by Malcolm Fry

Over the last few years ITIL has become the flavour du jour in the US whereas in Europe it has been part of the main course for quite some time. As someone who spends his time split between Europe and the US I am intrigued by the difference between the two continents I regard to Service Management. Same ingredients but a different recipe. By the way I agree with you that I have now over-cooked the food metaphor.

I have often wondered whether the difference lies in the culture of the two continents or is it because ITIL was developed in the UK and has had longer to establish in Europe. Everybody knows that the US and European cultures are different and I am sure that we all have examples so I will let you supply your own example. However the main cultural difference that intrigues me is the attitude towards service.

In the US the eagerness to give and receive good service is ingrained in the way of life, although 'Have a nice day, sir' can sometimes grate on the nerves. In general Americans are more outgoing and speak their minds freely whereas Europeans are often more private and keep their opinions and thoughts closely guarded. So when it comes to IT Service it is not surprising the Europeans like etiquette and rules whereas Americans just want to get down to the basics as soon as possible.

Europe is also a continent of many cultures as anyone who has travelled around Europe can testify. Imagine a call to a Service Desk in the UK from a customer in Greece about a piece of software developed in Germany that is maintained in France. There are enough cultures here to start an epidemic. It is no surprise therefore to see why defining best practices, complete with a common vocabulary, is important in Europe.

Originally ITIL was developed in early 1980's to standardize the UK government data centres, as they were called then. At that time the various data centres in the government agencies had processes that were similar but not the same, for example they all had change control but different ways of managing change, they had a vocabulary with different words, and phrases, meaning the same thing. Ironically this also describes IT around the world.

Once the UK government had developed the ITIL best practices they quickly became popular because many of the cultural barriers were immediately removed and a common It language was desperately needed. Very soon Government agencies around Europe started to adopt ITIL and ask for ITIL compliance from suppliers, including IT Service Management software suppliers. Very quickly large software suppliers found themselves losing government contracts because they were not ITIL compliant.

This is a key turning point in the story of ITIL because very quickly the large software suppliers needed to get their software ITIL compliant because ITIL was beginning to spread outside of governments. As if not being able to win large government deals was not enough. So the software companies began to make their products ITIL compliant.

Meanwhile in the US a different phenomenon was occurring - certification. Not just academic qualifications but certifications from hardware and software vendors to show competency in managing and supporting their products. Suddenly if you weren't certified you were an outsider.

So now these two mighty tsunamis began to meet Europeans were being told by vendors that they needed certification and Americans told by the same vendors that they needed to adopt best practices. Common denominator? The vendors. As a result we have a Bridge beginning to appear across the cultural divide. The beauty of ITIL is that for the Europeans it is a best practice that has certification whereas for Americans it is certification that has a best practice.

For Europeans ITIL has grown organically and been adopted and pruned accordingly by most organizations. Whereas for Americans ITIL is an introduced species and like all introduced species has caused some problems with the existing IT ecosystem. This has been, to some degree, overcome by the latest refreshed versions of the ITIL books and the involvement of largest American vendors, such as Microsoft, getting involved in some of the newer publications.

When I first started visiting the US I was surprised by the number of focused conferences and organizations with numerous chapters, for example the Help Desk Institute has very focused conferences and about 50 chapters. In Europe there are much fewer conferences, possibly because Europeans on average have 4-6 weeks vacation per year, and Europeans do not like attending after work events. Here ITIL has an ace up it's sleeve because the ITSMF, which provides chapters and conferences, perfectly fits the American model so if ITSMF really gets going the we can expect to see ITIL grow very quickly.

My experience shows that ITIL fits both cultures perfectly and because it is the public domain is neither expensive or is it restrictive. As a last point be aware of restricted practices, these are developed and owned by a vendor, that are based around ITIL, some are excellent but be careful what you commit to because as I said one of the biggest strengths of ITIL is that it is the public domain.

So y'all should adopt ITIL old chap.

--

Malcom Fry, a recognized IT industry luminary with over 35 years experience in Information Technology, serves as an independent executive advisor to BMC Software, and Remedy, a BMC Software Company. Malcolm offers an unparalleled breadth of knowledge and experience in IT business and technical issues. Malcolm is the author of four bestselling books on IT service and support, and he has had many other articles and papers published. Technology journalists regularly use Malcolm as a valuable source of information, and he is also the solo performer in a highly successful, bestselling video series made for the Help Desk Institute. He has Masters-level ITIL certification.

by Jean-Pierre Garbani

How Businesses Use Technology: Pushing the Envelope

The IT infrastructure and the corresponding organizational structure exist solely, in any enterprise, for the purpose of supporting the business processes. Over the years, the advance in technology has allowed IT to "push the envelope" of how businesses use technology:

• The number of business processes that could benefit from IT, from the simple, objective of administrative support has grown to include to more subjective areas such as marketing and sales.
• The areas of a business process that could benefit from IT support have expanded beyond data processing to provide decision support information, e-business, and so on.

Studies have shown [Schneiderman 84, Thadhari 81, Guynes 88] that the key to productivity in interactive applications is a rapid response time. As long as the user and the system keep a compatible pace -- that is they don't have to wait on each other -- productivity increases, cost of work drops, and quality improves.

In this environment, the IT management role is to provide not only the functions required by businesses, but to provide them with a satisfactory level of performances. The cost of providing these functions and keeping the user satisfied has to be minimal, or at least competitive with outsourcing providers.

The problem of reaching these objectives has multiple aspects:

• The non-linear growth of user demand
  As long as user functions are confined within a limited number of processes, growth is a linear function with roots that are in the business growth and the corresponding increase in, for example, personnel. When the paradigm shifts from data to information, the growth becomes non-linear since it shifts from a process-based demand to an individual-based demand. The example of "Web Surfing" shows how unpredictable this could be.
• The lack of suitable management tools
  For a number of years, infrastructure management vendors have provided a number of tools to capture and report component behavior, on the basis that "healthy" components must produce good performances when grouped together. The problem has proved to be more complex, however, and requires a more sophisticated approach.

The simplest, most common form has been, in most IT organizations, the creation of a "Fire Brigade." In firefighing mode, through help desk, trouble tickets, and the like, the IT organization basically waits for the user to complain before identifying problems and correcting them. Network and system management tools provide real time information about infrastructure components to the control center function. This leads to several potential problems:

• Users are experiencing a roller coaster ride in terms of performances, the net result being a lack of confidence in the infrastructure and the IT organization.
• The costs of constantly "fixing" problems under time pressure is higher than  it should be in a planned mode.
• The IT management does not have any visibility of the long-term deficiencies of the installed infrastructure and lacks the basic information needed to plan for its evolution.

The correct way to go about all this is to bring the IT infrastructure into a really controlled and managed environment. To achieve this, the IT management will have to control two key elements:

• user expectations in terms of performance, and, of course, costs. This means that, instead of blaming each other for the current results, both parties (users and providers) agree on a certain level of performance and costs.
• performance of the IT infrastructure has to conform to the agreed upon level. This forces IT to be managed in a "predictive" rather than a "reactive" mode.

