Strategic Information Resources Management: Fundamental Practices

Sharon L. Caudle*

How can we best manage our information resources? In these days of shrinking government budgets, increased workloads, and demands for better service, government managers no longer pose this question rhetorically. This article highlights six fundamental information resources management practices in successful organizations that can improve government service delivery performance.

On all sides, government managers see a heavy demand for improved public services, provided faster, to more people, at greatly increased accuracy, and at greatly reduced costs. No longer can government managers ignore accountability for bonafide results. Legislative requirements, performance reviews, and intense audit assessments ferret out whether glowing claims of performance match reality. Officials want to see real societal differences from publically financed programs. Taking advantage of information resources-information, information technologies, and other related resources such as

personnel-is one way to meet these demands. At every corner, it seems, experts and consultants say that information resources, if properly applied, are strong medicine for many of government’s service delivery ills.

“If properly applied” is the key phrase. The truth is that government managers often struggle with information resources management (IRM). They find it difficult to define their critical information and information technology needs. And even if they get that right, they are faced with the daunting task of selecting, deploying, and finally evaluating and controlling changing information technologies. Failure after failure with

* Direct all correspondence to: Sharon Caudle. U.S. General Accounting Office. 350 S. Figueroa SI.. Suite

1010, Los Angeles, Calijornia 90071 <caudles.laro@gao.gov>. The author served as the research director on the U.S. General Accounting office team conducting the

research on which this article is based. The views expressed in this article are those of the author and not necessari1.v those of the U.S. General Accounting Office.

Government Information Quarterly, Volume 13, Number 1, pages 83-97. ISSN: 0740-624X.

84 GOVERNMENT INFORMATION QUARTERLY Vol. 1 ~/NO. l/l 996

information systems, many costing millions of dollars and taking seemingly forever to develop, are often the painful symptoms of management problems.

“BEST PRACTICE” RESEARCH

While there have been many articles and reports written on IRM practices, most are based on private sector experiences or applications.’ To identify IRM “best practices” that could directly transfer to and improve government efforts, the U.S. General Accounting Office (GAO) conducted indepth case studies of private organizations and state and Federal government agencies, supplemented by focus groups of senior Federal managers.2 The GAO project team selected private and state government organizations representing IRM practices better than the norm, relying on expert opinion and a literature search. The private organizations included American Airlines, Xerox, Kodak,

USAA, and Royal Bank of Canada. The state organizations represented highest-level agencies and departments noted for

their innovative efforts in managing information resources. The organizations were in California, Florida, Minnesota, Oregon, and Texas. Case studies of Federal departments and agencies representing various missions, sizes, and department and agency coverage supplemented the findings from the private and state organizations. The Federal organizations were picked judgmentally based on known effective management of their information resources, the importance of information resources to their mission, and/ or problems with their IRM practices necessitating management

changes. These experiences were used to add to, confirm, or contrast with the private and state findings. The Federal case study organizations included the Federal Trade Commission, Social Security Administration, U.S. Coast Guard, Soil Conservation Service, Department of Housing and Urban Development, Department of Commerce, Environmental Protection Agency, Department of Veterans Affairs, and the Army Corps of Engineers. The project team also held three focus groups with senior program and IRM officials to capture IRM experiences and to test preliminary case study analysis.

GAO found that senior managers-the executive management team-in the most successful case study organizations used a consistent set of IRM practices that made a significant difference in enabling high organizational performance. The organizations could make a direct linkage from their IRM practices to their competitive position or delivery of services. In short, these IRM “best practices” GAO found were highly instrumental in how well the organization was performing or meeting its program service requirements.

Using best practices in an integrated fashion, senior managers effectively plan for, direct, and evaluate the use of information resources. Over time, these practices institutionalized a set of management processes for capturing the most customer-focused value out of the organization’s information resources. At the same time, they reduced costs and improved the quality, quantity, and timeliness of customer services. These practices’ are:

l Directing IRM changes; . Integrating IRM decision making in a strategic management process;

Strategic information Resources Management: Fundamental Practices 85

l Linking mission goals and IRM outcomes through performance management; l Guiding IRM project strategy and follow-up through an investment philosophy; l Using business process innovation to drive IRM strategies; and l Building IRM/line partnerships through leadership and technical skills.

DIRECTING IRM CHANGES

Without doubt, an important, if not the most important, contributor to more effective IRM in these “best practice” organizations is senior management activities and behaviors. In the successful best practice organizations, senior managers are “hands on,” involved extensively in IRM decision making, communications, and follow-up evaluation activities. IRM professionals may be initial facilitators or catalysts for changing IRM, but senior managers take on the actual leadership. They recognize that only they can initiate and sustain meaningful IRM change.

