It's time for enterprises to rethink their IT infrastructure and consider implementing a service-oriented architecture (SOA). SOA is a collection of services that can communicate with each other, but aren't necessarily dependent on each other. Like the early years of spreadsheets and PCs, SOA is still "below the radar" for most organizations. However, it won't stay there. Its potential is too great, and it is likely to mature rapidly over the next few years. For instance, the senior principal engineer at a leading Web-based retailer believes SOA is destined to reshape IT on every level. "It's comparable to the dramatic transition in how things were manufactured and sold that occurred in the 19th century," when the transition from craft to mass manufacturing and distribution began, he says.
THE BOTTOM LINE ON SOA
THE REAL BOTTOM LINE SOA has the potential to deliver substantial savings. |
According to Gartner, Inc., the Stamford, Conn. - based think tank, SOA represents a crucial step in moving toward what Gartner calls the real-time enterprise, able to respond faster to changing business requirements and to react to events in real-time. "Until now," said Massimo Pezzini, vice president at Gartner, in a statement published in 2004, "service-oriented architectures have only been implemented by a few leading-edge enterprises due to high costs and the level of technical skill required." However, he observes, Web services are now making it both affordable and possible from a skills point of view. The open nature of Web services means that any bit of code can potentially be reused and shared as needed. In addition, consolidation of security technologies and maturing standards for Web services mean security is no longer a stumbling block. Gartner predicts SOA adoption will be a mainstream phenomenon in Global 2000 companies by 2007.
While the idea of SOA has been around for many years, it did not have much impact. Now, with the advent of Web services, there's a nearly complete correspondence between the goal of SOA and the means to implement it. In fact, the biggest difference between SOA and Web services is that the latter has usually been implemented point-to-point where there was a complete understanding of the infrastructure.
What's more, the potential for reuse means software costs could begin to drop. By reusing services, IT doesn't have to spend money to create the same functionality over and over again.
SOA can help with many other aspects of business, some of them not obvious at first glance. For instance, compliance with the Sarbanes-Oxley Act and other regulatory mandates is easier with SOA because it provides a real-time view of who's accessing specific applications or data.
SOA also allows companies to be more agile by making it easier to change functionality to match business requirements, fosters information sharing, and discourages individuals and organizations from maintaining separate databases because resources are easier to share. But while SOA is exciting, there are factors that could slow its adoption. For IT organizations, there are cultural challenges in shifting away from traditional software paradigms. SOA requires contracts, policies, service level agreements, security, authentication, identity management, upgrades and governance.
by Howard Rohm
Reprinted with permission from the Balanced Scorecard Institute.
Part 1 | Part 2
Phase One: Building The Scorecard, consists of six steps. Step One is an Assessment of the organization's foundations, its core beliefs, market opportunities, competition, financial position, short- and long-term goals, and an understanding of what satisfies customers. Many organizations have completed this basic step, typically as a self-assessment at an off-site workshop for managers and executives. Usually, an organization's strengths, weaknesses, opportunities, and threats are developed, discussed, and documented. There is no need to repeat this "environmental scan" of an organization if the information is available and current, say within the past six months. It is important, however, to ensure that the assumptions that underlie the basis for the organization's existence and its business strategies are still valid and sound.
Other important aspects of the self-assessment step are to choose a champion and the core Balanced Scorecard team, set a schedule for the development steps, secure resource commitments necessary to develop and sustain the scorecard system, and develop a roll-out communications plan to build buy-in and support for the changes that will follow. Communications planning includes internal and external public information activities that will be used to spread the word about the Balanced Scorecard initiative and what it means for managers and all employees.
Step Two is the development of overall Business Strategy. In larger organizations, several overarching strategic themes are developed that contain specific business strategies. Examples of common strategic themes include: Build the Business, Improve Operational Efficiency, and Develop New Products. For public sector organizations, strategic themes might include: Build A Strong Community, Improve Education, Grow the Tax Base, and Meet Citizen Requirements. In addition to describing what the approach is, business strategy, by elimination, identifies what approaches have not been selected. Strategy is a hypothesis of what we think will work and be successful. The remaining steps in the scorecardbuilding phase provide the basis for testing whether our strategies are working, how efficiently they are being executed, and how effective they are in moving the organization forward toward its goals.
Step Three is a decomposition of business strategy into smaller components, called Objectives. Objectives are the basic building blocks of strategy -- the components or activities that make up complete business strategies. Southwest Airlines developed a business strategy to compete successfully in the crowded commercial airline market. The business strategy of Southwest includes the following components: innovation and speed in the redefinition of a marketplace; short-haul, high frequency, point-to-point routing (a significant departure from traditional hub-and-spoke routing); a high proportion of leased aircrafts; a very simple fare structure; and ticketless travel.1
Mecklenburg County, North Carolina developed a strategy to implement the Board of County Commissioners vision for 2015. The strategy has the following main themes: Growth Management and Environment, Community Health and Safety, Effective and Efficient Government, and Social, Education and Economic Opportunity. Strategic components include: Increased Employee Motivation and Satisfaction, Increased Employee Knowledge, Skills and Abilities, Improved Technology Capacity, Increased Use of Partnerships, Reduced Reliance on Property Taxes, Improved Service Value, Improved Environment, Reduced Crime and Violence, and Reduced Preventable/Communicable Diseases and other Health Problems, among others. 2
The Federal Aviation Administration Logistics Center developed two business strategies: Become Customer Driven and Increase Business. These strategies were then decomposed into actionable goals with specific performance measures (metrics) and targets.3
One of the military commands has developed the following strategic themes to meet its goal of Equipping The Warfighter To Win: Quality Systems Equipment, Expert Life-Cycle Management, Operational Efficiency, and High-Performance Organization. Each theme decomposes into specific objectives that drive performance and can be measured.4
In Step Four, a Strategic Map of the organization's overall business strategy is created. Using cause-effect linkages (if-then logic connections), the components (objectives) of strategy are connected and placed in appropriate scorecard perspective categories. The relationship among strategy components is used to identify the key performance drivers of each strategy that, taken together, chart the path to successful end outcomes as seen through the eyes of customers and business owners. Figure 5, a strategic map for a transactions-based company, shows how an objective (effect) is dependent on another objective (cause), and how, taken together, they form a strategic thread from activities to desired end outcomes.
In Step Five, Performance Measures are developed to track both strategic and operational progress. To develop meaningful performance measures, one has to understand the desired outcomes and the processes that are used to produce outcomes. Desired outcomes are measured from the perspective of internal and external customers, and processes are measured from the perspective of the process owners and the activities needed to meet customer requirements. Relationships among the results we want to achieve and the processes needed to get the results must be fully understood before we can assign meaningful performance measures.
We use the strategic map developed in Step Four, and specifically the objectives, to develop meaningful performance measures for each objective. Thus, we look for the few measures (key performance drivers) that are critical to overall success.

Figure 6. Develop Results and Process Measures
Figure 6 shows a continuous learning framework for measuring and managing both strategic and operational performance. We put our Performance Measurement stethoscope wherever it is required to get meaningful performance information, whether we want to measure if we are doing the right things, or measure if we are doing things right.
Developing meaningful performance measures (metrics) and the expected levels of performance (targets) is hard work if done correctly, and the development process is fraught with challenges. One challenge is the tendency to hurry and identify many measures, hoping that a few good ones are in the group and will "stick". The problem with this approach is that the value of information generated is limited, and the burden of data collection and reporting can quickly become overwhelming. (One of the worst mistakes I've seen made is for an organization to take measures that already exist, categorize them into four scorecard perspectives, and then announce that the corporate scorecard had been built! These "metric" scorecards are of little value to an organization, as they bear little relationship to strategy, desired results, and the processes needed to produce desired results.)
Another challenge is a tendency to rush to judgment -- not thinking deeply about what measures are important and why. This happens because, usually in response to pressure from a supervisor, we get in a hurry to develop a final set of performance measures ("I need some measures -- just get me some measures!!"). In most strategic plans and scorecard systems I have seen and reviewed, the development of performance measures is not taken very seriously, putting into question the value of the whole strategic and operational effort. Remember, measures are a means to an end, not the end themselves.
We use three different models to get to the measures that matter most. Our goal is to identify the critical business drivers, measure them, and use the information to improve decision-making. ("If it is important to executing good strategy well, and to operating good processes efficiently, measure it -- if it isn't, don't".) The three models are:
The Logic Model -- This model allows us to explore the relationship among four types of performance measures: inputs (what we use to produce value), processes (how we transform inputs into products and services), outputs (what we produce), and outcomes (what we accomplish). This model reinforces the logic of the strategic map by showing the relationship among the activities that produce good outcomes. For public sector organizations, and sometimes for private sector as well, we add another measure category: intermediate outcomes, to capture the important intermediate transformations that take place between what we produce and what we accomplish. This additional step is especially useful when the end outcome is far removed from the outputs produced, or when little control is exercised over the ultimate achievement of the end outcome.
Figure 7. Moving From Outputs and Activities to Outcomes
As shown in Figure 7, asking a series of "Why" questions will eventually get one to outcomes. The steps required to secure an end outcome usually include several intermediate outcomes. The process works from outcomes to processes also -- just substitute "How" for "Why" in the model above. Start with the outcome and work backwards to the processes that produce the outcome.
Process Flow -- Flow-charting has been around for a long time, and has been a favorite tool of systems engineers and process designers, among others. We apply the technique to build a better scorecard performance system, as flow charting processes helps identify the activities (and measures) that matter most to produce good outcomes. An additional benefit of the technique is that it often identifies places where improvements in efficiency in workflow are needed and possible. And we have found that after applying the model, we usually end up identifying several new initiatives (discussed in Step Six) that can be used to test our strategic hypotheses.
Causal Analysis -- Causal analysis identifies the causes and effects of good performance. We start with the result (the effect) we want to achieve and then identify all the causes that contribute to the desired result. The causal model is most useful for identifying input and process measures that are leading indicators of future results.
It takes more work to develop a few good measures than it does to develop many poor measures. This was reinforced for me when I was training a Balanced Scorecard team in Europe; one of the team members volunteered that his group had 930 separate performance measures. I asked him if he could Outputs identify the strategic measures; after some reflection he said he didn't think that he had any strategic measures. His Performance Measurement report sits on his shelf, unused.
In Step Six, new Initiatives are identified that need to be funded and implemented to ensure that our strategies are successful. Initiatives developed at the end of the scorecard building process are more strategic than if they are developed in the abstract. At one organization I worked with, an improvement team, working outside the framework of a Balanced Scorecard system, identified over 100 new initiatives to pursue. Few of the initiatives were strategic in nature, and after going through the logical framework presented here, the scorecard team identified about a dozen new strategic initiatives that were not on the original list of 100. The team was surprised to have identified any new initiatives at all, given the comprehensive nature of the previous exercise. As in the previous step, be careful to avoid a rush to judgment -- initiatives are means, not ends.

Figure 8. Balanced Scorecard Logic
Figure 8 shows the logic of scorecard development. Customer requirements drive the way an organization responds with products and services to market opportunities; vision, mission, and values shape the culture of the organization, and lead to a set of strategic goals that outline expected performance; business strategies give us the approach chosen to meet customer needs and attain the desired goals; strategies are made up of building blocks that can be mapped and measured with performance measures; targets give us the expected levels of performance that are desired; and new initiatives provide new information to successfully meet challenges and test strategy assumptions. Resource identification and budget setting complete the process of adding the new initiatives to the current operations to get a total proposed budget for the reporting period.
What does a completed scorecard look like? The presentation of final scorecard results takes a number of different unique forms to support each organization's unique communications and management needs. Most organizations want to see different scorecard views, including: an end outcomes view, a performance measures (metrics) view, a new initiatives view, and a strategic map. Figures 9 to 11 show examples of several different presentations. Note how an organization's vision and mission can be decomposed into strategic components that are actionable, specific and measurable.

Figure 9. Putting It All Together - Federal Government Logistics Center

Figure 10. Linking Scorecard Components

Figure 11. Putting It All Together - Local Government
How long does it take to build a scorecard system? Depending on the size of the organization, two to four months is typical, six weeks is possible. The drivers of "shorter rather than longer" are: senior leadership support and continuous commitment, currency of existing assessment information, size of the organization, availability of scorecard team members, willingness to change and embrace new ideas, level of organization pain that is driving the scorecarding journey, and facilitation support. (At the risk of sounding self-serving, the journey goes faster and smoother when outside expert training and facilitation assistance are used.)
A Balanced Scorecard system provides a basis for executing good strategy well and managing change successfully. Building Balanced Scorecard performance system using the framework described here will cause people to think differently (more strategic) about their organization and their work. For many, this is a refreshing change to "strategic planning as usual". But will also bring change in the way things are done, as new policies and procedures are developed and implemented. For some, these changes can be troubling. The realization is that the Balanced Scorecard journey involves changing hearts and minds at least as much as it involves measuring performance.
In the second installment of this article, in the next issue of Perform Magazine, we will explore the steps involved in implementing a scorecard performance system throughout the organization, and discuss the implications of using and managing with a Balanced Scorecard.
The Balanced Scorecard Institute is a free information clearing house on Balanced Scorecard issues, concepts, and techniques, and provides training, consulting, and facilitation support to organizations all over the world. You can reach the Institute at: www.balancedscorecard.org.
Howard Rohm can be contacted at hrohm@mindspring.com.
Building and Implementing A Balanced Scorecard: Nine Steps to Success, Howard Rohm
Performance Scorecard Toolkit, Howard Rohm
Performance Drivers, Niles-Gorman Olve, Jan Roy and Magnus Wetter, Wiley
The Strategy-Focused Organization, Robert Kaplan and David Norton, Harvard Business School Press
The Balanced Scorecard, Robert Kaplan and David Norton, Harvard Business School Press.
Keeping Score, Mark Graham Brown, Quality Resources
Measuring Performance, Bob Frost, Fairway Press
The Business of Government, Thomas G. Kessler and Patricia Kelley, Management Concepts
Outsourcing at Southwest Airlines: How America's Leading Firms Use Outsourcing, Michael F. Corbett & Associates, Ltd.