Improving Infrastructure Management: Shifting Gears

The first step in improving the situation will be to shift from an essentially subjective world to an objective one. By involving the user in the cost/performance trade offs necessary for a certain level of performance, the IT organization can bring user expectations to an objective and realistic level that is accepted by both sides.

The Service Level Agreement (SLA) is the instrument resulting from this negotiation. It provides a yardstick by which actual measures of performances can be judged, costs compared, and improvements negotiated.

The key to appropriate and sustained performances, and the basis of Service Level Management, clearly resides in IT management's ability to:

• create, by capturing key metrics, a performance scorecard at component level
• aggregate it into a user performance scorecard in line with the SLA
• manage the infrastructure capacity in such a way that the balance is  maintained between cost and performances

The success of this enterprise relies on two capabilities:

• The ability to create component models, which, from metrics captured at the IT infrastructure level yield an exact performance parameter such as service or response time.
• The ability to aggregate thousands of these parameters into user scorecards.

The following figure illustrates how service level management can be  implemented:

© Giga Information Group, Inc.

The first three layers of the model shown above are the data capture layers. All components of the infrastructure are represented, from hardware or service components such as server and network, to storage components (databases) applications. Different web services, which could be a platform for browser-based applications (a J2EE or .NET platform), or external services used in the performance of an application are also included in the data capture layers.

The second layer shows the parameters to be captured. Availability and performance, traffic and response times are pretty straightforward. Increasingly, parameters such as "application accuracy" and "security" become relevant. The content of a Web page, for example, becomes as important as the capacity to deliver it on time. Reacting to security breaches in an infrastructure that is open to the Internet is also a key point.

The data captured is reported in real-time in a Network Operation Center (NOC), where it is used in real-time to detect potential problems (alerts, alarms) and to identify their root cause to determine a real-time corrective action. Load balancing, alternative sites, and now utility computing are the types of corrective action available in modern computing infrastructures.

The Pivotal Layer

The pivotal layer in this infrastructure management model is the service level management layer. The data capture layers are traditionally component or device-oriented. Also, the functions provided are the traditional functions offered by the network and system management products, either through a framework, a suite of products, or a series of point solutions.

At the SLM level, however, the report on infrastructure performance becomes user-oriented instead of device oriented. This is where the different parameters collected are aggregated into end user "scorecards."

This demands an aggregation model. Since the link between the business process and the infrastructure is the application, reporting service levels as perceived by the end users requires that models of how the infrastructure supports the application be built, as illustrated in the following figure:

© Giga Information Group, Inc.

Most products available at this level propose a manual aggregation of the components. However, there are currently a number of companies working in infrastructure administration and configuration management that are on the verge of providing an automated way of "discovering" the components of an application and the dependencies between them. This will be a giant step forward in the implementation of SLM.

The upper layers of the infrastructure management "stack" are all capitalizing on the ability to build these models. Performance management is the capability to use the model to determine performance bottlenecks in real-time. Capacity planning is the ability to forecast the evolution of infrastructure usage or the impact of new applications and to adjust the infrastructure capacity accordingly.

Finally, the business process performance management is an aggregate of all data received from the application models in order to create a view of how IT is serving a business process in terms of efficiency, effectiveness, and costs.

Implementing service level management consists essentially in creating management processes within the IT organization that are capable of using the data provided by a number of tools and to convert that data into information. When an infrastructure has been instrumented in such a fashion that it can be controlled in real time from a NOC, a cross-divisional process has to be created within IT Operations to aggregate data in a way that is meaningful to the end user. Once this is done, the process can be capitalized upon to open the door to a complete control of IT performances and costs.

--

Jean-Pierre Garbani is a vice president of the Computing  Infrastructures and Security group, Forrester Research. His focus is on the  performance and capacity management of IT and Web infrastructure.

by Elizabeth M. Ferrarini

For 16 months before  his death, Elizabeth Haas Edersheim was given unprecedented access to Peter Drucker, widely regarded as the father of modern management. At Drucker's request, Edersheim, a former partner at McKinsey & Company, spoke with him about the development of modern business throughout his life, andI how it continues to grow and change at an ever-increasing rate. Edersheim's book, The Definite Drucker -- Challenges for Tomorrow's  Executives - Final Advice from the Father of Modern Management, captures his visionary management concepts, applies them to the key business risks and opportunities of the coming decades, and imparts his views on current business practices, economic changes, and trends.

Enterpriseleadership.org recently sat down with Edersheim to discuss how Peter Drucker might have responded to questions about technology, innovation, and C-level executives. She speaks from the point of view of having read and re-read Drucker's books and spending many hours interviewing him. She says, "He would often surprise everyone with his thinking."

EL: Peter Drucker believed that leaders must focus on people, especially what influence the CEO has on his/her people. Some great CEOs, such as Steve Jobs of Apple and Larry Ellison of Oracle, are known to be hard on their employees. What would do you think Peter Drucker would have said about tough CEOs?

EE: First of all, the CEO is an American invention modeled after the president of the U.S. There's no comparable thing elsewhere in the world, except the export of the American CEO. In Europe, several senior executives come together as a collaborative team. Each executive reports to a board.

The CEO's role is to provide strategic moral and human leadership with the right balance. In the US, you have this challenge to both lead and to create collaboration. Some people are more visionary, but don't create collaboration. Often times, their companies will fail when they leave because they haven't a team underneath them. Jack Welch was hard, but he absolutely had a bench. You need to be attracting the right talent for the team. In other words, are you building successors?

It's not bad to be tough on people, but you don't want to be abusive. Because you want to build their strengths and to make their weaknesses irrelevant, you don't want to undermine your confidence in them, and their ability to do what they do well.

EL: Peter Drucker was definitely an advocate of innovative technology. How do you think he would've viewed the role of chief information officer in a multi-national company? What advice might he have given to someone in this position?

EE: He didn't talk about the CIO. He did spend some time on the CFO. He said the CFO was the least knowledgeable person in the company because s/he always looks backwards. In some ways, the CIO has an opportunity to be the forward engine of an organization, but, on the other hand, the CIO can get caught up in chasing down problems too. The CIO has a huge opportunity for making an organization successful. I think Peter might say, "You need to be looking forward always, and executing against yesterday's requirements."

EL: How did Peter Drucker feel about formal best practices such as  Six Sigma or Lean?

EE: He often talked about what we can learn from others. As far as Lean and Six Sigma go, Peter worked with the two men who came up with the concepts of Lean and Six Sigma --  W. Edwards Deming and Joseph M. Juran. The Japanese loved all three men.

Peter felt that if you get too close inside, you only get cost. You really need to be looking outside and linking with customers. Again, you need this balance. Best practices can help you learn. Pushing things so they are better internally is good, but it's not sufficient. You can't loose sight of other critical areas, such are as your customers' needs. How are you providing them with value?

