Making the most of IT: IT governance and Business-IT alignment

1. Making the most of IT: IT governance and Business-IT alignment Prof. Dr. Hans Borgman, March 17, 2008

3. ICT in Business Research Focus Global Software Development eBusiness ICT Strategy ICT Infrastructure Knowledge Management Technology Adoption Change Management Open Innovation Data Mining Outsourcing IT Governance High-tech Entrepreneurship Modeling & Software Engineering Virtual Organizations

4. (Emperical) Research Methodsfor Information Systems Research • Design • Simulation • Experiments • Quasi Experiments • Questionnaires • Field Studies • Case Studies • Ethnography • Grounded Theory • Action Research Herbert SimonThe Sciences of the Artificial

5. IT Governance in Context IT governance and associated governance mechanisms provide the linkage between responsible corporate governance and effective IT management. • Overall decision making and accountability structure • Establish goals, measures, policies • Ensures shareholders interests are respected Corporate Governance Corporate Governance • Overall IT decision making and accountability • Ensures value is delivered to shareholders through IT investments and actions IT Governance IT Governance IT Management • Creates business value through IT • Manages IT budgets, resources, projects, operations, vendors • Runs IT as a business IT Management

6. IT Governance Definition IT governance is the set of enabling mechanisms to make & prioritize; fund & sponsor; monitor & enforce appropriate IT investment decisions • How are decisions made? • Who plays what role in the decision making? • What processes are used? • How are investments prioritised? • How does leadership work for the business and IT? • Who is the “evangelist” for technology? • How are investments authorized? • How is joint ownership secured? • What is measured and by whom? • How does the executive retain oversight and control • What incentive system is used? • What accountabilities and authorities exist? • How are investments managed? • What is the strategic business context, how is it refreshed and clarified? • What knowledge is required to decide between operational and strategic priorities? • How is a fresh view injected? • How do we learn continuously? Foundation for business value from IT investments: Firms with better than average IT governance performance have superior profits as measured by return on assets (ROA) - more than twice compared to firms with poorer IT governance.

7. IT Governance Drivers Increasingly difficult for executives to delegate decision makingMounting number of strategic IT issues requires cross-functional perspective Increasing ITPervasiveness IT must accommodate audit trails and legislative compliance Legislation like Sarbanes-Oxley Act requires business policies in IT to foster accountability Mounting human and financial consequences of IT put forward arguments for improved control processes Cost Control ComplianceRequirements ITGovernance* IT productivity paradox: IT investments failing to provide measurable business value, relates to unclear roles and responsibilities ROI Pressure StrategicIT Sourcing Executives are required to prepare for governing complex off shoring and outsourcing arrangements * Footnote Source: Source

8. IT Costs & Governance Discretionary costs (“want to”) Examples: • Customer Relationship Mgmt. (CRM) • eCommerce • Knowledge Management Tactical Strategic Norm: 23% Best practice: 35-45%(Forrester 2005) discretionary Non-discretionary costs(“must have”) Examples: • Computer Operations • Applications Maintenance • Planning and Administration • Euro-conversion, Y2K • KTLO: Keep The Lights On non- discretionary Norm: 77%Best Practice: 55-65%

9. IT governance applications Functionalities of IT Governance Applications(Business Technology Optimization)

10. Aim of this study is to provide a better understanding of IT governance software implementation projects and to explore thefactors which influence the success and failure of IT governance tool implementations. Research Aim & Framework IT Governance Strategies & Structures: • Centralized, decentralized, federal governance mode • Small, large firms Environmental Contingencies: • Corporate governance • Economies of scope • Absorptive capacities • Organizational culture Implementation Factors: • Project planning • Executive support • User involvement • User training • Commitment • Organizational intgr. • Metrics and feedback Implementation Success or Failure: • Portfolio management optimization • Project visibility & control • IT service automation IT Governance Processes & Software Modules: • Demand management • Applic. change mgt. • Portfolio management • Program management • Performance monitor. & management Legend: In-scope; Ex-scope.

11. Outcome Factors Overview Portfolio Management Optimization: Project Visibility and Control: IT Services Efficiency: • Improved alignment between business and IT • Better executive communication and decision-making • Monetary savings through revised investment decisions and repurposed capital investments • Higher capability maturity level (CMM) • Increased project sponsor satisfaction • Percentage increase in healthy projects (better on-budget and on-time) • Reduced project management costs as percentage of project costs • Improved quality of audit and regulatory compliance • Reduction of overall operational IT spending as a percentage of revenues • Higher productivity and lower IT personnel costs • Faster incident handling and deployment of application changes • Enforced compliance with architectural standards

12. Implementation Factors Overview (1/2) Project Planning and Analysis (PPA): Commitment(COM): Metrics and Feedback (MFE): • Develop a detailed plan of the required steps in the implementation process, including all resource requirements • Check the firm’s strategic objectives and business needs upfront • Analyze and challenge the pre-implementation situation, current IT governance arrangements, and affected stakeholders • “Commitment to change” - the willingness to accommodate changes in behavior, procedures, etc. which are necessary for IS to work • “Commitment to the project” - a more direct commitment of managers and users • Ensure a smooth systems requirements assessment at pre-design, followed by a post-implementation check • Review the implementation status of the project regularly • Make suggestions and corrections through formal feedback channels or review meetings • Establish a set of project-related KPIs for continuous progress, issue, and risk monitoring • Make metric data frequently available to project management

