CHAPTER 6:
SYSTEM DEPLOYMENT AND PROJECT RISK

The fast-changing information economy drives organizations to continuous information innovation, to find new ways of manipulating information to identify new avenues for competitive success. This, combined with relentless cost pressure, drives organizations to attempt continuous system and process improvement, usually expressed in the form of system upgrades, system development, or system deployment. Increasingly, organizations ‘bet the farm’ on the successful development and deployment of new systems, in a business environment that can change so fast that the original assumptions on which a project’s rationale were based can become fatally undermined prior to its completion.

These projects have ceased to be IT projects; they are complex ‘whole business’ projects, with varied impacts across the business as a whole, requiring input and resource from many areas other than the IT department. They are business projects and are too important to the strategic health of the organization to be left to the IT department or to be the management responsibility of one person alone.

IT departments increasingly recognize this. In both the public and private sectors, IT-enabled business projects are critical to the organization’s business model and the deployment of its business strategy. Stakeholders believe that IT-related projects should deliver measurable business benefits.

Guideline for Directors: boards need a framework that will deliver those benefits and enable informed reporting to stakeholders.

Project failure

The strategic vision must be translated into operational systems and organizations don’t have much of a track record of successful execution. According to research (‘the Chaos Report’) by the Standish Group, the US Government and businesses together spent US$81bn on failed projects in 1995 alone; on top of that, there was another US$59bn for project over runs.

• On average: one-sixth of the projects were completed on time and within budget.

• On average, at the point a halt was called, the failed projects were:

– 189 percent over budget;

– 222 percent behind schedule;

– Contained only 61 percent of the original specification.

The UK’s Office of Government Commerce (OGC) agreed with the National Audit Office (NAO)53 that the common causes of failure in government IT-enabled projects included:

1. Lack of a clear link between the project and the organization’s key strategic priorities including agreed measures of success;

2. Lack of clear senior management ownership and leadership;

3. Lack of effective engagement with stakeholders;

4. Lack of skills and proven approach to project management;

5. Lack of skills and proven approach to risk management;

6. Evaluation of proposals driven by initial price rather than the long term; value for money (especially securing delivery of business benefits);

7. Inadequate resources and skills to deliver the total project.

Experience teaches that these are also the reasons for private sector project failure. Common perceptions of the outcomes of IT projects, in both the public and private sectors, include:

• Deadlines not met;

53 HM Treasury letter dated 11 February 2003

• Budgets overspent;

• Quality worse than expected;

• Core business processes negatively impacted;

• Absence of innovation;

• Increased transitional or operational costs;

• Damaged reputations;

• Weakened competitive position.

Project governance objectives

While it is a common perception that large projects are IT related, the fact is that all large projects are essentially business projects. IT, like information, is pervasive in all organizations and, if IT is truly a business enabler, then every major project must in reality be a business change project, that has impacts on and requirements of many aspects of the organization, from culture through to process.

This means that no IT-based business project should ever be managed on a standalone basis, nor should it be managed as an IT project (ie it should not be led by IT people, nor should IT people be in a majority on the project board; business users, empowered to ask – and get answers to – detailed questions should form the majority on such boards). Every such project needs cross-organization buy-in and, because of its complexity and broad scope, is (usually) incapable of being run by a single, accountable person. Complex projects need to be managed with a governance framework that assures all stakeholders of appropriate input and which locks them into the success of the project. All the key change management principles need to be deployed alongside the traditional project management techniques if the project is to succeed.

