Best Practices in IT Portfolio Management

Business executives love to hate information technology, yet IT expenditures continue to increase. In 2002, $780 billion was spent on IT in the United States alone, with IT budgets of individual companies, such as Citigroup Inc., reportedly as high as $4 billion. At the same time, accounts of wasted investments make headlines, providing fuel for IT skeptics: An estimated 68% of corporate IT projects are neither on time nor on budget, and they don’t deliver the originally stated business goals. Some even claim that during the last two years, $100 billion to $150 billion of U.S. IT projects have failed altogether.1

Considering that IT budgets comprise hundreds or even thousands of projects running simultaneously across functions, business units and geographies, it’s a challenge to select projects for investment that are synchronized with corporate strategy. Charged with managing such projects effectively, executives are asking, “How do we maximize the business value from IT investments?”2

The answer may be IT portfolio management (ITPM) —that is, managing IT as a portfolio of assets similar to a financial portfolio and striving to improve the performance of the portfolio by balancing risk and return.

Analogies that build on financial-portfolio theory or on concepts about product and research-and-development pipeline portfolios (which are more akin to IT portfolio management than to financial portfolios) are not new.3 ITPM has evolved into a combination of practices and techniques used to measure and increase the return on individual and aggregate technology investments — existing and planned — and to reduce risk. An investment portfolio comprises all direct and indirect IT projects and assets, including infrastructure, outsourcing contracts and software licenses.

To find out how extensively ITPM is used in large U.S. companies, we conducted research from November 2002 to March 2003. The research — consisting of a survey of 130 Fortune 1000 chief information officers and in-depth interviews with selected respondents — measured ITPM adoption, identified implementation hurdles, assessed benefits, defined best practices and formulated strategies for success. (See “About the Research.”)

Eighty-nine percent of the CIOs polled were very aware of ITPM, and 65% believed that the approach yields significant business value. Nevertheless, only a few organizations (17%) appeared to be realizing ITPM’s full value. For example, according to respondents, 41% of their companies do not have central oversight of the IT budget, which is critical to ITPM; 46% do not document their applications and infrastructure well; 47% do not track projects centrally; 57% do not have criteria to define project success; and 68% do not track the benefits of projects.

Why don’t executives adopt the practices they purportedly believe in? Why, for example, do 59% of companies regularly calculate the return on investment of IT projects before making an investment decision, but only 25% measure the realized ROI after a project’s completion? Skills, attitudes and behaviors must change.

Consider the success of Harrah’s Entertainment Inc., the world’s largest gaming company. When he was chief operating officer, Gary Loveman — now president and CEO — began collecting extensive data on small-scale gamblers in order to measure the success of promotions targeted to them. Soon the rest of the casino industry found itself playing catch-up.4

The IT Portfolio Management Maturity Model

A new tool for assessing what constitutes best-practice ITPM is the IT portfolio management maturity model.5 The model segments a company’s IT portfolio management into four stages: ad hoc, defined, managed and synchronized. (See “The IT Portfolio Management Maturity Model.”) The characteristics of each stage emerged during interviews. The subsequent survey validated the model, finding that 4.5% of the 130 respondent companies are at the ad hoc stage, 24.5% at the defined stage, 54% at the managed stage and 17% at the synchronized stage.

Stage Zero: Ad Hoc

Companies at this stage make decisions about investments in an uncoordinated way. For example, an IT audit of a major Fortune 500 investment bank found four customer-relationship-management (CRM) projects under way in three divisions using software from different vendors. The bank was losing out on significant cost savings that would have accrued from consolidating the projects into a single CRM program. Similarly, a global property-and-casualty insurer found itself on the cusp of spending $10 million to implement software that was already in use.

An unfounded perception exists that large corporations having complex IT needs are poor candidates for the portfolio approach. When David Faith, senior vice president of the Enterprise Group at Scoular Co., which provides agricultural-industry services such as grain-elevator management, viewed IT spending from a portfolio perspective, he noticed the company’s myriad fixed-line, wireless and videoconferencing contracts. To tackle misperceptions about large-company IT, he engaged senior executives in a strategic dialogue about telecommunications needs, consolidated vendors and cut spending by 50% while simultaneously expanding network services.

