Information Systems Management

IS 483Information Systems Management

James Nowotarski

22 May 2003

• Recap risk management and RFP• Understand IT Outsourcing

Today’s Objectives

Topic Duration

• Recap risk management/RFP 15 minutes

• Assignment 2 reports 20 minutes

• Quiz 15 minutes

• *** Break 15 minutes

• IT Outsourcing 90 minutes


Today’s agenda

Topic Duration



• Quiz 15 minutes




Today’s agenda

IT Risk Management

• Economic

• Technical

• Organizational

• Legal

• Terrorism

Major Categories of Risk

Risks that can potentially affect the business• business environment changes• financial performance

IT Risk Management

• Economic

• Technical

• Organizational

• Legal

• Terrorism


Risks that can affect the development, implementation, and operation of a system• integrating technology with legacy• applying unproven technology• conversion may uncover “dirty” data• management inexperienced with projects of this size

IT Risk Management

• Economic

• Technical

• Organizational

• Legal

• Terrorism


Risks that can potentially result from lack of acceptance of a system• low morale• decline in effectiveness/efficiency

IT Risk Management

• Economic

• Technical

• Organizational

• Legal

• Terrorism


Risks arising from potential lawsuits and liabilities associated with implementation of a project• shareholder lawsuits• data privacy• Foreign Corrupt Practices Act (FCPA)

IT Risk Management

• Economic

• Technical

• Organizational

• Legal

• Terrorism


Risks arising from intentional destruction or malevolent modification of:• physical equipment• data• software• network

IT Risk Management

The process in which potential risks to a business

are identified, analyzed and mitigated,

along with

the process of balancing the cost of protecting the

company against a risk vs. the cost of exposure to

that risk.

Risk Management

Risk Frameworks

Fidelity’s Risk Cube

Risk Frameworks

Identify Analyze Mitigate Measure

Risk Awareness Risk ManagementRiskMeasurement

---------- Fidelity Risk Cube ----------

Risk Frameworks

RISK Cube - Key Questions

• R is for Return– Are we achieving an appropriate return for the risks we

take?

• I is for Immunization– Do we have controls and limits in place to limit

downside risk?

• S is for Systems– Do we have systems in place to measure and report

risk?

• K is for Knowledge– Do we have the right people, skills, culture, and

incentives for effective risk management?

Risk Management Approaches

Risk Management Approaches

• Interdisciplinary Approach

• Portfolio Approach

• Options Thinking

• Chaos Theory

Risk vs. Technology Maturity

Impact of Technology Maturity

Risk Early Adopter Mid Adopter Late Adopter

hands-on implementation experience little exper / high riskmore exper / mid risk

much exper / low risk

vendor survival for project after shake-out high risk mid risk low risk

sudden changes in direction of technology high risk mid risk low riskintegrating technology with existing portfolio

high risk mid risk low risk

Benefits

Period for Start of Payoff Short term Mid term Long term

Size of Returns per period Biggest Bigger Big

Risk Management at Project Level

Steps Taken by Prudent Managers

• List the risks that could occur and when they could occur

• Determine what detection method can alert IS that risk occurred

• Establish detection method

• Estimate each risk’s probability of occurring

• Formulate plans that can mitigate each risk

• Establish teams that will monitor and mitigate the risk

Procurement - Process

RFP Process

1. Pre-RFP

2. RFP

3. Proposal Submissions

4. Proposal Evaluations

5. Vendor Selection

6. ProcurementMethod

7. ROI Analysis

8. NegotiateContract

Objective: Identify best solution to meet stated business need while minimizing cost and risk

Topic Duration



• Quiz 15 minutes




Today’s agenda

Topic Duration



• Quiz 15 minutes




Today’s agenda

Topic Duration



• Quiz 15 minutes




Today’s agenda

IT Outsourcing

• On average, commercial organizations outsource 40% of their IT budgets

• “Outsourcing is one of the greatest organizational and industry structure shifts of the [20th] century” -- James Brian Quinn, Amos Tuck School, Dartmouth

Information technology (IT) outsourcing is widely accepted by most commercial organizations

IT Outsourcing

• Cost reduction -- Perception of IT as a cost burden coupled with availability of cheaper sources of services (e.g., near-shore and offshore)

• Cost predictability

• Require improved performance levels (e.g., speed of delivery, customer satisfaction, quality, etc.)

• Refocus on corporate core competencies

• Desire to have in-house IT resources focus on strategic systems and/or technology

• Lack of ability and/or willingness to hire/retain IT skills

Information technology (IT) outsourcing is the use of a third party to provide services rather than using those in-house.

