Sarbanes-Oxley and IT portfolio management to help manage risk

There is an interesting contention made in a recent article in the Sarbanes-Oxley Compliance Journal. (Note: I read that sentence over and realized I used the word interesting in a sentence mentioning SOX compliance. That is a first. I apologize to any of you who are riveted by SOX compliance). The author, Jan Sondergaard (VP of Products, HP) correctly asserts that many IT organizations are viewed as "black holes" or "bottlenecks" but takes it one step further and say that this is reflective of the inability of many IT organizations to "automatically capture, view, and report on all of the work IT is doing." And as a result, this deficiency creates real corporate risk making "sustainable Sarbanes-Oxley compliance impossible."

The author further contends that the "best way to implement standards across an organization is to take a top-down project and portfolio management approach that allows you to define and enforce 'control points' throughout the processes" and to "take project and portfolio management solutions that offer real-time alerts and indicators."

So a couple of interesting points/questions this raises:

1. I'd love to hear from any organizations who are using their portfolio management discipline as a source of SOX compliance. In general, I don't think I've seen that as the purpose behind a corporate portfolio management effort, but if the CPM discipline can aid in SOX compliance, it's an obvious benefit. Please leave a comment and let me know if you are doing this, and perhaps we can get a dialogue going.
2. Of course, those of you with opinions on this topic of any kind should also leave your comments.
3. Regarding the article itself, I like and am intrigued by the idea as I do feel that the rigor that a CPM effort would instill around IT investments can definitely help mitigate risk and offer insights into the behavior/nature of IT spending.
4. That said, the article does come from the "portfolio tool as savior" school of thought with dashboards, workflows and real-time alerts all being highlighted as the means to get at "accurate, reliable information that IT professionals at all levels can more effectively respond to the demands of the business while creating a culture of accountability that can support current and future regulatory requirements." This I disagree with on multiple levels:

• Technology solutions are not a panacea to any type of problem - regulatory or not. You must understand what your objectives are, what process you are trying to enable, etc and then think of how technology might aid in this effort.
• Portfolio management solutions do not magically create accurate, reliable information nor do they force accountability. They create rules (good or bad) which people, if not properly educated and incentivized can circumvent and/or ignore.
• If building a portfolio management process, you should aim to build it as a capability -- not as a process to enable just support of regulatory requirements. CPM is a powerful discipline which has widespread organizational uses and so building it in a sufficiently robust way will enable it to offer insights into SOX compliance but will also give it significantly more ability to contribute to the organization on other pressing fronts including ensuring achieving financial, strategic and risk-oriented goals.

I am glad that Mr. Sondegaard raises this idea around CPM and SOX as it is quite interesting and has some merit. I think the means to achieve what he is talking about maybe enabled by a technology solution, but that is not the first priority.

Followup on Gartner ITxpo 2006 Program & Portfolio Management panel

I had the opportunity yesterday to participate in a panel at the Gartner ITxpo on the topic of Corporate Portfolio Management. I was pleased (and surprised) to see the room was standing room only so obviously the area of corporate portfolio management is a hot one. The focus was, of course, on IT portfolio management given Gartner's deep expertise and relationships with IT professionals.

Besides myself, there were 3 other panelists who I had the pleasure of meeting including: Michael Menke of HP, San Retna of Transformaction and Mark Stabler of AAA of Northern California, Utah and Nevada. Each of us were asked to speak about our own organizational efforts around CPM and then we had a lively session of Q&A facilitated by Matt Light of Gartner.

A couple of observations from the discussion:

• Many organizations are still defining their portfolio management efforts around IT.
• Organizations seem focused on governance first and process second. So I heard much alphabet soup around PMOs and various IT councils, but this seems counter-intuitive. If the process is well-defined, the governance can then be established around this. If you don't what you are trying to enable, governance structures are pointless. Additionally, much of the governance structure seemed bureaucratic.
• I received a couple of questions about how American Express' Investment Optimization effort is enabled, i.e. what technology/software are we using? Again, as previously mentioned in prior posts, technology should not be your first concern. Understand the process and change behavior. But it seems that there is still a huge focus on "what tool should I use?" Matt Light probably summed up the over-focus on tools with his statement - "A fool with a tool is still a fool."

All in all, it was a great session, however. It was nice to see so many people in attendance who are also passionate about Corporate Portfolio Management. I also had the opportunity to meet many trendsetting prospective and existing practitioners moving their organizations towards realizing the benefits of CPM.

For anyone in attendance at the panel, were there any other insights you gleaned from the session that are worth highlighting?

Taking Corporate Portfolio Management beyond IT

I remain amazed at how the entire portfolio management discipline has become largely focused on enabling corporate portfolio management for IT investments. Granted, most organizations do struggle with their IT expenses. Many (most) do not even fully understand that these IT expenses are in fact investments, but this fixation on IT is a bit stifling - as it minimizes the impact that CPM can have on an organization.

Corporate Portfolio Management should be used for any area where discretionary expenditures and hence investments are occurring including advertising & promotion, innovation/R&D, operations, sales, IT, capital expenditures, etc. This means looking past just your capital expenditures but also looking at operating expenses which, today, maybe considered business as usual, but which in fact, can be highly discretionary.

Conversations with numerous companies shows that 25-40% of a company's operating expenses are in fact discretionary (industry dependent). While the added scrutiny will likely not appeal to people who've become used to a certain size treasure chest to play with, this huge percentage does underscore the massive opportunity organizations have before them if they can optimize their portfolio. For owners of these expense pools, CPM lets you articulate where you are spending your money from the lens of an investment - not as a discretionary expense that should be cut if and when the environment requires.

At American Express, we've defined anything that is not required to keep the machine running as an investment and so are able to introduce tweaks to our portfolio within and across business segments as well as functional areas. Why limit oneself to optimizing within one narrow mini-portfolio of the organization? Starting with a mini-portfolio might be the right way to start and pilot the concept of Corporate Portfolio Management, but ultimately, CPM is about thinking and achieving BIG.

I'd love to hear from those who've successfully introduced Corporate Portfolio Management to other areas of their organization and the successes and challenges you've faced. Also, if someone can articulate why IT seems to be receiving all the attention around CPM, that would be very useful to understand. It seems to me that this has been driven by the ecosystem of consultants and software vendors that have emerged, but I'd love to hear other insights and thoughts in this regard.