Today Scoular’s process is at the synchronized level. “The idea that IT infrastructure is just a burgeoning, unmanageable, out-of-control cost area is simply not true,” says Faith. “You can manage it. That’s one of the big benefits of portfolio management, because it allows you to regain control, ensure alignment with strategy and make smart day-to-day decisions toward identified objectives.”

Our research also uncovered another instance of the benefits of an ITPM approach: One particular global investment management firm used findings from a portfolio exercise to cut telecommunication costs by $30 million.

Stage One: Defined

Companies at this stage have identified and documented the key components of their IT portfolios, roughly estimating each element’s costs and benefits. After being codified, project data are logged in a central database. Having developed methods for evaluating and prioritizing investment proposals, the corporate IT department also has instituted central budget oversight and, most likely, maintains a central project-management office. Pertinent IT personnel have a basic understanding of the financial metrics used to make investment decisions — the portfolio having been defined in terms of an initial set of agreed-upon facts. Features missing at this level are consistency in organizationwide compliance, links into budgeting cycles and feedback loops to assess actual returns.

Companies functioning at the defined stage often struggle to link the IT portfolio to business strategy because of a lack of common beliefs and standards. As the CIO of a leading professional-services firm explained, “My biggest challenge was at the lower levels, both from IT people as well as the business users. IT people will do only whatever the users ask them to do, and then they’ll complain about it. Business users all own some piece of the pie but only care about their own slice. Neither group sees the big picture. They don’t get — or care for — a portfolio view.”

The CIO added, “Last year we created a new spreadsheet for project proposals that looked at risk as well as reward. Well, we found that our project managers look at risk and reward very differently. Everyone said they bought into the portfolio concept but still looked at the world their own way. Establishing a common view of things across 63 offices in 38 countries is a big challenge.”

Stage Two: Managed

Companies functioning at the managed stage distinguish themselves from those at the defined stage by a standardized ITPM process that enables objective project selection and has a clear link with business strategy. Examples of such companies include one of the world’s largest household-products manufacturers, one of the three largest banks, a U.S. convenience-store chain and a large paper-products manufacturer. Their portfolios are managed in the sense that they are part of existing management-control processes. Financial metrics, such as ROI and net present value (NPV), are consistently calculated and used in reviews with business leaders to align IT spending with strategy. However, at the managed stage, such exercises are usually annual rather than ongoing.

The director of program management of a Blue Cross Blue Shield-affiliated company functioning at the managed stage reports that the portfolio process helps with project selection: “The nature of our organization makes it hard to tie everything to an ROI. So we use alternatives to measure the impact of IT investments, such as the time it takes our associates to access information when taking member service calls. We also look at data from satisfaction surveys among our constituents. Those analyses translate into benefits-realization reviews at the end of each project.”

Stage Three: Synchronized

The most savvy IT management teams distinguish themselves by their ability to align investment portfolios with business strategy. These companies use evolving metrics to measure a project’s value through its life cycle. They routinely weed out underperforming initiatives. And to increase the aggregate value of their IT investments, they assess both the risks associated with each project (delays, cost overruns, strategic misalignment, end-user acceptance) and the portfolio risks (the blend of “run the business” innovation and breakthrough innovation). They also weigh option value — the value of investing in a project that will enable future opportunities. Synchronized companies also are disciplined about getting frequent feedback from business-unit heads and corporate-strategy vice presidents to ensure that IT efforts stay aligned with strategy after investments are decided on. They adjust course as necessary.

A Fortune 500 consumer packaged-goods company offers a relevant example. All potential IT projects costing over a predetermined amount — often $250,000 — go through a rigorous vetting process. Required to have a valid business rationale with an NPV or internal rate of return (IRR) calculation, each project is screened relative to the company’s existing and planned infrastructure. Then a cross-functional executive team evaluates each one using a Balanced Scorecard approach that captures the various dimensions of business value, risk and ability to succeed.6 The enterprise has a process guide with detailed grading for each category on the scorecard, ensuring consistent scoring and optimal alignment with the organization’s key business objectives. Plotting projects on a matrix of value to the business vs. risk helps companies such as this visualize the project portfolio’s viability. (See “Dimensions of the IT Portfolio.”)