How To Measure Performance: A Handbook of Techniques and Tools, Performance-Based Management Special Interest Group, U.S. Department of Energy
Various Balanced Scorecard Case Studies, Harvard Business Publishing
1 See Outsourcing at Southwest Airlines, above.
2 From Meeklenburg County, North Carolina Managing For Results Balanced Scorecard.
3 Federal Aviation Administration Logistics Center Strategic Plan.
4 Preliminary material from the U.S. Marine Corps Systems Command.
--
Howard Rohm is Vice-President of the Balanced Scorecard Institute, president of Howard Rohm Consultants, LLC and an international trainer, consultant, and facilitator. He has over 25 years of government and private industry strategic planning, Balanced Scorecard, Performance Measurement, and information technology experience.
Part 1 | Part 2
Private and public organizations find themselves continually trying to do more with less. As I visit business and government managers around the world, I am reminded of Stephen Covey's quote: "People and their managers are working so hard to be sure things are done right, that they hardly have time to decide if they are doing the right things."
Doing the right things and doing things right is a balancing act, and requires the development of good business strategies and efficient operations to deliver the products and services required to implement the strategies. Competitive pressures on private businesses, and performance improvement and reform pressures on public sector organizations, mandate that organizations continually worry about executing good strategy well, at the same time that they worry about running business operations efficiently. Today's organizations need to be both strategically and operationally excellent to survive and meet tomorrow's challenges. One framework that helps achieve the required balance between strategy and operations is the Balanced Scorecard.
The Balanced Scorecard is a Performance Management system that can be used in any size organization to align vision and mission with customer requirements and day-to-day work, manage and evaluate business strategy, monitor operation efficiency improvements, build organization capacity, and communicate progress to all employees. The scorecard allows us to measure financial and customer results, operations, and organization capacity.
This article discusses how to develop a Balanced Scorecard performance system, explores issues that organizations face in building and implementing scorecard systems, and shares lessons learned from organizations that have taken the Balanced Scorecard journey.
Originally developed as a framework to measure private industry non-financial performance, Balanced Scorecard systems are equally applicable to public sector organizations, but only after changes are made to account for the government mission and mandates, not profitability, that are unique to almost all public sector entities. (Some public organizations generate and use revenues to offset expenses and minimize the need for annual Congressional appropriations; their operations are more like a business than a government entity, and they could use the private sector scorecard model).
Originally developed in the early 1990s, the Balanced Scorecard has migrated over time to become a full Performance Management system applicable to both private sector and public (and not-for-profit) organizations.1 Emphasis has shifted from just the measurement of financial and nonfinancial performance, to the management (and execution) of business strategy.
Figure 1. Balanced Scorecard Performance Management System 
Balanced Scorecard systems give us the ability to view three different dimensions of organizational performance: Results (financial and customer), Operations, and Capacity, as shown in Figure 1 above. The figure also shows the components of a fully developed scorecard system: Business Foundations, including vision, mission, and values; Plans, including communications, implementation, automation, and evaluation plans, to build employee buy-in and communicate results; Business Strategies and Strategic Maps, to chart the course and define the logical decomposition of strategies into activities that people work on each day; Performance Measures, to track actual performance against expectations; New Initiatives, to test strategic assumptions; Budgets, including the resources needed for new initiatives and current operations; Business and Support Unit Scorecards, to translate the corporate vision into actionable activities for departments and offices; and Leadership and Individual Development, to ensure that employee knowledge, skills and abilities are enhanced to meet future job requirements and competition. We'll explore each of these components in more depth in this article and a follow-up article, in the next issue of Perform Magazine. In this first article, we'll concentrate on how to build a scorecard.
In Balanced Scorecard language, vision, mission, and strategy at the corporate level are decomposed into different views, or perspectives, as seen through the eyes of business owners, customers and other stakeholders, managers and process owners, and employees. The owners of the business are represented by the Financial perspective; customers and stakeholders (customers are a subset of the larger universe of stakeholders) are represented by the Customer perspective; managers and process owners by the Internal Business Processes perspective; and employees and infrastructure (Capacity) by the Learning and Growth perspective.
Figure 2. Basic Design of a Balanced Scorecard Performance System
Figure 2 shows an integrated relationship among the key parts of a scorecard system -- Vision, Strategy, and Perspectives. Balance is achieved through the four perspectives, through the decomposition of an organization's vision into business strategy and then into operations, and through the translation of strategy into the contribution each member of the organization must make to successfully meet its goals.
Variations in the basic design are common. Typical changes include changes in the categorization of perspectives (Innovation and Learning, or Employees, in place of Learning and Growth, for example) and the number of perspectives (adding Stakeholders as a separate, fifth perspective, for example).
When the Balanced Scorecard framework is applied to a public organization, such as a Federal agency, a military unit, or a state and local government organization, the framework must be changed to capture the mission-driven nature of public organizations (in contrast to the profit-driven motivation of private businesses). Also, government reform initiatives at all levels of government are placing more emphasis on accountability and results to meet citizen expectations for public services and products. The desired outcome for a private organization is a growing, profitable, competitive enterprise; for a public organization, desired outcomes center on the delivery of necessary, cost-effective services for citizens or members (for not-for-profits).
Figure 3. Public-Sector Balanced Scorecard 
Figure 3 shows the basic design of a public sector scorecard system. Note the changed emphasis on Mission (the key driver of a public sector organization), the change in the Customer perspective to Customers & Stakeholders (mission driven customer requirements, subject to government mandates and limitations), and the changed positions of Financial and Customer perspectives. We like to use the term Employees and Organizational Capacity for the final perspective, to reflect the importance of the human system and of capacity building through trained and knowledgeable employees and efficient information technology systems. Also, sometimes a Budget perspective is used in place of the Financial perspective, to reflect the budget formulation and execution processes associated with public accountability of funds.
For public organizations, the broader universe of all stakeholders becomes important as Balanced Scorecard teams account for the impacts of public programs on directly affected citizens, regulators and other oversight bodies, businesses, and the public at large. These changes are much more than cosmetic -- they represent a fundamental shift in the logic of building and implementing a scorecard performance system. But at the heart of the public scorecard system, just like for the private sector, is business strategy.
Strategy is the approach used to accomplish the mission and implement an organization's vision. Strategy exists at different levels within an organization, such as overall organizational strategy to, for example, address certain business markets and eliminate others, or to aggressively pursue research and development internally as a way of developing new products.
Organizations usually have more than one macro business strategy; typically, several common strategic themes or focus areas show up repeatedly across different businesses -- Build the Business, Improve Operational Efficiency (or Effectiveness), and Improve Product Competitiveness, for example. The same pattern is true for public sector organizations, where examples include: Meet Citizen Needs, Enhance Technology Applications, Improve Operational Effectiveness, and Enhance Community Safety and Well-Being. Each of the above strategic themes may contain one or more business strategies that determine what people do on a day-to-day basis.
At the next lower level of strategy, sometimes called management (or department) strategy, managers develop the strategies for their business units that support overall organizational strategy and help propel an organization to reach its goals. But before we know which strategies are successful and which are not, they must be treated as hypotheses to be analyzed and tested as data becomes available from the scorecard management system. We need a framework to develop and manage strategy, and align the work we do with the goals of the organization.
The decision to undertake development of a Balanced Scorecard is a decision to undertake a journey, not work on a project. While there are discreet start and stop points along the way, one should not miss the point that the real value of a scorecard system comes from the continuous self-inquiry and in-depth analysis that is at the heart of all successful strategic planning and Performance Management systems. Start your Balanced Scorecard with the idea that you are in it for the long term, and that changing behavior is at least as important as measuring performance. Start your Balanced Scorecard with the idea that you are in it for the long term, and that changing behavior is at least as important as measuring performance.
The scorecard journey has two phases: Building The Scorecard and Implementing The Scorecard.
We use a six-step framework to build an organization's Balanced Scorecard, and an additional three steps to implement the scorecard system throughout all levels of an organization. The steps and their sequence are shown in Figure 4. At the end of the first six steps, the high-level corporate scorecard is developed and it forms the basis for subsequent scorecard development. (Sometimes a scorecard journey begins in a strategic business unit or support unit, in which case the unit scorecard is built first and becomes the basis for subsequent unit and corporate scorecards.)
Figure 4.
1 See the description of the original study in Kaplan & Norton. The Balanced Scorecard.
--
Howard Rohm is Vice-President of the Balanced Scorecard Institute, president of Howard Rohm Consultants, LLC and an international trainer, consultant, and facilitator. He has over 25 years of government and private industry strategic planning, Balanced Scorecard, Performance Measurement, and information technology experience. To learn more about the Balanced Scorecard Institute, visit their Web site at www.balancedscorecard.org.
by Harris Kern
Featuring Harris Kern's 10 Commandments
Part 1 | Part 2
After studying over 350 Fortune 500 and Global 2000 IT organizations, I've compiled a list of the top issues and challenges plaguing IT executives. No wonder IT is still considered a cost center by their business counterparts. Below are some of the more common issues and challenges in IT:
These enterprises are bleeding profusely because of many years of procrastination and neglect. Years of merely focusing on new system development and technology have finally taken their toll, and it's costing companies millions. The issues are common and widespread throughout all industries (i.e., telecommunications, manufacturing, entertainment, and media). No one is excluded.
Executives are looking outside their confines for answers, and they're seeking guidance from infrastructure service providers for quick solutions. A word of caution to these executives-do you think these service providers -- many of which came out of the cupboards overnight -- have their act together?
Executives, please heed this warning: If you outsource trash, you will receive twice the trash in return, which of course means, twice as many headaches. You will have to manage two dumpsites. You will still have to deal with your customers, and in addition, with the vendor that stores your trash.
The only way to turn this around is to focus on people, process, and the organization structure as technology. The first step is to define the ideal IT environment.
My definition of the ideal IT environment is one that is designed to exceed the enterprise's strategic goals while nurturing the individual to achieve exceptional productivity and job satisfaction. The follow signs are an indication of such an environment:
When designing the ideal computing environment, a critical piece of the equation is establishing the right methodologies, or what I refer to as the 10 commandments for building a competitive IT organization. As depicted previously, most of what stands in the way of developing such an organization is not technology related. When designing this environment, the focus should be on:
Just as most people abide by a set of commandments in our everyday life, the same holds true for IT staff responsible for establishing a competitive IT organization. The following are guidelines, or what I refer to as the "10 commandments for building a competitive IT organization":
The corporate mandate is, "do more with less." In IT, we've been doing more with less for years. Arguably, running the business of IT is more difficult than managing any other business, for several reasons:
Physically and mentally, IT professionals are disheveling. IT executives are saying, "We've been lean for years and now my staff is burning out from consistently working 12+ hour days and weekends. What's it going to take to stop the hemorrhaging?" IT executives have invested in implementing key elements to build world-class organizations such as:
Management has also gone so far as to invest in a variety of team-building exercises over the past few years in an attempt to promote teamwork and motivate the staff, hoping they would see an increase in productivity and customer satisfaction.
Yet when all is said and done, the staff is still not performing at the level required to provide a satisfactory level of service to their customers. So what's it going to take? Effectively implementing best practices and acquiring the best technology money can buy will help a bit. The traditional ways of dealing with IT staff (i.e., communicating regularly, incentives, challenging people, delegating responsibility) also help, but only a bit; it will not guarantee success. The people issues today require extraordinary measures.
The key to success within IT is promoting self-discipline so staff can effectively manage their own lives. My vision brings the world of IT and discipline together to properly address the people issues in IT. The goal is to arm IT professionals with the right tools to become more productive, not only in their career, but in their personal life as well. At the end of the day it's all about the people. Staff will need to motivate themselves; yearly or quarterly offsite team-building activities are not the answer. Motivation has to originate from the individual consistently. IT executives need to empower their staff to acquire discipline to be successful.
The most important ingredient in one's lifetime is discipline; with it you can achieve everything; without, you will struggle to exist.
IT executives should also supplement yearly performance reviews (sponsored by HR) with a program I refer to as People Performance Management. Employees need to establish and monitor goals weekly. Yearly performance reviews are ineffective in IT; a year in IT seems like an eternity!
IT needs to be organized to rapidly respond to the needs of individual business groups. This requires a planning process tightly integrated with each of the business groups and an enterprise-wide vision within which all of these needs can be met. This can only be accomplished by establishing working relationships at individual, and group levels with all business partners.
Business teams, including IT as a "business," work together. Other than enterprise infrastructure, there is no such thing as an IT project. Whether IT is responsible for 10 percent of the tasks or 90 percent of the tasks, IT is merely a member of a business team led by a business project champion. All projects require business unit champions and business project champions.
All members of this business team are scheduled with accountabilities and deliverables, and priorities are determined through jointly developed business cases. All projects are required to build a business case; a technology case is not sufficient. Further, all business cases are required to discuss alignment of objectives with enterprise objectives. IT is inseparable from the business and requires complete alignment with business goals.
"Alignment with the business" needs to be more than a strategic plan or a written set of operating principles. The technology organization needs to be set up in a way that allows business alignment to flow as a natural consequence of the way the job is done.
To flexibly align with the business, IT needs to be able to react both functionally (e.g., deep technical skills) and geographically (e.g., globally, regionally, locally) to business imperatives. The solution is a matrix organization that combines shared services with personnel dedicated to business units at the global, regional, and local levels. This can accommodate any enterprise needs by strengthening or weakening "dotted lines" and/or "standards/guidelines."
The only way to align with the business is to become a part of the business. Dedicated applications development staff, physically sitting with the business, having their operational priorities set by the business, participating in business operations and strategy, and having their budget overseen by the line of business forces technology to be aligned with the business. The key to the matrix is that these groups, for all practical purposes of reporting to the line of business, are reporting on a straight line into technology and on a very strong dotted line to the business. This unit is a part of the business, but ultimately, reports to technology. The management principles to be followed are a strict adherence to joint understanding, with no surprises. The business priority is to discover and prioritize opportunities and needs, while the technology priority is to offer practical solutions. The systems manager in charge of this group must represent IT to the line of business, and must represent the business unit to IT. This position in a matrix organization requires the ability to report to multiple managers and to be an honest advocate for each. Success requires the appropriate personality as well as the appropriate culture. Taking the time to find and train capable systems managers is critical. The organization may be right, but still will not function correctly without the right people in these key positions. And they need to understand the business, the personalities, and the technology without allowing ego into the equation.
The systems manager is the single point of contact between business units and IT, since a many-to-many relationship is counter-productive. All activity is coordinated through the systems manager, who must avoid the trap of becoming a bottleneck. A large part of this role is like that of a traffic cop participating directly only in those activities that require a systems manager's direct involvement. The systems manager has direct control of the business unit's dedicated application development staff and coordinates the business unit's use of shared technology services.
