In Pursuit of Value

by Paul Williams

Measuring, maximizing, and monitoring the financial returns from investments in IT are critical components of a well-run organization. Yet despite the many benefits and increasing board-level attention, these continue to be extremely difficult tasks that, if left undone, can have potentially devastating results. Recently, a Harvard Business Review article noted that "a lack of board oversight for IT activities is dangerous; it puts the firm at risk in the same way that failing to audit its books would" [5].

To execute their IT governance-related duties, boards of directors and senior managers need a clear understanding of executive, business, and IT roles and responsibilities and guidance on the investment decision-making process. Only then can organizations truly realize the benefits of IT.

Organizations around the world have felt the glory of effective IT investments and the sting of inadequate ones. By connecting separate aspects of its supply chain (which enabled the reduction of inventory levels), IBM reportedly saved US $12 billion [1]. On the other hand, the virtual collapse of Interstate Bakeries' financial reporting system contributed to a loss in market value of one-third in a single day [1]. Clearly, IT investments are about so much more than just implementing an IT solution and calling it a day.

Decision makers need to understand that when they make an IT investment, what they are truly doing is instituting IT-enabled changes into the culture of their organization. The management oversight that previously was sufficient is no longer enough. IT investments have become the proverbial double-edged sword -- they can elevate competitive advantage and create valuable efficiencies, but at the same time they can cause costly disruption and destruction. The key to success is implementing strong IT-related governance and management practices, starting at the top and cascading throughout the organization.

FOCUS ON IT GOVERNANCE

Boards and executives already have agendas that are jam-packed with responsibilities and business cases competing for a limited pool of funds. IT issues are often poorly understood, yet by focusing on them, corporate decision makers have significant opportunities to improve shareholder value and increase market capitalization. An important factor to consider, though, is that these same opportunities can also expose the business to significant financial and reputational risks and even threaten the existence of the business.

To address this increasingly confusing IT tug-of-war between delivering value and mitigating risks, the IT Governance Institute (ITGI), a nonprofit research think tank, worked with international business and IT experts to develop the Val IT initiative. The overarching goal of this work is to meet the worldwide demand for generally accepted guidelines and supporting practices to help boards and executives make the most of their IT-enabled investments. Val IT is available as a complimentary download to help organizations better understand the extent to which their IT expenditures deliver true value [3].

Val IT, released in March 2006, is a governance framework supported by a globally developed set of guiding principles and key processes. Val IT is based on COBIT, the international framework for good IT governance and control developed by ITGI more than 10 years ago and recently updated and released as COBIT 4.0 [2].

Val IT provides a comprehensive source of authoritative guidance on how best to optimize the returns from an organization's IT-related business change portfolio. It encourages a focus on the original investment decision (are we selecting the right projects?) and the attainment of benefits (are we receiving appropriate return?). It complements COBIT, which focuses on execution (are we performing activities the right way, and are they being done well?). Overall, Val IT provides a well-researched, credible, codified, and, above all, practical source of essential guidance.

In many organizations, even if their IT department is generating value, executives question whether the benefits achieved are in line with the level of investment required. Thorough planning and support of value-related initiatives can help organizations:

• Increase the understanding and transparency of cost, risks, and benefits, resulting in more effective management decisions
• Increase the probability of selecting investments that have the potential to generate the highest level of return
• Increase the likelihood of executing selected investments such that they achieve or exceed their potential return
• Reduce costs because organizations are not performing activities in which they should not be involved
• Lessen the risk of failure, especially at high financial and reputational costs
• Lower the introduction of surprises as a result of IT costs and delivery, thereby elevating the overall level of confidence in IT

The experts behind Val IT have developed a set of guiding principles. These state that:

• IT-enabled investments will be managed as a portfolio of investments.
• IT-enabled investments will include the full scope of activities required to achieve business value. These include not just the delivery of a technical solution, but also those activities required to bring about the business changes needed to take advantage of the technical solution, such as the initial data cleansing, staff training, and essential human process changes.
• IT-enabled investments will be managed through their full economic lifecycle, from the original business case through to the eventual retirement of the resulting system or application.
• Value delivery practices will recognize that there are different categories of investments that will be evaluated and managed differently.
• Value delivery practices will define and monitor key metrics and will respond quickly to any changes or deviation.
• Value delivery practices will engage all stakeholders and assign appropriate accountability for the delivery of capabilities and the realization of business benefits.
• Value delivery practices will be continually monitored, evaluated, and improved.