The consumer-goods company reported convening a senior management council — business-unit vice presidents plus the CFO and the CIO — to review projects. Six criteria related to the 2002 strategic objectives were weighed: financial return, consumer focus, supply-chain business benefit, technology efficiency, knowledge advantage and work-life balance.

The CIO elaborated: “The benefits [of ITPM] spoke for themselves. In 2002, 89% of the IT investments went to the top 50 firmwide projects vs. functionally best projects, and the IRRs were from 20% to 100% plus. There was better alignment and wider support from senior business management. Most important, the process was perceived to be fair and objective.” An interesting side effect: The CFO and business-unit heads, upon reviewing the portfolio of potential projects, increased overall IT spending to fund additional high-value projects.

The more successful companies therefore link strategy to IT portfolio investments using a process similar to one first laid out in the late 1990s: Define the companywide strategic intent and business objectives; understand the strategic context of the company; develop business and IT objectives matched to corporate strategic objectives; develop an appropriate portfolio of business and IT investments to support the strategic business objective; and keep updating.7

Harrah’s Entertainment has a synchronized IT portfolio-management process.8 Says John Boushy, senior vice president of operations, “Every project has a business case. We ask, What is the business need? What does the business owner want the technology to do or the investment of information technology to provide? If it provides that, what are the business outcomes that will change? For example, what will change in terms of customer satisfaction? What will change in terms of increased revenues? What will change in terms of decreased costs? Then on the basis of the total cost of ownership of putting the investment in place, they ask, What is the increased support and infrastructure that might be required?” Every project goes through such an analysis. The higher the cost of the project, the more rigorous the analysis.

Harrah’s also has institutionalized after-action program reviews, which seek to further fine-tune the IT portfolio. Says Boushy, “In 2002, we sent out 228,000 customer-satisfaction surveys. We track our scores by Gold, Platinum and Diamond Rewards customer-tier levels, segmented by predicted customer lifetime value, and we actually look at the customer satisfaction scores that occur as we implement a service-improvement initiative.”

One example is the Harrahs.com eTotal Rewards Web portal that lets customers see their personalized offers and update their account information online. Says Boushy, “We’ve been able to quantify the value of increasing the satisfaction level of a customer from a B to an A: It represents an annual increase in revenue of about 6% from that specific customer. This enables us to objectively measure the value of customer-satisfaction IT initiatives and ties back into the IT portfolio-management process.”

Benefits of the ITPM Process

Data analysis from the survey uncovered a statistical link between a synchronized ITPM process and return-on-asset (ROA) performance.9 The research involved multivariable regression analysis for responding companies. The dependent performance variable was ROA, and the independent variables included such factors as IT spending as a percentage of revenue plus a special ITPM score.10 Most significantly, no link was found for companies with defined and managed ITPM processes. For companies with large investments in IT, a synchronized ITPM process appeared to impact ROA measurably, but simply defining and managing the ITPM process is not enough to improve performance significantly.11

Sixteen in-depth interviews with respondents validated the survey results. Qualitative data analysis of the interview transcripts revealed what the interviewees considered to be the top 10 benefits of ITPM. The benefit valued most was improved business-strategy alignment. Next came centralized control and, in descending order, cost reduction, communication with business executives, improved ROI, improved customer service, professional respect, competitive advantage, IT integration during mergers and acquisitions, and finally, improved decision making.

Lynne Ellyn, senior vice president and CIO at DTE Energy, a Michigan-based energy and energy-technology provider, described the benefits of ITPM: “Our portfolio-management approach has been instrumental in cutting costs by 40% over the last two years and increasing productivity. We have developed strong application-development and project-management skills. We are training other parts of the organization in project-management techniques.” Ellyn also reported increased company recognition for the IT group’s capabilities and said she is often asked to consult on non-IT issues, such as reviews of a recent plan for a power-plant construction project.