Shared services provide specialty skills that may not have critical mass within each business unit, and need to be managed for the enterprise to leverage skills, obtain economies of scale, and maintain an application architecture. Specialty skills may include database administration, system administration, help desk, and network administration. Shared services are traditionally almost exclusively found in infrastructure or data center groups. Technology as a business partner has now evolved beyond this model of shared services. Personal productivity services are critical, new shared-services organizations that don't report through the data center hierarchy.
Personal productivity services are a group that integrates support personnel and personal productivity applications at the desktop and individual level. It is technology with a human face. It is comprised of the help desk, first- and second-level support, training, and desktop development. Desktop development was created to expose many users to IT value powerfully and directly because of the speed of implementation and the very real and immediate "quality of life" improvement. This very quick response to individual and small group needs repeated for many small groups is an opportunity to add value to the enterprise and at the same time, establish relationships across the organization.
IT has become mission-critical and needs to be managed as a strategic asset. IT is inseparable from the business and requires complete alignment with business goals. Successful IT executives need to consider themselves and convince others to consider them as part of the business, not separate from the business, by managing risks and expectations.
Continue to Part 2.
--
Harris Kern is a renowned American author, publisher, lecturer, and IT consultant, who focuses his considerable talents on simplifying IT -- and making it work. Through the Harris Kern Enterprise Computing Institute (www.harriskern.com), he has developed a powerful resource for building competitive IT organizations. Under the umbrella of the Institute, IT professionals from many of the world's leading companies come together to take advantage of leading edge disciplines and strategies for improving the IT industry.
How can a company capture attention in this, the age of the distracted customer? What happened to knowledge management? What's next for ERP? Thomas Davenport shares his insights.
Tom Davenport has been around the IT block. One of the pioneers of process reengineering, he has been instrumental in the development of our understanding of how businesses use information to compete. A seminal thinker in the field of knowledge management as well, he has recently focused on the critical field of attention-management. His latest book is
The Attention Economy: Understanding the New Currency of Business.
EL: One of the things you say in your book, The Attention Economy, is that, "understanding and managing attention is now the single most important determinant of business success." What is the attention economy and what are its implications for companies and then individuals?
TD:The attention economy overall is an economy in which there's way too much information and knowledge floating around for the brain cells that humans have available. So it becomes an economy where attention is really scarce and hence really valuable. And getting attention for your ideas, your products, and your information is a critical prerequisite for any kind of business success. If people don't know that your products exist and spend any time cogitating about it, you don't stand a chance. A great example is "The Blair Witch Project" -- $750,000 making the movie, $30 million marketing it.
At an individual level, you say something about "there can't be too many initiatives at one time."
I see that as more of an organizational thing, but it certainly impinges on individuals. And ultimately, any organizational initiative that's successful comes down to individuals changing their behavior. But if they're not paying any attention to what the initiative is about, its objectives and so on, they're not going to change their behavior. Getting real change to happen in organizations becomes a matter of individual attention. Every individual has to look at him- or herself as a consumer, and you want to be a very intelligent consumer and consume only information that's going to benefit you, your family and your organization. And you've only got so much to give out, so you've always got to be making this calculation: Is this the best use of my attention right now?
That's why so many employee newsletters fail, because there is so much useless information.
EL: You note that there are different types of attention and certain teams are dominated by certain types ...
TD: We identified, based mostly on psychological research, three overall dimensions and six types. There's front-of-mind and back-of-mind -- what you try to do there is push as much as possible to back-of-mind through repetition and practice so you can free up your front-of-mind for other things. That's one of the dimensions with the Attentionscape tool that we've developed. There's front-of-mind versus back-of-mind, voluntary versus captive, attractive versus aversive. What we argue is that you really want to try to maximize all of those six types because you're getting a maximum amount of attention if you're hitting on all of them at the same time.
EL: You also discuss the critical success factors there are for getting the attention of CEOs. Can you talk about that?
TD: I wouldn't say CEOs -- I'd say executives. We looked at what managers, white-collar workers, and professionals pay attention to. We first asked what sort of media they pay attention to -- it turns out email is the most attention-getting medium in our research.
Then we asked what attributes of the message would make it most likely to receive a lot of attention. We found out that personalization was the single most important factor. Second was keeping it short and concise. Third was emotion, having either positive or negative emotion being evoked by the message. And the fourth one was making it come from a trustworthy source. The first three are relatively easy to manipulate. I say easy, but it's actually a lot of hard work, because personalization takes a lot more effort than sending out a big group distribution email.
EL: What are the lessons we should learn from the online world? How do you capture and sustain attention online -- or even offline?
TD: Actually, the biggest attention industry, if you look at how much attention goes to it, is television. People watch it for three hours and 26 minutes a day on average in the United States. They're not online quite that much. We had a whole chapter on e-commerce and the Web. But for those industries like television, the movies, publishing and advertising -- out of each industry or sub-industry, we tried to abstract some of the lessons. So for television, it's the power of narrative. They always tell stories, make it easy to get in and get out, have a predictable time schedule, and they don't let technology get in the way.
For movies, we talked about age segmentation and the captive setting. We tried to point out some circumstances where people had taken some of these lessons and moved them across industries. For example, we looked at Gamesville, a Lycos entertainment Web site, and how they start new games at the top of the hour, much like a television schedule.
EL: Let's shift to ERP. In terms of strategic use of ERP, you are the expert. Recently, I've heard from some database gurus that ERP systems are what has really allowed companies to take all their various sources of data and normalize them, allowing for one common method of talking to each other.
TD: I'm pleased that you say that, but the world didn't seem to be that interested in a strategic perspective on ERP, at least at the time. I had hoped that after the Y2K thing, people would go back and say, "Gee I spent all this money and I should optimize it and get a lot of business value." But the fact is that they did not do that. They basically moved from Y2K to e-commerce. And now people are just trying to figure out how to cut costs. I'm glad I did that work on ERP -- I think it's very important. But it (Mission Critical) certainly wasn't the most popular book I ever wrote.
EL: But you still have to fulfill everything, you still have to do the back-office stuff -- ERP isn't going away.
TD: Exactly. SAP in its advertising now, they call it, "Solutions for the New New Economy, the one where profitability matters." Certainly, you found some pretty small e-commerce companies were putting in ERP because they knew they had to do fulfillment and be able to promise inventory, and so on. People are still doing it -- Oracle, SAP, and PeopleSoft are doing pretty well as companies. For a while they were doing extremely well. I think there's still a valid question: For any given piece of functionality, do you want to do it in an ERP system, which optimizes the integration of it all, or do you want to do it for the "best of breed" thing, which may optimize specific functions? I think it's certainly still a valid question.
EL: What about taking the data captured in your ERP system and extracting it and turning it into knowledge that can be acted on? Are companies finally getting better at this?
TD: I think they're getting a little bit better as the tools from the ERP vendors get better. But it's still not great. Too many people still only do the transaction side and don't manage the business any differently.
EL: Would you say that the road for ERP in the future is going to be optimizing B2B buying and really looking at that?
TD: Certainly, that's part of it -- hooking up front-office and back-office stuff so you can do e-commerce and actually fulfill your orders, make your customers happy, and so on.
EL: What about the ASP model, in which everybody hooks into a system that's hosted somewhere else so all your suppliers can be on the same ERP system? Or a marketplace, where everybody is trying to collaborate? How do you manage the challenge of ERP talking to ERP?
TD: There's a huge integration challenge. I think it's fair to say that few companies or industries have solved it yet. What you're getting into is inter-organizational reengineering, and it's very time-consuming and very expensive. And I think that's one reason why a lot of these B2B exchanges, and so on, are going out of business.
They don't have enough capital to afford to do that kind of integration across multiple companies. Frankly, I think there will be a fair number of these consortiums, e-marketplaces and the like, that won't be able to avoid it either. It's already clear that it's taking a great deal longer than anybody thought it would to be able to do transactions without a huge amount of human intervention.
EL: What about companies like enterprise application integrators?
TD: I think there's an appeal to being able to keep a lot of your existing applications and integrate them through some means other than one big system. It's a complex world, and even if you end up only integrating pieces of the business that you've acquired, there would be a perfectly good role for software like that. I think we'll end up using a lot of that stuff for integrating across companies. You're not going to find very many industries where every company has SAP or Oracle.
EL: Knowledge management turned into business intelligence and then it turned into CRM and then supplier relationship management, some even say competitive intelligence. What's going on in knowledge management these days?
TD: Well, the bloom is off the rose on pure best-practices sharing. But I think there is more energy now than there has been in business intelligence and I think it was a good thing to think about business intelligence from a knowledge-management standpoint as some companies are starting to do, because that means that you don't just assume that some technology does it all. You don't assume that because you have some sort of data mining software, that these great insights are just going to jump out of your data.
The smart companies realize it takes a lot of very bright human beings around in addition to the software, and that's sort of a knowledge-management-oriented insight.
CRM is probably going to focus now more on customer knowledge. For some reason, companies were very slow to put customer knowledge into their knowledge-management initiatives. And what could be more important than that?
EL: I think your book, Process Innovation: Reengineering Work through Information Technology, is once again required reading . Do you see a second wave of re-engineering, brought on as companies try to transform themselves using Web technologies?
TD: The word re-engineering does seem to be coming back into favor a little bit. We're actually doing some work with high-end knowledge workers and how you make their work more effective. High-level scientists and product developers, software architects, investment bankers, and consultants -- their work has not been touched much by reengineering.
EL: What are you seeing there?
TD: We're looking at many factors. One is technology, which is probably the least exploited thus far. Workplace design is a pretty hot issue, and more people are probably doing things with it than with technology. And then organizational design, probably the single most important factor if what you're interested in are things like innovation and creativity, and so on. We were just out at Ideo, probably the most successful product design firm. They hardly use any interesting technology, their workspaces are kind of fun but not particularly unusual, but they have a really great culture that emphasizes innovation. And I think that's why they succeed.
EL: So it's really a people thing; almost how you manage people's spirits.
TD: Exactly. If you want employees to think creatively and share their ideas and so on, you have to work on that kind of stuff.
EL: What do you think about what's happening with convergence? What are some of the trends you see developing in that marketplace?
TD: The Internet is still there, and companies are still quite interested in how to take advantage of it more effectively. We're just at the beginning of thinking about how we change our processes and our cultures and our governance structures to do anything differently with it. It takes a huge amount of time. We've had ERP for 20 years, and only a small fraction of companies have started to change the way they manage using the systems. I think that will be true of the Internet.
Right now, we're sort of in a period where there's no really big new ideas, and a lot of managers, employees, and organizations just want to take all the ideas that have come along for the past several years and put them together, integrate them, simplify them, and get some value out of them. They're all looking to extract some value from their existing infrastructures and, at this moment, cut costs from their existing infrastructures.
EL: What about online communities? It's almost as if an online community does three things: it gets attention, it sustains attention with user participation, and it encourages knowledge sharing of the kind where a novice can learn from an expert. Do you see companies embracing the concept of communities -- internally with their own employees, and externally, with customers, suppliers, and other partners?
TD: I think online communities are great and they have a number of positive attributes. But I think a lot of companies try to do them on the cheap, and they don't really take experts and put them in roles to facilitate communities. It's a huge amount of work to facilitate an online community. Ultimately, within companies, we'll see online communities as kind of another unit of organizational structure. You'll say, "Well, I'm in the accounting department, but here are the online communities that I'm really active in." And that will give you some sense of a person's view of the organizational structure.
--
Christian Sarkar is Editor-in-Chief of christiansarkar.com. You can see more of Christian's work at onewwworld.com.
by Steve Ulfelder
An Executive Guide to Utility Computing -- What it is, what it isn't, and the kind of results you really can expect
In the May 2003 issue of the Harvard Business Review, Nicholas G. Carr wrote a provocative article titled "IT Doesn't Matter". As might be expected, it roiled the zone in which business and IT collide; the article immediately spurred counterpoint columns, became the subject of dozens of symposia and launched heated boardroom discussion.
A careful reading of Carr makes it clear that his true argument is not so much that IT doesn't matter, but that it matters so much -- has become such a slab of business bedrock -- that it is actually IT's competitive value that's no longer a potential business differentiator. This is highly arguable itself, of course; some might say that in today's business environment, technology doesn't matter in the same fashion that electricity and running water don't matter.
Which brings us to the concept of expecting technology to behave as electricity and running water do. Those commodities are available anytime they're needed; they stand by invisibly when they're not; the infrastructure that surrounds them is resoundingly reliable; and they are paid for based on consumption.
This "invisible utility" model is the promise of on-demand computing, which also is referred to as flexible computing, grid computing, autonomic computing and a host of other terms. (Editor's note: After studying these terms, we've decided "on-demand computing" is both a good description of the practice and a name commonly used in the industry.
The dizzying variety of names is a symptom of the wider confusion surrounding on-demand computing. The field is growing so quickly and is being "spun" so furiously by vendors, system integrators, analyst firms and other interested parties that business executives seeking to learn about and evaluate it have a difficult time getting a solid footing. "Different suppliers are offering different mixes of [hardware, software and professional services] and using the same buzzword," says Dan Kusnetzky, a research vice president at Framingham, Mass.-based IDC. "Managers are often confused."
IT and business leaders are taking the on-demand computing movement very seriously -- as they should -- but they are also appropriately skeptical, having seen the hype cycle at work before. Murray Horwitz, CIO at Uline Inc., a Waukegan, Ill., shipping supplies company that currently has no plans to adopt an on-demand model, speaks for many technology leaders when he says, "It's a great concept, but I don't know how you implement it, and I think [vendors and enterprises] are going to have trouble figuring out how to cost it." This article's mission is to cut through the hype, language barriers and confusion to present a cleareyed look at on-demand computing -- its genesis, potential, limitations and implications for your business.
Here is a simple, if circular, way to define on-demand computing: It is IT functionality on demand. At its heart, on-demand consists of two elements:
To ensure business continuity, enterprises generally possess enough IT resources to meet peak demand. During off-peak hours, a great deal of processing power, bandwidth and storage capability sits unused, contributing nothing while draining electrical power, real estate and human resources.
