IT Governance

How Top Performers Manage IT Decision Rights for Superior Results

Peter Weill, Jeanne W. Ross

• Publisher: Harvard Business Review Press
• Year: 2004
• Print ISBN: 9781591392538
• eBook ISBN: 9781422163344
• Topic: Business
• Subtopic: Information Management
• Index: Business

Firms with superior IT governance have more than 25% higher profits than firms with poor governance given the same strategic objectives. These top performers have custom designed IT governance for their strategies. Just as corporate governance aims to ensure quality decisions about all corporate assets, IT governance links IT decisions with company objectives and monitors performance and accountability. Based on a study of 250 enterprises worldwide, IT Governance shows how to design and implement a system of decision rights that will transform IT from an expense to a profitable investment.

1

IT Governance Simultaneously Empowers and Controls

DO YOUR information technology (IT) capabilities enhance your competitiveness?¹ Do managers throughout your organization recognize their responsibilities for the effective management and use of IT—or do they assume that the IT department will manage IT? Do your IT investments target enterprisewide strategic priorities—or does your firm squander resources on diverse tactical initiatives? Simply put, are you getting acceptable value from your IT investments?

Firms manage many assets—people, money, plant, and customer relationships—but information and the technologies that collect, store, and disseminate information may be the assets that perplex them the most. Business needs constantly change, while systems, once in place, remain relatively rigid. IT implementations involve both up-front and ongoing investments for outcomes that no one can precisely predict. These uncertainties and complexities lead many managers to abdicate their responsibilities for ensuring that their people use IT effectively.

For many years, some organizations could succeed despite weak IT management practices. But information—and consequently IT—is an increasingly important element of organizational products and services and the foundation of enterprisewide processes. The tight linkage between IT and organizational processes means that the IT unit cannot bear sole—or even primary—responsibility for the effective use of information and information technology. Getting more value from IT is an increasingly important organizational competency. Leaders throughout an enterprise must develop this competency.

Our research shows that top-performing enterprises generate returns on their IT investments up to 40 percent greater than their competitors.² These top-performing enterprises proactively seek value from IT in a variety of ways:

• They clarify business strategies and the role of IT in achieving them.
• They measure and manage the amount spent on and the value received from IT.
• They assign accountability for the organizational changes required to benefit from new IT capabilities.
• They learn from each implementation, becoming more adept at sharing and reusing IT assets.

Top-performing enterprises succeed where others fail by implementing effective IT governance to support their strategies. For example, firms with above-average IT governance following a specific strategy (for example, customer intimacy) had more than 20 percent higher profits than firms with poor governance following the same strategy.³ We define IT governance as specifying the decision rights and accountability framework to encourage desirable behavior in using IT. IT governance is not about making specific IT decisions—management does that—but rather determines who systematically makes and contributes to those decisions. IT governance reflects broader corporate governance principles while focusing on the management and use of IT to achieve corporate performance goals. Effective IT governance encourages and leverages the ingenuity of the enterprise’s people in IT usage and ensures compliance with the enterprise’s overall vision and values. This book is intended to alert both business and IT unit executives to the critical role they play in defining IT governance processes—a role that ultimately determines how much value the enterprise receives from IT.

All enterprises have IT governance. Those with effective governance have actively designed a set of IT governance mechanisms (committees, budgeting processes, approvals, and so on) that encourage behavior consistent with the organization’s mission, strategy, values, norms, and culture. In these enterprises, IT can factor significantly into competitive strategy. For example, David Spina, CEO of State Street Corporation, a world leader in global investor services, defined the firm’s corporate vision in 2001 as “One State Street.” This vision shifted the focus of the enterprise from the individual accomplishments of business units such as investment research and management, trading and brokerage services, and fund accounting and custodial services, to the firmwide demands of the customer. Desirable behaviors changed to include optimization of enterprisewide as well as business unit objectives. State Street established and refined a set of governance mechanisms, including enterprisewide IT budgeting and an Office of IT Architecture, to encourage the new behaviors.⁴

In contrast, enterprises that govern IT by default more often find that IT can sabotage business strategy. One financial services firm was pursuing a cost reduction strategy. Rather than create a comprehensive set of mechanisms that would encourage cost saving, this firm relied on a new chargeback system to curtail demand for IT services. When the chargeback system led to bickering among IT and business managers, the CIO assigned relationship managers to restore internal customer satisfaction. They improved satisfaction scores but did not lower IT or business process costs. Without a cohesive IT governance design, enterprises must rely on their CIOs to ameliorate problems through tactical solutions rather than position IT as a strategic asset.

To understand IT value creation, we studied IT governance in over 250 multibusiness unit for-profit and not-for-profit enterprises in twenty-three countries in the Americas, Europe, and Asia Pacific (see appendix A). Our research revealed that top-performing enterprises governed IT differently than did other enterprises. Mindful of competing internal forces, the top performers designed governance structures linked to the performance measure on which they excelled (for example, growth or return on assets), thereby harmonizing business objectives, governance approach, governance mechanisms, and performance goals and metrics. The net effect: Good governance design allows enterprises to deliver superior results on their IT investments. We conclude that effective ITgovernance is the single most important predictor of the value an organization generates from IT.

What Is Governance?

