Sarbanes-Oxley and IT portfolio management to help manage risk

There is an interesting contention made in a recent article in the Sarbanes-Oxley Compliance Journal. (Note: I read that sentence over and realized I used the word interesting in a sentence mentioning SOX compliance. That is a first. I apologize to any of you who are riveted by SOX compliance). The author, Jan Sondergaard (VP of Products, HP) correctly asserts that many IT organizations are viewed as "black holes" or "bottlenecks" but takes it one step further and say that this is reflective of the inability of many IT organizations to "automatically capture, view, and report on all of the work IT is doing." And as a result, this deficiency creates real corporate risk making "sustainable Sarbanes-Oxley compliance impossible."

The author further contends that the "best way to implement standards across an organization is to take a top-down project and portfolio management approach that allows you to define and enforce 'control points' throughout the processes" and to "take project and portfolio management solutions that offer real-time alerts and indicators."

So a couple of interesting points/questions this raises:

1. I'd love to hear from any organizations who are using their portfolio management discipline as a source of SOX compliance. In general, I don't think I've seen that as the purpose behind a corporate portfolio management effort, but if the CPM discipline can aid in SOX compliance, it's an obvious benefit. Please leave a comment and let me know if you are doing this, and perhaps we can get a dialogue going.
2. Of course, those of you with opinions on this topic of any kind should also leave your comments.
3. Regarding the article itself, I like and am intrigued by the idea as I do feel that the rigor that a CPM effort would instill around IT investments can definitely help mitigate risk and offer insights into the behavior/nature of IT spending.
4. That said, the article does come from the "portfolio tool as savior" school of thought with dashboards, workflows and real-time alerts all being highlighted as the means to get at "accurate, reliable information that IT professionals at all levels can more effectively respond to the demands of the business while creating a culture of accountability that can support current and future regulatory requirements." This I disagree with on multiple levels:

• Technology solutions are not a panacea to any type of problem - regulatory or not. You must understand what your objectives are, what process you are trying to enable, etc and then think of how technology might aid in this effort.
• Portfolio management solutions do not magically create accurate, reliable information nor do they force accountability. They create rules (good or bad) which people, if not properly educated and incentivized can circumvent and/or ignore.
• If building a portfolio management process, you should aim to build it as a capability -- not as a process to enable just support of regulatory requirements. CPM is a powerful discipline which has widespread organizational uses and so building it in a sufficiently robust way will enable it to offer insights into SOX compliance but will also give it significantly more ability to contribute to the organization on other pressing fronts including ensuring achieving financial, strategic and risk-oriented goals.

I am glad that Mr. Sondegaard raises this idea around CPM and SOX as it is quite interesting and has some merit. I think the means to achieve what he is talking about maybe enabled by a technology solution, but that is not the first priority.

Followup on Gartner ITxpo 2006 Program & Portfolio Management panel

I had the opportunity yesterday to participate in a panel at the Gartner ITxpo on the topic of Corporate Portfolio Management. I was pleased (and surprised) to see the room was standing room only so obviously the area of corporate portfolio management is a hot one. The focus was, of course, on IT portfolio management given Gartner's deep expertise and relationships with IT professionals.

Besides myself, there were 3 other panelists who I had the pleasure of meeting including: Michael Menke of HP, San Retna of Transformaction and Mark Stabler of AAA of Northern California, Utah and Nevada. Each of us were asked to speak about our own organizational efforts around CPM and then we had a lively session of Q&A facilitated by Matt Light of Gartner.

A couple of observations from the discussion:

• Many organizations are still defining their portfolio management efforts around IT.
• Organizations seem focused on governance first and process second. So I heard much alphabet soup around PMOs and various IT councils, but this seems counter-intuitive. If the process is well-defined, the governance can then be established around this. If you don't what you are trying to enable, governance structures are pointless. Additionally, much of the governance structure seemed bureaucratic.
• I received a couple of questions about how American Express' Investment Optimization effort is enabled, i.e. what technology/software are we using? Again, as previously mentioned in prior posts, technology should not be your first concern. Understand the process and change behavior. But it seems that there is still a huge focus on "what tool should I use?" Matt Light probably summed up the over-focus on tools with his statement - "A fool with a tool is still a fool."

All in all, it was a great session, however. It was nice to see so many people in attendance who are also passionate about Corporate Portfolio Management. I also had the opportunity to meet many trendsetting prospective and existing practitioners moving their organizations towards realizing the benefits of CPM.

For anyone in attendance at the panel, were there any other insights you gleaned from the session that are worth highlighting?