VALUE AS A CONCEPT

What does this all mean for the everyday expectations of those involved in high-level oversight of IT? Although successfully attaining value is different for executives in different types of organizations, one aspect is consistent throughout -- value should consist of an improvement in the organization's financial and operating performance when measured against established metrics.

The sidebar shows the terms that are often assigned to the measurement of value. Of course, organizations may use different words to describe similar aspects, but this gives a good overview of generally agreed-upon terms.

REAL-WORLD EXPERIENCE

It is critical for businesses to address assumptions on costs, risks, and outcomes related to a balanced portfolio of business investments. They need to ensure there is benchmarking capability and best practices for value management.

By sharing hard-earned experience in enterprise value management spanning several years, Fujitsu contributed greatly to the development of the Val IT management practices. Financial giant ING has done substantial investment research into IT and enterprise value, originally through its IT performance measurement and investment management team, and since 2005 as SeaQuation, a wholly independent company.

As ING considers an overall IT project portfolio, it focuses on ensuring that project dependencies and links are considered. Changes to infrastructure, for example, may be required to develop a platform for a new customer relationship management (CRM) system. Appropriate costs of the infrastructure should be incorporated into the CRM project so the company attains a workable and comprehensive view of the actual total costs and benefits.

Instead of approaching the IT portfolio as a collection of independent, standalone projects, ING views it in terms of a series of programs, each of which contains one or more linked projects. Even though it is never easy, ING and other well-managed entities understand that appropriate portfolio management may require, on occasion, the cancellation of projects after assessing their actual or anticipated underperformance. Here are some of the ways ING handles this thorny issue:

• Projects often have a tendency to develop a momentum of their own once approved and commenced. Therefore, ING has processes in place to provide regular, independent, and objective review, which is followed by positive action.
• As soon as it is known that a project cannot be delivered appropriately, projects may be cancelled, merged, or rescoped. At ING, this is viewed as strong management and good governance.
• Cancelling a project can impact the profit and loss (P&L) statement, resulting in related previously capitalized costs being written off in one P&L account hit. While this is not the preferred short-term measure, it may be necessary for financial prudence and regulatory compliance.

Overall, the IT governance framework at ING strives to ensure that its business leaders are informed and committed, and the organizational structure is established to accomplish this goal. ING's IT dashboard is primarily a communication vehicle to provide the necessary transparency into IT to assist top management in making the right decisions. They have made it a priority to realize a clear and active link between the enterprise strategy, the portfolio of IT-enabled investment programs that execute the strategy, the individual investment programs, and the business and IT projects that make up the programs.

ING pays particular attention to the balance between risk and return and uses different hurdle rates depending upon the inherent risk and external factors, such as the general trends in the market [3].

BUILDING A BUSINESS CASE

Value delivery has been identified as one of the five focus areas of IT governance, alongside strategic alignment, performance management, resource management, and risk management [4]. These focus areas are so intertwined that, in many cases, unless success is achieved in the other four domains, achieving value delivery will be very difficult or nearly impossible.

To maximize the return on IT-enabled investments, the preparation of formalized business cases, use of hurdle rates, attention to portfolio management and program management, and application of metrics such as internal rate of return, net present value, and payback period are essential.

While a fully comprehensive business case is all too often considered an unnecessary bureaucratic hurdle, it is actually one of the most valuable tools available to management and a vital component in the quest for creating business value. However, it is important to remember that a business case for any project is a snapshot at one point in time. The business case is an operational tool that needs to be reviewed and reevaluated continually to support the ongoing implementation and execution of a project or program, including the realization of appropriate benefits.

Business cases must answer the following four questions [6]:

1. Are we doing the right things? What is proposed for what business outcome, and how do the projects within the program contribute to the achievement of business strategy?

2. Are we doing them the right way? What management and operational practices have we put in place to maximize our chances of success (e.g., use of Prince 2 for project management)?

3. Are we getting them done well? Are we applying the defined practices in the optimal way and monitoring them to ensure that they remain effective?

