CHAPTER 10:
IT’S ALL ABOUT LEADERSHIP
The IT Governance Institute recently observed that, while boards are happy to focus on strategy and strategic objectives, they are far less happy to deal with IT, even though IT is so fundamental to business success. It identified three reasons for this state of affairs:
• ‘IT requires more technical insight than do other disciplines to understand how it enables the enterprise and creates risks and opportunities.
• IT has traditionally been treated as an entity separate to the business.
• IT is complex, even more so in the extended enterprise operating in a networked economy.’66
This statement is kind, and true – as far as it goes.
There is another side to the story, and that is that some of the people running IT have, over many years, either deliberately obfuscated and confused their executive colleagues or (negligently) promised incredible benefits that only they can deliver but which will transform the enterprise…aided and abetted by IT vendors, ‘solution providers’ and strategic consultants, they have successfully parted stakeholders from trillions of dollars for largely worthless information and communications technology products and services.
The hype about the redeeming, transforming miraculous enabling power that is technology (combined with the mixture of greed, cynicism, stupidity and hysteria that characterises the end of a bubble) led to a short, sharp period of dramatic value destruction as world stock markets crashed in 2001.
And yet, in spite of the hype, the world has changed: it’s not quite a William Gibson-esque matrix, but technology really is revolutionising business and society. Technology offers break-through opportunities, but only if there’s a management team that has the vision and leadership skills to take advantage of the opportunity: voice-over-IP, for instance, is an opportunity, fuelled by increasing business and homeowner conversion to broadband connectivity, but without leadership – expressed through a management team, an organization and shareholder funds - how likely is it that long distance fixed-line calling will be destroyed as a business?
Technology isn’t the driver – technology is only a tool, and this technology has enabled people to make a living in new ways. Anyone from anywhere can get along – provided she can use a computer.
Technology is not the source of competitiveness. There are still only three generic competitive strategies: overall cost leadership, differentiation, and focus.67 Technology might be deployed as part of a competitive strategy; but its role is to serve the strategy, not to drive it.
Board leadership
IT governance is a board responsibility. There is, however, a widespread view amongst directors that IT is not something they care about, and not really something they should care about.
This is an abdication of responsibility.
The IT Governance Institute talks68 of the CIO being ‘the bridge between IT and the business,’ and of the need for promoting ‘co-responsibility between business and IT for the commercial and technical success of IT investments.’ This really is nonsense. IT is
67 Competitive Strategy: Techniques for Analysing Industries and Competitors, Michael E Porter, 1980
68 ‘Board Briefing on IT governance’, 2nd Edition, IT Governance Institute, 2003
not a separate but allied business. It’s part of the business. IT doesn’t have to ‘align’ itself with the business. It’s much simpler than that: the CIO needs to deliver precisely what the business requires in order to achieve its business goals – or be replaced.
You wouldn’t debate for a moment whether or not R&D should align itself with the business and you would be apoplectic if the Head of HR suggested that s/he should be the bridge between the people and the business; if the CFO suggested there were some parallel financial strategies that could transform the business (and that involved off-balance sheet entities, for instance) you might accelerate your succession plans for each of those roles.
The key function of the board IT strategy committee is to understand IT’s role in the strategy, assign responsibilities, assess the risks, define the constraints within which the executive are to operate, measure their performance and continue managing the risk. With the (possible) exception of understanding IT, board members already know how to do all these things and are currently doing them in respect of the rest of the business.
If the organization has an IT governance failure – evidenced by an IT project failure, an information security breach, a compliance failure, a loss of competitiveness, or a business continuity challenge – it is primarily the board that has failed.
Guideline for Directors: there are three options: keep your head in the sand, change the board, or ensure that your board has on it enough technology-savvy directors who understand the business, and who can ride shotgun on IT, through the IT steering committee, until they’ve adequately educated their board colleagues to the point where they too can play a full role in governing IT.
CEO’s role
The CEO leads the business. The CEO, leading by example (either deliberately or through lack of awareness) sets the tone for the business. If the CEO doesn’t understand the role and value of IT in this business, the organization won’t get real value from its IT investments. A CEO who was openly disparaging of the ability of the sales team to deliver the sales numbers, who downgraded and largely ignored the sales leaders (having them report, for instance, to the CFO) – but who kept up the financial pressure for them to ‘do more with less’, while wondering if ‘sales could ever align itself with the business’, is a CEO who would be out of a job in the blink of an eye.
If IT is fundamental to the information economy, then the IT team is at least as important to the organization’s future as the sales team. In some industry sectors – like finance and banking, and any organization with a significant online sales channel, the IT team is probably even more important than the sales team.
The CEO is responsible for actually making IT governance work in the organization. This means that the CEO simply has no option but to get himself – or herself – sufficiently knowledgeable about the strategic IT governance and business issues to ensure that IT is making the sort of contribution to the organization’s future as it should be.
‘Does IT matter?’69 Is IT still capable of being a strategic differentiator for us? Is someone out there preparing a technology silver bullet for us? Are we really leveraging our intellectual assets to their fullest extent? Am I likely to go to jail? These key question the CEOs of all organizations, key questions that cannot even be considered, let alone answered, without having first got to grips with the subject – not at the detailed, bits and bytes level, but at the strategic, business, social and economic levels.
The CEO has to appoint an IT leader who will ensure that the IT unit adds real value to the organization, and the CEO has to structure the organization so that the CIO is part of the top executive management team, with equal status to the CFO, the COO or other similar roles. Strategic planning without the involvement of the CFO and head of sales (or equivalent) is inconceivable; it should be equally
69 Does IT Matter? Information Technology and the Corrosion of Competitive Advantage, Nicholas G Carr, HBS Press, 2005
inconceivable without the CIO’s involvement on precisely the same basis as the other business executives.
The CEO also has to ensure that IT has clearly articulated targets and performance metrics - in just the way, for instance, that HR, sales or operations do - that relate to their performance and contribution to the organization’s overall strategic success.
Finally, the CEO has to get the organization behind the business vision for information and IT, ensuring that line of business managers and users everywhere understand – through a realistic, hype-free internal communication strategy – what is expected of IT and what is expected of the users of IT.
Guideline for Directors: if the CEO simply doesn’t get IT, then you need to think about your CEO’s future. You need to be looking for CIOs who have the calibre and breadth of business understanding to become your next CEO.
CIO leadership
‘Career Is Over’ is not a good way to think of the CIO role; the CIO, like the CFO, should be one of the organization’s inner executive cabinet. Ideally, someone whose width of business experience (including, perhaps, a good MBA) and depth of technology experience (including a first degree in computing and practical, relevant experience in the key IT disciplines: program management, performance optimisation, security, compliance, enterprise IT architecture).
The CIO needs to be a leader more than a technology specialist. The CIO has to be competent to structure the IT organization so that it will deliver the IT strategic goals, which means recruiting and retaining staff, at all levels of the IT organization, who have the right mix of technical and business skills to deliver the required IT performance within the broader organizational culture. And these skills are as much about relationship building, responsiveness, service and performance orientation and results focus as they are about protocols, network layers and service stacks.
The CIO has to fight for, and get, an operational unit budget that will allow the creation of an IT organization that is genuinely fit for purpose, the purpose being the delivery of the organization’s strategic business goals. This may also require dedicated resource: HR staff, for instance, who understand the skill sets and competences required for staff in the IT organization.
The CIO also has to manage communication between the IT team and the rest of the organization, building a sense of shared commitment to the organization’s goals. At the same time, the CIO has to ensure that users throughout the organization understand – in a realistic, hype-free manner - the IT unit’s objectives and plans.
Guideline for Directors: the quality of the IT contribution to the organization will stand or fall on the quality of the CIO: make sure you hire the best and that your appointee gets appropriate organizational support.
IT users
The integration of IT into the organization has to be approached along two tracks. The first is through board and executive leadership, concentrating on building a world-class IT unit that will deliver the organization’s information and IT goals; the second is through building a world-class community of IT users.
There are a number of levels at which this has to happen:
• Line of business managers have to buy into and support the executive in promoting the business significance of IT, its specific goals and delivery plan.
• Line of business managers have to be trained to become savvy ‘buyers’ of current and future IT services, understanding how IT can – and can’t – contribute to their business success. They also have to become effective, commercially pragmatic (differentiating between ‘must have’ and ‘nice to have’ functionality, for instance) specifiers and testers of applications and software systems.
• Users throughout the business have to be communicated with, involved, consulted, and trained on an ongoing basis and as part of every new IT initiative; their experience of IT has to be that it pro-actively helps them achieve their personal performance objectives. Under these circumstances, their contribution to and involvement in critical user-based information security and compliance activities will have far greater success than it does when they feel excluded, unsupported and dumped-on.
• Users throughout the organization have to see results; the issues they raise, the requests they make, have to be dealt with expeditiously and meaningfully. They have to believe that they are not being hyped or lied to; telling them when something can’t be done immediately and why is always better than promising an immediate solution and then failing to deliver. IT users are like customers: they need eight good messages about IT before they’ll be supportive, but only one bad experience (by someone else) to shy away.
Guideline for Directors: building a community of responsive, supportive IT users will require a significant resource contribution – communications expertise, people, time and money. It’s well worth the investment: a community of informed, supportive users is the long term answer for integrating IT governance into the organization.