EL: Peter Drucker talked about giving employees some autonomy and allowing them to contribute by asking the question, "What can I contribute?" How do you provide information technology workers with autonomy when they work on very well-defined projects?

EE: If you step back for a second, the question is really, how can they find ways to contribute? For example, if the end product is very well defined, there has to be a feedback loop. Ideally, they are part of the definition of the end product. Given how much information is embedded in product, services, and what is done, the IT group might not be part of the definition of that requirement. That doesn't work today.

Toyota has its engineers find solutions to problems. In 2003, when Toyota was redesigning the Sienna, the engineers in North American drove across highways in the U.S., high crowns in Canada, and dirt roads in Mexico. Engineers observed there is greater distances between cities in the U.S. Americans need to be able to eat in the car, and load the van at Home Depot. Engineers took this information back and provided feedback about what the design needed to be. The Sienna became the number one minivan in 2004.

EL: In The Practice of Management, Peter Drucker talks about the importance of regular face-to-face meetings between managers and their employees. How did he view how technology has, in many cases, replaced face-to-face communication?

EE: He talked a lot about the impact of technology on face-to-face communications. He was all about community, but he never walked away from discontinuities and new realities. In one of our conversations, Peter remembered how the kids in the 50s, 60s, and 70s used to come out and play every evening. He said that today, if kids come out at all, they usually have their cellphones or Game Boys with them. They play with electronics, not with each other. He was concerned about their ability to have face time.

Email is an important change. It can be a great mechanism. If Steven Hawking was born 20 years earlier, he never could've communicated with us. The new communication mechanism lets one be more inclusive to more people in different kinds of ways. On the other hand, face to face is a human way of exhibiting to someone that they have value. It's a huge way of understanding at a different level. You don't want to abuse it. I have sat in plenty of two-hour meetings when nothing got done. Technology facilitates a different kind of connection, but it doesn't replace face to face.

EL: What would Peter Drucker have said about whether or not the U.S.  is falling short with its own global leadership?

EE: I asked him the same question. He would've said that we aren't the global leader anymore. We're one of many leaders. Our first challenge is to accept our new role. It creates a different kind of mindset. We need to be investing in the needs of tomorrow so we can create opportunities as a country. We need to be the place where entrepreneurs want to be, and where technology wants to come.

EL: What role does information technology play in helping a company  carry out its business strategy to stay competitive?

EE: Information isn't in the backroom of a company. It's an integral part of what a company is today: it's part of product, the service, and the way we put things together. It lets people and companies link. It's the connector. I can't imagine a strategy that doesn't embrace an information component. Information lets us do so much more.

EL: What are some of the ways an organization can promote  innovation?

EE: Innovation is a discipline about how we do everything. That needs to be a formal process. There needs to be a manner or mechanism for letting ideas happen, evaluating them, for picking where we are investing, and allocating resources, and not allocating resources to yesterday's problems all the time. It needs to be an exclusive part of what a company is doing.

Elizabeth M. Ferrarini is a writer from Boston,  Massachusetts. Reach her at elizabethferrarini@yahoo.com.

by Deb Radcliff

The job description of a hybrid Chief Security Officer (CSO) with responsibility for physical and IT security has been elusive ever since the American Society of Industrial Security formally began defining such a role in 1999 during its national conference in Washington, D.C. Even today, if you ask ten experts, you'll get as many different

opinions -- all of which still fall into one of the same two camps.

To the enterprise-centric, it means blended identity and access management systems, maybe even security systems (e.g., cameras, videos, door entry) running over an IP network. But CSOs who've been at this a while say it's much more the convergence of physical and technical security. As such, their hands are just as full, with executive protection, workplace violence, regulatory compliance, supply chain, conflict-of-interest, disaster operations and other risk areas competing for their attention.

"People have been talking about the concept of how security interrelates and comes together for some time," says Tim Williams, CSO of Nortel, with a 25-year background in corporate security compliance starting with Proctor Gamble in the 1970s. "What it really boils down to is layers of interdependencies between all our business operations prioritized by what we deem most critical to our operation, which is the intellectual property and capital that comes from our employees."

Figure 1. Earnings drivers. Nortel Networks Corporate Security analyzed corporate strategy, the processes, and assets that drive our success and the risks jeopardizing all. Every company will have its own set of earnings drivers and risks to consider when integrating security with enterprise strategy.

Where convergence occurs, then, is where interdependencies naturally  arise.

On an organizational level, for example, this would mean the guard needs to be trained in data center disaster recovery and understand that physical security in the data center is wound around audit trails, which only approved people have physical access to, says J.P. Callahan, operations security executive, customer data center security, Verizon Business. On a tactical level, convergence occurs when you replace a guard's station with a self-sign-in kiosk that can be watched remotely over the enterprise network.

Form Partnerships Now

Such technological convergence is already occurring. By 2007, the physical and IT security convergence market will command global revenues of over $6 billion, exceeding $22 billion by 2010, according to 4A International, a converged security analyst and consultancy firm based in Chicago.

"In five years, all of the systems that physical security relies on will be developed by IT companies," says Steve Hunt, President and founder of 4A. "That means that the IT professional, whether he likes it or not, becomes a major influencer in corporate physical security. My advice is not to let it go to your head. Form constructive relationships with your security staff today rather than wait for political battles tomorrow."

Such partnerships are critical, agrees Williams. Williams, with a staff of 18, reports to the VP of corporate compliance with what he calls a dotted line to the CIO.

"If we've had any level of success here at Nortel it's because of the CIO/CSO relationship and the drive of our CIO to make security part of our culture," Williams says. "I'm joined in my objectives with his objectives to provide a more secure network."

Tearing down silos is one of the biggest challenges facing the integrated CSO, says John Pontrelli, CSO of TriWest Healthcare Alliance, a medical services outsourcer for the U.S. government.

"My job is to take the hot seat for security, and that includes data on the enterprise network. When I explained that, our CIO was more than happy to defer that risk to me," says Pontrelli, who reports to the COO.

To do so means aligning with the CIO in a shared vision of protecting the network and the human capital that represents, he continues, adding, "We've got to have mutual respect, and the ability to work together quickly to support fast-moving business applications."

Pontrelli, like Williams, has a long history in converged security. In the mid-1990s, he set up the first combined physical/IT security group at Microsoft, then again at Gore Associates (the company behind Goretex and Teflon), before coming to TriWest in 2003 to do the same. Of his nine reports, four are directly responsible for network event monitoring and access security. And he co-located his physical and technical security staff to stimulate cross-training between the two groups.

Hunt praises TriWest as one of the truly converged organizations in a small portfolio of perhaps a dozen Fortune 500 organizations trying to manage the two disciplines under the single title of CSO.

At ten years old, TriWest has the advantage of being agile enough to grow up with a convergence mentality, says Pontrelli. Older companies are less nimble, particularly if there've been mergers and acquisitions, taking on average about five to six years to converge security across their organizations.