Project governance has six interlinked objectives:

1. Ensuring real business value: any project must be linked to key strategic business goals, must strengthen the business model and project plans must continue to be aligned with business objectives – and, in a rapidly changing business environment, failure in this single aspect can often signal failure overall;

2. Controlling cost: centralized program and project management resourcing enables the organization to monitor and – through standardization and use of existing infrastructure - control costs more effectively – and dynamic budgeting, which allows for rapid re-alignment of expenditure, is a discipline that is appropriate for critical projects that are taking place in a fast changing environment;

3. Resource maximization: high-value internal (and external) resources can be allocated as appropriate to conflicting projects in a way that helps, rather than hinders, the business – and, in a rapidly evolving business environment, resource maximization is a dynamic discipline;

4. Risk management through portfolio balancing: the organization can assess (preferably on an ongoing basis) the range of risks, resource requirements and cost requirements across all its projects and implement appropriate controls to keep its overall exposures within its preferred tolerances;

5. Uniform application of best practice: the organization can ensure that those techniques, processes and skills that are most likely to ensure success in its project portfolio are applied across all its projects.

PRINCE2

The deployment of Prince2 (or any other recognized and comprehensive project management methodology), while not, of itself, sufficient to ensure successful project execution, is a pre-requisite. Deployment of Prince2 can only be effective where the internal customers, the users, have been fully trained in their role and where the organization’s programme office (if there is one) is independent of the IT function – usually reporting directly to the CEO.

Prince2 projects that are implemented outside a clearly defined IT governance structure are as likely to fail as are projects that have no formal project management methodology.

6. Organizational coherence: the organization can ensure that all projects adhere to the organization’s agreed IT enterprise architectural standards, cross-organizational policies and procedures, and the business model.

Execution risk

There are four levels of project risk, each of which needs to be considered and appropriate dispositions made. Not all of them are ‘simple’ execution risk.

• Corporate or strategic (political, commercial, financial, environmental, cultural) risks that can derail a project, however well it is being handled at all the other levels;

• Programme (expertise, funding, procurement, organizational, security, safety, continuity) risk is a combination of external and internal factors;

• Project (expertise, technical, scheduling, quality, providers, resource) risk is directly execution-related;

• Operational (expertise, cost, scheduling, quality, infrastructure, culture, processes, other parties) risk arises more from the challenges posed by an existing infrastructure and other demands on any of the parties to a project than it does from a narrowly defined failure of execution. A successful project requires an appropriate operational environment.

Execution risk needs to be addressed at all four levels, and from within a coherent, organization-wide risk treatment framework that assesses risks, and appropriate methods of controlling them, in a consistent, business strategy-focused way.

Good corporate governance (looking after the interests of the shareholders) demands that boards take appropriate steps to manage project risk and ensure effective project governance. The Standish Group, in a 2000 repeat of its earlier survey, identified project success factors, and their average contribution to the success of the project, as:

1. Executive support (18 percent)

2. User involvement (16 percent)

3. Experienced project manager (14 percent)

4. Clear business objectives (12 percent)

5. Minimized scope (10 percent)

6. Standard software infrastructure (8 percent)

7. Firm basic requirements (6 percent)

8. Formal methodology (5 percent)

9. Reliable estimates (5 percent)

The most significant success factors are, clearly, all organizational: between them, the top five factors account for 70 percent of the reason for projects to succeed.

Guideline for Directors: project success is the result, in two words, of project governance. Executive support is critical. The board cannot stay aloof.

Executive level project governance

The executive is responsible for delivering specific components of an effective project governance approach:

1. Ensure that the business reason for any project is clearly understood and communicated throughout the organization;

2. Ensure that the board and senior management actively support the project, and that authority and accountability are unambiguously defined at all levels;

3. Customize the organizational structure (ie the inter-related programme and project boards, user groups, etc) to ensure project success, break large projects down into components of a total programme which is actively programme managed, and ensure that a comprehensive change management methodology is deployed;

4. Carry out a thorough critical path analysis, within the overall project portfolio, to ensure that all project plans – particularly those that draw on the same resources - are realistic;

5. Develop and deploy an appropriate risk treatment plan that is integrated into the overall corporate risk treatment plan;

6. Deploy a recognized project management methodology, having first ensured that everyone involved in the project (including users and providers) are fully trained in the methodology and capable of providing their required input;

7. Ensure that the programme has adequate resources at all levels.

Board level project governance

IT investment decisions (for OR against) expose an organization to significant risks, financial, operational and competitive. The board must insist that project risks are assessed within the organization’s strategic planning and risk management framework and ensure that the right investment and management decisions, the ones which enhance competitive advantage and deliver measurable business value, are made. Ultimate accountability for the effective management of the project portfolio must rest with the board as a whole, rather than with any one individual.