ITPM can be instrumental in improving communication between business units and IT. Says Laura Scott, CIO of Carpenter Technology Corp., a Pennsylvania-based manufacturer and distributor of specialty alloys, “Without portfolio management, I wouldn’t have been able to communicate to senior management the lack of value we get for the money we invest in our systems. It provided the facts and insights needed to convince our executive team to move forward with consolidating all our disparate systems into one ERP.”

Similarly, at a leading wireless-services provider, portfolio analysis helped identify between $50 million and $75 million in savings from eliminating system and platform redundancies.

Our research also revealed how a lack of ITPM could hurt companies after mergers and acquisitions. Waste Management Inc., the largest waste-management-services company in the United States, with $11 billion in revenues in 2002, is the result of a series of acquisitions. But the company’s aggressive growth strategy hit the skids in the late 1990s. Former Waste Management CIO Tom Smith, who joined the company in 1999, said, “The merger of the prior Waste Management with USA Waste Services in mid-1998 failed, and to a large extent this was due to the lack of a common systems foundation.” Accused of federal securities-law violations surrounding the merger, Waste Management confronted class-action lawsuits, which it eventually settled for $229 million and $457 million, respectively, in 2001. Top management was fired and various acquired companies were divested.

Many of Waste Management’s acquired companies never had a standard IT infrastructure: Some had no technological infrastructure at all. That resulted in the company being unable to manage its resources and measure performance. For example, the lack of standardization in the numerous accounting systems meant that 1,100 external consultants and staff had to spend weeks to close the company’s books for year-end 1999.

When Smith came aboard, his main challenge was to create an IT platform that would integrate the independent entities into a united network. Quite simply, Smith says, the company needed IT systems and processes “to gain control of managing the business” and “the associated metrics to effectively measure the business units’ performance.” Smith believes that the portfolio-management principles used in managing IT spending helped him do exactly that. Waste Management now closes its books in a timely manner, drives out costs, focuses on improved customer service and, most important, captures adequate information to run the business. Though it is speculation at this point, having had such systems and processes in place might have prevented the company’s control gaps and subsequent downfall in 1998.

Implementation Hurdles

Despite ITPM’s benefits, implementation challenges are impeding its widespread adoption. The first two barriers are essentially about poor execution, the third relates to the deep-rooted divide between business and IT.

Metrics and measurement process.

As many as 82% of survey respondents identified the ability to estimate IT benefits as a major challenge; 33% never established baselines to compare outcomes against; 30% said project scope changed too often; and 13% said investments lacked known objectives on which to base evaluation.

Three examples from the insurance industry indicate the opportunity cost. A global life insurer saved $35 million by eliminating projects that lacked clear objectives. A smaller, regional property and casualty (P&C) insurer found 30 full-time-equivalent (FTE) years tied up in two wayward projects lacking ties to business objectives.

A multinational P&C insurer having more than 20 million policyholders found that, in North America alone, it supported 375 business applications utilizing 56 development tools and 22 database engines. Portfolio-level scrutiny helped identify six out of 34 capability needs as truly critical (for example, “improved policy underwriting and processing”), so the company was able to prioritize and consolidate application maintenance and development efforts. Detailed analysis revealed its spending was excessive when compared with industry peers as well as many tactical savings opportunities. For example, the company was using internal resources to train contractors who were also invoicing training time as billable hours.

Skills and resources.

The percentage of respondents reporting that their IT staff lacked basic working knowledge of financial concepts was 46%; 37% reported frequent staff turnover; 28% said their companies lacked staff and resources to gather data; and 18% said their organization did not provide relevant training.

Business alignment.

Survey respondents cited a general lack of respect for IT plus communication problems between the CIO and business executives. Interviews revealed that some business leaders, in an effort not to expose their ignorance of IT, wasted resources by deciding on initiatives without IT consultation, then demanded that IT groups manage the projects well or take the blame. Meanwhile, some CIOs thought keeping business leaders technologically uninformed translated to job security and thus took little initiative to bridge the divide.

Forty-six percent said business leaders didn’t understand that ROI is not always applicable. For example, a manufacturing company’s CIO recalled how, until auditors finally expressed their concern, fellow executives continually dismissed project proposals for security and disaster-recovery assets because they couldn’t see immediate bottom-line benefits. As many as 36% of respondents saw a lack of mutual respect between IT and business executives; 30% perceived business leaders as lacking basic technological understanding; and 28% said business executives regarded IT as a “necessary evil.”

