topic, creating a CIO Insights research paper, working with members to write blog posts about the topic, gathering pertinent partner research and hosting virtual events on related subjects.

This is an important element of the Center’s role in collecting advice and insights from peers.  Send us an email if you are a CIO interested in being interviewed as part of the Center’s research on any of the 2011 topics. 

Here’s a bit more detail about the Center’s Three Key Topics of Focus for 2011:

TOPIC 1: Analytics: a Tool for Customer Centricity

Customer centricity is increasingly critical to companies’ strategies for growth, and presents an opportunity for CIOs to take the lead.  Technology is at the core of today’s customer engagement strategy, and now plays a key role in the customer experience.  There is a strong need for improved customer data aggregation, segmentation and analytics to support the execution of customer-centric activities across the enterprise, from customer service, to delivery, to marketing and relationship building.  The customer centric enterprise requires a single view of the customer across the enterprise, which in turn reinforces the need for collaboration among those driving the relationship and connections to the customer (marketing) with those providing the conduit, the support and the information (technology).  Today’s CIO has the opportunity to lead the strategy and enablement for customer engagement – but this comes with a new imperative to partner with the CMO – and other customer facing executives - to deliver on the revenue promise of customer centricity.

Please note that our next CIO virtual roundtable, Getting Value from Social Media and Unstructured Data: The New Unified View, will cover a key aspect of this important topic.  Check the event page for more details on this event on June 22^nd.

For those of you interested in past events on the topic of analytics, see the Center Virtual Roundtable, Partnering to Drive Change through Analytics that took place in March.  Click here* to listen to the recording. 

TOPIC 2: Security and Risk Management

With the advent of the financial crisis, and rapidly evolving influences of information access and transparency, CIOs more than ever have the opportunity and imperative to take the lead in managing risk and thinking about security in a strategic context for the business.  This topic will explore key elements of the challenges and the potential for CIOs to lead their enterprise, including:

• Beyond IT risk management to understand operations, security and enterprise risk
• Creating  a culture that is risk aware, not risk averse
• Playing a proactive role in leading the enterprise to manage risk as a business opportunity

TOPIC 3: Next Generation IT Governance

IT Governance continues to be of interest and challenge to CIOs has they expand their influence as business leaders. This topic will help CIOs explore opportunities and new ways to think about the next generation of IT governance, including:

• Governance to enhance and enable integration and alignment with the business
• Role of governance in  driving impact with analytics and risk management

Which of these topics resonate with you and why?  What other topics are you interested in discussing in 2011?

* Only CIO members have access to the roundtable event recording.  Join Now.

The Trojan horse outside the walls of Troy had an alluring appeal, but it was the stratagem that allowed the Greeks finally to enter the city of Troy and lead to the capture of the city.

This story is an extreme view point of some IT people on the concept of IT Consumerism. On the other side of the balance it may well be an over-bloated and melodramatic view of this new paradigm shift.

It may be necessary to try and introduce/define the concept to create some context. Generally speaking IT Consumerism refers to the increasing influence that technology experiences of individuals as consumers—both hardware and applications—have on the technology that they expect to use at work.

I would bet that most of CIOs are already experiencing some form of this in their organizations. How many CIOs can still fetter access to internet usage? Or block access to IM and social networks like Facebook, Twitter, etc.?

The reality, however, is that employees already use these technologies as part of their everyday lives. With the pervasiveness of technology and the increasing always-on connectivity of devices and end-points, users come to work expecting the same experience, convenience and flexibility they have elsewhere in their lives. Unfortunately, at work they meet the strong wall of opposition -- namely “IT Governance” -- that spells out what can and cannot be done within the corporate network.

The real challenge is that the enterprise has suddenly lost the monopoly of “cool, cutting-edge, and latest” gadgets as users today now experience the “latest” in terms of innovative technology and applications even before corporate IT can offer it. This is partly due to the conservativeness required to secure the enterprise and also the cost-benefit challenge of multiple needs and demands competing for an ever reducing IT budget. Added to all the mix is the increasing influence on the work-force by the “X-generation folks”, who have never been held back from experimenting with and experiencing technology growing up, and typically take inter-connectivity as given.

What does this mean for enterprises? It means that the influence of consumer technologies on the corporate workspace and the workforce is unavoidable – with implications on enterprise security, employee satisfaction and retention. Gone are the days when IT dictates which technologies the enterprise implements without push back and discussion. Going out the window very quickly is the “veto-power” of IT in making decisions on IT investment. So many users are already marking those technology choices and decisions in their private and personal lives, they cannot understand why they should not have such powers within their companies.