The driving question behind on-demand computing is compelling: What if businesses could buy fewer of these IT resources, pool them and reliably meet users' needs by pushing the resources wherever they were needed?
Frequently asked questions: Do all these resources come from our own existing IT infrastructure? Or do we let a third party own the computers, so that we simply flip a switch and watch the functionality pour out? Or are we simply reorganizing the IT resources we already own? For the purposes of this article, "on-demand computing" refers to the practice of pooling your existing IT equipment, while "utility computing" refers to buying it from an outside provider.
On-demand computing brings a major shift in the way enterprises think about IT challenges. For the past decade or more, the idea was to integrate -- to make disparate software applications work together.With on-demand, IT becomes a set of functions a vailable on the network. "This is an architectural change," says Jason Bloomberg, a senior analyst at Waltham, Mass., research firm ZapThink. "And software architectures have always been very difficult to understand, let alone change."
To devise an on-demand computing architecture, the IT organization must create what's known as an abstraction layer. This is not for the faint of heart; it's a complex, time-consuming process that must begin with an exhaustive inventory of existing IT resources, which, in and of itself, is enough to frighten off many organizations.
Make no mistake, integration doesn't vanish in an on-demand world -- it remains a part of the picture, but it is no longer the final goal. Bloomberg offers one helpful way to think of this transformation. Under the traditional integration view of IT, all that matters about your company's mishmash of computer systems is connecting them. To shift to on-demand, you must change the mishmash into a set of Lego building blocks. Accomplishing this won't solve all your problems -- far from it -- but it's a necessary first step.
The major point to remember is that we are a long way from the day when you twist the tap and useful computing flows out.
Many executives wonder what on-demand will do to their investment in Web services, which are essentially a way for different software programs to communicate. Most experts say Web services will play a key role in the adoption of on-demand. The reason: The initial technical challenge is to virtualize resources -- to make them behave as if they are something they are physically not -- and it's not a stretch to say that Web services do the same for software applications. Put another way,Web services are a valuable tool in transforming the mishmash into Legos.
Like neckties, technology strategies come back into fashion if you hang on to them long enough. Veterans from the days before CIOs, when IT was the Data Processing department, may recall time-sharing. Developed at MIT during the 1950s, time-sharing became a popular way to access mainframes back when computers were as big as your shag-carpeted rec room and CPU cycles were expensive.
The endless boom of Moore's Law drove down the price of computing horsepower inexorably, and timesharing all but vanished. Then, in the late 1990s, the general idea made a comeback when businesses called application service providers (ASPs) appeared and attempted to rent out software applications (as opposed to actual computer processing). ASPs' pitch was that they could relieve businesses of expensive hardware purchases and IT employee salaries. This promise appealed to many smaller organizations eager to avoid up-front costs. For the most part, large enterprises weren't swayed; they already had a massive IT investment, and they were being urged to view technology as a major competitive differentiator.
Because ASPs tended to be startups, most failed during the Great Nasdaq Meltdown of 2000-2001. That failure sticks in the minds of some e xecutives. Michael McClaskey, CIO at Perot Systems Corp. in Plano, Texas, is bearish when it comes to on-demand computing. "I fear that just as in the ASP bust of a few years ago, users will expect commodity pricing along with significant customization of service," McClaskey says, "and the two cannot coincide in a commercially viable model." While he does not entirely dismiss the concept, McClaskey says Perot Systems won't embrace on-demand anytime soon.
Outsourcing, too, is hardly a new concept, and many of its goals and potential gains mirror those of on-demand: lower fixed costs, improved agility, closer alignment with strategic goals.
In fact, many elements of on-demand computing are already commonplace in enterprise IT. The practice is "to a large extent a financing option," points out Bruce Caldwell, an analyst at Stamford, Conn., research firm Gartner, Inc., and there's certainly nothing new about leasing or renting a server, or paying for only six processors on a 12-processor server with the option to add capacity if needed. Storage is sold by the gigabyte, mainframe power by the MIPS. Even services, such as the help desk, are contracted out and paid for by the trouble-ticket.
What is new, then, about on-demand? Unlike leasing and outsourcing, which are IT-organization-centric, it begins with business users' needs and works backward toward a solution.
Naturally (and rightfully), this is a persuasive argument for business executives.
For CIOs, on-demand's major draw is its ability to allow them to say, "Yes, we can do that," rather than, "Now, hold on a sec." The past decade has seen senior technologists shift from their old gatekeeper role, in which they frequently found themselves explaining why various initiatives couldn't be undertaken, to a new and welcome role as enabler. "Today, the CIO is fundamentally thinking about making IT meet the needs of the business," says ZapThink's Bloomberg. "In the past, most IT groups weren't very good at that.Well, the CIO doesn't want to be the bad guy anymore. In those C-level meetings, he wants to say, 'We have a flexible IT organization that can meet the needs of the business and do it with low risk.'"
According to Gartner's Caldwell, this is the factor that has CIOs from every industry intrigued by on-demand: by cutting up-front investment dramatically and offering variable operating costs, flexibility and scalability, it allows enterprises to "deploy a new system almost overnight, so you see much faster ROI," he says -- and return on investment is one of the maj or goals of enterprise IT today.
Amid all the hype regarding on-demand computing and its offshoots, it pays to take a close look at what the technology cannot do -- by itself, at any rate. For example, while on-demand may help businesses reduce their investment in IT resources, it does little to address the age-old challenge of aligning technology spending with strategic business goals. Because on demand is at its root a way to shift resources from one spot to another, its Achilles' heel is exposed when the following questions are asked:
On-demand computing can be very attractive. But know that, if you do it poorly, you will sometimes be under-provisioned and sometimes over-provisioned. In other words, you'll be no better off than if you had simply stuck with your old-school, overbuilt IT infrastructure. In fact, you'll be worse off, because with the old infrastructure, you were almost never under-provisioned.
One major reason for the prominence of on-demand is that most of the world's largest technology vendors have embraced it. Hewlett-Packard, IBM, Microsoft and Sun Microsystems have all made significant investments in the initiative.
System integrators, too, are elbowing in. Some analysts say that if on-demand gains favor, the actual practice of system integration loses its starring role in enterprise IT -- which could place system integrators in the uncomfortable position of advising clients to undo much of the work that SIs have been advising them to do for a decade.
But businesses implementing on-demand will face many new challenges, and many will turn to integrators for expertise -- and indeed, much of the knowledge SIs have built around XML-based Web services and other technologies will prove valuable. Thus, according to a recent Summit Strategies report, on-demand is "a double-edged sword" for global SIs -- those firms "will certainly not be shut off from all this emerging technology," the report says, but they are "unlikely to reap huge revenue gains" from on-demand.
IT veterans have watched plenty of Next Big Things fizzle. In a recent IT World survey, 25 percent of all respondents called on-demand a smoke-and-mirrors technology. Uline CIO Horwitz says, "On-demand will never be as cost-effective as buying the correct size hardware and planning for peak loads. It is a great concept and could solve many issues. But most of the time as a CIO, you need to be in control of the hardware environment, and this does not lend itself to that."
Colin Rankine, an analyst at Cambridge, Mass.-based Forrester Research, is another skeptic -- from a value standpoint. "The pay-per-use model is intuitively appealing, but the reality is that technical and licensing issues don't allow effective resource-sharing," Rankine says. "For enterprise data centers, it's a zero-sum game; the risk and metering overhead cancel out any savings."
For most, merely evaluating on-demand is a challenge today, what with the rapid change and unsettled terminology that prevail in the field. However, it's a challenge
worth addressing, as on-demand may be the most significant shift in IT thinking to arise in the past 20 years.
Research RoundupA LOOK AT SOME OF THE LATEST TALK AND TERMS OF ON- DEMAND One of the difficulties in discussing and evaluating on-demand computing is that as with most young, rapidly changing technologies, the various names and terms used to describe it are constantly in flux. For example, some use "grid computing" to refer to something quite similar to on-demand computing, while others think of grid computing as vast peer-to-peer networks of home PCs. Confusing? You bet. "We know of no fewer than 14 buzzwords" commonly used to describe core on-demand computing alone, says Dan Kusnetzky, a research vice president at Framingham, Mass. - based IDC. We'll try to cut through the confusion and describe the types and offshoots of on-demand computing as they are most commonly used today. On-demand computing is an enterprise computing model in which resources are funneled to users according to demand. Those resources can theoretically include servers, network bandwidth, storage, data and even software applications; moreover, they may originate with an outside service provider or within the enterprise itself. Think of on-demand computing as the parent of many of the other terms defined here; that is, utility computing and grid computing as subsets of on-demand. Utility computing is the on-demand subset (sometimes called pay-per-use or metered services) in which the IT resources and infrastructure are provided by an outside services firm. As the name suggests, enterprises are charged according to their usage. Grid computing is the practice of applying many networked computers' processing power to a single problem simultaneously. It originated as a way to create a virtual supercomputer to solve complex scientific problems. Grid computing is an ingenious way to mass the power of hundreds, even thousands, of computers that would otherwise sit idle. Today, it's most frequently used in technical, scientific and academic communities; opinions are split on whether grid computing will have practical enterprise applications in the near future. Some call grid computing "provisioning on steroids." DCML (data center markup language): A proposed standard created by the DCML Organization aimed at describing the components running in corporate data centers. If DCML catches on, it could become an accepted metric service providers could use to charge for utility computing. EDS, Computer Associates and BMC Software are all members of the DCML Organization, but key players IBM, Microsoft and Sun have not signed on as of press time. Virtualization, often used to describe computer servers and storage, occurs when a device is made to appear and behave as if it is something it's not. For example, a virtual storage device may actually be a pool of several devices -- but the computer's operating system treats it as a single entity. This is an important enabling technology for on-demand because the idea is to pool multiple devices into a single virtual entity, then draw from that entity as needed. Web services: A relatively new class of software applications that can communicate and work with one another over the Internet. |
by Tom Field
Need to comply with HIPAA, Sarbanes-Oxley, Basel II or other regulatory requirements? Trying to decipher IT security's role? Be prepared for good news and bad news. The bad news: Demonstrating regulatory compliance will put IT security efforts under heightened scrutiny. The good news: This scrutiny will force enterprises to do something they should have been doing all along: Ensure that adequate security policies and procedures are in place, monitor for any lapses in compliance, and fix any problems that arise.
"When companies look at what they need to do to comply with these regulations, it turns out that much of it is what they should have been doing anyway to make the environment more secure," says Mark Nicolett, research analyst at Gartner. "So many of the regulations aren't really demanding anything beyond well-defined and effective identity and access management policies, practices and processes, and effective monitoring functions."
Rather than see regulatory compliance as a burden, smart enterprise leaders see it as an opportunity to demonstrate that investing in IT security is more than just a cost of doing business. It can pay off by helping companies reduce financial risk, maintain customer confidence, increase trust among business partners, protect the company's reputation -- and keep the auditors happy. "If you're not ready to answer auditors' questions, that's a sign you don't have your act together," says Michael Rasmussen, principal analyst in Forrester Research's security research group. "If you don't have a well-documented security architecture and someone who can answer questions, that's going to be a red flag that something requires further investigation."
SECURITY CHECKLIST Top Tips on How to Secure Compliance DEFINE:
PROTECT:
VERIFY:
|
From an IT security point of view, the first aspect of demonstrating regulatory compliance is documenting existing security policies and controls, seeing how those mesh with regulatory requirements, and making changes where necessary. Companies can take a high-level view, using the ISO 17799, CobiT or COSO security standards as a framework, but that won't get them all the way there, says Amy Ray, trustee professor of computer information systems at Bentley College in Waltham, Mass. "A high-level centralized security policy doesn't work well because systems are decentralized, and information sharing is happening outside the network," Ray says. "Much of the new legislation, including HIPAA [and the Gramm-Leach-Bliley Act], is driven by problems associated with external information sharing. This is a new phenomenon."
In some ways, going through this definition stage is the ultimate exercise in IT-business alignment. It's imperative that IT avoid talk of packet sniffers and buffer overflows, analysts say. "A lot of the process of documenting compliance means identifying where information is in the enterprise, what systems and business processes interact with it, and what controls are in place," Rasmussen says. "In trying to hit the technical [side of compliance], you have to go through the business lens." Ray concurs: "The onus is on security officers to speak the language of business."
After companies have defined security policies and procedures that meet the regulatory requirements, and have identified critical assets and business processes, the next step is to ensure that the appropriate technology is in place to protect those assets. Organizations that have focused their security efforts primarily on the perimeter -- building good fences, so to speak, to thwart external attacks -- will need to broaden their focus to police activities on internal networks and applications. "Most organizations have adequately addressed security around the perimeter, but the heart of the regulations is around specific data at the core of our networks and systems," Rasmussen says.
In response to regulatory compliance and audit demands, Gartner's Nicolett says he has seen an increase in client activity in two areas: User administration and access controls, and monitoring for lapses in user administration and access controls. Password management, identity management, and access-control software are garnering attention, as is software that monitors system and application logs for administrative changes and resource access.
Some organizations may not need to buy new technologies to comply with regulations. "It's more about documenting or more effectively managing what you have," Rasmussen says. If a company has role-based access control deployed in one part of the organization, for example, it should use that capability in another part. Rasmussen has seen companies roll out intrusion detection systems and then neglect to have anyone monitor them. "Intrusion detection doesn't make much sense if you're not going to have analysis behind it," he says. Many companies could also do a better job of making sure that new operating systems and applications are securely configured when they are installed, and have patches added when new vulnerabilities are exposed, he says.
When auditors come knocking, it isn't enough for a company to just show its policies of how it will comply with regulations, and then tell them about its identity and access control management practices. Auditors are looking for a process to monitor problems -- and a process to fix them. Security information management systems, which aggregate log data from security devices, network devices and applications, can help companies show that they can find lapses in compliance. Such products also offer real-time event management, as well as security analytics and reporting.
One cautionary note: Auditors' requirements for monitoring will probably get more specific, according to one expert, as they learn more about what types of technology-fueled capabilities companies can deliver.
HIPAA, SOX, European data privacy laws and opt-in email laws, among other regulations, all have penalties attached to them for noncompliance. For example, in Italy, commercial spamming has become a crime punishable by fines of up to 90,000 euros and jail time. U.S. regulators have shown that they are not afraid to go after companies on security-related violations. In April 2004, after the Federal Trade Commission alleged that a security flaw on TowerRecords.com exposed customers' personal information, violating federal law and the Website's privacy policy, Tower Direct signed a consent decree agreeing to have its Website security audited by an outside firm every two years for the next decade. Just over a week later, in response to the New York Attorney General's office investigation of a vulnerability on BarnesandNoble.com that could permit unauthorized access to customer accounts, the online bookseller agreed to establish an information security effort, set up programs for management oversight and employee training, hire an external auditor, and pay additional costs and penalties.
Even in the face of these cautionary tales, some companies may be tempted to do the minimal amount of work possible to comply with regulations. But experts say companies would be better served by taking a proactive approach. "Minimal compliance with legislation is not a strategic investment," says Bentley's Ray. "The challenge for security personnel in all companies is to demonstrate how security investments can yield return through reduction of financial risk, maintenance of customer confidence or other business metrics. But it is going to require a shift in thinking for those security officers, as well as some extra work to develop and monitor metrics on return on security investment."
Before the U.S. Health Insurance Portability and Accounting Act (HIPAA) was signed into law in 1996, Capital District Physicians' Health Plan (CDPHP) was determined to be fully compliant even before the mandatory deadline. Much of the compliance burden fell to Kevin Colwell, a change-management specialist at the Albany, N.Y., health insurer.
Colwell soon found that HIPAA's stringent rules surrounding patient information complicated simple actions that had always seemed straightforward. For example, when computer users call the help desk, it seems obvious that their phone numbers must be captured for call-back purposes. But HIPAA restricts access to such numbers, as well as how the information is subsequently safeguarded.
The plot thickens when you consider that CDPHP's 750 employees are also clients of the insurer. So, when the computer users buzzed the help desk, how was the company to know whether they were calling as employees or as customers? Factor in remote workers and physicians (who might also be customers themselves), and the regulatory situation gets more complex. "We needed to protect all this communication," Colwell says. "But we also need to communicate."
The challenges faced by CDPHP are familiar to businesses everywhere and multiplied many times over by the latest regulations. All over the world, regulatory agencies are tightening business rules with new regulations. As a result, global enterprises now must comply with everything from regional laws that have an enormous impact (such as California's Senate Bill 1386, which compels organizations doing business in that state to contact anybody whose personal information may have been compromised -- one university recently notified 380,000 people in its database) to the growing likelihood of class-action lawsuits in Far East countries that have never before allowed such actions.
The details of the regulations vary, but what they all have in common is scrutiny over corporate governance, with an eye toward protecting consumers and investors. Thus, enterprises must track and save digital information more closely than ever before. This establishes compliance as both an IT and a business issue. And addressed properly, strategies for compliance help IT mature and move toward best practices that are good for both IT and business. Leading enterprises are responding with systems and governance processes that ensure quick response to any new rule, whether it originates in Sacramento or Singapore.
The increased government and regulatory oversight of corporate activity is a new cost of doing business, and it can be a high one at that. When you examine that expense, look at a sampling of the regulations facing business today and explore the components common to many of those regulations, the need to form a proactive compliance strategy then takes on new urgency. To meet these objectives, there are changes enterprises can make to their governance processes and technology systems to not only respond rapidly when new regulations arise, but also achieve competitive advantage and IT efficiencies while doing so.
To this point, regulatory compliance has been an expensive task -- but that's partly due to the newness of the concept (where information is concerned, that is). Businesses tackling HIPAA or UK Data Protection Act 1998 deadlines have generally done so by throwing together all-hands-on-deck teams, pulling key IT and business staffers away from their daily jobs, and thus leaving vital gaps elsewhere. In general, enterprises are at the steep portion of the compliance learning curve.
This underscores the need to devise a comprehensive, repeatable compliance-management process. Few companies can afford to scramble a team of specialists each time a new regulation looms. It makes sense to instead create a proactive policy that can be adjusted for the specifics of any regulation.
How much money will a proactive approach save in the long run? It's difficult to pin down, but the costs of Section 404 of the Sarbanes- Oxley Act serve as an example. Section 404 is the mandate that U.S. public companies' annual reports include a statement of management's responsibility to establish and maintain adequate internal controls, assess financial reporting, and disclose any material weaknesses in the company's internal-controls structure.
In a survey of 321 U.S. public companies, industry group Financial Executives International found that for businesses whose revenue tops $5 billion, the average cost of Section 404 compliance will be $4.6 million, which includes 35,000 hours of internal manpower; $1.3 million for consulting and software; and $1.5 million in new audit fees.
Another survey, conducted by the Business Roundtable, polled 150 CEOs at large U.S. companies. Half said their compliance costs would range from $1 million to $5 million; some estimates topped $10 million.
Where Sarbanes-Oxley is concerned, "Governance and compliance are no different than most other business issues," said Brian Wood, a Gartner analyst, at the Gartner Symposium/ITxpo 2004. "A compliance architecture doesn't necessarily require new software investments and does not need to be implemented across the enterprise in a single step. Most organizations will find that they already have many of the software tools they need." The research firm says the same is true of Basel II and other regulations.
Gartner analysts offered other reassuring words at this event, pointing out that any enterprise that has in place items including solid security and business continuity planning and a document management system possesses the foundations for a compliance architecture.
By establishing such an architecture, enterprises will reduce the cost of regulatory compliance because it "eliminates requirements to hire external auditors or consultants every time a new law appears," says Gartner's Rich Mogull.
John Hagerty, a compliance expert at Boston-based AMR Research, agrees. "If you address each new regulation in isolation, you'll overpay," Hagerty says. In February, he authored a report, "Planning for a Sustainable Active Compliance Architecture," that called regulatory compliance "a strategic objective, not just a collection of tactical projects."
"All legal, regulatory and industry-driven directives are vast in scope and effect," writes AMR's Hagerty. "Nonetheless, many share business requirements, allowing for a common approach and management." He adds that "virtually all compliance mandates are driven from rules, policy, and procedure." Common requirements include the following:
These common threads add up to a compelling argument for methodologies that tie technology resources to business priorities.
Today, where regulations are concerned, it's vital to become proactive. With the right processes and tools in place, an enterprise can react quickly whenever and wherever a new set of rules springs up. In and of itself, this approach can provide competitive advantage, because you can focus on business while your competitor is still scrambling to comply with the latest regulations. Moreover, monitoring information for regulatory purposes also improves a company's knowledge about its customers, trading partners and competitive environment.
AIIM International (the Association for Information and Image Management), a leading computer industry group, has recently published a book on regulatory compliance that attempts to lay out a step-by-step program for businesses. Information Nation: Seven Keys to Information Management Compliance, by Randolph Kahn and Barclay Blair (March 2004), details the following critical compliance factors:
John Mancini, president of AIIM, says, "We represent enterprises all over the world. As we discuss today's regulatory environment with them, we urge them to not just think of compliance as a thing they have to do in response to new laws; if you think in those terms, you're too late. You're just knee-jerking."
Rather, Mancini says, businesses must think in broad-based terms. "Government regulations, legal requirements, process management, business requirements -- this is all part of the big picture, and it's all about treating information with the same demanding tolerances you treat anything else in your organization."
Increased regulation surrounding business data is sweeping the globe, even in nations previously regarded as laissez-faire. Here's a rundown of just some of today's international regulatory efforts.
IAS/IFRS. All European Union-listed companies must prepare consolidated accounts in accordance with International Financial Reporting Standards (IFRS) or International Accounting Standards (IAS) beginning with their first reporting period after Jan. 1, 2005. The sweeping package of regulations will affect about 7,000 European enterprises more or less simultaneously, so there's already a shortage of expertise. The goal is a standardized corporate financial statement that can be readily understood by potential investors anywhere in Europe.
BASEL II. Due to be in place by 2006, Basel II (formally known as the New Basel Capital Accord) is an international set of regulations being spearheaded by the Bank for International Settlements. Central banks and regulatory authorities in the United States, Japan, Germany and other countries are also major players. In a nutshell, Basel II is intended to paint a more accurate picture of financial institutions' risk management.
DATA PROTECTION ACT 1998. Though this UK law took effect in 2000, its ramifications are only now becoming clear to global businesses. The act established rules for processing UK citizens' personal data. It also tightly controls the transfer of UK employee, customer and subscriber data to U.S. companies.
LAUNCH OF SINGAPORE'S ACRA. This is not a regulation per se, but rather a new regulatory agency -- the Accounting and Corporate Regulatory Authority -- in Singapore, which has a history of being extremely business-friendly. "ACRA will combine the function of monitoring and ensuring that companies comply with the prescribed accounting standards," said Lim Hng Kiang, Singapore's second minister for finance, at the May announcement of ACRA's formation. Singapore, along with other Asian nations, is tightening accounting and data-gathering rules in response to reduced investor confidence.
Chaos! That's the best word to describe the roar of shouting traders on the floor of the Chicago Mercantile Exchange (CME). The largest futures exchange in the U.S., CME handles more than $2 trillion in trading values both on the floor and through its electronic system.
Jim Krause, CME's CIO, has the daunting task of making sure his IT staff of 500 employees keep the more than 2,500 servers running at top speed around the clock. About 1,000 of these servers power the front-end of the trading system. In addition, Krause has to keep up with providing technology to an organization that's growing at 400 percent a year. Providing excellent customer service has become Krause's first priority.
EnterpriseLeadership.org sat down with Krause to find out how he manages his priorities, how he handles the key sectors of the public with whom he deals, and what factors can change the nature of the futures business overnight.
EL: What is your IT vision?
JK: Understanding what the impact of a change might be for the customer has to be your first priority. The most important things for our customers' satisfaction include reliability, speed, and performance. Functionality plays a role, but it's not number one until these first three are delivered.
EL: You're wrapping up a major Linux deployment. Why Linux?
JK: We will run 1,000 out of 2,500 servers on Linux, with 10 terabytes of storage.
We intend to run Linux on the front end of our electronic system -- getting the orders in and out of the system, and getting market data out of the system to the market vendors and to the traders.
One of the key factors in our decision to go with Linux included speed, and the second factor, cost. The ability to scale quickly at a reasonable cost while we're improving performance was the driving factor.
We're deriving millions of dollars in cost savings by expanding with commodity-based Intel servers. A Sun server costs more than 50 percent more than a comparable Intel-based server running Linux.
EL: Where are you with the Linux deployment?
JK: We're about three quarters of the way done. We first did all of the things we could do quickly, such as import Java-based applications. We're taking more time to deploy our C applications. Here, we need to have some quality assurance and to make minor changes.
EL: How do you look at speed advantages?
JK: We use milliseconds to measure the speed of our trading activity. In fact, every millisecond counts. When we rolled out Linux to most of our environments, we saw that just by changing hardware, we gained about a 30 millisecond reduction in throughput. We don't tend to overload servers. Reliability and performance are key. If we're 50 percent loaded, and we get two or three extra milliseconds, we'll add another server and make it 25 percent loaded so we don't incur those extra milliseconds.
EL: Given the nature of your business, what types of IT governance do you have going on?
JK: We don't say “IT governance”; this is the company business we need to do in order to stay competitive. Our management team goes through the budget process routinely. The team agrees on the priorities for each project and makes adjustments as necessary. So, the competitive nature of our business drives which IT projects get done.
EL: How do you manage people, vendors, and customers?
JK: They don't call me Grumpy for nothing. Just joking; I try to lead, not manage. I show my staff what we have to do and what I expect from them. My goal is to develop people to make the right decisions. So, my management style is to be part of what they do and then let them do it.
As for vendors, we stick with a minimum of two vendors for a particular type of product. Our server vendors include HP and Dell, and some Sun. We want to get the best deals for our company. We've no problems developing a strategic, long-term relationship with a vendor to ensure that we get extra support when we need it.
Customers' concerns will always be my prime priority. How can IT be customer-focused if no one ever talks to a customer? I work with our Projects and Services group to go out on customer calls. We also have a User group comprised of our customers. We routinely hold forums in which we talk about the status of our products, and give customers solutions for fixing problems. We also do customer satisfaction surveys. Everyone in IT has a chance to get in front of customers, either through the forum meetings, or just by talking to customers on the telephone.
EL: Do you have quality programs such as Six Sigma in place?
JK: Not really. I couldn't tell you all of the tenets of Six Sigma. However, quality is important. We've a fairly extensive quality assurance process which involves the business side of the company.
We don't have really big implementation projects such as taking three years to get SAP up and running. If we do have a project that's going to take a year or two, we break up things into phases and carry out each phase within an allotted time period. We do go back and validate the other phases.
Our business has grown as a result of global competition. By doing things in smaller, manageable time increments, we can react quickly to a business process or business change, in order of priority.
EL: Have you carried out process automation, or do you plan to?
JK: Our quality-assurance initiatives include regression tests of a specific functionality, such as bootstrapping a server, to make sure we didn't break anything that was new. We have some development methodologies that we use for automating processes.
Since my budget is a big part of the organization’s budget, we're under a lot of scrutiny. The speed and reliability of our electronic trading dominates most of what IT does. We have to make sure we've got the capacity to handle growth of 400 to 600 percent every year.
EL: What external forces drive your market conditions?
JK: Ten years I would've told that the Chicago Board of Trade was our key competitor. Today, we're both in the futures business, both trading electronically, and both seeing a lot of global competition. For example, our global competitors include Euronet Life owned by the London International Financial Futures Exchange and a Euronet from Paris, and Eurex, the German futures exchange.
Perhaps in the future, we'll see some consolidations, such as Nasdaq and Instinet.
EL: What disruptive technologies are you considering?
JK: If our central order book, which holds all of our bids your offers, gets too big, we have to scale vertically as well as horizontally. So, we're looking at blade servers. We're also doing putting forth some extensive research and development efforts to predict what the technology will look like three or four years out. For our switch infrastructure, we're considering gigabit updates in order to scale vertically. Everything right now is 100 megabit port speeds. Grid computing fascinates us. However, we don't know if it will be able to scale vertically.
The current client-service architecture everyone loves still has about two years of life for us.
The regulatory side of electronic trading means that we have to do a lot of analysis and real-time review of activity.
EL: How do you spend your free time?
JK: I try to play golf once a week and spend most of my free time with my family. I work six days a week. The exchange trades 24 hours a day, starting up Sunday afternoon and closing on Friday night. We continuously expand, and upgrade users. We've got rigorous quality requirements which requires that we check everything, even it's a process that is automated.
EL: To be successful in your IT department, what characteristics do employees need?