Surmounting the Hurdles

Significantly, the research reveals a significant skills gap. As many as 46% of respondents agreed that IT staff lack working knowledge of financial concepts. Although most IT staff know what NPV is and how to calculate it, they have trouble making a strong business case in partnership with business-unit executives.12 But, as the consumer packaged-goods company found, making a strong case can lead to executives increasing resources for high-value projects.

To improve the financial skills of IT people, successful ITPM adopters make such skills a formal part of training curricula. A cross-functional approach that involves IT, finance and lines of business is essential.

As the CIO of a major manufacturing company explained in an interview, “The business side did not realize how critical their involvement was. They were used to giving us rough ideas, and we would use our imagination to define what we thought they wanted. In addition, our attitude was a ‘Call me if you have a problem’ kind of thing. The challenge was to break through this behavioral traffic jam. Two things made a difference. First, senior leadership realized there was a need for a champion — someone to step up and get right down to the nitty-gritty. Second, we realized that both the IT and business people would gradually come around.”

Resistance to a centralized ITPM process sometimes comes from managers’ fear of losing budgetary ownership. As the CIO of a major financial-services firm observed, “Each business unit would manage its own IT budget. They saw corporate IT as taking away their flexibility, their independence, their freedom. It was a big concern for them, and it took us four years to change their mind-set.”

By its very nature, ITPM risks being viewed as a “corporate” project by the troops, and greater transparency is not always welcomed. Says the CIO of a capital-goods manufacturer, “We ran into a strong desire to keep costs under the radar screen. … IT projects were stuck into all kinds of different budgets. So the company always had this perception that we were a really low spender in IT just because it wasn’t visible.”

Strategies for Success

The ambiguity inherent in quantifying IT’s business value, the lack of communication, executives’ limited understanding of and low respect for IT, and IT staffers’ inadequate business skills — all translate to major organizational challenges for successful implementation. However, analysis of practices in the best-managed companies surveyed suggests four approaches that work: staged implementation strategy, creating a process for upgrading ITPM, ensuring that staff members are trained — and involving business-side people from the beginning.

Staged Implementation

Consistent messages heard throughout the research were that ITPM should be phased in iteratively and that performance feedback is critical. Says John Boushy of Harrah’s, “First, [IT portfolio management] instills the discipline of making sure that we are investing in those projects that are floated by the needs of the business and create a tangible return — as evidenced by the business case that has to be developed. At a later stage, that discipline then leads to not just evaluating projects on the front end, but comparing what the actual performance is on the back end.” Harrah’s continuously tested the results of its national customer-rewards program and quadrupled cross-market gaming in the first three years.

Most synchronized-level respondents weighed the following four dimensions in deciding how to stage implementation.

Organization.

Successful practitioners focused on specific parts of the organization (or budget) rather than taking on the entire company. Making ITPM work in one business unit or department helped win over skeptics and deter turf battles.

Components.

A well-known beverage producer, already focusing its ITPM initiative on U.S. operations, decided to limit its portfolio components in each stage of implementation. Thus the first stage addressed only application-development projects. In the second stage, the company added infrastructure assets to the portfolio.

Analytics.

A common pitfall is to include too many metrics. The research uncovered portfolio scorecards with as many as 400 metrics. Successful practitioners track no more than a dozen, just the ones that clearly tie to decision making. For example, if a strategic initiative is to increase operational effectiveness, a corresponding metric is “increase in inventory turns.”

Life cycle.

A key feature of a well-managed portfolio is having distinct sets of metrics for different types of investments. But top practitioners take this concept a step further and adjust metrics continuously as assets of projects progress through their respective life cycles. One organization, for example, measures expected risk and return of a project in the planning phase, then measures earned value in the delivery phase — and employee productivity during the maintenance phase.

Process To Upgrade ITPM

The most accomplished ITPM practitioners follow a well-defined process to implement capability upgrades. Five steps are common. (See “Steps To Establish or Upgrade IT Portfolio Management.”)

