Home > Chapter excerpt: Decision-making processes and IT governance
Chapter Download:
EMAIL THIS

Chapter excerpt: Decision-making processes and IT governance

22 Jun 2009 | Harvard Business Press

Enterprise IT tips and expert advice
Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google

The following is an excerpt from the book IT Savvy: What Top Executives Must Know to Go from Pain to Gain, by Peter D. Weill and Jeanne W. Ross:

Get the book
IT SavvyBuy IT Savvy: What Top Executives Need to Know to Go From Pain to Gain, from Harvard Business Publishing.
Around 2000, when UPS was moving aggressively into Eastern Europe, UPS's regional head proposed equipping drivers and warehouses with technology different from UPS's standard handheld device. He could demonstrate that in Eastern Europe the nonstandard approach would cost less and be adequate to meet the needs of a less mature market. Then, as now, UPS had an IT decision-making process that reviewed exceptions to these types of standards. In this case, the decision was passed up to senior management, who insisted that Eastern Europe adopt standard UPS business processes and technology. Then UPS CEO Mike Eskew explained: "We are a network and we can't have some warehouses managing with this system and others managing with that system … [When you allow differences] you can't transfer people and you can't transfer information."

UPS was building out a digitized platform providing global visibility into data and standard core processes to meet the needs of its unification operating model. Management was determined to extend that platform and generate benefits. Because of management's commitment to the digitized platform, whenever UPS changes the functionality of its handheld devices or the systems with which the devices interact, management knows that all parts of the network will still be compatible. UPS has achieved this desired predictability because management has implemented decision-making practices to build, protect, and leverage its digitized platform.

Not every firm needs as much process integration and standardization as UPS's package delivery business. But every firm, at some level, needs a digitized platform to operate effectively. The only way to deliver a digitized platform -- and superior business value from IT -- is to design IT decision rights and accountabilities so that daily decisions about IT support the firm's strategic goals. Otherwise, IT is destined to become an obstacle to long-term success.

We refer to a firm's framework of IT decision rights and accountabilities as IT governance. For some people, the term governance conjures up visions of bureaucracy or endless committee meetings. We see the opposite. Governance empowers people by providing transparency about decision-making processes and criteria. Effective IT governance minimizes bureaucracy and dysfunctional politics -- and it pays off. Firms with above-average IT governance effectiveness had 20 percent higher profits as measured by three-year industry-adjusted return on assets (ROA).

Five Key Decisions

To effectively govern IT, firms must allocate decision rights and accountabilities for at least five decisions:

  • IT principles: As explained in Chapter 2, strategic use of IT requires that management specify the firm's operating model. IT principles refer to the firm's operating model and any other directives clarifying the role of IT in the firm. Governance should allocate decision rights for determining IT principles -- usually to one or more members of the senior management team.
  • More compliance management resources
    How to mitigate operational, compliance risk of outsourcing services

    Chapter excerpt: The Three Core Disciplines of IT Risk Management

  • Enterprise architecture: Enterprise architecture refers to the design of the firm's digitized platform. Governance should specify the people responsible for establishing business process, data, and technology standards and for dealing with requests for exceptions to those standards.
  • IT infrastructure: Infrastructure is the set of shared IT services available to all parts of the enterprise. Governance allocates responsibility for defining, providing, and pricing IT shared services.
  • Business needs and project deliverables: New systems and processes emerge from an extended organizational effort that starts with a business case for a new system and ends, ideally, with a review of the outcomes of that system implementation. Governance allocates ownership for defining the business case, ensuring successful implementation, and delivering the benefits.
  • IT investment and prioritization: In Chapter 3, we discussed the IT funding and prioritization process in depth. Although critical, IT investment and prioritization is only one of five IT decisions that needs to be governed. Here we discuss how it fits with the other four governance decisions.
  • Firms implement governance through a set of mechanisms: individual roles (e.g., CEO or CIO), committees or teams (e.g., IT steering committee or IT leadership team), and formalized processes (e.g., architecture exception processes or business case review processes). A firm's governance mechanisms clarify how each of the five decisions will be made and who will be held accountable. Southwest Airlines offers an example of how an IT-savvy firm designs IT governance to fulfill strategic business objectives.

    IT Governance at Southwest Airlines

    Southwest Airlines is a $9.5 billion U.S. airline offering primarily short-haul, point-to-point, low-fare flights. Founded in 1971, Southwest built locally optimal systems until the late 1990s, when CFO Gary Kelly started pushing the use of IT to enhance operational efficiencies and customer service. When Kelly became CEO in 2004, he worked with CIO Tom Nealon to provide a solid platform of digitized processes for the enterprise.