4. Are we getting the benefits? How will the benefits be delivered? What is the value of the program?

The business case for an IT-enabled investment considers the following causal relationships:

• Resources are needed to develop:
• A technology/IT service that will support:
• An operational capability that will enable:
• A business capability that will create:
• Stakeholder value, which may be represented by a risk-adjusted financial return or total shareholders' return.

A frequent complaint about business cases is that they are too complex. With the increasing need for business agility, IT investment governance principles need to establish the right balance between allowing appropriate entrepreneurial behaviors and the need for a proper basis for making investment decisions. The business sponsor who owns the business case should ensure that the level of detail provided is appropriate to achieving that essential balance. This will help prevent essential, time-critical initiatives from being stifled or delayed through what might be regarded as undue bureaucracy, whilst preserving the essential need for prudence in the allocation of corporate resources.

One way to address this issue is to introduce categories of investment that recognize differing levels of complexity and degrees of freedom in allocating funds. Factors that might influence the level of detail required include the proposed project duration, its relative size in terms of cost and resource requirements, its possible impact across more than one department or line of business, the impact of its being delayed or not succeeding, and its relevance to the achievement of business strategy.

The prime responsibility for preparing a business case should reside with the business sponsor, although support will be required from the CIO and his or her team. In order to provide a clear demonstration of the value that is expected to accrue from the proposed investment, the business case should be developed top-down, starting with a clear understanding of the desired business outcomes. As shown in Figure 1, development of the business case occurs through an eight-step process:

Step 1: Build a fact sheet with all the relevant data.

Step 2: Analyze the data, particularly with respect to strategic alignment.

Step 3: Perform a financial benefits analysis.

Step 4: Perform a nonfinancial benefits analysis.

Step 5: Perform a risk analysis.

This will result in:

Step 6: Development of an appraisal of the risk and the return of the investment, which will be represented by:

Step 7: A structured recording of the previous steps' results and documentation of the business case, which will be maintained by:

Step 8: A review of the business case during program execution, including the entire lifecycle of the program results.

Figure 1 -- Steps of business case development.

Experience shows that the quality of a business case, the processes involved in its creation, and its continued review throughout the economic lifecycle of an investment can dramatically increase the value achieved.

ACHIEVING BUSINESS VALUE

The growth of and increased dependence upon IT have made boards of directors and executives responsible for helping to ensure that their organizations achieve optimal value from IT-enabled business investments at an appropriate cost and with an acceptable level of risk. CIOs and their business sponsor partners are under increased scrutiny to demonstrate the same things. It doesn't help when executives hear Fortune 1000 CIOs report that, on average, 40 percent of all IT spending brought no return to their organizations [7].

Nevertheless, there is much empirical evidence that well-managed and controlled IT-enabled business investments provide organizations with significant opportunities to create value. The message is clear: while IT-enabled business investments can bring great benefits, C-level executives need to understand IT investments are no longer just about implementing IT solutions. Business value is attained by what organizations do with IT rather than by the technology itself.

REFERENCES

1. IT Governance Institute (ITGI). The CEO's Guide to IT Value @ Risk. ITGI, 2005.

2. ITGI. COBIT 4.0 (www.isaca.org/cobit).

3. ITGI. Enterprise Value: Governance of IT Investments, The Val IT Framework. ITGI, March 2006 (www.isaca.org/valit).

4. ITGI. Optimising Value Creation From IT Investments. ITGI, 2005.

5. Nolan, Richard, and F. Warren McFarlan. "Information Technology and the Board of Directors." Harvard Business Review, October 2005.

6. Thorp, John. The Information Paradox. McGraw-Hill, 1999.

7. Watters, Doug. "IBM Strategy and Change: A Survey of Fortune 1000 CIOs." Paper presented at SHARE, New York, NY, August 2004.

ABOUT THE AUTHOR

Paul Williams, FCA, CITP, is a past international President of the Information Systems Audit and Control Association (ISACA) and its affiliated ITGI. He is an independent consultant specializing in IT governance, IT due diligence, IT audit, and project risk management. He acts as strategy advisor for SeaQuation and advisor on IT governance activities for Protiviti UK, a risk management consultancy. Mr. Williams can be reached at paul@paulwilliamsconsulting.com.