First is design, which defines the right objectives and secures buy-in from business leaders. During the second step, diagnosis, a new portfolio baseline is established, and the facts to be used in decision making are agreed on. Business units usually apply different IT budget categories: One counts telecommunications as IT, while another does not. That results in a mismatch of portfolio data that must be resolved. The agreed-on fact base is then used in the third step to define opportunities: quick-hit improvements, emergency remediation or realignment of projects within the portfolio.

The opportunities can be substantial. When the North American division of a large foreign car manufacturer decided to subject its 352 e-commerce initiatives to the rigors of portfolio diagnosis, only 30 core initiatives survived. Those that were redundant or lacked clear links to business objectives were terminated. The estimated savings from that expansion of ITPM scope was $45 million on an annualized basis.

Portfolio analysis revealed, for example, that the automaker had myriad product and services vendors working on conflicting and redundant projects under blanket purchase orders without any specific objectives or deliverables. Among the underlying issues: aging legacy systems that are unable to keep up with rapid demand growth; lack of a common technology platform to support business with 500 dealers; a decentralized management structure without incentives for cross-enterprise coordination; and a consensus-based culture averse to transformational change or termination of projects.

Recognizing it was misspending IT dollars, the car company set out to create an inventory of all projects, reassess business-capability needs and develop an investment-prioritization and decision-making mechanism. This resulted in ranking 352 discrete projects and 58 capability needs (for example, the capability to configure models, parts and accessories online) against six weighted prioritization criteria (for example, strategic fit, with a 5% weight; business economics, 50% weight; and operational impact, 20% weight). Each criterion was built from two to nine questions — each translating to a 10-point scale — such as “Does this project address an identified need?” “What is our expected payback period?” and “What is the expected risk- and time-adjusted return on investment?” In the end, only five of those 58 desired capabilities were judged to be business-critical.

A key characteristic of the fourth step, adding new tools or capabilities, is that the upgrades are opportunity-driven. Top practitioners select those capabilities that are most useful in pursuing the specific opportunities identified in the diagnosis step. The most highly valued capability among synchronized practitioners studied was to excel at measuring and managing the risk of project failure. A risk-management strategy for each project can significantly improve project success rates and may require relatively little effort compared with the cost of large projects. A simple but effective method is to plot possible risk events on the dimensions of probability of occurrence and severity of consequences. Then specific contingencies can be put in place to deal with risks that have a high level of severity.

Finally, at the fifth stage, new capabilities are incorporated into existing budgeting and decision-making processes. Approaches such as the Balanced Scorecard can help quantify the extent to which projects are aligned with strategic objectives, adding rigor to prioritizing. The resulting alignment can give a clear direction for IT. If assessment metrics geared to the individual case are built into the original project plan, companies will be able to monitor long-term portfolio health and, ultimately, success or failure.

Trained and Prepared Staff

Training people in the ITPM process as well as in financial and project-management skills enables them to develop better metrics to define IT success and failure for the particular situation. As project success rates improve, so should the returns of the entire IT portfolio. To attract the best personnel to join ITPM initiatives and to counter the perception that it’s an overhead activity for junior staff members, smart executives also design special reward systems.

Business Involvement From the Beginning

The key to bridging the business-technology divide and improving results is early communication. Not only must senior business managers understand more about how IT affects both strategy and the bottom line, but CIOs also need to learn to communicate the vision, strategies and goals of the IT organization in terms that non-IT executives can understand. The most effective partnerships studied were those in which the CIO took the initiative in engaging business leaders about ITPM and eventually transferred accountability to the business. “A major step in making business collaboration work was to stop referring to [ITPM] as an IT project,” said the CIO of a large capital-goods manufacturer. “We literally took ‘IT’ out of portfolio management.”

Pulling It Together

Although only 17% of the organizations polled are at the synchronized stage, the prize for that 17% appears to be substantial and suggests that becoming synchronized is the right move for others. The most successful practitioners experienced cost savings of up to 40% of pre-ITPM budgets, better alignment between IT spending and business objectives, and greater central coordination of IT investments across the organization. By following the steps to establish or upgrade ITPM and by benchmarking against synchronized companies, large organizations can make IT an integral part of their competitive advantage.