"There's a veritable dearth of awareness about what it's going to take to manage security that utilizes the best of physical and the best of IT security," adds Hunt. "From the IT side, there's little awareness of the politics of regulatory compliance, budgeting, and the business and architectural value of building streamlined systems and functionality."

Layers of Accountability

That's why Williams helped to develop the ASIS CSO  Guideline, published in 2004. In the report, Information Technology is identified as one of many risk areas under the responsibility of the CSO. Others, equally important, include human resources and intellectual assets, ethics and reputation, financial assets, IT systems, transportation, distribution and supply chain, legal, regulatory and general counsel, physical and premises, environmental, and health and safety.

Also in 2004, Williams developed a roadmap around Nortel's inter-dependencies where shared risk resides, the results of which were published in a Nortel white paper titled "Integrated Enterprise Security," released in 2004.

"In our plan, business continuity must have a cross-functional relationship with risk management, finance, and control areas where they move together across the organization," Williams says. "So we assess risk across the organization with an emphasis on business drivers: What are the risks to those drivers and what are the interdependent risks between functions and processes?"

Figure 2. For integrated security to be most effective, the enterprise will need to map security processes within each discipline and document where different groups have process ownership and cross-functional responsibility.

Once this mapping was completed, Nortel had identified who owned what security processes and the cross-functional team members working to support them. Interestingly, Information Security was owner of, or cross-functional partner in, all but three categories.

That's because much of corporate risk today is regulation-driven. And technology provides the best means of meeting new regulatory requirements.

"Right now, auditors have to go around and visit each business group and look for physical signatures on documents. Why not sign them electronically?" explains Callahan. "You can also answer other questions. Like who was physically in the room when something happened on the computer network?"

Logically, we do this very well, he continues. If there's a problem, firewall logs go off and correlate with access and security event management to tie everything together at a time and place. Just like our logical systems, he adds, we need a physical dashboard to manage events at the facilities level.

Pontrelli's already converged physical security information gathering into his 21-state enterprise network. Alarm monitoring, door activity, cameras, intrusion detection, and burglar systems for more than 150 sites ride over the corporate IP network.

"To me, it's all about data," Pontrelli says. "So if I'm not going to integrate my security systems with my data systems, then why bother?"

Falling Through the Cracks

Without integration, he adds, critical information can fall through the cracks and create new risk. As an example, Williams retells the story of how a Nortel client's corporate data center was shut down for hours because a contract security guard mishandled a prank bomb threat and evacuated the data center staff.

Another client, he says, kept getting its system hacked by authorized user passwords even after they were reset. Suspicious, corporate security finally observed the dumpster late at night after a janitor recalled "homeless" people near the bin after hours. Turns out the homeless were hackers that were "dumpster diving" for passwords on sticky notes, forms and other slips of paper the employees threw in their garbage cans.

Ultimately, that's where physical and IT security most come together: In educating employees, explains Callahan. The Nortel interdependency matrix supports this, with cross-over functionality listed for all risk factors in the category of employee education.

So, to prevent the tossing of passwords into the garbage, password protection and shredding policies should be taught together. And if you're teaching them about a new physical/logical security access card, remind them that bad guys can circumvent this security when they "tailgate" close behind an authorized employee into the building, just as easily as they can "shoulder surf" information off their open computer screens by reading over their shoulders.

"To ASIS, their vision of the CSO is the single stop for four different risk management disciplines," Pontrelli explains. "Information security, physical security, risk assessment, and business continuity. These are all wrapped into what we call the 21st-Century CSO."

It doesn't matter how you get to the job of CSO, continues Pontrelli. It could be the path he and Williams took, as both have military security backgrounds and went corporate with business management degrees and CISSPs. Or it could be CISOs who've trained with ASIS and other security training and membership organizations.

That's because the role is not so much about facilities and technology as it is about identifying and managing risk across the organization.

"Who's better equipped to handle this, the CISO or the CSO?" asks Williams. "That would depend on the person's business acumen, leadership characteristics and political skills needed to drive the function."

Of Note

In February, the Alliance for Enterprise Security Risk Management (AESRM) www.aesrm.org, announced a series of studies it  will release on the matter of convergence at security conferences starting in  June.

These conferences will be hosted by the three organizations responsible for the 2005 formation of AESRM to provide guidance on matters of convergence, including integration of technologies, value proposition, international security, and the formation of risk councils. The groups behind AESRM include American Society for Industrial Security or ASIS www.asisonline.org, Information System Audit and Control Association (ISACA) www.isaca.org the Information System Security Association (ISSA) www.issa.org.

--

Deb Radcliff is an award-winning freelance writer, educator and speaker based in Northern California. She's been covering online crime and security ever since working as researcher on a book about infamous hacker, Kevin Mitnick back in 1995.

by Elizabeth M. Ferrarini

Xerox's 50-year history has run the gamut from a that of a leader in disruptive technology, to bad product mixes; from financial turmoil, to financial and market share recovery. In 1959, the company rolled out the first plain paper copier, the 915, and also trademarked the duplicating process as "Xerography." The company's name was changed to Xerox. Other innovations have included the invention of Ethernet, the first laser printer, and the first plain paper FAX machine. During the 1980s, Xerox dabbled in everything from typewriters to personal computers.

At the start of the new millennium, however, Xerox found itself in enormous debt and near bankruptcy. It was by carrying out massive "rightsizing" programs such as Lean Six Sigma that this legacy disruptive technologist has reduced its debt from $17 billion to $7.3 billion, and has cut the workforce from 110,000 employees to 55,000 employees. Today the company owes its $15.7 billion annual revenues to a leadership role in digital printing.

Since 2002, $600 million of the $1.8 billion reduction in operating costs has come from IT. And in what may be supreme understatement, Patricia Cusick, Xerox's CIO for the past seven years, says of her first two years in the role that it was "an intense period." Enterpriseleadership.org recently sat down with Cusick to talk about the cost cuts, the role of Lean Six Sigma in IT, and the way IT works with the business units.

EL: Can you provide an overview of your IT organization?

PC: The IT worldwide organization has about 3,500 people -- 1,000 are Xerox employees and the rest, either from EDS, our primary IT supplier, or other contract sources.

Xerox IT employees handle strategic planning for IT and the linkages with the business partners. For example, relationship managers support specific territories within business units, such as sales, or manufacturing. These managers understand the business and the systems requirements, and can provide the appropriate delivery service, whether it's internal or through an outsourcer.

At the next level of IT, we have integration folks who work on how applications come together. Our project teams in this area work within different organizational models. Xerox personnel tend to work on proprietary solutions. Project management teams use people with similar skills. Project creation-to-delivery teams comprise people with a range of skills who are drawn from inside the organization and from our outsourcers.

EL: Can you talk about how you accomplished the cost cuts in IT?

PC: Because the company was near bankruptcy, we were under pressure to cure the company's financial health. Improvements in productivity, starting with the CEO on down, have became a key driver of returning Xerox to profitability. IT played both the role of participant and enabler, finding places to reduce costs through automation. We were successful at making the company lean and more efficient.

Cuts in the number of employees and the outsourcing of key functions such as manufacturing reduced the size of the operation IT had to support. Meanwhile, we started to consolidate a whole series of decentralized IT operations across the company. This consolidation and standardization across operations, and improvements in productivity enabled us to drive $600 million of cost out of IT.

EL: How does Lean Six Sigma factor into productivity improvements in  IT?

PC: Since 2003, we've been developing our Black Belts and training in Lean Six Sigma, and we've been using the Lean Six Sigma tools and the methodology to standardize IT processes. This causes us to focus on how we can reduce costs and meet our productivity goals. For example, the IT people on the business teams focus on how to simplify their processes by getting rid of waste, and automating any manual tasks.

Lean Six Sigma has helped us to put better processes around the entire application development flow -- from project requirements to final production. In fact, the applications development process flow is very similar to that of product manufacturing, where Lean Six Sigma has its roots. For example, we have an initiative going on now called "patch progression." When we get a fix from a major supplier, such as Oracle, we identify the environment, make sure it's compatible and tested for integration, and then we promote it to production. Using Lean Six Sigma, we've laid out the individual steps in this process, looking at where there was time lost and how we could simplify that process.

EL: What does your governance model for IT include?

PC: Our information management board, which I head, meets annually with the executive committee to go over upcoming projects and their budgets. Each quarter, we meet to review project status, budgets, and project deliverables. This process repeats itself down through the various working levels of the organization.

EL: How do you ensure that IT delivers on what is promised to the business  units?

PC: Our overall lifecycle management process, which we call "time to market," is key to IT's delivery of services. It uses the same type of process we have for our product delivery. The process has all of the same disciplined phases, starting with the business engagement and examining all of the requirements. Each project has a decision team -- a partner from IT and a business owner -- which report to a governance board. For example, the decision team goes through phased exits at each point in the lifecycle. At each point, the team must account for the business case to the board. These steps exist to ensure that we've met our objectives. The entire lifecycle process helps us to keep the alignment with the business units, as well as with the IT project teams.

EL: What kinds of training programs do you have to keep IT people on the  ball?

PC: We have development efforts across all levels of the organization. We set a specific number of hours each year for each IT employee. We also do extensive e-learning, both within the company and externally. And we do a lot of creative things such as the Lunch and Learn program. Each week, we'll have a program for IT people, such as an overview of Microsoft security updates.

EL: What initiatives have IT undertaken to drive product  innovation?

PC: We created a remote capability that enables customers' machines to link to us for things such as ordering supplies, doing meter readings, and alerting technical support to a problem. This communication is accomplished entirely over the network; interactive communication with our products has helped to strengthen Xerox's competitive advantage.

EL: How do you promote technology careers outside of the company?

PC: I'm a member of the Rochester CIO Roundtable, which works with local colleges to promote IT careers. We'll take a few days and go around and talk to students about our roles in IT and the kinds of people we're looking for.

EL: What were some of the most challenging assignments you've had as a  CIO?

PC: Supporting the CEO, Ann Mulcahey, in her efforts to turn Xerox around and return it to greatness has been both the most challenging task, and most rewarding, of my career. We had to have absolute focus on managing our expense base, changing the profile of the campus, and concentrating on our customers and technology. As for IT, my challenge was to make IT a shared service, while driving cost reduction and being sensitive to the minds and hearts of the people.

Another challenge has been to build the credibility of IT people among business partners inside the company. I feel passionate about getting IT people to be involved in how every aspect of the company works together.

--

Elizabeth M.  Ferrarini is a free-lance technology writer from Boston, Massachusetts.

by Elizabeth M. Ferrarini

When a major corporation files for bankruptcy, senior executives can take one of two paths: stay and help build the company to be better than ever, or bail out in search of greener pastures. Dan Wagner, the CIO of Global Crossing, the fourth top U.S. telecom company, as ranked by InformationWeek, is a  builder, a survivor, and a you-can-achieve-anything optimist.

Two months before Wagner was appointed to the CIO role at Global Crossing in 2002 , the company filed for bankruptcy. John Legere, Global Crossing's CEO, immediately enlisted Wagner, who had been running the company's European operation, to be part of the turnaround team. Global Crossing, a darling of the dot.com days, had racked up $12.4 billion in debt as a result of building a 100,000-mile fiber optic network.

Today, Global Crossing, which sells telecommunications products and services to organizations in 50 countries, is a leaner, more efficient and customer-oriented machine with improved IT business processes. In fact, the company's headcount has gone from 16,000 employees to 3,400 employees.

During the past four years, Wagner has diligently rebuilt IT, reducing spending from $300 million a year to $60 million a year, and cutting the IT workforce from 1,600 to 350 employees. He is involved in integrating the company's recent acquisition of Impsat, a Latin American-based telecom company, which will give Global Crossing, 1,200 new employees and 4,500 new customers.

Enterpriseleadership.org recently spoke with Wagner about some of the things he did to help turn the company around, especially in IT operations.

EL: Can you sum up some of the initial things you had to do as part  of your turnaround work?

DW: It has taken a massive, five-year effort to get to where we are today. We had no choice but to change and improve operations. Initially, we focused on reducing costs. For example, we reduced our IT cost by 80 percent from what it was in 2001. We also realized we had to increase our IT capabilities to the business.

We reduced our IT spending from $300 million to $60 million. Our operational expenditures were reduced by 50 percent or more. Our cash burden in 2001 was $400 million a month, and we are now cash-flow positive. This is a better place to be than the place we were in before.

EL: Can you talk about some of the key restructuring actions you  took?

DW: Before the restructuring, we had dozens of competing projects and lots of capital going out of the door. The first phase of restructuring included consolidating applications, servers, data centers and infrastructure, as well as closing down millions of square feet of real estate. We focused on the key applications that were good for our customers, good for our products, and good for revenue growth. For example, we reduced 17 billing systems to two, and took provisioning and order management systems from 25 to seven.

The next phase consisted of building an intelligent front office to make all of our employees more productive. Built on the Microsoft.net platform, the intelligent front office, for example, enables our sales force and our customers to see, and to manage, their services directly. This platform powers our external portals, enabling us to focus today on what's important to Global Crossing -- customers!

EL: Can you go into more detail about how the intelligent front  office works?

DW: We incorporated many things into our intelligent front office to improve the way our employees collaborate with each other as they do their work. We deployed a pretty extensive next-generation platform based on Microsoft Communicator. In fact, we built some of these capabilities into many of our applications, as well.

Take the org chart: you can look at it and see whether people are online or not. You can immediately click and talk to them, click and send them email, or chat with them. This presence-enabled infrastructure and functionality carries over to most of our applications. You can click and communicate in real time, while you're in a corporate application, such as order entry.