Guidelines for Directors:

1. Recognize at board level that program and project governance is a ‘must have’, and that the board is accountable for approving project initiation, for managing the project portfolio and for expeditiously pulling the plug on under- or non-performing projects;

2. Make one or more non-executive board members specifically responsible – within the IT governance framework – for overseeing project governance, and enable them to have independent, informed oversight of progress on all business IT projects – including attending program (or large project) board meetings. If necessary, bring in external expertise to fill any board level knowledge gaps and ensure that the criteria by which the board will review project progress are SMART (specific, measurable, achievable, risk-measured and time-bound), clearly defined as part of the project planning and initiation process, effectively communicated, and acted upon;

3. Require clear, unambiguous identification of accountability at all levels of every project, with detailed and rigorously tested project plans based on a critical path analysis and that contain clearly identified critical success factors, regular milestones, clearly defined ‘go-no go’ checkpoints, with clearly specified and allocated resource that allows for a margin of error. Where necessary, insist that appropriately qualified and experienced staff are recruited or retained before project approval is given;

4. Ensure that every project proposal contains a full business case, with a fully costed (ie Total Cost of Ownership) estimate that can stand up to independent audit, with clearly stated assumptions that can withstand rigorous analysis. Vague or aspirational assumptions should be immediately struck out of any proposal. Return on Investment criteria must be the same as those applied to any other investment decision and the possible return on every project must be assessed in comparison to any other investment opportunities the board may have.

5. Ensure that the board and its IT committee has available to it experienced, independent professional IT advisers, and that their advice is taken and considered;

6. Manage all IT related projects as part of a portfolio, so that all the benefits (including the risk management ones) of this approach can be enjoyed and so that there is a widely understood strategic approach across the organization;

7. Adopt and deploy a recognized project management methodology, ensuring that everyone involved in the project (including users) is trained in it and has a full understanding of their roles and responsibilities;

8. Adopt a clearly defined, programme and project level, risk management plan that reflects the corporate level risk treatment requirements. Ensure that the risk management plan and selected controls are reviewed and confirmed on a regular basis;

9. Establish a monitoring framework that informs the board of progress and provides an early alert – not just of divergence, but of slippage in any of the critical success factors. Ensure that project monitoring includes a regular, planned review of the assumptions that were fundamental to adoption of the project in the first place: is the project still relevant, are the reasons for pursuing it still as strong, and are the expected benefits still capable of realization? If not – and in a fast-changing business environment projects can be overtaken by events – the project should be pulled and resources redirected more appropriately;

10. Commit funding only on a phased basis. While the total funding requirement needs to be available at the outset of the project, funds for the next stage should only be released once this stage has been successfully signed off and the original project assumptions confirmed as being still valid;

11. Internal audit should include appropriately qualified and experienced auditors, capable of assessing and reporting accurately on IT projects, who have open access to all parts of the organization – and to any external contractors involved in the project. They should be accountable directly to the board for providing regular, timely and unambiguous reports on progress, on project slippage against planned milestones, budget, requirements specification and quality requirements. When internal audit identifies project divergence, the board should not release further funds until it is satisfied that the cause of the divergence has been fully dealt with.

Conclusions

In the global information economy, which is characterized by information and knowledge intensity, networking and connectivity, and in which the capture and deployment of knowledge is intrinsic to an organization’s competitive position and to its intellectual capital value, IT-supported business project execution becomes fundamental to its survival. This makes IT project governance one of the board’s most important responsibilities.

An effective IT project governance framework also enables listed companies to explain to stakeholders how the company is aligning its strategic and technology objectives to maintain and grow market position and deliver long term shareholder value in this information rich, competitive environment.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset