The Development and Implementation of an IM/IT Governance Framework

Bryan Shane and Patricia Lafferty

Wisdom in IT decision making is the acid test  for effective governance.

In most public sector organizations, Information  Management/Information Technology (IM/IT) plays a vital role in the delivery of  key programs and services. Many program branches spend millions of dollars on  IM/IT initiatives. Approximately half of all government capital expenses along  with the associated FTEs (full-time equivalents) are allocated to IM/IT to  enable the business vision to be achieved. Yet many of the processes and best  practices needed to ensure the most effective use of these resources are not  fully implemented. As a result, there is much duplication of effort; decisions  regarding the allocation of IM/IT resources are not made from a branch- wide  perspective; and some of the applications under development are behind schedule,  over budget and not to the satisfaction of clients. The return on investment for  the IM/IT funds spent leaves much to be desired.

To maximize the contribution of IM/IT in the  delivery of federal public sector programs and services, there is a need to  enhance the effectiveness and expediency of decision making through a more  effective IM/IT governance framework. Effective IM/IT governance will ensure all  IM/IT initiatives are managed from an organization-wide perspective and  contribute to the business goals of the public sector organization.

Elements of an IM/IT governance  framework

A governance framework includes three elements:  principles by which to work, a structure through which to govern and a process  to make it work.

Governance  principles

To be used effectively, the IM/IT governance  framework must adopt the following principles of operation:

• All IM/IT initiatives considered must support the  long-term business goals of the department and be based upon long-term IM/IT  strategies. Business and IM/IT must work together.
• All new IM/IT proposals must be supported by a  business case addressing the priorities as negotiated and established in the  informatics strategic and operational plans.
• All IM/IT initiatives are subject to the  governance process, including those related to application development,  infrastructure modifications, major projects and/or purchases of hardware or  software.
• The IM/IT governance process must be as simple  and efficient as possible to provide maximum assurance of the relevance and  importance of informatics initiatives, yet not unduly delay their initiation.
• The IM/IT governance process must interact  effectively with departmental operational and strategic planning processes.
• The framework must support existing IM/IT  policies, standards and guidelines.

Governance  structure

For IM/IT governance to be effective, there must be a  structure in place that allows maximum participation while ensuring sound  decision-making practices. The roles and responsibilities of the major  stake holders in the IM/IT governance decision-making process are described  below.

The Management Committee (MC) is the executive  committee of the program branch. The MC is ultimately responsible for setting  the business directions for the branch. It is the ultimate decision-making  authority on all IM/IT issues, approving the branches’ IM/IT strategic direction  and priorities, and approving the overall IM/IT budget and initiatives. Its key  responsibility is to approve specific IM/IT projects, including funding and  human resourcing.

The Information Management Committee (IMC) includes  representatives from the informatics organization, the program branch and the  regions. This committee recommends most major decisions related to IM/IT  investments in the branch to the MC based on a thorough review of the business  case.

In addition to these committees, the governance  structure centers on several key organizations within the department. One of  these, the Information Management Organization (IMO) is the user organization  charged with assessing IM/IT needs, completing and updating an IM/IT operational  plan, and assessing and addressing associated risks. It monitors projects that  are underway and resolves problems related to individual projects or  multi-project priorities.

In addition, it coordinates all IM/IT  initiatives and provides quarterly status reports on all IM/IT initiatives to  MC. It also maintains, monitors and reports on the central IM/IT budget and  recommends allocation of funds to IMC. In addition to these, each IM/IT project  has a steering committee. The steering committee’s role is to oversee the work  of the project team, ensure that the project remains on schedule and within  budget, and keep the project in sync with the business requirements it is meant  to address.

Governance  process

This framework proposes a seven-step process for  launching new IM/IT initiatives within the branch or department. The best way to  illustrate this process is to present the steps in sequence, as they would apply  to a new candidate initiative. (See the Appendix, page 10, for a graphic  illustration of the governance process.)

Project proposal development

Anyone in a program branch may conceive of an idea  for a new IM/IT project. The first step is to enlist a senior manager willing to  act as a project sponsor should the project be approved. The idea must be  documented in a standard project proposal format, a brief two-to-three page  document outlining the opportunity/problem, the project’s objectives and scope,  and the expected benefits. The project proposal format and content are further  described in the Governance tools section (see page 6). The proposal is  submitted to IMO which reviews it against a number of criteria, including its  alignment with the business and IM/IT directions of the branch/department. IMO  forwards those ideas that are promising to IMC for further consideration.

Project proposal approval

IMC can either give the project proposal the go-ahead  to proceed to business case development or reject it with reasons. Rejected  proposals may be amended and resubmitted.

Business case development

The next major step in the approval process is the  development of a business case. The business case uses a standard format to  provide the information necessary from a business and technological point of  view that will lead to IMC approval. The business case presents a detailed  examination of the opportunity or problem, the project’s objectives and scope,  the estimated cost, benefits and risks. The format and content of the business  case are further described under the Governance tools section (see page 6).

The project sponsor assigns a project manager (PM) to  prepare the business case. A subject matter specialist (SMS) can also be  assigned to assist the PM in this. The departmental informatics organization  also assists in preparing the business case by providing a preliminary  determination of possible technical solutions.

Business case approval

Once the project sponsor has reviewed and approved  the business case, it is submitted to IMC. Then IMC reviews it to ensure that it  aligns with the business vision and strategic IM/IT priorities of the branch and  department, and that its overall budget and timing are reasonable. Business  cases meeting these criteria are recommended for approval to MC. Such approval  establishes the IM/IT initiative as an official project, with a budget only for  the next phase, that is, for user requirements/technical solution development.  From this point on, budgets are approved only on a stage-by-stage basis. This  project management discipline is used as the primary engine in the governance  process to ensure the relevance and success of the initiative.

User requirements/technical solution  development

Approval of the business case is tacit approval to  proceed to the next stage – user requirements/technical solution development. A  project team composed of a technical and a user project manager is assembled.  The user project manager documents all required business functionality in a User  Requirements Report. The technical project manager, from the departmental  informatics organization, focuses on defining the best technical solution for  the client, assessing the proposed solution against operational, support and  maintenance implications and against departmental standards and architectures.  Where the appropriate technical solution has serious implications on the  departmental IM/IT infrastructure, it is the responsibility of the technical  project manager to obtain the necessary approvals from the departmental  informatics organization. This information is documented in the Technical  Solution Report. Together the user project manager and the technical project  manager also produce the project plan and budgets (which include class B  estimates).

User requirements/technical solution  approval

Approval of the user requirements must be obtained  from the project sponsor, and approval of the technical solution must come from  the departmental informatics organization. Once these approvals are obtained,  the proposed solution and accompanying project plan/budget are submitted to IMC  for approval. IMC may accept, reject or insist on revisions to this plan and  budget. IMC approval means that the project plan and budget are forwarded to MC,  which also has the right to reject, approve or revise it. If MC’s decision is  positive, the project then proceeds to its remaining stages.

Project implementation

The final stage in this governance process is the  implementation work that leads to completing the project and deploying the  resulting solutions. This may involve augmenting the project team as required.

Throughout the project, IMO and the project sponsor  review and assess functional and technical progress and adherence to budget  monthly and at the completion of each remaining stage. Lack of progress or  significant deviations from the project plan will result in corrective action  being recommended to IMC and/or MC.

Selection criteria

Implementing this governance process on an ongoing  basis requires clear criteria to determine where and when it should be applied.  It is suggested that it should apply to IM/IT initiatives that meet the  following criteria:

• The initiative is not included in the department  or branch business plan and is not funded (the assumption being that those  initiatives that have made it onto the departmental plan have already been  approved through the annual governance and planning cycle).
• The initiative is not included in departmental  IM/IT plans and strategies.
• The cost of the initiative exceeds a specific  value (such as $50K), based upon a class B estimate,
• The project is national in scope and/or involves  at least two regions.
• The project will impact corporate  information/data administration.
• The project does not use departmental standard  and supported products according to approved usages.
• The project is likely to have an appreciable  effect either on the departmental infrastructure, or operation’s support or  maintenance.

IM/IT initiatives, which are “stand-alone” in  nature, do not involve the sharing of data and are not subject to the governance  process.