Drivers

IT Outsourcing

“[g]et rid of context and focus on core” - Billy McCarter, former CIO of Fireman’s Fund, who reduced IT staff from 1,100 to 600 with much of the work outsourced to offshore workers

A desire to focus on core competencies is frequently the strongest driver to outsource

“[a]llows me and my staff to focus on fun areas . . . be more productive, more visible to the business, understand what the business needs versus worrying about whether one of the servers needs additional RAM” - Daniel Sheehan, CIO at Advo, Inc. (infoweek, 4/14/03)

IT Outsourcing

IT is often viewed as a commodity and, thus, not “core”

• IT is like electric power -- a commodity that is required by all but provides distinction to none

• IT capability is broadly accessible and affordable

• New or proprietary technologies offer opportunity for companies to gain a step, but this advantage is short-lived

• Further evidence of IT commoditization:– overcapacity– price drops– vendors positioning selves as “utilities”– bursting of the investment bubble

Carr, N. “IT Doesn’t Matter.” Harvard Business Review. May 2003.

IT Outsourcing

• Chipmakers no longer make chips

• Pharmaceuticals outsource new drug research

• Government outsources prisons

• Apparel firms outsource apparel manufacturing

Processes once considered core are now candidates for outsourcing.

Examples

IT Outsourcing

• Data center operations

• Network operations

• Application maintenance

• Desktop workstations

• Help desk/Support

• Application development

• Business process execution

What parts of IT to outsource?

most common IT activities to outsource

IT Outsourcing

• Transitional Outsourcing

• Selective Outsourcing

• Total Outsourcing

To what extent should you outsource?

most common approaches

IT Outsourcing

What is it• Outsource legacy systems• Focus in-house staff on development of “new world”• Outsourced activity may return in house at some point

Transitional Outsourcing

Advantages• Legacy systems are well-understood, facilitates

specifying outsourcing contract terms• In-house organization moves on to next new thing (Tarzan

grabbing the next rope in the IT jungle)• Contract may be shorter termDisadvantages• Vulnerable to loss of vendor support if new system is

delayed • More vulnerable to vendor manipulation of pricing,

maintenance costs

IT Outsourcing

What is it• Select the best-of-breed for an activity

Selective Outsourcing

Advantages• Creates a competitive environment• Enables staff to be retained and redeployed• Provides flexibility to adapt to changes • Less risky than total outsourcing

Disadvantages• Overhead associated with multiple evaluations,

multiple contract negotiations, and multiple vendors to manage and coordinate

• Dividing up pieces of infrastructure (e.g., help desk and network management) can lead to trouble since the pieces are integrated

IT Outsourcing


“Global access to Enterprise Service Providers (ESPs) with low cost structures is accelerating outsourcing adoption rates, leading to the proliferation of mixed-sourcing delivery models in which the ‘best’ provider of a particular service wins.” (Gartner 2003)

IT Outsourcing


“Today, businesses look to "selective sourcing & services" for their IT infrastructure, operations and management needs. With selective sourcing the focus is on securing services for very specific needs. Using managed contracts, selective sourcing has proved very successful in limiting risk, motivating vendor performance and achieving goals. With selective sourcing/services organizations have the best of both worlds with the flexibility to select a best practice supplier while maintaining overall control of their IT practices.” -- Strategic Sourcing Advisory Council, http://www.ssacouncil.org/

IT Outsourcing


“I don’t believe you should have a dozen partners, because then it’s not a real relationship” -- Mukesh Mehta, VP of IT at Metropolitan Life, InformationWeek, 23 December 2002

IT Outsourcing

What is it• Use one vendor for many activities• Extreme outsourcing: At least 50% of IT functions

outsourced

Total Outsourcing

Advantages• Consistency and stability with same vendor for many

activities• Lower overhead because there is only one vendor

Disadvantages• More vulnerable to vendor manipulation and loss of vendor

support• Lack of competition between suppliers• One vendor cannot be best across the whole spectrum• Needs can change dramatically after 1-2 years

IT Outsourcing

Survey Results

Type of sourcing Success Failure Mixed

Total outsourcing 38% 35% 27%

Selective outsourcing 77% 20% 3%

In house 76% 24% 0%

Source: Study of 116 companies by college professors Mary Lacity and Leslie Willcocks, Computerworld, 10 May 1999

IT Outsourcing

Consider business, economic, and technical factors in deciding whether to outsource

Business Considerations

Outsource

Insource

Commodity Differential

Critical

Useful

StrategicImportance

Potential for Differentiation

IT Outsourcing

Consider business, economic, and technical factors in deciding whether to outsource (cont.)