The senior managers in best practice organizations change IRM for the better in several ways. For one, they recognize and communicate the urgency to change IRM after examining and linking mission performance issues and problems to crucial mission-related IRM strategies and applications. The bottom line is that if senior managers do not get the support and delivery they expect from information resources, then senior managers take immediate and powerful corrective action. Senior managers widely communicate information resources problems in and out of the organization. They use the problems to justify integrating IRM decisions with mission delivery decisions at all levels of the organization. The senior managers also set an IRM performance baseline by benchmarking against leading organizations to challenge accepted IRM habits and set appropriate targets for change.

Further, the best practice organization’s chief executive sets clear expectations and places responsibility for information resources decisions and activities with line management-those who must deal directly with the organization’s customers. He or she sets clear IRM performance goals for all management levels and holds line managers accountable for choosing, supporting, and ensuring effective implementation of IRM decisions and solutions. Management performance reviews, bonuses, and/ or promotion decisions include IRM dimensions directly related to mission service delivery improvements. Without ownership and accountability for IRM, line managers often delegate IRM decision making, fail to monitor key IRM projects and results, and then have no idea when the projects fail to deliver on their promises.

Example: Directing Changes. In one Federal organization, an IRM steering committee reports directly to the agency head and the chief operational officer. This highly active committee is charged with reviewing and approving or recommending

approval of (I) the long-range IRM plan; (2) IRM goals, strategies, and policies; (3) organization-wide information, application, data, and geographic architectures; (4) the organization’s information systems modernization plan; (5) significant IRM issues; and (4) proposed IRM cost allocation methods. The top operational official in the agency chairs the steering committee. There are 12 voting members from all of theprincipal line divisions. Five other senior managers representing stafffunctions and major modernization projects attend but cannot vote. Members of the steering committee must attend the meetings and vote. If a quorum is not present, no

86 GOVERNMENT INFORMATION QUARTERLY Vol. 1 ~/NO. 1 /1996

decisions can be made. The steering committee meets at least quarterly, but an executive committee of the very key members meet weekly to discuss issues that cannot waitfor the meeting of the overall committee. This executive group also serves as the overall resource management boardfor the agency, making resource decisions on personnel, finance, facilities, IRM, and other resources.

Last, for the best practice in directing IRM changes, senior managers have both short and long-term strategies, taking advantage of opportunities to change IRM leadership, service delivery structures, and overall IRM directions. For example, senior managers take advantage of short-term windows of opportunity such as budget crises or leadership changes to signal or reinforce the need for IRM improvement. They often designate and support a high-level champion to facilitate IRM activities day-to-day in key business processes. Often, the chief executive leads a senior management IRM steering committee to create top management visibility in IRM decision making. Senior line managers

receive IRM education through a combination of conferences, training, co-location and rotation programs, and joint visits with IRM professionals to organizations that use technology well. And, because of existing barriers to improving IRM, successful best

practice organizations pay close attention to managing change.

INTEGRATING IRM DECISION MAKING IN A STRATEGIC MANAGEMENT PROCESS

Almost every organization has mission and information resources planning processes and products such as formal plans. But these are only effective if they directly respond to customer needs. Customers are any individual, group, or organization that can lay a claim on the organization’s attention, resources, outputs, outcomes, or is affected by its outputs and outcomes. In short, they are any individual or groups with whom the organization has a business relationship. The most important customers are external to the organization-the direct recipients of products and services. For example, an

agency administering Medicare or Medicaid benefits would have beneficiaries as customers. Other customers are internal-such as employees-or even stakeholders, such as oversight agencies, the legislature, public interest groups, and the general public.

Even though there is a customer service emphasis in much of government today, most organizations are just in the early stages of defining their current and future customers for services and related IRM support. Nor have they prioritized those customers’ needs and assessed the seriousness of the performance gap between what the organization delivers and what the customers expect. Best practice organizations specifically define their products and services by customer groups and their needs. They use the information to craft goals and corrective action based on the highest priority customer groups. Then, the successful organizations tailor IRM products and services to those goals and priority customer group needs. Best practice organizations define information systems not just as those delivered on time and within budget but also as those producing customer improvements in terms of quality, quantity, timeliness, and cost of service. Thus, the best practice organizations start with the customer in developing their strategies. But they also integrate planning, budgeting, and performance evaluation decisions and activities in an organization-wide “strategic

Strategic Information Resources Management: Fundamental Practices 87

management” process. These best practice organizations have a rigorous strategic planning process to set long-range strategic directions, develop operational and tactical plans, and guide senior management operational decisions and assessments.