IM/IT governance development and  implementation process

To realize the full benefits of an IM/IT governance  framework in program branches, a number of requirements must be met to provide  improved direction and more cohesion to the operation and use of the governance  process.

Policy  requirements

There are a number of underlying policies required to  make this framework an effective tool:

• The governance framework must be understood,  supported and used by all relevant stake holders submitting IM/IT initiatives  for consideration.
• All new IM/IT initiatives are subject to the  process as specified in the selection criteria.
• The status of all IM/IT approved initiatives must  be reviewed on an ongoing basis to ensure their continued relevance and  progress.
• All relevant IM/IT investments made without using  the governance process must be suspended and processed through governance.
• The governance process must interact with  existing strategic and operational planning and other processes within the  department.
• A clearly worded policy statement from  management reinforcing these principles would provide the authority and  guidance needed to implement and effectively operate a governance framework in  the program branches.

Structural  requirements

In many programs there is  no central focus or control of IM/IT responsibility. As a result, there may be  no effective IM/IT planning at the strategic or operational level. This results  in projects not being delivered on time or within budget or to the satisfaction  of clients. Financial resources will have been spent on IM/IT initiatives  without an effective return on investment. Informed decisions about IM/IT  investments may have been lacking. Some program areas may be making investment  decisions without a full appreciation of the business or technical consequences.

To rectify this situation and to professionally manage IM/IT resources  in the branch, responsibility for all IM/IT functions must be clearly defined  and consolidated in the new user informatics organization. IMO responsibilities  include operational planning, implementation and operation of the governance  framework, budget monitoring/reporting, project oversight and change management.  As well, the reporting relationship of the new organization must be finalized.  Due to the importance of IM/IT as an enabler of programs and services, the  direct reporting relationship to the Assistant Deputy Minister (ADM) should be  established.

Planning  requirements

The completion and approval of the strategic  information management plan is needed to provide the vision and direction for  IM/IT initiatives required to achieve the business vision for the program  branch. The completion of this plan provides the priority and sequence of IM/IT  initiatives needed to support the business vision. It also provides the means of  assessing the relative importance of the many IM/IT proposals that are being  evaluated through the governance process.

Proactive identification of IM/IT needs will help to  ensure the availability of informatics resources, improved service and the  likelihood that projects will be delivered on time, within budget and to the  satisfaction of clients. The use of ad hoc methods to assess, plan and carry out  major IM/IT projects greatly increases the likelihood that serious problems will  be encountered.

Budget  requirements

One of the key requirements for the improvement of  the governance process is controlling the annual IM/IT budget to ensure that  informed investment decisions which support the business vision of the program  branch are made. This will ensure that investment decisions are made from a  long-term perspective, with knowledge of the consequences from a business or  technological perspective.

Monitoring and reporting on an IM/IT budget,  along with the power to recommend adjustments, will provide the control  necessary to ensure that all IM/IT investment decisions benefit the branch as a  whole. It will also help to provide an effective return on the investment of  IM/IT funds. Once an IM/IT initiative has been approved through the governance  process and becomes an official project, the funding is allocated and becomes  the responsibility of the project sponsor and the project manager.

Business process requirements

A number of best practices need to be implemented  across the program branch to ensure the effective operation of the governance  framework. These best practices include:

• IM/IT initiative assessment – An integral element  of the governance process is the accurate assessment of all IM/IT initiatives  to determine their merit and relevance. Two of the tools designed to assist in  this process are the project proposal and the business case. The project  proposal is used to initiate an IM/IT initiative for consideration first by  the home program area and later through the governance process. It must  receive the blessing of the relevant director general (project sponsor) in  order for it to be submitted for consideration by the governance process.
  Once IMO and IMC have accepted the project proposal, a business case for  it must be completed. The business case specifies in greater detail the  opportunity, project objectives, scope, assumptions, expected benefits, costs  and risks.
  The acceptance and use of these tools across the user  organization are critical to the successful implementation of the governance  process. The provision of training and guidelines on their use should be  implemented across the user branch.
• Committee operation – The effective operation of  committees is one of the essential elements of an effective governance  process. There are several requirements to ensure their effective functioning  including:
  – Terms of reference for all  committees (including roles and responsibilities, authority to make decisions,  membership, principles of operation, etc.) should be published using a  standard format across the branch.
  – The  limited time available to committees must be clearly focused on making  decisions with other items receiving less attention. Some committees operate  on a consensus basis and are somewhat reluctant to make tough decisions.  Delaying decisions on important issues can impede the progress of projects and  waste resources. Where important decisions are required regarding policy,  planning, governance or allocation funds, they should be made when needed,  based upon a clear understanding of the issue, the considered alternatives and  a recommendation.
  – As much as  possible, committee meetings should be scheduled to eliminate delays in making  needed decisions. Special provision must also be made to hold emergency  meetings when needed.