Before we dive into IT governance, we must look at the broader issue of corporate governance in enterprises. Corporate governance became a dominant business topic in the wake of the spate of corporate scandals of midyear 2002—Enron, Worldcom, and Tyco, to name a few. Interest in corporate governance is not new, but the severity of the financial impacts of these scandals undermined the confidence of both the institutional and the individual investor and heightened concerns about the ability and resolve of private enterprises to protect their stakeholders. The crisis in confidence in the corporate sector contributed to the downward pressure on stock prices worldwide and particularly in the United States. In the first six months of 2002 the S&P 500 fell 16 percent; the technology-heavy NASDAQ fell 36 percent. The U.S. government intervened, and new legislation required CEOs to personally attest to the accuracy of their firms’ accounts and report results more quickly.⁵ Simultaneously, corporate America increased the level of self-regulation.

Good corporate governance is important to professional investors. Major institutions rank corporate governance on par with the firm’s financial indicators when evaluating investment decisions. A McKinsey study found that professional investors are even prepared to pay large premiums for investments in firms with high governance standards.⁶ Premiums ranged from an average of 13 percent in North America and Western Europe to 20 or 25 percent in Asia and Latin America and even higher in Eastern Europe and Africa.⁷ On average, when moving from poorest to best on corporate governance, firms could expect an increase of 10 to 12 percent in market value.

A number of bodies have published guidelines for good corporate governance.⁸ One we found very useful was the Organization for Economic Cooperation and Development’s 1999 publication “OECD Principles for Corporate Governance,” which defined corporate governance as providing the structure for determining organizational objectives and monitoring performance to ensure that objectives are attained.⁹ The OECD emphasized that “there is no single model of good corporate governance,” but it noted that in many countries corporate governance is vested in a supervisory board that is responsible for protecting the rights of shareholders and other stakeholders (employees, customers, creditors, and so on). The board, in turn, works with a senior management team to implement governance principles that ensure the effectiveness of organizational processes.

We propose a framework for linking corporate and IT governance. The top of the framework (figure 1-1) depicts the board’s relationships. The senior executive team, as the board’s agent, articulates strategies and desirable behaviors to fulfill board mandates.

FIGURE 1-1

Corporate and Key Asset Governance

© 2003 MIT Sloan School Center for Information Systems Research (CISR). Used with permission.

We see strategy as a set of choices.¹⁰ Who are the targeted customers? What are the products and service offerings? What is the unique and valuable position targeted by the firm? What core processes embody the firm’s unique market position?

Desirable behaviors embody the beliefs and culture of the organization as defined and enacted through not only strategy but also corporate value statements, mission statements, business principles, rituals, and structures.¹¹ Desirable behaviors are different in every enterprise. Behaviors, not strategies, create value. For example, Johnson & Johnson relied on autonomous business units to create shareholder value for nearly a hundred years. Eventually, however, customers insisted that they wanted to deal with J&J—not a set of individual J&J operating companies. Accordingly, J&J’s well-known corporate credo has evolved to specify desirable behaviors such as lowering the cost of its products to customers, creating mechanisms for better understanding the unique needs of individual customers, and transferring employees across J&J companies to enhance individual careers and help them identify with the corporation.¹² Clear desirable behaviors are key to effective governance and are major topics in chapters 3 and 6.

The lower half of figure 1-1 identifies the six key assets through which enterprises accomplish their strategies and generate business value. Senior executive teams create mechanisms to govern the management and use of each of these assets both independently and together. The key elements of each asset include the following:

• Human assets: People, skills, career paths, training, reporting, mentoring, competencies, and so on
• Financial assets: Cash, investments, liabilities, cash flow, receivables, and so on
• Physical assets: Buildings, plant, equipment, maintenance, security, utilization, and so on
• IP assets: Intellectual property (IP), including product, services, and process know-how formally patented, copyrighted, or embedded in the enterprises’ people and systems
• Information and IT assets: Digitized data, information, and knowledge about customers, processes performance, finances, information systems, and so on
• Relationship assets: Relationships within the enterprise as well as relationships, brand, and reputation with customers, suppliers, business units, regulators, competitors, channel partners, and so on

Governance of the key assets occurs via a large number of organizational mechanisms (for example, structures, processes, committee, procedures, and audits). Some mechanisms are unique to a particular asset (for example, the IT architecture committee) and others cross and integrate multiple asset types (the capital approval process, for example) ensuring synergies between key assets. Maturity across the governance of the six key assets varies significantly in most enterprises today with financial and physical assets typically the best governed and information assets among the worst.

At the bottom of figure 1-1 are the mechanisms used to govern each of the six key assets. We contend that enterprises with common mechanisms across multiple assets perform better. For example, if the same executive committee governs both financial and IT assets, a firm can achieve better integration and create more value. Some mechanisms will always be unique to each asset—the audit committee for financial assets and the IT architecture committee for IT, for example—but some common mechanisms lead to better coordination of the six assets.

As a sobering exercise, quickly jot down the list of mechanisms used in your enterprise to govern each of the six assets. Could you complete the lists? How many of the mechanisms were common across more than one asset—more than two assets? Coordinating the six key assets of an enterprise is not easy. The average assessment of a group of forty-two CIOs on how well their enterprises integrated IT governance with the governance of the other key assets was less tha...

Table of contents

• Cover
• Copyright
• Adcard
• Preface and Acknowledgments
• 1. IT Governance Simultaneously Empowers and Controls
• 2. Five Key IT Decisions: Making IT a Strategic Asset
• 3. IT Governance Archetypes for Allocating Decision Rights
• 4. Mechanisms for Implementing IT Governance
• 5. What IT Governance Works Best
• 6. Linking Strategy, IT Governance, and Performance
• 7. Government and Not-for-Profit Organizations
• 8. Leadership Principles for IT Governance
• Appendix A
• Appendix B
• Notes
• About the Authors