JK: Employees at CME need to pay attention to details. They also need to understand what has to be done and to make everyone stay focused on those priorities. Some technology folks like to work with technology only; however, capabilities, such as redundancy, fault tolerance, and backup, enable us to keep the customer trading while we fix systems in the background.
Our customers include the largest banks and other financial institutions in the world. Liquidity drives the commodities market.
The exchange started by traders buying membership. And these folks are still making markets. With electronic trading, you also have a new breed of customer who comprises a trading arcade. These folks make money by trading our products.
--
Elizabeth Ferrarini is an IT consultant and free-lance writer from Boston, Massachusetts. Elizabeth can be reached at elizabethferrarini@yahoo.com.
It's no secret that we are fans of services and service-oriented architecture. For years, we have been proclaiming the significance of service -- oriented architecture and Web Services technology in creating an adaptive IT architecture for customer experience.
More recently, we have shared our belief that the current uses of SOA for integration and customer- (user-) facing applications are merely the first stages of the service-oriented evolution. Over the next few years, SOA will be the springboard for innovative IT shops to move towards business scenario development. In business scenario development, IT business solutions will be compositions of services, business events, and business processes. These compositions match the interactions of your business -- with customers, partners, employees, and regulatory agencies -- in support of commerce, collaboration, and information exchange.
Now, everyone is talking SOA, services and Web Services. If you Google "service oriented architecture," you get almost 12 million hits. 12 million hits for an IT concept with "architecture" in it! And if you Google "Web Services," over a billion hits! While that's no indication of true adoption, it certainly does validate the buzz factor.
In fact, so many people are talking SOA, and labeling their products and services accordingly, OASIS has recently formed an SOA reference model technical committee. According to the May 3, 2005, OASIS news release1, "the SOA reference model will offer an understanding of the core elements within a service oriented environment and the associations and relationships among those elements." Essentially, the intent of the reference model is to separate fact from fiction -- to provide software and application architects a starting point to delivering SOA solutions. This is good, but as we all know, it will take time (perhaps a lot) to complete.
In the meantime, as a service to our clients who are interested in, or are pursuing a service-oriented strategy, we have developed this overview report on services and SOA. This "SOA Cheat Sheet" report includes key service concepts, information on supporting technologies, a view of the SOA landscape, and some keys to SOA success.
Simply stated, a service is a thing that fulfills a purpose. A service is, in essence, a "worker," employed to achieve a specific end goal for a requester. The end goal may be small in scope, such as retrieving information, or large in scope, such as executing a business process. Most services are in the middle, completing a function. The scope of a service is referred to as its grain, or level of granularity.
WHAT KIND OF THING IS A SERVICE? A service is an abstract resource that has a name, a job, job tasks, contact information and policies regarding security and service levels. To use (request) a service, you send a message -- in accordance to the contact information and policies -- and then (if appropriate), receive a reply message.
A SERVICE'S JOB. The job of a service is limited to a single distinct business concept, function, or process. This characteristic is referred to as the bounds of a service. Finding the correct bounds is a key factor in service definition. A service may call upon other services if it needs assistance to complete its job. This service-to-service relationship is called collaboration.
The term SOA is used interchangeably for three distinct concepts: the architectural concept, the style of the resulting business solutions, and the supporting infrastructure.
SERVICE COLLABORATION. Services collaborate through orchestration, business interaction, or interception:
NOT ALL SERVICES ARE ALIKE. Not all services are simple information-oriented requests/replies. Beyond request/reply, a service may be a worker, a monitor, an agent, an aggregator, or even a process
.
The term SOA is used interchangeably for three distinct concepts: the architectural concept, the style of the resulting business solutions, and the supporting infrastructure. In this section, we describe each concept.
SERVICE-ORIENTATION. Service orientation is an architectural concept that refers to the loose coupling of a service (an abstract resource with a defined job) and its provider (the physical asset(s) that perform the job tasks). A requestor only knows what the service's job is and how to request it. The service is the only one that knows its implementation.
Typically, service-orientation is applied to functional assets that correspond to business concepts (Open Customer Account) or system concepts (Authenticate User). However, service-oriented thinking can apply to any domain, including integration, network, platform, or even programming services. If a requester knows what a service offers (job, service levels) and how to use it (contact, security), then it really is not important (to the requester) how that service works, as long as the results meet expectations.
SERVICE-ORIENTED ARCHITECTURE. SOA is an IT architecture strategy for business solution (and infrastructure solution) delivery based on the concept of service-orientation.
SOA STYLES FOR BUSINESS SOLUTIONS. The two primary styles of SOA used in business solution development are composite application development and flow.
Composite Application Development. In composite applications, the user interaction drives a request for one or many services. Most of the service invocations are synchronous in nature. A composite application typically serves one business domain. Composite applications are often delivered in a portal.
Flow. In flow, business process and/or events drive the service invocations. The service invocations are a mix of asynchronous and synchronous; however, the overall flow is usually long running and asynchronous. A flow typically crosscuts business domains and often extends outside of the enterprise.
In business process-driven SOA, a business process may implement as a service, and/or a business process step (activity) may invoke one or more services.
Closing the loop on flow, any service may generate an event or be invoked via an automated transaction (business process step, eventdriven activity). We believe this is the true power of SOA, combining services, events, and business process for human and automated (agent-based) interactions.
SOA ENVIRONMENT. Refers to the collective environment that allows services to be defined, developed and used by other services, and to be assembled into solutions by adding process, interaction mechanisms, user interface, and/or rules. In addition to service development and solution assembly, the SOA environment provides runtime and management functions such as service discovery, policy definition and enforcement, quality of service (performance, availability, reliability and load), transaction management, audit, and usage metering.
Certainly, everyone is talking about SOA, but talk doesn't justify adoption. In our experience, we find that SOA has both business and IT advantages.
Business advantages consist of the following:
IT advantages include:
1 See http://www.oasis-open.org/news/oasis_news_05_03_05.php.
2 Note that the ROI from reuse typically occurs between the second and third use of the service. This note is based on industry metrics that consider the increased design and development time to "get the service right" to be reusable.
--
Brenda M. Michelson is the Sr. VP and Sr. Consultant for the Patricia Seybold Group.
Read more reports on Web Services and Service-Oriented Architecture by Brenda M. Michelson and others.
During her 20-year climb up the corporate ladder at SAS, the world's largest privately held software company, Suzanne Gordon, SAS's CIO, developed a strategy for how IT could work in lockstep with the business units to reinforce the company's success. A roadblock stood in the way of selling her idea to management, and she decided to move out of IT and into the sales-consulting side of SAS. It was there that she got to see IT from the customer's perspective.
When the CIO position came open at SAS, which develops and markets business analytics software, Gordon was ready to turn her vision in a reality for her staff of 310 employees. In fact, in 2003, Computerworld recognized Gordon's leadership talents by including her in the list of Premier 100 IT Executives for that year.
Gordon recently talked with EnterpriseLeadership.org about how she carried out the realignment agenda for IT, how IT carries out the role of sales champion and beta tester, and how she develops and mentors her staff and young women interested in technical careers.
EL: What is your vision for IT at SAS?
SG: It's a people vision of getting the IT staff and the business unit leaders to work harmoniously together in carrying out the company's strategy. To accomplish this task, we need to correct any relationships that don't work as efficiently as they should, and to improve processes so we don't spend money on things we don't need.
EL: Describe the biggest risk you took in your IT career and what you learned from the experience?
SG: I left IT because I wasn't happy with my boss. I loved what I did, but my boss and I were going in different directions. So I went over to SAS Consulting where I worked directly with customers.
The move gave me an entirely different perception of SAS -- how customers viewed us and how our customers viewed their IT departments. I became a customer of our IT department. I worked closely with our sales people, who are a different breed from IT folks. The experience taught me the value of communication. When the CIO position became available, I was better prepared for it than if I had stayed in my previous job.
EL: Can you describe how you realigned IT with the business units?
SG: When I headed up applications for the MIS group, I wanted us to set up an IT governance council to meet quarterly with the business units. My boss at that time didn't like the idea. When I came back, this was the first thing I did.
I put together a list of all the projects we were working on. I then selected those projects that I knew everyone would be interested in, that were important to the business, that everyone would understand. The list went to the executive staff, who forwarded it to their directors and vice presidents of the various business units. These second-tier executives really understand how the company operates.
Since 2003, we have been meeting quarterly to discuss proposed new projects. Prior to each meeting, our business analysts in IT go over the proposed projects with each business unit executive. The business analysts do a rough executive summary of what is going to be involved and a rough guess about what resources that each project will take. During the meeting, we talk about each one of the projects, deciding if it is something we all agree needs to be worked on immediately, and ranking where it sits in the present priorities. Some projects get killed.
EL: Apart from deciding on projects, what other favorable things have come out of the quarterly IT government meetings?
SG: The meetings show how well colleagues can cooperate with each other and do things for the good of the company, not their business unit.
The IT department no longer comes off as the bad guy.
I asked a Gartner Group analyst if other companies have good collaborative working relationships between IT and the business units. He said they work on "if you vote for my project this quarterly, I'll vote on yours next quarter."
I should add that cooperation and collaboration reside at the heart of SAS's culture. Also, the company's strong employee retention rate help to reinforce the willingness of everyone to work together.
EL: Do you have quality programs, such as Six Sigma, in place?
SG: We haven't carried out any specific quality program. We've gotten some ideas from Six Sigma and the IT Infrastructure Library. We're always looking at how we can improve our processes.
EL: Can you give me an example of a concept you carried out for IT that flowed out of a Six Sigma or ITIL?
SG: We've been trying to do more project management, but didn't want to be overwhelmed by assigning dozens of graduated levels to each project. We, instead, came up with a concept called, "just enough" project management. The degree of project management depends on the project's scope. For example, if it's a small project, we might do three things for it. We might do more things for a larger project.
EL: Do you get involved in beta testing SAS products?
SG: I have a dual role. In fact, I tell my staff, "We don't want to be the best IT organization, we want to be the IT organization that helps SAS be the best at what it does." In addition to the traditional IT tasks, we take the time to help test and to use new products for the business units. Finding and documenting bugs can take time away from scheduled IT projects. At the IT governance council meeting, we always discuss project delays. Business unit executives understand that what we're doing provides our customers with better quality software. We also use our software in-house.
EL: Can you go into more detail about how you work with the business units that are testing these products?
SG: Our IT staff works with the research and development (R&D) staff who are writing the product, and the managers from the business unit. IT provides feedback to R&D staff on such things as how well the product was installed, and how easily it could be brought back up. The business unit evaluates the product's features.
EL: Since you use SAS software in house, do you help SAS sales representatives influence prospective customers?
SG: Yes, in a couple of different ways. We set up a backend system that enables the sales representatives to demonstrate our enterprise software via the Web. Sometimes we go on sales calls or talk to customers on the telephone. We often meet with customers who come to our offices. We show them how our products work at SAS. We maintain a Web site that has data on all of the different SAS products we are using in-house. The site tells how we are using them and whom to contact as a product reference.
EL: How is performance and/or quality measured for IT?
SG: We don't measure performance or quality in a very analytical way. We tend to focus more on customer satisfaction. We do customer satisfaction surveys both on handling requests, problems, and then follow-up to projects.
EL: How do you develop your staff to be better at what they do?
SG: We offer many on-site technical training courses. Our training budget enables our staff to go offsite and to learn new skills. We also do many workshops in interpersonal skills, such as team building. Informal coaching helps employees to work on the areas they need to improve.
I like to visit the front-line meetings and get a feel for what problems aren't getting up to me. Acting as a facilitator, I try to remove any obstacles that keep individuals for getting their job done.
EL: You have a B.S. in math and computer science and a M.S. in statistics. Outside of SAS, you participate in educational activities that help to promote technical professions to young women. Can you talk about what you do?
SG: I sit on the Board of Trustees at North Carolina State at Raleigh, where I graduated from. Various departments at the college frequently call upon me to speak at workshops, such as Women in Business sponsored by the MBA program.
EL: Larry Summers, president of Harvard College, took a lot of heat in the media when he said that women don't have the ability to do well in a math and the sciences. Comments!
SG: Summers' comment could easily bruise the confidence of a young woman who wants to pursue a career in a scientific or technical field. We need more women in these areas. Women bring a different perspective on things, especially human relations. Women tend to facilitate conversation. They tend to be concerned about getting the job done, not on proving they're always right.
--
Elizabeth Ferrarini is a free-lance writer and IT consultant from Boston, Massachusetts. She can be reached at iswive@aol.com
How can a company capture attention in this, the age of the distracted customer? What happened to knowledge management? What's next for ERP? Thomas Davenport shares his insights.
Tom Davenport has been around the IT block. One of the pioneers of process reengineering, he has been instrumental in the development of our understanding of how businesses use information to compete. A seminal thinker in the field of knowledge management as well, he has recently focused on the critical field of attention-management. His latest book is The Attention Economy: Understanding the New Currency of Business.
EL: One of the things you say in your book, The Attention Economy, is that, "understanding and managing attention is now the single most important determinant of business success." What is the attention economy and what are its implications for companies and then individuals?
TD:The attention economy overall is an economy in which there's way too much information and knowledge floating around for the brain cells that humans have available. So it becomes an economy where attention is really scarce and hence really valuable. And getting attention for your ideas, your products, and your information is a critical prerequisite for any kind of business success. If people don't know that your products exist and spend any time cogitating about it, you don't stand a chance. A great example is "The Blair Witch Project" -- $750,000 making the movie, $30 million marketing it.
At an individual level, you say something about "there can't be too many initiatives at one time."
I see that as more of an organizational thing, but it certainly impinges on individuals. And ultimately, any organizational initiative that's successful comes down to individuals changing their behavior. But if they're not paying any attention to what the initiative is about, its objectives and so on, they're not going to change their behavior. Getting real change to happen in organizations becomes a matter of individual attention. Every individual has to look at him- or herself as a consumer, and you want to be a very intelligent consumer and consume only information that's going to benefit you, your family and your organization. And you've only got so much to give out, so you've always got to be making this calculation: Is this the best use of my attention right now?
That's why so many employee newsletters fail, because there is so much useless information.
EL: You note that there are different types of attention and certain teams are dominated by certain types ...
TD: We identified, based mostly on psychological research, three overall dimensions and six types. There's front-of-mind and back-of-mind -- what you try to do there is push as much as possible to back-of-mind through repetition and practice so you can free up your front-of-mind for other things. That's one of the dimensions with the Attentionscape tool that we've developed. There's front-of-mind versus back-of-mind, voluntary versus captive, attractive versus aversive. What we argue is that you really want to try to maximize all of those six types because you're getting a maximum amount of attention if you're hitting on all of them at the same time.
EL: You also discuss the critical success factors there are for getting the attention of CEOs. Can you talk about that?
TD: I wouldn't say CEOs -- I'd say executives. We looked at what managers, white-collar workers, and professionals pay attention to. We first asked what sort of media they pay attention to -- it turns out email is the most attention-getting medium in our research.
Then we asked what attributes of the message would make it most likely to receive a lot of attention. We found out that personalization was the single most important factor. Second was keeping it short and concise. Third was emotion, having either positive or negative emotion being evoked by the message. And the fourth one was making it come from a trustworthy source. The first three are relatively easy to manipulate. I say easy, but it's actually a lot of hard work, because personalization takes a lot more effort than sending out a big group distribution email.
EL: What are the lessons we should learn from the online world? How do you capture and sustain attention online -- or even offline?
TD: Actually, the biggest attention industry, if you look at how much attention goes to it, is television. People watch it for three hours and 26 minutes a day on average in the United States. They're not online quite that much. We had a whole chapter on e-commerce and the Web. But for those industries like television, the movies, publishing and advertising -- out of each industry or sub-industry, we tried to abstract some of the lessons. So for television, it's the power of narrative. They always tell stories, make it easy to get in and get out, have a predictable time schedule, and they don't let technology get in the way.
For movies, we talked about age segmentation and the captive setting. We tried to point out some circumstances where people had taken some of these lessons and moved them across industries. For example, we looked at Gamesville, a Lycos entertainment Web site, and how they start new games at the top of the hour, much like a television schedule.
EL: Let's shift to ERP. In terms of strategic use of ERP, you are the expert. Recently, I've heard from some database gurus that ERP systems are what has really allowed companies to take all their various sources of data and normalize them, allowing for one common method of talking to each other.
TD: I'm pleased that you say that, but the world didn't seem to be that interested in a strategic perspective on ERP, at least at the time. I had hoped that after the Y2K thing, people would go back and say, "Gee I spent all this money and I should optimize it and get a lot of business value." But the fact is that they did not do that. They basically moved from Y2K to e-commerce. And now people are just trying to figure out how to cut costs. I'm glad I did that work on ERP -- I think it's very important. But it (Mission Critical) certainly wasn't the most popular book I ever wrote.
EL: But you still have to fulfill everything, you still have to do the back-office stuff -- ERP isn't going away.
TD: Exactly. SAP in its advertising now, they call it, "Solutions for the New New Economy, the one where profitability matters." Certainly, you found some pretty small e-commerce companies were putting in ERP because they knew they had to do fulfillment and be able to promise inventory, and so on. People are still doing it -- Oracle, SAP, and PeopleSoft are doing pretty well as companies. For a while they were doing extremely well. I think there's still a valid question: For any given piece of functionality, do you want to do it in an ERP system, which optimizes the integration of it all, or do you want to do it for the "best of breed" thing, which may optimize specific functions? I think it's certainly still a valid question.
EL: What about taking the data captured in your ERP system and extracting it and turning it into knowledge that can be acted on? Are companies finally getting better at this?
TD: I think they're getting a little bit better as the tools from the ERP vendors get better. But it's still not great. Too many people still only do the transaction side and don't manage the business any differently.
EL: Would you say that the road for ERP in the future is going to be optimizing B2B buying and really looking at that?
TD: Certainly, that's part of it -- hooking up front-office and back-office stuff so you can do e-commerce and actually fulfill your orders, make your customers happy, and so on.
EL: What about the ASP model, in which everybody hooks into a system that's hosted somewhere else so all your suppliers can be on the same ERP system? Or a marketplace, where everybody is trying to collaborate? How do you manage the challenge of ERP talking to ERP?
TD: There's a huge integration challenge. I think it's fair to say that few companies or industries have solved it yet. What you're getting into is inter-organizational reengineering, and it's very time-consuming and very expensive. And I think that's one reason why a lot of these B2B exchanges, and so on, are going out of business.
They don't have enough capital to afford to do that kind of integration across multiple companies. Frankly, I think there will be a fair number of these consortiums, e-marketplaces and the like, that won't be able to avoid it either. It's already clear that it's taking a great deal longer than anybody thought it would to be able to do transactions without a huge amount of human intervention.
EL: What about companies like enterprise application integrators?
TD: I think there's an appeal to being able to keep a lot of your existing applications and integrate them through some means other than one big system. It's a complex world, and even if you end up only integrating pieces of the business that you've acquired, there would be a perfectly good role for software like that. I think we'll end up using a lot of that stuff for integrating across companies. You're not going to find very many industries where every company has SAP or Oracle.
EL: Knowledge management turned into business intelligence and then it turned into CRM and then supplier relationship management, some even say competitive intelligence. What's going on in knowledge management these days?
TD: Well, the bloom is off the rose on pure best-practices sharing. But I think there is more energy now than there has been in business intelligence and I think it was a good thing to think about business intelligence from a knowledge-management standpoint as some companies are starting to do, because that means that you don't just assume that some technology does it all. You don't assume that because you have some sort of data mining software, that these great insights are just going to jump out of your data.
The smart companies realize it takes a lot of very bright human beings around in addition to the software, and that's sort of a knowledge-management-oriented insight.
CRM is probably going to focus now more on customer knowledge. For some reason, companies were very slow to put customer knowledge into their knowledge-management initiatives. And what could be more important than that?
EL: I think your book, Process Innovation: Reengineering Work through Information Technology, is once again required reading . Do you see a second wave of re-engineering, brought on as companies try to transform themselves using Web technologies?
TD: The word re-engineering does seem to be coming back into favor a little bit. We're actually doing some work with high-end knowledge workers and how you make their work more effective. High-level scientists and product developers, software architects, investment bankers, and consultants -- their work has not been touched much by reengineering.
EL: What are you seeing there?
TD: We're looking at many factors. One is technology, which is probably the least exploited thus far. Workplace design is a pretty hot issue, and more people are probably doing things with it than with technology. And then organizational design, probably the single most important factor if what you're interested in are things like innovation and creativity, and so on. We were just out at Ideo, probably the most successful product design firm. They hardly use any interesting technology, their workspaces are kind of fun but not particularly unusual, but they have a really great culture that emphasizes innovation. And I think that's why they succeed.
EL: So it's really a people thing; almost how you manage people's spirits.
TD: Exactly. If you want employees to think creatively and share their ideas and so on, you have to work on that kind of stuff.
EL: What do you think about what's happening with convergence? What are some of the trends you see developing in that marketplace?
TD: The Internet is still there, and companies are still quite interested in how to take advantage of it more effectively. We're just at the beginning of thinking about how we change our processes and our cultures and our governance structures to do anything differently with it. It takes a huge amount of time. We've had ERP for 20 years, and only a small fraction of companies have started to change the way they manage using the systems. I think that will be true of the Internet.
Right now, we're sort of in a period where there's no really big new ideas, and a lot of managers, employees, and organizations just want to take all the ideas that have come along for the past several years and put them together, integrate them, simplify them, and get some value out of them. They're all looking to extract some value from their existing infrastructures and, at this moment, cut costs from their existing infrastructures.
EL: What about online communities? It's almost as if an online community does three things: it gets attention, it sustains attention with user participation, and it encourages knowledge sharing of the kind where a novice can learn from an expert. Do you see companies embracing the concept of communities -- internally with their own employees, and externally, with customers, suppliers, and other partners?
TD: I think online communities are great and they have a number of positive attributes. But I think a lot of companies try to do them on the cheap, and they don't really take experts and put them in roles to facilitate communities. It's a huge amount of work to facilitate an online community. Ultimately, within companies, we'll see online communities as kind of another unit of organizational structure. You'll say, "Well, I'm in the accounting department, but here are the online communities that I'm really active in." And that will give you some sense of a person's view of the organizational structure.
--
Christian Sarkar is Editor-in-Chief of christiansarkar.com. You can see more of Christian's work at onewwworld.com.
The Importance of Justifying IT Projects in Financial Terms
After several years of fighting for every dollar while being challenged to do more with less, IT executives are seeing signs of a shift in expectations for IT spending. "CIOs are approaching the coming year with marching orders to do more, and to do it more quickly," observes Gary Beach, group publisher of CIO magazine.
Those in the trenches -- such as Kevin Johnson, founder and CTO of Seamless Technologies Inc., Morristown, N.J. -- find that the push for speed and results forces CIOs to raise the bar on virtually every IT initiative. Says Johnson: "Technology executives today know they must get to positive value in less than a year."
If you'd like to achieve that kind of result, you need only look to world-class companies for inspiration. Top performers consistently demonstrate that even during lean years, if you choose your IT initiatives wisely, you'll spend less than your competitors while still gaining share in your market.
According to new research from the Hackett Group, an Atlanta-based division of the consulting firm Answerthink Inc., total IT budgets tightened by nearly 11 percent between 2002 and 2004. Yet top-performing companies spent almost 18 percent less on per-user IT costs than did their mid-tier counterparts. They also employed 37 percent fewer IT staffers.
How did they do it? Beth Hayes, the Hackett Group's IT practice leader, cites several ways that world-class performers maintain their lead, including:
However, the biggest factor in achieving world-class status is a familiar one: The need to align IT with business. It's a matter of understanding both the business goals and the IT controls that must be in place to support them, and demonstrating how new IT initiatives contribute solid business value to day-to-day operations.
Though an October 2004 CIO poll of IT executives indicates optimism that spending will grow in the coming year, financial justification continues to be paramount in getting the go-ahead from investors. Financial executives still remain reluctant to green-light IT projects without solid evidence of real business benefits.
In other words, to get your IT project funded, you must "sell" your case to the people with the checkbooks. Doing so effectively requires making sure your metrics jibe with the way financial decision-makers like to see project costs justified. While you don't need an MBA or a Ph.D. in finance to calculate costs and benefits, it does help to understand what CFOs want. Of course, even some of the most worthy IT projects ultimately won't receive funding, but framing your business case the right way may well increase your chances for success.
A well-structured business case should open with a compelling executive summary that argues for funding by presenting relevant facts about anticipated business benefits. It should also explain why the project is being proposed now, what problems it will solve, its specific financial impact on the company, and the timeline for spending and return on investment.
The rest of the business case should provide detailed validation of your argument by describing the problem, solution, project goals, and metrics. Following are tips on addressing each of those issues.
PROBLEM DESCRIPTION. What are the issues (and, if applicable, the opportunities) that this initiative will address? Clarify the compelling need for change. Highlight other organizations' best practices for addressing similar situations. Then present the gap analysis between where your company is today and where it should be.
SOLUTION DESCRIPTION. How do you propose to address the problems identified? Provide a concise overview of the technologies and business process changes involved, as well as major issues affecting other departments. Describe the resources and costs required for implementing the solution. Cite any alternatives you've considered, explaining why they were rejected. Present a project timeline, including key milestones. Finally, lay out the financial risks and their potential impact on the business.
KEY GOALS AND METRICS. What exactly do you want the project to accomplish? How will you measure its success? Define the goals and the metrics that will be used to ensure alignment between the IT solution and the business issues it is intended to address.
A successful business case translates the proposed solution into the universal language of money. But make sure that your financial analysis matches the standards used by the financial executives who will sign off on your project.
Here are some of the ways in which you might paint the financial picture.
DISCOUNTED CASH FLOW ANALYSIS (DCF) evaluates the movement of cash in and out of your organization over time, taking into account the value of money over time. The two most widely used methods are net present value (NPV) and internal rate of return (IRR). NPV compares the value of money spent today against the value of benefits that will occur in the future, taking into account the firm's cost of capital (discount rate). The discount rate is calculated based on the firm's weighted average cost of capital, which varies by industry segment and financial strategies. IRR is the interest rate that equates the initial investment outlay with the present value of future cash inflows (cost savings) over a period of time, usually three to five years.
The core of a discounted cash flow-based financial decision model is the cash-flow table. A simple table that shows costs and benefits discounted to today's dollars allows financial decision makers to compare different proposed capital projects such as data center consolidation or an application upgrade.
RETURN ON INVESTMENT (ROI) is a ratio consisting of the NPV of benefits (cash inflows) minus the NPV of costs (cash outlays) over the NPV of costs (cash outlays).
TOTAL ECONOMIC IMPACT (TEI), as presented by Forrester Research Inc., of Cambridge, Mass., is a highly regarded methodology for calculating financial impact. It builds on the basics included in a discounted cash-flow analysis by including project costs and benefits. But it also factors in solution flexibility and project risk. Costs and benefits are discounted to today's dollar, the same as with ROI. Flexibility focuses on how the project will enable the deployment of future projects that will have a positive financial impact on the company. Risks require discounted costs and benefits to provide a range of less-than-optimal results. Risk-adjusted ROI adjusts all project costs higher and financial benefits lower to provide a more conservative view of the technology project's overall value.
To ensure that all your calculations lead to credible results, establish a standard process to collect data scattered across the enterprise. Identify people in each department or business unit who can ferret out the necessary information. Then arm them with a carefully constructed questionnaire designed to collect the critical metrics in a uniform way that guarantees the integrity of your business-case calculations.
Also, consider benchmarking the metrics from your business units against industry standards. For instance, a number of third-party research firms -- including Forrester, Gartner Inc., and the Help Desk Institute (HDI) -- conduct technology studies spanning a range of industry segments. You can compare your in-house information against the researchers' findings to help create your own unique baseline.
Recently a leisure/travel/entertainment conglomerate hoping to reduce its overall employee headcount began considering the possibility of consolidating its service desk. Framing the financial justification for that effort was quite straightforward: Implementing the consolidated service-desk platform and single-data model would pay off quickly by reducing the need for parallel support and development staff to service multiple platforms.
But the company went one step further by seeking additional potential sources of ROI, digging for specific metrics such as:
The company's business case, developed using Forrester's TEI model, also incorporated long-term cost-avoidance savings. Those benefits included:
While making a case for long-term ROI isn't overly difficult, it's worth noting that CIOs are under pressure to demonstrate greater returns in shorter time periods. As the entertainment conglomerate's experience indicates, today's most compelling business cases focus first on a proposed IT project's short-term returns, then with projected longer-term benefits.