Senior managers use the strategic management process to make critical decisions for major IRM projects through their life cycle-from initiation to post-implementation reviews. Decisions from one key strategic management process carry forward to another. Outputs of the operational IRM planning process are used as inputs to the budget process. Project progress evaluations are fed back into the key elements of the strategic management process. Post-implementation reviews of IRM projects are used as feedback in making future planning decisions.

Example: Strategic Management Process. In one state government, the central IRM group worked with the legislature and the state budget and planning offices to develop a strategic management process, ratified by a senior manager steering council. Beginning with strategic business and information planning, agencies identify organizational goals and how IRM plans can support those goals. Next, based on the strategic plans, they develop the costs, benefits, and risks associated with specific information system projects over the course of their predicted ltfe spans. third, annual budget review combines an examination of agency business, strategic IRM, and life-cycle planning with an analysis of how the project proposal relates to the statewide information architecture. Fourth, project implementation is reviewed systematically starting from the funding decision to assess tf the agency is meeting strategic goals. Lessons learned are applied in the next years iteration of strategic planning. Finally, in each step of the cycle, architectural choices are explicitly considered in screening and designing IRMprojects to achieve the goals of interconnectivity, data sharing, and interoperability.

As the strategic management process example shows, the organization’s strategic IRM plan is a key part of the strategic management process. It shows how well an organization has thought through its IRM needs. Best practice organizations conduct operational IRM planning that links information resources to anticipated mission needs, complies with the organization’s information technology architecture, and serves as the basis for resource allocations. For IRM, this forces the linkage of information systems efforts to the mission, provides tight controls during system implementation, and mandates regular assessments of benefits against expectations.

Organizational leaders use the strategic plans and overall management process to communicate and educate employees, customers, and other interested parties about IRM critical goals and why and how priorities are chosen.

LINKING MISSION GOALS AND IRM OUTCOMES THROUGH PERFORMANCE MANAGEMENT

Best practice organizations rely heavily on performance measures to define mission goals and objectives, quantify problems, evaluate alternatives, allocate resources, track progress, and learn from mistakes. Performance measures provide the means to understand and value the contribution of any part of the organization, including IRM, makes to mission delivery. The best practice organizations identify outcome-based

88 GOVERNMENT INFORMATION QUARTERLY Vol. 1 ~/NO. 111996

performance measures for major mission areas that directly link to key external customer needs-those who are the intended recipients of government services and products.

Leaders in these best practice organizations constantly and consistently communicate

the importance of performance management in their strategy development, in reports to stakeholders and external decision makers, and in discussions with lower-level managers and staff. Mission delivery and IRM performance measure analyses are built

into the planning, budgeting, and evaluation decision-making processes mentioned earlier. Performance measures such as service-level achievements, error rates, and timeliness standards are attached to each mission goal during strategic planning.

These organizations develop specific performance measures for all IRM products

and services, reflecting mission outcome requirements. The organizations further emphasize both output and outcome IRM measures. Output measures capture the

immediate results of new information system investments. Outcome measures track the accomplishment of longer-term goals and objectives, based on mission needs.

As might be expected, the best practice organizations use IRM measures which are

very different from what one normally sees for IRM measures. Often-used measures such as lines of code generated, reports issued, or computer availability make sense to IRM professionals but often make little sense to line managers, who must translate

them into mission delivery measures. Instead, better measures relate to the quality, quantity, cost, and cycle time of mission products and services. Good performance measures define the information needed to perform a mission well and allow

organizations to learn objectively and consistently over time. They also measure whether information technology projects really make an impact on mission outcomes. Customer groups periodically review, validate, and accept the IRM performance measures.

Example: Performance Measurement. In one private organization, the central IRMgroup uses a qualityframework based on a value chain to its customers to assess its performance. The quality approach started with the IRM mission and vision, both heavily oriented toward customer satisfaction, superior performance, and benchmarking. The group identt$ed major goals and measures for customers. The group believed the measures must answer the following questions: Are we satisfying customer requirements? Is our overall productivity and quality improving? Are we working on the right strategic projects? Are we gaining a competitive advantage? Are we delivering systems that provide value? Customer surveys of satisfiers and dissatisfiers, quality reviews, andpost-implementation reviews arefed to senior staff:

Best practice organizations such as this one find that one of the most powerful ways to motivate IRM change is benchmarking-either against an internal baseline or another part of the organization, or against an external leading organization for the same IRM process or set of activities. Specific benchmarks indicate how changes in performance might be related to changes in strategic planning initiatives, architecture development, new organizational structures, or other factors. IRM performance measures and targets are continually assessed and adjusted upward to match changes in the internal and external environment, technological developments, and benchmark

changes. In these organizations, senior managers are knowledgeable about

Strategic Information Resources Management: Fundamental Practices 89

benchmarking concepts and have designated staff to conduct IRM benchmarking activities.

Internal or external audit or program evaluation units are tasked to monitor and report on IRM performance against performance targets. Inhouse IRM services are frequently required to compete with outside information services to win internal customers on the basis of performance and costs. Organizational leaders may keep within the organization only those IRM services that are considered absolutely vital for mission delivery.

Generally, in the most successful best practice organizations, performance management recognizes that “you get what you measure” and, thus, serves as a tool that helps managers and staff reach expected IRM results. Moreover, an effective performance management system produces hard data on mission critical outcomes for use by elected officials. It provides evidence of cost savings, product and service levels achieved and improved, and customer satisfaction with service delivery.

GUIDING IRM PROJECT STRATEGY AND FOLLOW-UP THROUGH AN INVESTMENT PHILOSOPHY

Most organizational managers often view IRM funding as administrative costs-much less important than funding for program staff. However, the best practice organizations manage IRM funding as investments rather than expenses. What that means is that, philosophically, they view IRM funding as vital for the organization’s long-term health, not as “back office” or of little importance.

How do the best practice organizations carry out an investment philosophy? Typically, an active investment review board represents top leaders of each major program area and major support functions such as finance, personnel, and IRM. Although the major support functions are often represented, final decision-making authority resides with program executives. The board has the ultimate authority to approve projects, but it also has the authority to stop or delay IRM projects, if needed. Its basic ground rules are simple-approve mission-critical projects, mitigate risk, and validate expected benefits and savings.

The board in a successful organization is very active as a decision-making body, meeting regularly to make decisions on investments and to assess major project progress. The members must attend board meetings and do not delegate their decision-making responsibilities. The board assigns senior management sponsors from its ranks to major IRM projects. These sponsors serve as the bridge between the board and the project team. The sponsors are expected to remain actively involved in all facets of assigned projects during their entire life cycle-from birth to dismantlement.

However, the board is only as good as the tools and techniques it uses to select projects and then track them to completion. In best practice organizations, the board uses a disciplined process in its decision making. The board uses comprehensive qualitative and quantitative investment decision criteria used to rank proposed projects for current and future funding. The criteria cover such factors as risk, cost/ benefit, business results/ impact, longevity, size, and customer impact. These are weighted for their importance. For example, one government agency set weighing for risk at 20 percent; impact on organizational personnel at 10 percent; impact on external and internal customers at

90 GOVERNMENT INFORMATION QUARTERLY Vol. 1 ~/NO. 1 /1996

20 percent; alignment with strategic objectives at 25 percent; and the value of the system in terms of benefits and costs at 25 percent.

Example: Investment Decisions. In one private organization, a management system has evolved over the years for assessing and managing IRM projects using project return on investment (ROI) analysis, risk assessments, and attention to business goals. The ROI analysis screens out projects with unacceptable financial returns. Projects must provide a return exceeding a certain threshold to move on to risk analysis. The risk analysis measures the probability ofproject success orfailure. The risk analysis applies 24 factors grouped within five weighted categories-security, user and customer impact, system and project management, capital, and project complexity. i’hen, top management looks at the alignment with business goals in making the final decision on which projects to fund. In cases where the organization is willing to take on greater risk to achieve a higher return, the project risk analysis gives top managers the tools to condition project approvals upon the mitigation of certain risk factors or the achievement of specific results, and identt$es the extent and frequency of further top management attention as the project is implemented.

Investment review boards in the best practice organizations also use other decision rules. As part of their investment strategy, the boards often require complex projects to be done in modules, avoiding multiyear, high-risk projects. And the boards categorize projects as either maintenance of existing information systems or strategic investments in new systems, and track and analyze investment decisions across and within these categories as a complete portfolio. Over time, progressive investment decisions move available funding from established, less critical applications to mission-critical projects.

Generally, no board-approved and well-managed, multiyear project that meets an important mission goal is later deprived of funding in favor of a new project. In the government best practice organizations, political and career officials work together to ensure continuity of management decision making and commitment for multiyear IRM

projects. This disciplined process ensures that dollars are put to work where the needs are greatest and the returns on investment are highest.

Simply deciding on new project funding does not end a board’s work in the best practice organizations. This contrasts with the ways of doing business in many

organizations where, even if there is an investment review board, the board’s decision making ends with the initial project go-ahead. Then the board drops out of sight. Project tracking over an entire life cycle and post-implementation reviews are left to lower- level managers. The best practice organizations establish management oversight processes that make sure major information systems proceed in a timely fashion toward agreed-upon milestones in the information system life cycle. At the time when a board makes its initial project decisions, it sets project implementation review requirements, such as reporting and timing. The board bases its review requirements broadly on project importance and risk elements. Project action reports, technical design reviews, walk- throughs, and performance audits are some of the means to assess a project.

Example: Ongoing Investment Reviews. In one state, an ongoing assessment program examines system development and performance beyond the initial budget decision. The assessment program breaks the life cycle of an information system

Strategic Mormation Resources Management: Fundamental Practices 91

project into five phases: (1) planning, process redesign, and analysis; (2) system design; (3) development; (4) installation; and (5) evaluation and maintenance. At each phase, agencies use a series of questions to provide a review of the project’s status. These phase questions, among other things, question tftheproject is on time, within budget, and ready to go on to the next phase.

In best practice organizations, the investment review board adjusts its portfolio of IRM investments over time for changing conditions such as major changes in legislation or regulation, new technologies, or the results of prototype or pilot tests. As part of its oversight and control, the board does not stop its attention even when an IRM project is fully implemented. The board mandates regularly conducted post-implementation reviews on new or substantially modernized information systems. Such reviews show whether IRM projects have demonstrated their expected payoffs. These post- implementation reviews provide lessons for managing future IRM investments.

USING BUSINESS PROCESS INNOVATION TO DRIVE IRM STRATEGIES

The best practice organizations follow another practice that is simple but particularly valuable: they apply information technology at the right time, to the right process. The best practice organizations first identify and prioritize their core processes before they even think about possible IRM solutions. Core processes are those vital for organizational success in providing mission products and services to external and internal customers. For example, delivering accurate and timely monthly benefits would be a core process for social service agencies, involving tasks from client eligibility to distribution and other organizations such as banks.

Then, these organizations rigorously examine their core processes and determine if they need to be redesigned or reengineered before funding information systems that support those processes. If IRM investments are made without reexamining processes, the new or enhanced systems may simply improve the efficiency of ineffective processes. IRM projects that do not really consider process redesign or reengineering typically fall far short of their potential benefits. It is also true that process improvement efforts that ignore technology usually do not maximize the potential of the process improvement. These organizations select IRM projects because they support or make possible significant core business process improvement.

Example: Business Process Innovation. In one private organization, for example, definition of core business processes was only the prelude to major reengineering efforts. Senior managers set “‘stretch “goals to reduce customer cycle time by 80 percent, cut overhead in half; triple real sales per employee, reduce inventories and account receivables by half reduce development time by one-third, and produce significant new business growth. A series of projects are designed to achieve the stretch goals. One project became the pilot for all reengineering efforts. i’hat project resulted in a dedicated, full-service team to handle all customer transactions in real time; a simplified and consolidatedprice catalog; a consolidated, simple invoicing system; a single-tiered distribution network; a reduced number of interfaces and handoffs, andfewer information systems and interfaces. lhe business unit movedfrom 70 systems and data stores to one integrated business system.

92 GOVERNMENT INFORMATION QUARTERLY Vol. 1 ~/NO. 1 il996

In successful organizations, representatives of all the functions involved in the current core processes work together and with customers, suppliers, and others to analyze each

process, including where it begins and ends, and assess how well each one is currently working. Project teams work to redesign or reengineer a better process or even get rid of processes if they are found to be not actually central to mission delivery.

Leaders in the best practice organizations also do not let “a thousand process improvement flowers bloom.” They pick a small number of processes to work on at any one time, recognizing the limitation of organizational resources and the capacity for change. Senior managers also strictly set the timeframe and parameters for process change implementation. For example, one private organization sets a schedule of no more than 12 months from the beginning of the effort to implementation of a new process. More complex efforts may take longer but generally must be completed in close to two or three years. And these successful organizations strenuously prototype and pilot business process reengineering projects. These testing efforts minimize risk, demonstrate the real benefits of doing business differently, and address change management overall in adopting the new process.

And like investment portfolio management, the best practice organizations keep track of all their process improvement efforts, avoiding coordination problems and efforts working at cross-purposes. One senior manager might be designated to coordinate all process improvement efforts. While line managers are in charge of the overall process improvement efforts, managers and staff from the IRM organization serve as partners on the multifunctional task forces that work on the major redesign or reengineering projects. Formal IRM group units are set up to provide leadership and expertise for these efforts. In some cases, the name of the central, organization-wide IRM group was

changed to “Information Systems and Business Processes,“incorporating a process focus. The best practice organizations also select and enforce compliance with an

architecture to reduce risks and maximize the benefits of process improvements across the entire enterprise. Management ensures the IRM architecture is developed based on strategic planning that describes how the organization’s business processes, data and information, and technology configurations will evolve in the future. The IRM architecture is a “blueprint” of the hardware, software, and information components of an organization which may include a separate, yet consistent, architecture for each organizational component. A robust, flexible, and responsive architecture is needed for business process reengineering projects because they generally require extensive communication capabilities and the use of shared databases.

BUILDING IRM/LINE PARTNERSHIPS THROUGH LEADERSHIP AND TECHNICAL SKILLS

Last, these best practice organizations know that strength in the organization’s IRM and line relationships and capabilities is a key component of their success. These organizations define roles and responsibilities, set accountability for IRM, communicate the importance of IRM through the role of a chief information officer, and upgrade the IRM skills of both line and IRM professionals.

For this practice, these organizations understand IRM roles and responsibilities clearly-knowing who is going to do what. In many organizations, IRM professionals

Strategic information Resources Management: Fundamental Practices 93

are primarily responsible for centralized management and control over IRM. In the best practice organizations, line program managers make the key decisions, supported by cooperative working arrangements with IRM professionals in a “customer-supplier” relationship. As described earlier, line personnel typically behave as the customers of IRM support professionals by asserting control over significant IRM project funding and direction. As customers, the line managers who administer programs supported by information systems are responsible and accountable for the mission impacts of those information systems.

IRM professionals in the best practice organizations then act as suppliers, working to support the line unit’s effort to achieve a mission objective, make a critical decision, or solve a problem. The IRM organizations support program delivery units by providing technical expertise and experience that program offices lack. Often, the IRM group forms “centers of expertise,” which can move from customer to customer as demand warrants, in special expertise areas such as imaging, geographic information systems, networking and data communications, CASE (computer-aided software engineering) tools, and data management. The IRM professionals work to prepare service delivery plans and customer profiles and regularly survey customers to see how the IRM organization is performing.

Example: IRM and Line Partnerships. One private sector IRM group, experiencing problems with its customers, wanted to build an IRA4 plan and tested a potentialplan model andplanning decision-making process with a senior executive. While the senior executive liked the idea, he believed it should be a business unit

plan, not an IRM plan. The IRM organization then developed a prototype IRA4 plan to support individual business units, starting with a comprehensive under- standing of the business unit’s strategies. The IRMgroup used the concept of a service delivery “value chain” to analyze the business unit’s processes and identify high-value business activities. Working with the business unit staff; thegroupfirst outlined critical success factors for the business strategies. The group also did a scan of the business unit’s competition, developing an awareness of the competition strategies and how they used information resources investments to support those strategies.

The overall analysis identified potential IRM exposures and opportunities for the business unit. These exposures and opportunities then were translated into an IRA4 plan that clearly addressed the business unit S strategic needs in the short and long- term. This prototype effort then was migrated to the rest of the organization.

Best practice organizations such as this one maintain accountability for IRM services through a number of mechanisms. These include establishing service agreements between providers and consumers of information resources, incorporating IRM issues and require- ments into program plans, and establishing cost recovery processes where users pay for the use of centrally provided IRM services. A service-level agreement is a contract between a service provider and a customer based on welldefined, measurable objectives. It typically is developed by teams from the service provider and the customer that link back to other service and business groups for needed services, buy-in, and sign-off. The agreements specify what IRM is committed to provide, such as service access and availability, performance, and system backup. IRM organizations are routinely included in operational decisions and evaluated on the basis of their contributions to program results.