Project management  requirements

Sound project management is an obvious requirement  for successful governance. The following identifies some of the key requirements  often not considered:

The project roles/responsibilities must be clarified,  understood and carried out effectively so that each project operates under the  same parameters. These should become the standard set of roles and  responsibilities for all IM/IT projects. The major project players include the  project steering committee, the user project manager and the IT project manager.  Where IM/IT projects are applications, these roles and responsibilities should  also be aligned with the methodology being used for either custom applications  or commercial off-the-shelf software.

The most qualified and effective project managers  available must lead projects, from either the program area or from Informatics.  The project must be staffed with dedicated subject matter specialists from both  the user environment and from Informatics, especially on projects related to  application development. Without knowledgeable project managers and subject  matter specialists effectively representing the interests of the program branch,  there is a much stronger likelihood that projects will not be delivered on time,  within budget or to the satisfaction of clients.

Project management practices must employ sufficient  assessment points or “gates.” After a business case has been approved, many  projects are allocated a budget to complete the remainder of the project. At  this point, there is not a complete understanding of user requirements or  technical solutions. The budget estimate is inaccurate, and a full understanding  of the complexities of the project is not possible.

A number of assessment points are required to ensure  that the project’s progress reflects user needs, that the most appropriate  technical solutions are used, that an effective return on the investment is  provided and that the business of the branch is supported. The proposed  governance framework fulfills this requirement by providing assessment points at  the completion of project proposal, business case and user  requirements/technical solution. Assessment points also take place during and at  the completion of each remaining phase.

A standard reporting format/guideline must be  established for all project status reports, along with a standard set of success  criteria to assess project progress.

Governance framework  approval

• All elements of the IM/IT governance framework  must be reviewed, revised and approved by relevant stake holders and  management. These elements include:
• governance principles;
• information management organization roles and  responsibilities – project organization including terms of reference for  project steering committees and project teams;
• the IM/IT governance process – standard formats  for all project proposals and business cases;
• standard project reporting format and  standard success criteria to assess progress.

Confirmation of start  date

Once all the elements of the framework have been  approved, a start date for their use should be confirmed.

Timing  guidelines

There are a number of timing guidelines for the  completion of the various stages of the IM/IT governance process. The key  guideline is that the process must be simple and flexible enough not to unduly  delay the assessment and consequent development/implementation of important  IM/IT initiatives . At the same time, there must be a rigorous process in place  to ensure that approved IM/IT initiatives do indeed support and enhance the  IM/IT and business vision. This governance process is an end-to -end  decision-making process to ensure that from project conception through to  delivery, there is an effective return on investment for IM IM/IT funds  expended.

The exact timing to complete the assessment  stage from project proposal and business case will vary with each organization.  The completion of the development and implementation stages will depend upon the  type and complexity of the IT project.

Governance  tools

Two of the essential tools needed to provide  effective IM/IT decisions are project proposals and business cases for all  proposed initiatives. The project proposal is a high-level investment tool  providing a description of the problem to be addressed, the objectives, scope  and assumptions of the initiative, its high-level benefits and risks. In  conjunction with the detailed information on costs, benefits and risks provided  by the business case, it provides the information necessary to ensure that all  IM/IT investment decisions support the business vision of the user branch.

The benefits inherent in the use of project  proposal and business cases include:

• Project proposals and business cases prepared  according to the standard formats enable direct comparisons between candidate  projects. They help to determine which projects are most worthwhile. This is  especially important when there is competition for limited resources.
• The process of developing a project proposal in  combination with the business case requires a detailed analysis of costs,  benefits and risks of a proposed project. Consequently, the resulting  decisions to approve or reject it can be made with the most accurate and  detailed information possible.
• The process of developing a project proposal and  business case in which all stake holders participate helps to enlighten all  concerned and creates a set of shared expectations. These shared expectations  form the basis of improved communication, cooperation and coordination of  efforts.
• The completed project proposal and business  case provide a benchmark against which the results of the solution delivery  can be measured. The benefits expected from the completion of the project are  the return that is expected on the investment of funds. The business case  estimates these benefits and provides the means to compare them once the  project is implemented.

Project  proposal

The IM/IT project proposal is an investment tool used  to provide an initial understanding of the problem/opportunity and a high-level  solution. It includes a high-level description of the problem, project  objectives/scope/assumptions, benefits/risks for a proposed IM/IT investment. It  is the initial mechanism used in the IM/IT governance process to screen  potential investments to determine whether the information is sufficiently  complete to judge its merit. Where the information is incomplete, the project  proposal is returned to the author for revisions. Where it is complete, the  project proposal is then assessed to determine whether it has sufficient merit  to warrant refinement into a business case.

All project proposals should adhere to a common  format and be developed using a common process. This project proposal  development process includes:

• obtaining the support of a project sponsor for a  proposed IM/IT investment;
• defining the problem to be rectified or the  opportunity to be exploited;
• describing the objectives, scope and assumptions;
• describing the potential project risks and  benefits;
• preparing the project proposal documentation using  a common format; and
• submitting the draft project proposal to IMO  for review and recommendation to IMC for approval to develop a business  case.

Business case

An IM/IT business case is a detailed investment  submission providing an understanding of all costs, benefits, risks and  alternatives associated with a proposed investment. It provides a context to  understand how the investment supports and/or promotes the IT strategy and the  business vision of the branch and department. It provides the information to  ensure decision-makers have a level of confidence that the investment will  support program delivery, reduce costs, enhance client services, or support  business priorities to implement a required new program.

While business cases can vary in their level of  detail, they all should adhere to a common format and be developed using a  common process. This business case development process essentially refines the  information provided in the project proposal to a point, which allows an  informed decision to proceed to be made. It:

• describes the business problem, need or  opportunity and its relation to the department’s goals or other objectives;
• outlines the project objectives, scope and  assumptions and the range of possible actions;
• identifies the options considered to solve the  problem;
• identifies the interdependencies or linkages with  existing or proposed initiatives;
• states the high-level business requirements and  possible technical solutions;
• identifies and quantifies the costs of the  planning and analysis phase only;
• identifies and quantifies potential benefits of  the proposed investments; and
• identifies/assesses risks and outlines risk  management strategies associated with the proposed investment.

The business case is created using a common.  format and submitted to IMC for consideration.

Evaluation of the proposed  initiative

Once the costs, benefits and risks associated with a  proposed IM/IT investment have been determined, the next step in the business  case development process is evaluation. The evaluation of a proposed IM/IT  investment must be based upon a set of criteria. These criteria allow a  determination of how well the proposed IM/IT investment supports the  organization’s goals and its business processes, and demonstrates its benefits  to the branch, department or government as a whole. The evaluation of the  proposed IM/IT investment must be based upon a multi-criteria approach. The  evaluation criteria to use in assessing business cases may be grouped under the  following headings:

• support the delivery of programs and services
• contribute to business or informatics mission
• improve client and/or employee satisfaction
• enable continuous improvement
• lead to reduced costs or improved business  processes.

The specific evaluation criteria under each of these  headings must be tailored for each organization.

Based on an analysis of the findings, the  proposed IM/IT investment is either recommended for approval or rejected with  reasons by IMC. Based on the recommendation from IMC, MC rejects or approves the  business case and its budget for the user requirements development and technical  solution development.

Governance  interface

There are three levels of alignment in terms of  the IM/IT governance of the program branch and that of the informatics;  organization including: the policy level, the planning level and the project  level.

• Policy level – Policies are established within the  informatics organization and the program branch at the ADM level to provide  direction and guidance in carrying out day-to-day activities in support of the  business goals of the branch/department. For example, a draft IM/IT governance  policy provides the direction needed to ensure that IM/IT resources are  aligned and contribute to branch and departmental goals. Further, the policy  outlines high-level governance principles, the governance process, and the  roles and responsibilities of major participants. It also provides guidelines  for the effective use of the policy. Where branch policies affect the  operations of other branches, communication and coordination at the ADM level  should be used to ensure that these policies are implemented effectively.
• Planning level – At this level, multiyear IM/IT  plans are developed for both informatics and program organizations. The  alignment of these plans in terms of compatible goals and strategies must be  undertaken to ensure the effective utilization of IM/IT resources as the key  enabler in the achievement of the business goals of the branches and of the  department. The program and information organizations must ensure the  development, alignment and compatibility of these multiyear IM/IT plans. The  alignment of informatics and program IM/IT operational plans is manifest in  the identification of projects and activities to be carried out during the  year. These projects may include such elements as the acquisition and  installation of hardware, commercial off -the-shelf software, or the  development and implementation of applications. The alignment of these  operational IM/IT work plans in terms of priorities, resources and schedules  will help maintain the productivity of workers through the provision of needed  IM/IT tools, the delivery of effective training/support and implementation  resulting in minimal disruption to client work schedules.
• Project level – Once the business case has  been approved by the program branch using the governance process, an IM/IT  project is established. At the project level, the alignment of program and  informatics project management activities is achieved through the project  steering committee and the project managers from both organizations. The  project steering committee provides the direction, guidance and decisions  required by the project team to ensure the successful implementation of the  project. The project managers and their staff work closely together as part of  a project team. This project team is the principal mechanism through which the  program branch and the informatics organization jointly manage the project to  ensure it is delivered on time, within budget and to the satisfaction of  clients. Interface and integration issues that cannot be resolved at the  project team level are then raised to the project steering committee for  resolution. If there is still a deadlock, program branch issues are then  raised to IMC and/or MC for resolution.

Critical success  factors

There are several factors crucial for the governance  framework to prove effective for any federal public sector department:

• • It must be understood, supported and used by all  relevant stake holders submitting IM/IT initiatives for consideration.
  • It must be an effective forum to discuss and  resolve IM/IT initiatives/issues between program branches and the informatics  group, as well as with the regions.
  • All new IM/IT initiatives over $50K or some  similar amount must be subject to the governance process.
  • IM/IT initiatives not following the governance  process must not be funded.
  • It must be as simple and efficient as possible to  provide maximum assurance of the relevance and importance of initiatives but  not unduly delay their initiation or completion.
  • It must be effectively integrated with  strategic/operational processes and functions of the program branch and  department.
  • It must be an effective means of addressing  opportunities for the employment of new IM/IT applications or initiatives in  the branch or department.

It must be effective in eliminating  duplication of effort/overlaps in IM/IT initiatives across the program branch  and department and in realizing subsequent cost savings.

Conclusion

This approach to informatics decision making  provides the ability to organize disparate pieces of data into the coherent body  of information that is needed to make rational decisions about allocating scarce  organizational funds and to ensure an effective return on IT investments. In  short, the use of this governance regime will ensure that data will be converted  to information, the information refined into knowledge, and knowledge  transformed into wisdom. Wisdom in IT decision making is the acid test for  effective governance.
Bryan Shane is a senior partner with BPC  Management Consultants, For more than 20 years, be has provided consulting  services in strategic management, information technology and performance  measurement to a wide variety of public and private sector organizations. He has  published a series of three articles on performance measurement in the public  sector in Optimum . Mr. Shane holds an MEd from the University of Ottawa. He has  also completed extensive graduate studies in statistics and evaluation.

Patricia Lafferty is a partner with BPC  Management Consultants and has extensive experience as a senior professional  manager She has served as a senior consultant to both private industry and the  federal government for more than 20 years. Her areas of specific expertise are  strategic change management, facilitation, implementation planning and  performance consulting. She holds an MEd (Administration) from the University of  Ottawa.

Click on images below to see larger versions