Economic Considerations

Outsource

Insource

Subcritical Critical

Leading

Lagging

ManagerialPractices

In-House Economies of Scale

IT Outsourcing

Consider business, economic, and technical factors in deciding whether to outsource (cont.)

Technical Considerations

Low High

High

Low

Degree of TechnologyIntegration

Degree of Technology Maturity

Outsource

Insource

IT Outsourcing

Give examples of applications that would be good candidates for insourcing and outsourcing based on technical considerations

Technical Considerations

Low High

High

Low

Degree of TechnologyIntegration

Degree of Technology Maturity

Outsource

Insource

IT Outsourcing: Offshore

IT organizations and solutions providers are increasing their offshore capabilities for both maintenance and development

• JP Morgan

• Merrill Lynch

• Lehman Brothers

• Ford

• NY Stock Exchange

• Motorola

• Boeing

• Household

• Many unpublicized

IT organizations• Accenture

• IBM

• HP

• Offshore firms, typically with local presence

Solutions providers• Legacy

maintenance

• New development

• Projects requiring specialized expertise, e.g.,

– Embedded software

– ERP

Types of projects

• Reduce cost– 40-50% savings, according to Merrill Lynch CTO

• Higher quality/capability– Approximately 50 out of 70 CMM Level 5 systems

development organizations are in India

Cost and quality are the two main reasons for going offshore


• Highly capable workforce

• Focus on process and product quality

• Low labor and infrastructure costs

• Government commitment and support

• English language skills

India is the leading location for offshore sourcing

Reasons


• North American brokerage firms spent $417 million on offshore contracts in 2002 and will spend $1.31 billion by 2005 (a compound annual growth rate of 46.4 percent)

• In cumulative terms, 8,150 U.S. Wall Street IT jobs (or 15 percent of the four-year moving average IT headcount) will head offshore between 2002 and 2005.

• India's share of outsourced work from U.S. securities firms will rise in 2003 to 94 percent, but will settle at 84 percent by 2004 as other offshore locations (including China) gain ground

• Reasons cited for India’s success:– Low labor costs– Sophisticated processes to manage offshore projects– Highly certified staff

(Source: Intelligent Outsourcing Strategies, March 24, 2003)

Wall Street’s top firms are investing heavily in offshore outsourcing of IT and operations


• U.S. financial-services companies plan to transfer 500,000 jobs, or 8% of total industry employment, to foreign countries in the next 5 years

• Involves a wide range of work, including financial analysis, regulatory reporting, accounting, and graphic design

• Example of cost savings: A Wall Street researcher with a college business degree and a few years experience can earn as much as $250K, compared with $20K in India.

• Corporate chiefs list India as the most attractive country, followed by China, Philippines, Canada, Czech Republic, Mexico

• Among the most aggressive U.S. companies: GE Capital, Citicorp, American Express.

Wall Street Journal, 1 May 2003

Wall Street’s top firms are investing heavily in offshore outsourcing of IT and operations (cont.)


IT Outsourcing

• High costs associated with white collar labor• Heavy data processing that financial firms face• Not only IT services

– Outsourcing business processes such as check processing ($7-8/hour vs. $12-16 for U.S. worker)

• U.S. and Indian services firms are pairing up to provide onshore/offshore model to financial services companies

- InformationWeek, 12 May 2003

Wall Street’s top firms are investing heavily in offshore outsourcing of IT and operations (cont.)

• Salary costs in India are going up

• Undervalued currency (rupee) could gain 20-30% against the dollar

• Vietnam, China, and Philippines are training armies of programmers to compete with India

India’s advantage is beginning to erode

Reasons


• English or language difficulties

• Lack of industry-specific knowledge

• Distrust

• Communication/Coordination– “Outsourcing is prone to failure because of breakdowns in

communications between outsourcing providers and their clients, according to Gartner” (InformationWeek, 3/31/03)

Need to manage risks of offshore outsourcing

Potential Risk Areas


• Which statement do you agree with and why?

Discuss

Outsourcing offloads a burdensome technical responsibility and allows management to focus on its core business.

Outsourcing strips a company of an important core competence -- IT know-how.

• Some industry watchers believe that certain functions ought always to be retained in-house. For instance, “application maintenance is the most dangerous thing to take out. This is very subtle, but it’s the glue that sticks everything together. If you outsource it, you lose the ability to understand and change your environment.”

– Peter Bendor-Samuel, president of Everest Software Corp., Dallas-based outsourcing consulting company, Software Magazine, July 1998

Discuss

• “Outsourcers are good with day-to-day repetitive tasks, but not with implementing bleeding-edge technology. Those who are successful ‘focused on infrastructure, which is 80% of an IT operating budget. Infrastructure is a lot easier to outsource than application development.’ ”

– Mary C. Lacity, associate professor of management information systems at the University of Missouri in St. Louis, Computerworld, 10 May 1999.