94 GOVERNMENT INFORMATION QUARTERLY Vol. 13/No. l/1996

The seriousness of how IRM is viewed in the best practice organizations is visible most often in the person selected to shepherd IRM activities and his or her hierarchical position. Establishing a chief information officer (CIO) as a senior management partner is critical to building an effective organization-wide IRM capability. The CIO reports directly to the organization head and works closely as a peer with other senior managers in articulating the role of IRM in mission delivery. Although the CIO is no substitute for institutionalized information management processes, this person-working as a peer with senior managers--helps line executives change how they manage IRM assets. In best practice organizations, the CIO typically serves as an effective bridge between top management, information management units, and line managers and users. The CIO helps create an appropriate balance of decision-making authority between corporate and program levels on information resources issues. The CIO also has a highly credible service organization, closely monitored as to how it is impacting mission delivery by

program offices. In the best practice organizations, IRM capabilities is another area for building IRM

and line partnerships. One of the reasons line managers typically defer to IRM professionals for IRM decisions is their lack of knowledge of IRM concepts, how IRM contributes to mission delivery, or even simple knowledge of basic technical considerations. On the other hand, IRM professionals may not have an adequate understanding of mission delivery needs and how their IRM products and services fit into the bigger strategic and operational picture. This is not the case in the best practice organizations.

The successful organizations continually assess and develop IRM skill sets for both line and IRM professionals. Most line managers have received minimal training in IRM, while IRM professionals have concentrated on developing technical skills and knowledge. Lasting improvements in IRM are impossible without upgrading the knowledge and skills of executives, managers, and IRM professionals. Otherwise, antiquated skills will stymie the organization as it tries to assess the potentialities of emerging information management and information technology.

After a skill assessment is done, the best practice organization evaluates the current competencies of personnel and identifies barriers to skill acquisition. These barriers might include factors such as lack of a reward system, low pay, obsolete personnel systems, lack of training opportunities, a limited labor market, and an embedded base of aging technology and old skills. For example, in one organization, people on board were skilled in doing batch programming, but the organization was moving to a client-server approach.

Overall, line managers in these best practice organizations have the skills to judge how to align IRM applications with internal and external customer needs and mission objectives. IRM professionals are skilled in understanding the mission benefits to be derived from IRM activities. These organizations continually identify IRM skill and knowledge requirements for line and IRM personnel and provide resources and time for personnel to obtain them. Management and professional development plans include IRM as a key skill and knowledge area.

TAKING THOSE FIRST STEPS

These six fundamental practices work in a symbiotic relationship in the best practice organizations. While not all were fully developed in all of the best practice organizations,

Strategic information Resources Management: fundamental Practices 95

the most successful organizations generally had fully mature practices in place. None of the practices were identical, but all did have the basic characteristics described above. With the exception of the first practice (directing IRM change), which serves as the catalyst, the development of the other practices in these organizations is not done in a linear, “pass off” way. One practice is not put in place followed by another, and then another. Instead, once top managers decide that improving their IRM practices are critical, they set out to build the practices generally across-the-board. Some practice building may proceed faster than others, but the game plan is to fashion a total IRM practice framework.

Obviously, the first step for the organization is to decide to change. If there is no urgency to change, then status quo IRM practices will remain entrenched. But once there is strong management commitment to change, a good starting point is current mission performance. In general, the best practice organizations studied mission performance, setting up a team and a champion to define the organization’s mission and vision and high-level mission goals. Often, this is done as part of the agency’s strategic planning process. From there, the best practice organization assesses how IRM supports mission performance and other practices such as developing strong performance management and business process improvement.

For those government organizations just starting to change their IRM practices, the crucial actor may be identifying a senior manager who can champion and direct IRM improvement. He or she can serve as the facilitator in developing and integrating the practices, particularly in piloting approaches such as customer identification and needs assessment which is difficult in government. He or she can also advise the organization’s senior managers on which practices are the weakest and will require the most work to bring up to a mature level.

In any event, the organization cannot expect the IRM practices and mission results to change overnight. Current IRM practices, particularly if IRM is a vital support function in the organization, are the result of years of internal and external policies, procedures, and management attention or neglect. However, it is also clear that information resources are key enablers for government to do its work both differently and better to meet performance expectations. The challenge is to get started and to stay committed.

BEST PRACTICE STUDY IMPACT

GAO’s best practice report’s impact has been far-reaching, well beyond that of many other GAO products. Although it was intended primarily as an educational and awareness tool for Federal government executives and managers, the report’s findings have had a far greater influence.

For the oversight community, the report provides a set of standards that can be used as criteria for evaluations and assessments. The Office of Management and Budget (OMB) drew heavily on the best practice report in developing the policy guidelines in Circular No. A-130 covering the management of information technology in the Federal government.4 The General Services Administration (GSA) has adopted the practices in developing material highlighting good IRM performance for use in management reviews.5 GAO itself has translated the guide into a more proactive, preventative

96 GOVERNMENT INFORMATION QUARTERLY Vol. 13iNo. 111996

approach to its audits and evaluations of Federal government IRM and information systems. And, more importantly, many of the best practice concepts were also incorporated into the Paperwork Reduction Act of 1995 (P.L. 104-13). This Act is the definitive legislation on information resources management policy and procedures in the Federal government.

GAO also used the best practice findings to develop a draft assessment guide on overall IRM practices for its evaluators and for Federal officials.6 The guide provides detailed descriptions, assessment questions, and evaluation matrices for examining IRM

practices. The guide contains a diagnostic, quick-hitting assessment section and another section covering more detailed examinations. Several organizations such as the

Department of Housing and Urban Development and the Internal Revenue Service have conducted their own self-assessments using the guide. GAO is further testing the

draft guide in organizations such as the U.S. Customs and the Health Care and Financing Administration. State and local officials are increasingly requesting both the

report and assessment guide for application in their own organizations. The best practice report has spawned other guides besides the one on overall IRM

practices. GAO and OMB collaborated on an IRM investment guide, which is undergoing testing by OMB staff and agency officials.’ GAO is also developing a business process reengineering guide, influenced by the best practice of business process innovation. Last, GAO is developing a guide on IRM performance measures and performance management.

And the next steps? GAO recognizes that best practices often do not stay stable over time, especially in a new, dynamic area such as information resources. Further research and case studies will continually enrich and evolve the best practice report, assessment guides, and agency evaluations. Through using the best practices as evaluation criteria, GAO believes it can not only point out high-risk IRM practices but also provide advice

on good IRM practices derived directly from the “state of the art” in successful organizations.

ACKNOWLEDGMENT

The author wishes to acknowledge the contributions of Chris Hoenig, Kevin McCarthy, Ken Thompson, and Ed Joseph who served on the U.S. General Accounting Office research team producing the original study from which this article is derived. She also appreciates the help of David McClure, David Turner, and John Finedore who helped in refining the practices and their characteristics.

NOTES AND REFERENCES

I. At the time the research was done, the research team used many articles and reports to guide the case

study questions, Examples included Roland Volk and Wayne DeBox, “Managing the Changing Role

of the Information Systems Professional,” SIM Nerwork, 8 (April, 1993), pp. l-3; Cliff Hallberg and

Rich DeFlore, “Reengineering the Information Services Function,” SIM Network, 8 (June, 1993), pp.

I, 3-4; Bruce Rogow, “Putting the ‘T’ Back into IT: Developing the IT Management Agenda for the

Mid-1990s,” SIM Executive BrieA 4 (Spring, 1993), pp. l-2; CSC Index, “The Future Role of the CIO,”

Indications, 10 (1993), pp. I-10; Andrew C. Boynton, Gerry C. Jacobs, and Robert W. Zmud, “Whose

Responsibility Is IT Management,” Sloan Management Review, 33 (Summer, 1992), pp. 32-38; Antonio

Strategic Information Resources Management: Fundamental Practices 97

Kovacevic and Nicolas Majluf, “Six Stages of IT Strategic Management,” Sloan Management Review, 34 (Summer, 1993), pp. 77-87; Thomas H. Davenport, “The New Industrial Engineering: Information Technology and Business Process Redesign,” Sloan Management Review, 31 (Summer, 1990), pp. 1 I- 27; and SIM Working Groups on Quality, Quality Assessment and Planning Tools for IS (Chicago, IL: SIM International, 1992).

2. The U.S. General Accounting report on IRM best practices resulting from this research is called Execufive Guide: Improving Mission Performance Through Strategic Information Management and Technology (GAO-AIMD-94-I 15) (May, 1994).

3. The Executive Guide: Improving Mission Performance through Strategic Information Management and Technology, presents 11 best practices. This article combines a few of the practices for better consistency and to remove duplication found in the original Guide.

4. Office of Management and Budget, “Revisions to OMB Circular No. A-130, Management of Federal Information Resources, Transmittal No. 2,” Federal Regisfer, 59 (July 25, 1994) pp. 37906-37928.

5. General Services Administration, “Transition to the Future: A Model IRM Program for the 21st Century” (Draft) (Washington, DC: Management Review Division, General Services Administration).

6. GAO’s Accounting and Information Management Division developed the ‘Strategic Information Management (SIM) Self-Assessment Toolkit,” issued as an exposure draft in October 1994.

7. Office of Management and Budget, “Evaluating Agency Investments in IT: A Guide for Analysis,” exposure draft (Washington, DC: Office of Information and Regulatory Affairs, February 1995).