13. User Training (UTR): Executive Support (ESU): User Involvement (UIN): Organizational Integration (OIN): • Explain the scope of the IT governance initiative and its relation to the organization, as well as to the environmental contingencies • Facilitate formal and informal training, practice fields, as well as support groups of people experiencing similar difficulties • Ensure executive participation and involvement • Facilitate high degree of cross-stakeholder collaboration and power reallocations • Communicate a compelling vision for the IT governance initiative and allocate non-routine resources • Configure and participative customize the selected software and rollout approach • Involve users so that they can form realistic expectations about the IS • Foster a sense of ownership and increase the assessment of system requirements’ quality • Align IT governance software rollouts with the organization’s strategic focus and business drivers • Embed the tool in the organizational context (i.e. structures and processes) • Drive users to assume ownership and responsibility for the tool’s maintenance and evolution Implementation FactorsOverview (2/2)

14. “A case study is an empirical inquiry that: investigates a contemporary phenomenon within its real-life context, especially when the boundaries between phenomenon and context are not clearly evident.” 1) “refers to the collection and presentation of detailed information about a particular participant or small group. […] Researchers do not focus on the discovery of a universal, generalizable truth, nor do they typically look for cause-effect relationships; instead, emphasis is placed on exploration and description.” 2) The Case Study as Research Method 1) Yin, R. K. Case Study Research, Design and Methods, 3rd ed. Newbury Park, Sage Publications, 2003. 2) Colorado State Writing Guide, http://writing.colostate.edu/guides/research/casestudy/

15. Title: “conceptual question: the case of …” Intro - Method - Research - and - Discussion (IMRaD) Typically focus on understanding the relationship between factors that are inter-releated and contextual and cannot be separated for study in lab experiments (The Anatomy of a Case Study Research Paper General research question Method & rationale General ‘answer’ Discussion, limitations Case study data Case study analysis

16. Four Case Studies

17. Outcome Factors Results Gas & Other Services Combined: Health & Allied Services: • 2% reduction in project defect rates • 5% increase in projects on budget • 10% improvement in the timing and scheduling of resources • 20-25% time reduction in processing change requests (contact- and data center) • Implementation was in an early stage and in a rather turbulent environment with diverse stakeholder expectations • The case illustrates that successful implementation of IT governance applications requires clearly-designed IT governance processes • At this stage the case is inconclusive in terms of business outcomes Management Services: Sporting & Athletic Goods: • 20% workforce reduction due to automated and standardized IT request lifecycles • 35% of workforce relocated to low-cost countries • 10% increase in projects on budget • 20% decrease in delays • 15% decrease of average project costs (due to more efficient project mgmt. and automated reporting) • 5% decrease of operational IT costs • 5% decline in time to market for approved initiatives • 10-20% increase in projects meeting quality criteria • 1-5% project management cost decrease • Recovery of implementation costs ($1.5m) after1.5 years

18. Implementation FactorsResults (1/2) Gas & Other Services Combined: Health & Allied Services: • Some of the projects received a high level of ESU • High user COM already in early project stages • High levels of PPA and UIN - the project was tracked and users were involved • Little information regarding MFE • Emphasis was placed on UTR • Strong evidence for OIN - detailed process definitions • Limited ESU - no process owners for ppm modules • Very little general COM during the rollout • Insufficient degree of PPA • UTR followed different approaches - mixed success • Limited information regarding MFE • No evidence of UIN during implementation • Limited evidence of OIN - “the tool was just screwed in” ESU COM PPA UIN MFE UTR OIN ESU COM PPA UIN MFE UTR OIN S S M M W W Legend: strong evidence, moderate evidence, weak evidence

19. Implementation FactorsResults (2/2) Management Services: Sporting & Athletic Goods: • Major evidence for ESU - tool received full support • PPA was highlighted - processes were defined • Several occurrences of UIN became visible • Little evidence for MFE • High COM - staff & users believed in the product • High UTR - conducted in multiple user groups • Strong evidence of OIN - workflows built into tool • Low ESU - “marketing-driven company” • Little COM evidence from the designated tool users • Poor PPA and limited MFE - the tool was selected rather on motivation than evaluation • No instances of UIN - the advantages of the tool were not articulated to users • Medium OIN - limited process design and mapping ESU COM PPA UIN MFE UTR OIN ESU COM PPA UIN MFE UTR OIN H H M M L L Legend: strong evidence, moderate evidence, weak evidence

20. Conclusions and Further Research Support for relation between six out of seven implementation factors To implementation success or failure • Cases 2 and 4 show major deficiencies - implementation failed to some extent Cases 1 and 3 show careful attention to most implementation factors - implementation was regarded successful Comparing the findings MFE • Little evidence was found for the implementation factor MFE • Should not be included in further research • UIN, UTR, and COM may serve as a priori explanations of implementation success or failure. UIN, UTR, and COM • PPA, ESU, and OIN are powerful measures to overcome common failure points • A correlation between PPA and OIN was found - effort spent on PPA may translate into improved OIN PPA, ESU, and OIN • A questionnaire-based quantitative survey with a larger cross-sectional sample will be conducted • A better understanding of the cause and effect relationships between implementation factors and rollout success or failure would be valuable to academic and practitioner communities Further Research

21. Making the most of IT: IT governance and Business-IT alignment Prof. Dr. Hans Borgman, March 17, 2008