IT portfolio management

Balancing risks and rewards of projects yields significant returns.

By Joanne Cummings
Network World, 04/01/02

Investing your entire nest egg in one risky Enron-like venture is unwise to say the least. So why do so many IT organizations bet the bulk of their budget on one huge risky project? Diversification works well for your stock portfolio, so why not apply it to your IT project portfolio as well?

That's the point of IT portfolio management, a methodology for ensuring that every project within an IT organization's "portfolio" is analyzed and balanced for risk and return. When implemented right, IT portfolio management ensures that the entire range of IT projects performs successfully in real world conditions.

"It's not unusual for an IT organization to carry one high-risk project, and not much else," says Doug Hubbard, president of consultancy Hubbard Decision Research, in Glen Ellyn, Ill. "But if your stock portfolio looked like that, you'd be in trouble."

IT portfolio management helps get a handle on that. "It ensures that every project makes sense in terms of risks and rewards. If the risk is too great or the reward too little, the project doesn't get funded," Hubbard says.

Mary Lou Griffith, senior IT planning adviser in the Department of Information Services (DIS) for the State of Washington, agrees. The state adopted IT portfolio management about three years ago, and has since seen the average IT project decrease in size, scope and complexity, while the success rate has increased markedly.

Prior to implementing diversification principles, the state had been struggling with huge unwieldy projects. One such project, the License Application Migration Project (LAMP) eventually grew too big, ate up a lot of funding, missed scheduled deliverables and was cancelled, but not before a great deal of money and IT trust were lost.

We had to turn the lights out on LAMP," Griffith says. "After that, we decided we needed to find a better way to manage these things."

In its most basic terms, IT portfolio management consists of three steps. The first is to list in a central place every IT project in the organization, together with its resource requirements and stated objectives.

"You see right away where projects overlap," says James Albin, vice president of IS for Mercy Health Partners in Toledo, Ohio. "Inevitably, some of those projects either get pared down or stopped altogether. That's a savings right there."

Evaluate risk and return

Unfortunately, that first step is where many organizations stop the process. But the key to reaping the true benefits of IT portfolio management is following through and evaluating the projects for risk and return.

According to Hubbard, the major risk factors most often glossed over by IT are project size, adoption rate/utilization and chance of cancellation. "People don't evaluate the risks, or the benefits for that matter, because they say they are intangible," Hubbard says. "But there are no intangibles. You just haven't figured out how to measure them yet."

For example, a typical intangible benefit to many IT projects is user empowerment, or giving users a bigger voice in the overall business. "Well, how would you know if users were more empowered?" Hubbard asks. "Maybe product development is faster, product quality is higher, the organization is more flexible. Those things can be measured. They're not intangibles."

For its part, Washington state has put together its own risk assessment matrix, in which it categorizes projects as low, medium or high risk in terms of their effect on the public, their visibility and the consequences of failure. A main criteria that lands projects in the high-risk area is a budget of more than $10 million.

"Since we've implemented this, we see very few projects as large as that," Griffith says. "It's in the end-user agency's best interests to keep things small, and keep them under the radar. The benefits would have to be particularly high to get past such a high risk factor."

Ongoing risk and value assessment

Step three, ongoing risk assessment, is also often overlooked. Risks need to continually be assessed as the project progresses. "If there's a slip in time, cost or scope, those are new parameters and they need to be assessed again in terms of risks and benefits," says Howard Rubin, executive vice president at Meta Group. If the benefit no longer outweighs the risk, the project needs to be revamped or even cancelled.

Another area people need to focus on is value, Rubin adds. "Too often, IT is focused on delivering projects on time, and on budget, when the real concern should be whether the intended value was delivered." If the project goes like clockwork, but doesn't gain acceptance, it's still a failure, he says.

When implemented correctly, IT portfolio management ensures that the projects IT implements are those that will deliver the most value to the business, an important point in this lean era of tight budgets.

Mercy Health Partners' Albin has already seen those benefits. Since his organization adopted IT portfolio management, it has been able to lop $4 million off the IT budget without significantly affecting patient care or services. "We were going to have to lose the $4 million anyway for budgetary reasons," he says. "But portfolio management has helped us ensure the money we do spend gets earmarked to the right projects with the highest value and return."