Speaking at the Gartner ITxpo/Symposium 2006

A note to others that I will be a speaker on a panel about Program & Portfolio Management at the Gartner ITxpo/Symposium 2006 being held in Orlando, Fl on October 10, 2006. The conference is targeted at the IT community, and I'm looking forward to hearing what other panelists and the audience have to say about Corporate Portfolio Management. If you will be in attendance at the panel discussion, please do come up and say hello. I'm looking forward to the event and meeting any of you there.

Taking Corporate Portfolio Management beyond IT

I remain amazed at how the entire portfolio management discipline has become largely focused on enabling corporate portfolio management for IT investments. Granted, most organizations do struggle with their IT expenses. Many (most) do not even fully understand that these IT expenses are in fact investments, but this fixation on IT is a bit stifling - as it minimizes the impact that CPM can have on an organization.

Corporate Portfolio Management should be used for any area where discretionary expenditures and hence investments are occurring including advertising & promotion, innovation/R&D, operations, sales, IT, capital expenditures, etc. This means looking past just your capital expenditures but also looking at operating expenses which, today, maybe considered business as usual, but which in fact, can be highly discretionary.

Conversations with numerous companies shows that 25-40% of a company's operating expenses are in fact discretionary (industry dependent). While the added scrutiny will likely not appeal to people who've become used to a certain size treasure chest to play with, this huge percentage does underscore the massive opportunity organizations have before them if they can optimize their portfolio. For owners of these expense pools, CPM lets you articulate where you are spending your money from the lens of an investment - not as a discretionary expense that should be cut if and when the environment requires.

At American Express, we've defined anything that is not required to keep the machine running as an investment and so are able to introduce tweaks to our portfolio within and across business segments as well as functional areas. Why limit oneself to optimizing within one narrow mini-portfolio of the organization? Starting with a mini-portfolio might be the right way to start and pilot the concept of Corporate Portfolio Management, but ultimately, CPM is about thinking and achieving BIG.

I'd love to hear from those who've successfully introduced Corporate Portfolio Management to other areas of their organization and the successes and challenges you've faced. Also, if someone can articulate why IT seems to be receiving all the attention around CPM, that would be very useful to understand. It seems to me that this has been driven by the ecosystem of consultants and software vendors that have emerged, but I'd love to hear other insights and thoughts in this regard.

CFO Executive Board session to discuss American Express Investment Optimization

Today, I hosted and convened the first of three tele-conferences to talk about resource allocation and our Investment Optimization efforts at American Express in conjunction with The CFO Executive Board (CEB).

The presentation entitled "American Express' Optimal Resource Allocation Process" was very well-attended and spurred some useful discussion. There were several questions from participants about the organizational change required to enable CPM. The realization that CPM is about impacting organizational behavior is a fairly astute observation as many often worry solely about the process elements or worst yet, many think that CPM is an effort which just requires a software tool in order to be enabled.

For those interested in seeing the presentation, please email me, and I'd be happy to send it to you. Also, let me say thanks to Roisin Ryan and Eisha Tierney Armstrong of CEB for their outstanding efforts and support in putting this presentation together.

Corporate Portfolio Management blog begins...

Corporate Portfolio Management (CPM) - An increasingly important discipline. I hope to share some of my experiences, insights, ideas and questions about CPM through this blog, and more importantly, hope to encourage discussion amongst current and prospective practitioners of the CPM discipline. Of course, the many valuable (and sometimes not so valuable) insights of other practitioners and thought leaders will also be highlighted.

For those unfamiliar with the term CPM, let's start with a bit of a definition. CPM encapsulates several other more commonly known terms such as enterprise portfolio management or project portfolio management (PPM). By encapsulate, I mean that enterprise portfolio management and PPM are most-often associated with information technology (IT) while CPM is more expansive. CPM includes IT investments but also is a strategy & discipline that can be utilized to optimize decisions related any area where an organization is making discretionary investment including: marketing/advertising & promotion, salesforce, IT, R&D/innovation, capital expenditures, operations, etc. CPM looks at these discretionary projects but as investments which generate benefits - financial, strategic, risk, etc.

In terms of my background and expertise with CPM, I am currently a Vice President at American Express managing the organization's corporate portfolio management effort (known internally as Investment Optimization). Additionally, I head up American Express CFO's internal strategy and business analysis group. I've lead the development of the company's CPM effort which is patent-pending alongside numerous talented colleagues over the last several years.

Beyond efforts at American Express, I've had the opportunity to speak with numerous thought leaders within other organizations and think tanks about CPM who've really helped to evolve my thinking about CPM and the field overall. I hope some of them will contribute to this blog going forward and/or that I'll get the opportunity to share some of their insights with you over time.

I welcome your feedback, questions and ideas about this blog, and my hope is that will serve as a useful forum to spur dialogue, new ideas and greater interest in and realization of the power of CPM. Happy optimizing. Whether you agree or disagree with my viewpoints, I welcome and look forward to your feedback.