    Although business leaders agreed that enterprise systems and processes would be valuable, they struggled to define those processes. To support enterprise thinking, Southwest created seven strategy teams. These strategy teams, with names like Low-Cost Carrier, Best Place to Work, and Best Customer Experience, meet twice a month to define enterprise priorities for implementing the strategy. The top thirty leaders of the company each sit on two or more strategy teams so they can inform their colleagues of services and needs within their own functional area while learning about the operations of other functional areas. The teams propose enterprise IT projects, which are reviewed by the firm's executive committee in establishing project priorities. Around 80 percent of Southwest's technology projects are aligned with one of the strategy teams.

    Governance empowers people by providing transparency about decision-making processes and criteria ... [and] minimizes bureaucracy and dysfunctional politics -- and it pays off.
    To ensure that individual projects deliver on their business objectives, Southwest has implemented a tollgate process. The tollgates are monthly reviews of each project's progress and objectives. The tollgates bring together IT and non-IT people who are responsible for resolving any technology and business issues that could hinder project delivery or business value.

    One of the tollgates involves a review of the technology that the project team proposes to use to support the new system. In the review process, a group of IT professionals, known as the architecture working group, works with application developers and business people to make sure proposed technologies are either architecturally compliant or the project justifies an exception to standards.

    Table 5-1 provides a high-level chart of Southwest's accountability framework for its five governance decisions. Southwest has specified one person or group of persons ultimately accountable for each decision, but the governance design also assigns some specific decisions to other individuals or teams within a decision area. Overlapping participation on decision-making bodies helps to coordinate the five IT decisions to provide consistency in the firm's strategic pursuits.

    Management's commitment to building a digitized platform in support of customer service and operational efficiency has made Southwest the United States' largest (in terms of passengers flown) and most profitable airline. In October 2008, while most U.S. airlines were reporting losses, Southwest reported its seventieth consecutive quarterly operating profit.

    Read the rest of Chapter 5, "Allocating Decision Rights and Accountability." Reprinted by permission of Harvard Business Press. Excerpt from IT Savvy: What Top Executives Must Know to Go from Pain to Gain. Copyright 2009 Peter D. Weill and Jeanne W. Ross. All rights reserved.



    Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google



    RELATED CONTENT
    Managing compliance teams
    Priorities for your sound regulatory compliance management policy
    HIPAA-covered entities' first step should be a quality assurance plan
    Survey shows privacy policy success lies in collaboration with IT
    HIPAA-covered entities, business associates confront HITECH rules
    Steps toward making information security as important as data security
    FAQ: What is the impact of e-discovery law on IT operations?
    A compliance officer, secure network aren't enough for real compliance
    Is all the PCI DSS compliance whining and complaining justified?
    Anatomy of a hyperproductive compliance management team
    Chapter excerpt: The Three Core Disciplines of IT Risk Management

    Managing governance and compliance
    Google adds Dashboard: Does transparency mean more online privacy?
    NERC CSO warns of cybersecurity threats, risk to electric grid
    Priorities for your sound regulatory compliance management policy
    Threat management for information systems relies on categorization
    HITECH FAQ: What is the impact of the HITECH Act on IT operations?
    Survey shows privacy policy success lies in collaboration with IT
    Record locator service a step to health information exchange
    U.S. CIO Vivek Kundra on Data.gov, OpenID and government transparency
    Nonprofits are working to maintain donor trust with PCI compliance
    Mass. data protection law requirements amended, deadline extended

    Compliance framework software
    ISO 27001 certification not enough for verifying SaaS, cloud security
    OpenID federated identity framework set for .gov authentication pilot
    Energy efficiency, carbon driving sustainable business development
    Architect preventative compliance controls for best risk management
    Social media platforms demand a clear employee Internet use policy
    Pietrylo case a cautionary Web 2.0 communications compliance failure
    Compliance concerns dog enterprise 2.0 collaboration platforms
    Startup helps turn carbon footprint management into cost savings
    Chapter excerpt: The Three Core Disciplines of IT Risk Management
    Open Group releases log management update, risk management guide

    RELATED GLOSSARY TERMS
    Terms from Whatis.com − the technology online dictionary
    IT controls  (SearchCompliance.com)

    RELATED RESOURCES
    2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
    Search Bitpipe.com for the latest white papers and business webcasts
    Whatis.com, the online computer dictionary


    HomeNewsTopicsITKnowledge ExchangeTipsBlogsMultimediaWhite PapersProducts
    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    SEARCH 
    TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Site Map




    All Rights Reserved, Copyright 2009, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts