Risk management is a key area for financial leaders. When we look at IT development projects, we’re usually focused on opportunities rather than risks. But IT investments have risks beyond security and privacy issues. Project failure can lead to losses even beyond the intended investment. Here are seven ways to look at IT development projects from a risk management point of view.
1. IT Operations and IT Development must be managed differently. Development is Engineering and must be managed as such. In particular, this means that there must be a certain amount of experimentation to find the best implementation. Outsourcing of Development does not convert it into Operations – it is still Engineering.
2. Success criteria for IT Operations and IT Development are also different. Development should be measured based on expected ROI plus the strategic value of the project. For externally visible development, time-to-market and accuracy in delivery against market requirements are also relevant measures. Operations should be measured on predictability of spending and on Quality of Service. Operations measures should undergo regular and consistent assessment of their relevance to the business.
3. Most failures in IT Development are caused or compounded by management errors. Very few failures are due to technical inadequacy. The probability of future failures remains undiminished so long as the management errors are not addressed. Examples of these errors include not planning for scalability or not emphasizing modularity of the implementation.
4. The cost of failure in IT Development nearly always exceeds the allocated budget for the activity. Project failure has consequences beyond the immediate failed project, both for people and for other projects. For example, one late project often cascades through to lateness of follow-on projects. Another risk factor is the loss of key people when a development project fails. It is rare to find IT management mitigating this people risk immediately on learning of a development failure.
5. Failures and losses in IT Operations involve directly managed operations centers or outsourced providers’ operations. Outsourced operations are inherently riskier because the providers’ operations are less visible, and therefore less familiar, to Operations managers.
6. IT management should be able to communicate to top management the tradeoffs in IT Operations and Development, so that they understand the strategic implications of decisions in IT. Operational budget must not be the exclusive determinant of IT decisions. In general, the CIO should not report through the CFO.
7. Multi-year planning is essential for both IT Operations and Development. A roadmap for upgrade and integration of resources and services is necessary, even if it must be revised multiple times per year as new services and equipment are needed. Contingency planning and scenario analysis related to possible shortcomings of vendors and outsourced services must be part of the plans.
If these ideas resonate with your experience – or if you disagree, please add your comments below.
These thoughts were triggered by a recent paper, “Risk Management Failures” (http://tinyurl.com/7ew4t79) by Prof. René Stultz of Ohio State University, published by Cornerstone Research in 2009 (http://cornerstone.com). With thanks to Andre Neumann-Loreck for his feedback and comments.
About John Levy