More than 90 percent of our employees use IP telephony, which is part of this integrated intelligent front office. Wherever I am in the world, I can pop on calls that have been flowed into my laptop and can communicate with anyone on our network or outside of our network.

EL: What have you learned from the traumatic experience of Global  Crossing's bankruptcy?

DW: I've learned that you can do anything you want if you set your mind to it. Of course, you need to have the right people with the right attitude. I have an irritating go, go, go model. However, it exemplifies what Global Crossing is about. Because of what we've gone through, we've created a culture of people hungry to serve customers passionately.

EL: What does your IT governance model look like?

DW: Reporting to the president, we have an executive team  that sets strategies and priorities. I'm part of this team.

Below that, we have a portfolio action committee consisting of the IT executives in the company, along with members of product marketing and finance. This committee manages all of the major projects and capital expenditures. Every two weeks, we look at the status of the priorities for product development, for operational efficiencies, and for IT spending.

We also have a steering committee made up of people who represent different functions in the company. They meet weekly to look at the progress being made in about 55 active projects. The goal here is to make sure everything is on track. If there is an issue, they come back to our action committee for resolution.

The good news is that there are no disconnects between these groups.

EL: You have 350 IT people reporting to you today. How have you  allocated these resources?

DW: About half of them include operations people who man the data center or the help desk. The other half of the workforce resides in strategic product development. We've decided to increase the number of people doing this software development. Our IP products, along with the intelligent front office, require a lot of software development. On occasion, we'll hire a team of developers -- perhaps a dozen -- to work on specific projects.

EL: What are you doing to keep customers excited about Global  Crossing's future?

DW: We're a huge carrier of VoIP, providing more than 5 billion minutes of it each month to about 600 carriers. We're also a big consumer of VoIP services internally, It's important for an IT shop to sell what it consumes, especially since it has saved us huge amounts of money. I spend about 50 percent of my time selling to customers.

In 2006, I went on 100 sales calls. Members on my IT team made 500 sales calls in 2006. Making sales close differentiates us from our competitors. Customers like that we pay attention to them and provide the products and services they're looking for.

The IT team has a lot of credibility because we can talk about our experience using our products. I go out as a testimonial to our product capabilities and technology know how. When I talk to a customer's CIO, I know there is an innate trust between us. We've become our own success story about why customers should do business with us.

At the start of 2006, I said, let's go from restructuring to revenue growth by helping the sales force as much as we can. IT people know more about the business than anyone else, especially how everything works across functional areas.

We've put IT at the center of our company's strategy, and it's been working for us. Perhaps the passion in our IT team's voice while talking to customers helped to drive revenue growth by 17 percent in 2005.

--

Elizabeth M. Ferrarini is a freelance technology writer  based outside of Boston, Massachusetts. Reach her at elizabethferrarini@yahoo.com.

by Mary Nugent

Internal IT organizations are frequently viewed as cost centers. While most business units assume that the cost of IT is too high, and that they can get better value by outsourcing, they should consider the undocumented services performed by IT. At the same time, IT must prove its business value by demonstrating its understanding of customer needs.

As the Internet enables enterprises to become "virtual," organizations must be able to share business systems with partners and customers. This trend is putting more pressure on IT departments. In fact, IT is no longer just focused on LAN or WAN; now it must deal with remotely dispersed servers, disconnected clients and public Internet connections. IT assets must be managed with guaranteed and reliable service levels. To cope with the new demands of service level management, many enterprises will look at outsourcing.

Is outsourcing less expensive than internal IT?

While many enterprises believe that using external service providers will automatically lower costs, analysts caution them to look closely at the breakdown of services offered by providers. According to M. Nicolett of Gartner, "Good business decisions can only be made with a clear understanding of current services and costs, the impact of change and the risk associated with IT services that do not meet business requirements."

Internal IT organizations must provide their business units with a complete list of services they offer. If this documentation is not provided, enterprises may pay more for outsourcing in the long run as they request services that were once standard with IT but were missing from the external service provider's initial quote.

What if outsourcing is not an option?

For some enterprises, outsourcing IT resources is not a viable option. For example, while security is a paramount concern, outsourcing IT may create rigid security precautions that do not allow for the same level of productivity. Also, some organizations may choose not to outsource because they do not want to give up control of their technology infrastructure, their applications or their information. If any of these concerns are present, the internal IT organization must adopt the practices of outsourcers to become a service provider to its own enterprise.

How is IT affected?

As a result of this new enterprise-internal service provider relationship, IT departments will be held responsible for providing business services in addition to IT services. For example, rather than monitoring just the performance and availability of each component (server, database, etc.), IT will need to ensure that the service levels meet the strategic goals and needs of individual business units and departments.

How does IT become a service provider?

Think like an external service provider

For starters, IT organizations must replace the term "end user" with "client." Referring to individuals as "users" is a thing of the past -- now everyone is a "client" or "customer." This change in thinking leads to the biggest hurdle the IT organization faces -- becoming an effective communicator. The entire IT staff must improve its communication skills and business acumen. Becoming a good communicator means learning how to sell the IT value proposition. "Selling" does not come naturally to a technical person so IT staff must be trained to understand their customers' businesses and to effectively communicate with the business units.

Define good service levels

The basics of "who, what, when and where" apply to any service levels that are agreed upon with the customer. Who is responsible for what, how often it will be reviewed (when) and where the review process will occur.

Also, IT must define services within the context of business strategy and customer needs. According to Kris Brittain and Richard Matlus of Gartner, "…defined services are an amalgamation of the internal and external elements from a business and IT perspective."

Clearly communicate the value proposition of IT services

IT organizations are used to focusing inward on technology. Now they need to focus outward on communications with the business units. According to D. Curtis of Garter, "To optimize its contribution to corporate profitability, [IT] must also focus outwardly on regularly communicating with business stakeholders."

IT must proactively demonstrate that it understands its customers' needs. If not, the business units may turn to outsourcers because they think external service providers -- who use the same business terms as business units -- are more familiar with business needs and have better processes than internal IT. However, Nicolett points out: "The internal IT operations group can solidify its position as the preferred service provider by defining current services, developing granular cost information and leveraging its potential for customer intimacy."

Also, according to Martin Rosenberg of META Group, "… IT executives and [business unit] managers should jointly assess IT investments by regularly running tactical and strategic services planning meetings." IT can achieve this by identifying business "gurus" who will agree to act as the IT organization liaison to the business group. Getting these experts to feel as if they are a part of the "team" is important. IT should work at this relationship through frequent, personal contact, such as lunch dates. Otherwise, as B. Gomolski and J. Grigg, of Gartner, write: "If personal contact is limited to the office, it will be difficult -- if not impossible -- for the [IT] outsider to become a management insider."

At the same time, Curtis says, "This communications path must be a two-way street, meaning that the [IT] organization is not the only stakeholder. The business units must also identify the parties responsible for their end of the negotiations."

Curtis goes on to say that communicating with business units about service levels on a continuous basis will help IT to better meet service levels. "A defined process to renegotiate SLAs because of changes in the business environment will ensure that the IT infrastructure continues to perform as needed by the business units."

Assigning a value to and charging for services

Rosenberg says that IT organizations should offer variable pricing linked to availability options, similar to those of external service providers. Different levels of services should be offered at different costs so the amounts charged back to business units are based on specific requirements. This "…enhances the enterprise's ability to better compare "apples to apples" in services that are internally sourced to those offered by external service providers," say Matlus and Brittain.

Defining SLAs that govern services

Often when business units ask for SLAs, they receive raw data, which is not relevant to what they want to know. Business units require business-focused metrics. These metrics must be clearly defined and understood before SLAs can proceed. IT and business units must agree on key performance indicators, such as what is being measured, what form it will be in and the types of reports that will be provided.

According to Brittain and Matlus, the IT organization determines the terms and metrics of these SLAs, which are documented as service commitments and communicated to the business units. They go on to say that often times SLAs are not met because lack of communication and failure to set expectations. They suggest that IT and business units need to agree on service levels to be measured and on each other's roles. Internal IT must be willing to accept SLAs as performance to work against and define penalties for when SLAs are not met need to be defined. Also, IT should evaluate current service levels so that it is aware of what is realistic before guaranteeing SLAs to business units.

In addition, a well-defined SLA has a language common to both IT and business units, which reduces the cost of having to explain reports, according to B. Gassman of Gartner. Accuracy of metrics is important to their value, and the value should be determined by what the customer requires so that only relevant metrics are published.

Adopt new tools to address the unique requirements of a one-to-many  model

IT needs a solution with a multi-tenancy architecture that enables it to deliver a highly scalable and reliable application with low administrative costs. Then IT can easily, reliably and seamlessly support large numbers of customers (business units).

Continually review practices and look for industry-adopted templates for IT  service

IT should examine current operations to identify ways of improvement. Nicolett suggests that to be proactive in its marketing to business units, "the IT operations group should implement best practices independent of any outsourcing evaluation."

To better position themselves against external service providers, internal IT organizations should have both a detailed service description and well-defined process. A formalized approach to supporting business initiatives is best. To do this, IT needs to get formal acknowledgement from business units that certain levels of service are necessary.

Summary

IT organizations must continually communicate with their business unit customers to ensure a good working relationship and long-term success. Changing the language used and focusing on how service levels relate to business needs will help demonstrate IT's value to the business units.

--

Mary Nugent is an accomplished software technology executive with expertise and in-depth knowledge of information technology. She is responsible for the development of projects around Business Service Management (BSM) for BMC Software.

by Dana Farver

The Internet has come of age, and organizations continue to find ways to leverage the power of the Web to build, and improve, relationships with customers, vendors, partners, and employees. Even that bastion of tradition and stability, the banking industry, has come to appreciate Internet resources that far-thinking IT groups are utilizing to become more customer-centric than ever. Witness Wells Fargo, whose executive vice president for wholesale Internet solutions, Danny Peltz, was chosen as a Bold 100 Winner for Commercial Electronic Office by CIO magazine. Enterpriseleadership.org caught up with this banking exec recently to talk about how his group adds value to his business, keeping morale and productivity high (free food is part of the answer!), and the greatest risk he's taken so far in his career. Here's what he said:

EL: Can you tell us a bit about yourself, about the Wholesale Internet and Treasury Solutions Group at Wells Fargo, and how you came to head up this group?

DP: I've been with the bank for about 16 years and have worked in a variety of different capacities, including finance, project management, marketing, and incentive compensation project management. In 1999, Wells Fargo decided to make a big investment in the Internet. You've got to remember that at that time, the thought was that all banks were going to "become dinosaurs," and we were going to be "dot.com'ed" to death! Each and every line of business was leveraging, or hoping to leverage, the Internet as an avenue for growth at the bank. And if you know anything about Wells Fargo, you know that our focus is on topline revenue growth. So utilizing the Internet was a pretty key issue, going all the way up to the CEO of our company, Mr. Dick Kovosovich. He decided to form a centralized group that focused exclusively on the Internet, and it was at that time that the Wholesale Internet and Solutions team was born. I would've been Employee #2 in that group, along with a gentleman named Steve Ellis. The two of us built out a variety of different services focused on our customers, of which the flagship product was the Commercial Electronic Office (CEO), and that just grew like wildfire at the company. As it grew, its importance to our customers and to our relationship managers within our company also grew, and our responsibilities increased. Eventually, Steve got promoted and I got promoted, and that's how I wound up heading the Wholesale Internet and Treasury Solutions Group.

EL: What is "CEO"?

DP: CEO is our Commercial Electronic Office. It is a single-sign-on, financial-services portal that enables our larger, business customers, through a single interface, to access all the products and services that we offer them. And I define "larger business customers" as customers with essentially $10 million in annual sales, all the way up to the largest companies on the planet. The CEO has had spectacular growth. Since 2000, we have gotten about 70 percent of our commercial customers to actively use the CEO on a daily basis. And we process trillions of dollars worth of payments on an annual basis through that platform. It enables us to access products and services such as treasury management, brokerage services, credit services, trust services, foreign exchange services, letters of credit, 401k services, etc., all through a single interface.

EL: That probably reduces a tremendous amount of confusion and  duplication of effort.

DP: It made it much simpler. Most other banks at the time really delivered Internet functionality through each one of those lines of business, and we decided to take a holistic approach to our customers. Our business model stood true over time, and most of the other companies are now continuing to play catch-up with us.

EL: That was probably quite a challenge for the IT  group.

DP: I don't know if it was as much of a challenge to the IT group as it is the convergence of business and IT. It changed the way that we approached business. My philosophy about IT is that when my business people are confused for my IT people, and my IT people are confused for my business people, I know that I'm successful. And all of them need to be incessantly focused on what the customer wants and needs as opposed to what the bank needs, and that makes us super successful.

EL: We are curious about the demographics or trends for Wells Fargo's online commercial business these days. Has it become dominated by a small number of major players, or is there still a lot going on with small businesses online?

DP: Well, obviously the bank has had successful penetration rates for the small business line; in fact I think 53 percent of our small businesses actively bank with us online, but not on the Commercial Electronic Office platform. The CEO has 70 percent of our commercial customers, so it's not small businesses, its all businesses. And what we found is that the more control and products and services that you can give to a customer, the happier they are, because they're able to manage their own finances as opposed to waiting for the bank to support their needs.

EL: We've interviewed a number of CIOs since we launched a year ago, in many different industries -- hospitals, government, academia, as well as the retail sector -- You're the head of a group that provides products and services for the 5^th largest bank in the U.S. What is it you need to do to add  value, to keep your business competitive, in your particular  area?