The biggest challenge in building any business case is obtaining reliable and accurate baseline data. But applying a flexible financial model -- such as Forrester's TEI methodology -- can make that task easier.
In addition, using risk-adjusted ROI with both aggressive and conservative cost and benefit assumptions lets stakeholders see the range of hard-dollar costs and savings that might result from a proposed IT project's implementation.
The biggest obstacles between you and alignment -- and how to avoid them
The catalog of best practices grows daily as enterprises seek to align IT resources and processes to directly support critical business objectives. So, too, does the catalog of potential hurdles faced by those pursuing alignment.
Indeed, a recent survey of 200 IT executives by Deloitte Consulting and IDG Research Services found that 96 percent anticipated a positive bottom-line impact if they could improve alignment -- but only 10 percent could claim their alignment efforts were extremely successful.
Here, we've identified four major alignment traps and provided expert advice on how you can avoid or overcome them.
Analysts say that when many enterprises begin exploring business-IT alignment, they run into a chicken-and-egg problem: They need alignment largely because, metaphorically speaking, IT and business are working on opposite sides of a high wall, with both tossing needs, demands, and blame back and forth. While alignment is clearly necessary, the biggest obstacle may indeed be that seemingly insurmountable wall itself. So any serious initiative must start with tearing it down.
Tim Buckley, CIO at the Vanguard Group, an investment management business based in Valley Forge, Pennsylvania, has advice worth listening to -- the investment giant was well ahead of the curve, beginning its alignment initiative in 1992. "Even then, it was clear that IT would be a differentiator for us," Buckley says. "Now, 80 percent of our business comes through our Web site."
Vanguard's approach to breaking down the barriers to alignment was extremely innovative more than a decade ago, and is still rare today: The company reorganized its systems development around the departments and business units that ultimately used the technology while consolidating all infrastructure operations. That meant creating one development group for the company's institutional retirement business, one for retail, and so on. "There are huge advantages to this," Buckley says. For starters, such a system "ensures that IT people need to understand only a single client -- and since we insist that IT employees know their client's business inside and out, one client is plenty."
Moreover, Vanguard found that the increased autonomy allowed various business groups to react more quickly to unique market pressures. Over the past decade, IT has been advised to decentralize -- or recentralize -- so many times that CIOs can be forgiven if they have a case of whiplash. But the experiences of Vanguard and other leading enterprises make a powerful argument for IT organizations that revolve around individual lines of business.
Enterprises seeking to align business and IT often get deep into the process before realizing that they need to adjust their approach to metrics. They must, for example, expand their concept of traditional service-level agreements (SLAs), which focus primarily on technology, to include measuring service from an end-user perspective. According to Lee Adams, of the Hospital Corporation of America (HCA), a crucial challenge involves changing the IT mind-set from being focused on components to being focused on business services. Technologists are accustomed to tracking network outages, latency times, and server availability, but the idea of measuring the end-to-end quality of, say, a customer's online care-center query is new territory. HCA has addressed this by devising its own state-of-the-art metrics for measuring and understanding client experiences in real time.
Once an enterprise commits itself to alignment, IT must communicate to both senior executives and end users that the company has embarked on the journey, and that while impressive benefits will be seen quickly, everyone should take and communicate a long-term view across business and IT lines. This can be problematic in IT organizations that have historically not communicated well.
As a Forrester Research report puts it: "It is characteristic of IT shops that are considered not aligned to have a poor track record regarding communication of IT's successes and capabilities to the business." In contrast, researchers say that in aligned organizations, CIOs not only communicate in business terms -- a prerequisite in today's world -- but can "see things from the business perspective and recommend technology-based innovations that make a material difference to the bottom line."
When undertaking an effort as challenging and broad as alignment, IT groups don't stand a chance without the enthusiastic support of top management. Vanguard's Buckley says business managers' support was a key reason for the company's alignment success. "Starting with the CEO, all our business leaders get it," he says. "They've always been strong advocates of IT."
That buy-in is critical, but Vanguard's efforts are not limited to the boardroom. The company stresses two-way communication of business and technology issues at all levels. Indeed, Buckley is proud that during especially busy periods, IT employees routinely help staff the customer care center. "We spent thousands of hours doing that last year," he says. On the front lines, IT workers learn what it's like to use the applications they've created, and gain an appreciation of operations. "It's amazing the ideas that come out of that process," he adds.
Does a commitment to aligning business priorities and technology use bring fresh challenges to the IT organization and the enterprise as a whole? Sure. But as Vanguard's experience shows, companies are finding creative ways to meet those challenges.
An easy trap is to concentrate too much on either process or technology, rather than to develop them in tandem. Like a football team, you need to have a good defense and a good offense to win championships. A coach who concentrates too much on one at the expense of the other will win nothing. Purists would say that the process comes first, but what is the point of developing a process that creates more manual activities? Can you imagine the reaction of a business manager asked by IT to perform some manual activities as part of business alignment?
"Whether following ITIL [IT Information Library] principles or not, IT organizations must develop processes that are efficient, have minimum human intervention, and are cost-effective and reliable," says industry luminary and author Malcolm Fry. "This can only be achieved by focusing on process and technology at the same time. Remember that, to achieve business alignment, we have to align IT processes with the business processes, and often, technology is the only way to successfully integrate and align these processes."
Can dreamers and discipline coexist and create new business value? A lot of smart business leaders say yes
Chances are you've at least heard of Cingular's Rollover Minutes plan, which lets the North American wireless carrier's customers hang on to precious calling minutes from month to month. Since its inception, the program has been an overwhelming success. And why not? From a consumer's perspective, it seems like a fair deal -- and a simple one.
But it's hardly simple to Thaddeus Arroyo, CIO of Atlanta-based Cingular. "Rollover Minutes is a massive record-keeping project," he says. "We're tracking minutes across billing cycles, which gets complex. And we have to provide flexibility for customers to move between [various Rollover Minutes] plans and, of course, the transition from one plan to another."
Thus, what looks intuitive to consumers is actually a hugely successful but complex campaign jointly created by Cingular's marketing and IT groups in an effort to differentiate the company from its competitors. As for simplicity, well, as Thornton May, a futurist and the dean of the IT Leadership Academy in Jacksonville, Fla., puts it, "The great ideas are always the monstrously simple ones."
Don't look now, but innovation is making a comeback. For several years, the post-Internet bubble business climate focused -- with grim determination, some would say -- onoperational efficiency and cost-cutting. These are both worthy goals, to be sure, and were sorely needed after the Internet- and Y2K-driven flurry of IT spending that marked the 1990s.
Nevertheless, to business and IT leaders who enjoy nothing more than using technology to solve problems, all that efficiency tasted a bit like a side of spinach. "The trauma of it all," says May, "is that a whole generation of IT has grown up without innovation."
Now, with outlooks improving all over the world, new attention is being paid to creativity and innovation. "For a long time, the only question was, "Can you get this enterprise software deployed?" May says. "But the zeitgeist is changing. CEOs are now asking, "Can we change the game?"
This is not the "Cost is no object!" Toy Department IT mentality of the late 1990s, but rather a more disciplined effort to introduce bold ideas to the business -- if, and only if, they contribute to business goals. Can innovation and discipline coexist? A lot of smart people, and respected companies, think so.
TALKING POINTS
After years of IT focus on cost-reduction, innovation is back in global enterprises -- and technology is playing a leading role in creating new business value. This edition offers tips for fostering innovation with leading-edge technologies such as:
As in Cingular's case, much of that innovation is enabled by technology. Indeed, it's difficult to imagine a breakthrough business idea today that doesn't rely on IT. Supply chain innovation, lean manufacturing, deeper connections with customers, breakout products -- they all go hand in glove with technology.
Recent customer service changes at Cingular exemplify the shift from cost-cutting mode to innovation. "We've been doing a lot of thinking about customer self-service," Arroyo says. "Historically, enterprises thought about that strictly as a cost reduction. What we're doing, on the other hand, is examining the way our customers choose to interface with us. What are their preferences? How do they want to communicate?"
For example, the most common question among wireless customers is how many minutes they have left before they're hit with surcharges. "Folks want easy access to that information, and they usually don't want to talk to a customer-care rep to get it," Arroyo says. Cingular's response: a simple key combination that immediately provides customers with the status of their minutes.
If there's one key adjective to describe the new innovation in technology -- and, in particular, to distinguish it from earlier eras -- it's "discipline." The cost-consciousness of the past several years has created an atmosphere in which IT initiatives must be justified before they're green-lighted.
"Yes, IT is definitely getting more creative," says Gil Amelio, former CEO of both National Semiconductor and Apple Computer. Amelio -- who knows a thing or two about innovation -- is now a venture capitalist, chairman of the board at SiVault Systems (a hot company in the transaction-processing area) and a sought-after speaker. Until fairly recently, he says, a lack of standards made it difficult for technology spending to translate into productivity.
"In the 1990s, all the application software being written [by vendor companies] was essentially custom," Amelio says. "But because there were few standards, a lot of it was merely moving bits around so that applications could work together, without really increasing productivity."
Sometimes, choosing the right standard is in itself innovative. In 1998, the global relief organization UNICEF selected Internet Protocol as its only networking standard -- a nearly unprecedented move at the time. But a few years later, with IP far more mature, it would be the key technology when UNICEF created a satellite communications program, dubbed Fly-Away VSAT, that allows the organization to set up complete relief centers in areas ravaged by disaster, such as those hit by the devastating tsunami in December.
In 2000, when UNICEF asked providers about running IP traffic over a satellite network, people scoffed, according to CIO Andre Spatz. In 2004, the system was honored by Computerworld magazine as a "Best in Class" IT leader.
"The term "innovation" was thrown around a lot in the late 1990s," says Jack H. Cage, senior client partner, technology markets, at Korn/Ferry International. Cage is a veteran recruiter of senior technology executives and has seen the demands on those executives shift. "Today, when businesses talk about technology innovation, they use the term in a very focused way," he says. "They are seeking technology that helps the company meet its business goals."
That shift was long overdue, and has helped establish the CIO as a bona fide member of the strategic decision-making team. There's no reason to expect enterprises to go back to the practice of signing blank checks for technology projectsthey don't understand. Rather, experts believe the building wave of innovative technology projects will borrow elements from both eras of the recent past: the envelope-pushing technology of the 1990s coupled with the fiscal discipline and pragmatism of the early part of this century.
Intriguingly, research indicates that the enterprises implementing the most innovative technologies spend less on it than do their less advanced counterparts. The Hackett Group tracks IT spending at hundreds of large businesses and studies factors that separate leaders -- that is, enterprises whose IT expenditures can be proven to help meet business goals -- from the pack.
"The leading companies spend about 18 percent less on IT, and 28 percent less on infrastructure," says David Hebert, Hackett's IT practice leader. "And they have 36 percent fewer technology employees." That translates into efficiencies on commoditized IT services, and "frees up money to spend on R&D and value-add projects," he adds. Indeed, Hackett's research shows that the same innovation leaders that spend 28 percent less on infrastructure spend 25 percent more than their counterparts on planning and strategy. Moreover, they dedicate a whopping 40 percent more to application management than do median companies. "That's important because the application layer is the interface between IT and business," Hebert says.
Some experts believe that the keys to IT-driven innovation in the near future are refinements of existing technologies, such as service-oriented architectures, virtualization and collaboration tools. The intersection of these technologies will increase agility and tighten the feedback loop, predicts John Hagel III, an author and management consultant.
"The hardwired, inflexible platforms of the past limited companies to "big bang" innovation that took years, and to which they could only guess at business benefits," says Hagel, who, with John Seely Brown, the legendary former director of Xerox Corp.'s Palo Alto Research Center (PARC), has cowritten The Only Sustainable Edge, a new book about finding fresh ways to achieve competitive advantage in the global business environment. By contrast, Hagel adds, "these new technologies let you do rapid, incremental innovation quickly and get immediate feedback on the results."
The questions faced by many technology groups that have mastered the cost-cutting discipline are: How do you take that next step forward? And how do you return innovation to your IT philosophy without losing your focus on the business?
Hebert points out that you need to walk before you can run. "What we're seeing in leading companies is IT organizations that have proved their day-to-day competency," he says. "You need to be flawless in execution -- on time, on budget, efficient on the help desk and so on. If you don't master those basic skills, you cannot build a true partnership with the business." As an example, Hebert notes that world-class companies" IT groups deliver 30 percent more projects on time than do their lesser counterparts.
What's emerging in leading businesses is a two-tiered IT strategy. Think of the first tier as the operational, keep-the-lights-on level. Here, cost is king; such measures as outsourcing, utility computing and purchasing software as a service (the IT innovations of the past several years) are all ways to reduce dead-money infrastructure and commodity costs.
Now that so many enterprises have mastered tier one and grown remarkably efficient, tier two -- think of it as the innovation layer -- is gathering steam. Innovation is back infashion in products and services that are increasingly difficult to distinguish from IT.
The real beauty of this two-tiered system is that the impetus to cut costs at tier one never goes away. As Cingular's Arroyo puts it, "We're separating operations from new investment, and every dollar we save [at the tier one operational level] funds additional investment" at tier two.
Another major benefit is that after years in heads-down mode, enterprise IT organizations are finally kicking up their heels and offering staffers the chance to do some exciting work. To most programmers and developers, it feels like a long time since the glory days of the successful Y2K work and sky-high signing bonuses. The past several years have been marked by shrinking staffs, growing responsibilities and, most notably, a dearth of go-for-it technology projects.
Yet research consistently shows that these are the projects that motivate IT workers. The most brilliant programmers and analysts often prefer challenging projects over higher pay and other benefits.
All of which means, of course, that the return of innovation will be a shot in the arm for valuable employees. Indeed, it's a shot in the arm for the industry as a whole -- and the big winner is the forward-looking enterprise.
Tips for fostering creativity in your enterprise
Too many businesses mistakenly believe that innovation can only spring from some sort of alchemy over which they have no control. But enterprises can create an atmosphere that fosters innovation. Here are four ideas.
To learn more about the new wave of business innovation, please check out:
|
© Copyright 2005-2009 BMC Software, Inc. Use of this site signifies your acceptance of BMC's Terms of Use and Privacy Policy. Feedback |
|