Since this is a trend that we cannot run away from, I would say that the relevant question is how do we leverage it for the advantage of the organization?

For my own view on this, truthfully, I am undecided. I do appreciate that federating IT and empowering users has productivity value, and that ignoring the consumerization of IT trends possess some risk. Benefits to consider include:

• The impact on employee productivity.
• Using social computing to engage customers.
• Integrating social computing with enterprise business processes to unlock new value

But at the same time how do you:

• Ensure you don’t lose control of the enterprise environment and expose the organization to unnecessary risk in the bid to provide user convenience and flexibility?
• Strike a balance between enabling new technologies and securing data?
• Establish clear policies for the use of social networks?

The responses I’m looking forward to getting from this blog are: how would you approach consumerization of IT? And how can you help embrace the trend to help boost productivity and increase your competitiveness and flexibility of your IT organization?

Yesterday, I attended the Center roundtable on Customer-Centricity and the discussion about the role of the CIO in leading the organization to be externally customer-focused prompted my thinking on the role of an IT Steering Committee in connecting the CIO with his or her executive peers to ensure IT is aligned with the business and the business priorities. On the call, I mentioned the concept of creating an IT Steering Committee, and I thought I would expand on that idea a bit in a post.

I teach in an IT course in an MBA program at a local university. At the start of each class I ask the students to go back to their companies and ask four questions:

1. Does the company have an IT steering committee to prioritize projects and who serves on it?
2. What is the % of revenue of IT spend?
3. What is the % of Capex expenditures for IT?
4. Does IT chargeout their services?

Each time that I ask, I get a broad range of responses to question one. They range from the CIO gets all the requests and decides what to do; the CIO makes all the decisions; the decisions are made by a committee run by the CIO; the CEO and the CIO make all the decisions and finally, the officers of the company meet on a regular basis and decide what should be done.   There are more variations but these are the major ones.

I can see the look of dismay that crosses the students’ faces when they see the myriad of approaches that are being presented by the students. After all, most of the students are non-IT’ers who are taking the course in order to learn how to work with the IT department. They are surprised at the diversity on something as fundamental as project prioritization.

Although I am not surprised by the variation, I continue to reflect on this situation. IT should have a set of basic operating principles which should be sacrosanct and universal among all IT departments. The makeup and the functioning of the IT steering committee should be one of them. In my judgment, the IT steering committee should be composed of the officers of the company and should be chaired by the CEO. Period. The only variation that I would allow would be to replace the CEO with the COO if appropriate.

Here are my reasons:

1. The officers of the company are the only people who have a complete grasp of the strategic plan for the entire corporation. They are the only ones who have the insight and the power to add projects, exchange projects or delete projects based on resources, budget and plan. Lower level executives should not be put into that position.
2. The CIO should never be put into the position of deciding priorities. If the CIO does this, then the CIO’s position is compromised relative to all the officers. In this scenario, the CIO is required to determine that one officer’s priority is not as important as another. Although the CIO may be right, it should not be the CIO’s call. The decision should be the consensus of the entire officer group based on the strategic plan. This approach is politically very dangerous for the CIO.
3. The CIO, as a member of the steering committee, is allowed to express views as to the appropriate automation agenda just like any officer may comment on their or any others requested project. Each officer should be able to defend his or her project before the committee.  The CIO should bring technical expertise to the conversation to either support or discourage the discussed project. The CIO must also be in a position to defend any large technical infrastructure projects.
4. This is the only way to assure that IT is aligned to the business. We still hear stories about IT departments not working on the projects that the company wants and needs. That cannot happen when the officers all participate in deciding what is to be done.
5. This approach avoids the “squeaky wheel” approach which allows powerful executives to dominate the automation agenda while less powerful departments are ignored even though their requirements may be more strategic.

We used this approach at my company for 25 years and it was very effective. Never once did someone come to me to ask why their projects were not getting scheduled. They knew that that decision rested, not with me, but with the IT Steering Committee.

Administrator’s note: CIO Members can listen to the archived recording of the Customer Centricity roundtable mentioned in this post.  You can also learn more about Customer Centricity by reading the Center’s research: Empowering the Business to Be More Customer-Centric: Lessons from Leading CIOs.