DP: Probably the most important thing is to focus on is the end user, the customer, and to keep things as simple as possible. And then, to provide them with the right workflow tool, so they can accomplish what they need to. The interesting thing for me in terms of how the industry has evolved is as clear as the difference between a client-server application and a Web-based application. In the old days, there was an extreme divide between where the bank ended and the customer began. The workflows that happened in the customer's office were distinct from the workflows that happened in the bank. But the Web has allowed us to create a greater interconnection, and those boundaries no longer exist. So, we're now an extension of our customers' workflow, as opposed to an extra step, and by focusing on what our customers need and the ease of use of our products, this has enabled us to be successful. I usually frame things in three different ways when building out new functionality: 1) How is what I'm building going to make it easier for my customers to do business with their customers, partners, vendors, employees; 2) How is what I'm building going to make it easier for our customers to do business with us; and 3) How is what I'm building going to make it easier for my relationship managers, sales force, and staff to do business with my customers. If you can frame everything you do within those three questions, you're probably on the right track.

EL: What quality initiatives do you find most effective for your  organization?

DP: I'm a big believer in organic growth and organic ideas and innovative thinking, and we don't use an "off the shelf" industry standard quality initiative like ITIL or Six Sigma. We basically create Pillars of Truth, and we try to focus all of our development and efforts around them. Those are: We want to be 99.9 percent available for our customers, we want customers to be one click away from where they want to get to, we want to make sure that everything we do is centered around the customer, and focused on what they want to do, and we test out our ideas with our customers first, and we never do anything like a "Big Bang" type of migration; we're always doing progressive rollouts and migrations. It's a slightly more costly way to do business, but it's a better way to do business because you have a better service delivery model.

EL: We've read that you and your group are constantly upgrading your commercial Web portal to be more customer-friendly, and thus encourage more revenue per customer. Can you talk about some of the ways you've done this, and your philosophy in general about customer service in an age of depersonalizing customer contact?

DP: That is an excellent question, because our business is all built on relationships. And so, I am in the business of creating more contact because it allows us to strengthen our relationship with that customer. So, when we went out on the Internet, it became quite clear to us that this was a channel, and not the channel, and that it was not a cost-cutting play, but a revenue growth and customer experience play. And by focusing on it that way, we enabled those existing customer service people who were already servicing those customers to have access to more tools, to be able to service them online. And so, if our customers always called Judy down in the call center, we wanted them to continue to do that, but to also enable the access to the tools to support the channel within that call center. And that's been extremely important because -- and this is what's interesting to us -- the more a customer calls us, the more satisfied they typically are.

EL: We understand that your group has also made strides in cleaning up your internal systems architecture. Based on what you've learned and implemented for your external customers, can you talk more about that?

DP: What we learned pretty easily was that people like single sign-on. They don't like to remember all these passwords and usernames. So, it was obvious that, once we understood the technology, by creating a single sign-on portal for our employees to be able to access their tools was a pretty important initiative. And so we built out what we call the ICEO, or Internal Commercial Electronic Office, which allows our employees, through the single sign-on interface, to access the tools that they need to support our customers. And really, this was an effort to simplify their day-to-day business line so they could spend more time on the street and less time focusing on how to manage the bank.

EL: So Danny, what do you think has been the greatest risk you've  taken so far at Wells Fargo?

DP: I think the greatest risk is the incessant focus on doing things as simply as possible for the customers, because this sometimes means taking technology risks. I'll give you an example: We offer our commercial customers a desktop deposit solution that is an Internet-based, remote deposit capture solution that enables them to take their checks, run them through a scanner, and deposit those items online When we went about building that out, we took a different tack than the rest of the industry. The rest of the industry decided that they could not do this without having software loaded on the customer's location. And for us at the bank, that required software maintenance, software distribution, interfacing with the customer's IT organization, and not a lot of flexibility in terms of changes over a long period of time. And I basically put my foot down and said no, we're going to figure out how to do this on the Internet; I don't care how complicated we think it is, that's the easiest way for our customers to be able to do business with us. While the rest of the industry was going one way, we went another, so we were the first bank, or vendor for that matter, to roll out an Internet-based tool. It has shown that we were right going in this direction -- while it was a risk that we may have some execution problems, if you put huge challenges in front of people, they'll step up, provided they're smart and have the right resources. And in a little over a year since our launch, we have over 10 percent of our commercial customers depositing electronically with us, and all told, I think we have somewhere close to about $71 billion in deposits going through our Check 21 service.

EL: How do you maximize productivity within the group while keeping  up morale?

DP: I buy them food! No, I think that's the great question: How do you keep a "crusade mentality" as you grow and mature within a large organization? The good news is that success begets success, so as we've been successful, we've been asked to do more things, and so we've gotten more people involved. And those who started out originally with us have gotten more responsibility and have grown within the organization. We realized early on that this was a marathon, not a sprint, and while we run really hard, we also have fun together. And so, it's not just about working people hard; we have company picnics and end-of-the-year celebrations, routine parties, and celebrations of milestones and accomplishments, because without that, I think people would feel there was something missing in their day-to-day lives. And we also do buy food, and, we allow people to dress how they want. We look much more like a dot.com of 2000 than we do a financial institution of 2006.

EL: They probably feel more relaxed and more creative as a  result.

DP: Yeah, and you know, the other thing that I do is I have what is called a "fishnet organization." That fishnet organization allows me the flexibility to move people around to new things, so that the power of the organization doesn't rest within the hierarchy, it rests within what people are doing and the projects that they're on. And as they complete those projects, we move those people around in the organization. That allows them to get their head around new ideas and new activities. In the first 100 days of a new initiative, I've found that the best ideas come from people from other projects with different perspectives.

EL: That's really smart, because when people get so overly focused on the hierarchy, they sometimes lose focus on getting the job done.

DP: Exactly, and people lose sight of the fact that it's  what they're doing, not where they sit.

EL: We know that your group's infrastructure at Wells Fargo has become service-oriented architecture, or at least you're moving in that direction, but you believe that not every project should be opened up as a service. Could you talk about that, and tell us what are your criteria when you're deciding whether or not to make a function a service?

DP: When you start making functions services, if you continue to do that, you all of a sudden increase the management of those services. And I believe that there are not that many services that we want to be able to share across many different applications. And so I really want to make sure that at least three, four, five applications that we know of today would want to consume that service before I'm willing to actually make it a shareable, callable service. It requires somewhat of a change in philosophy of development. I think the great hope was that everything would become services and that you'd be able to compile applications on the fly. And I think the reality is that life is not that simple, and that you need to be very measured in how you're using these Web services. Having said that, SOA a great tool for the right uses.

EL: What cost saving initiatives do you use to keep  competitive?

DP: Well, again, I focus a lot on the topline growth and the customer, and improving the quality of service. Because I think in banking -- and let's be honest here, nobody actually wants to do banking -- the easier you can make it for your customers, the more satisfied they are, and we're in a business where the average delivery is very average. We happen to be in a position where our delivery is considered by the vast majority of our customers to be either very good or excellent. So, I'd rather spend a penny than save a penny, but make people happier, because they're going to stay with me and buy more products.