Discuss

• Losing skills in functions/processes that are outsourced• Internal backlash from staff who fear outsourcing• Loss of control over quality and timing of outputs• Provider may sell or leak buyer’s solutions to competitors• Lack of face-to-face communication can hinder applications

development

There are several risks to be managed

IT Outsourcing

Risks

What are the implications of all this on IT managers?

Discuss

IT Outsourcing Trends

• More outsourcing of things that were traditionally mission-critical, such as billing services (optimize, 12/02)

• It takes 3-6 months for offshore IT project managers to gain authorization to visit the [client] company’s US offices . . . last year the typical waiting period was 1 month (InformationWeek, 3/31/03)

Trends


• Technology Business Research analyst Humberto Andrade says he expects revenue generated by IT outsourcing deals to increase 12% to 15% this year compared with last year (Source: InformationWeek, 11 April 2003)

• Almost one in five companies plan to increase their spending on IT outsourcing in 2003 (Source: Internet World, 23 December 2002)

A Growing Market


• HP will manage IT infrastructure, data center, desktop, and user support, network management, and application development at Procter & Gamble Co. operations worldwide. It sealed the $3billion, 10-year deal last week (InformationWeek, 14 April 2003)

• Motorola farming out much of its IT infrastructure to Computer Sciences Corp. in a deal valued at $1.6B . . . CSC will run desktop and midrange technology, including global help-desk and network operations. IT will also acquire some of Motorola’s physical IT infrastructure and network assets (InformationWeek, 14 April 2003)

Recent News

End of slides

5. Vendor Selection

• Vendor site visits

• Weighted score method

• Final cost, value, and risk analysis

– Costs

-- one-time vs. recurring

-- fixed vs. variable

– Benefits

-- tangible vs. intangible

6. Procurement Methods

• Purchase

– not that popular because of fear of obsolescence

– longest-term commitment of these 3 methods

• Rent

– usually less than 1 year in duration

– only need to give 30 days’ notice to cancel

– more expensive than purchase or leasing

• Lease

– usually 12-36 months in duration

– often done with an option to buy

– middle of the pack in terms of cost and ability to get out

7. ROI Analysis

• Must be able to calculate the income stream in $

• Not usually able to calculate for:

– Strategic investments

– Informational investments

– Infrastructure investments

• Usually able to calculate for:

– Transactional investments

investment Totalinvestment on Earnings

ROI

8. Contract Negotiation

• Do’s

– Include vendor responses to RFP in the contract

– Keep lawyers at bay until Statement of Work is complete

– Leverage outside expertise in negotiations

– Provide incentives/penalties

• Don’ts

– Buy vaporware instead of proven solutions

– Purchase low bid unless the value is there

– Settle on final offer prematurely

8. Contract Negotiation

• Agreement between firm and vendor

• Was outlined in the RFP, now it gets finalized

• Includes

– Software characteristics

– Implementation plan

– Technical architecture

– Training strategy

– Maintenance and support

– Service levels (SLA items)

– Cost schedule

Statement of Work

Approach to qualityDefinition of quality metrics

• “Incentives can bring vendor behavior in line with a client's expectations, thereby improving performance, but they can also distort it, causing performance to drop”

You Get What You Measure

Statement of Work

Approach to Quality and Measurement

Plan

Do

Check

Act

1. Identify quality standards and goals

2. Measure project performance

3. Compare metrics against goals 4. Conduct quality reviews, e.g., peer reviews5. Test for defects

6. Eliminate causes of deficient performance- fix defects- fix root causes

Statement of Work

Quality Metrics

Progress Measures the amount of work accomplished by the development team in each phase

Quality Evaluation Effort Measures the percentage of the development effort spent on internal quality evaluation efforts

Test Coverage Measures the amount of the software system covered by the testing process

Defect Detection Efficiency

Measure percentage of the actual defects originating in a stage of the project that were actually detected in that stage

Requirements Traceability Measures the percentage of the requirements that have been addressed by the system

Defect Removal Rate Measures the number of defects detected and removed over time

Defect Density Identifies defect-prone components of the system

Customer Satisfaction Measures customer satisfaction using objective surveys.

Procurement - Process

RFP Process

1. Pre-RFP

2. RFP

3. Proposal Submissions

4. Proposal Evaluations

5. Vendor Selection

6. ProcurementMethod

7. ROI Analysis

8. NegotiateContract

Information Systems Management

Business

downside risk

report risk

effective risk management

exper mid risk

fidelity risk cube

minutes quiz

minutes todays agenda

exper low risk vendor