GAO-04-394G Information Technology Investment …

1 AGAOU nited States General Accounting OfficeExecutive GuideMarch 2004 Version Technology Investment MANAGEMENTA framework for assessing and Improving Process MaturityGAO-04- 394g To view the full product, click on the link above. For more Information , contact David Powner, 202-512-4299, or Lester Diamond, 202-512-7957, Highlights of GAO-04- 394g , an executive guide. March 2004 Information Technology Investment management a framework for assessing and Improving Process Maturity The ITIM framework is a maturity model composed of five progressive stages of maturity that an agency can achieve in its IT Investment management capabilities. These maturity stages are cumulative; that is, in order to attain a higher stage of maturity, the agency must have institutionalized all of the requirements for that stage in addition to those for all of the lower stages.

2 The framework can be used both to assess the maturity of an agency s Investment management processes and as a tool for organizational improvement. For each maturity stage, the ITIM describes a set of critical processes that must be in place for the agency to achieve that stage. The figure below shows the five stages and lists the critical processes for each stage. At the Stage 1 level of maturity, an agency is selecting investments in an unstructured, ad hoc manner. Project outcomes are unpredictable and successes are not repeatable; the agency is creating awareness of the Investment process. Stage 2 critical processes lay the foundation for sound IT Investment processes by helping the agency to attain successful, predictable, and repeatable Investment control processes at the project level.

3 Stage 3 represents a major step forward in maturity, in which the agency moves from project-centric processes to a portfolio approach, evaluating potential investments by how well they support the agency s missions, strategies, and goals. At Stage 4, an agency uses evaluation techniques to improve its IT Investment processes and its Investment portfolio. It is able to plan and implement the de-selection of obsolete, high-risk, or low-value IT investments. The most advanced organizations, operating at Stage 5 maturity, benchmark their IT Investment processes relative to other best-in-class organizations and look for breakthrough Information technologies that will enable them to change and improve their business performance.

4 The ITIM Stages of Maturity with Critical Processes In 2000, GAO published an exposure draft of Information Technology Investment management : a framework for assessing and Improving Process Maturity (ITIM). Built around the select/control/evaluate approach described in the Clinger-Cohen Act of 1996 which establishes statutory requirements for IT management the framework provides a method for evaluating and assessing how well an agency is selecting and managing its IT resources. The exposure draft reflected current accepted or best practices in IT Investment management , as well as the reported experience of federal agencies and other organizations in creating their own Investment management processes.

5 This new version updates the exposure draft to take into account comments that GAO has received; GAO s experiences in evaluating several agencies implementations of Investment management processes and the lessons learned by these agencies; and the importance of enterprise architecture (EA) as a critical frame of reference in making IT Investment decisions. Using the framework to analyze an agency s IT Investment management processes provides: (1) a rigorous, standardized tool for internal and external evaluations of these processes; (2) a consistent and understandable mechanism for reporting the results of assessments; and (3) a road map that agencies can follow in improving their processes.

6 Page iGAO-04- 394g GAO IT Investment management framework ContentsPreface1 Section 1: Introduction5 Changes from the Exposure Draft 6 Investment management Overview 7 Section 2: Overview of ITIM11 The Stages of Maturity 11 Progressing through the Stages of Maturity 15 Section 3: Components of ITIM21 ITIM Hierarchy 21 Section 4: Uses of ITIM23 Principles Guiding the Use and Interpretation of the framework 23 Tool for Organizational Improvement 24 Tool for assessing the Maturity of an Organization 26 Limitations and Boundaries 27 Section 5: Critical Processes for the ITIM Stages29 Stage 1: Creating Investment Awareness 30 Stage 2: Building the Investment Foundation 33 Stage 3: Developing a Complete Investment Portfolio 63 Stage 4: Improving the Investment Process 90 Stage 5: Leveraging Information Technology for Strategic Outcomes 102 AppendixesAppendix I: Glossary113 Appendix II: Conducting an ITIM Assessment121 Using ITIM to Assess IT Investment Decision-Making Processes 121 Summary of ITIM Assessment Process 122 Appendix III.

7 Acknowledgments135 ContentsPage iiGAO-04- 394g GAO IT Investment management framework FiguresFigure 1: Fundamental Phases of the IT Investment Approach8 Figure 2: The Five Stages of Maturity Within ITIM11 Figure 3: Critical Maturation Steps Required to Move to the Next Stage16 Figure 4: The Components of an ITIM Critical Process22 Figure 5: The ITIM Stages of Maturity with Critical Processes29 Figure 6: The ITIM Stages of Maturity with No Stage 1 Critical Processes30 Figure 7: The ITIM Stages of Maturity with Stage 2 Critical Processes33 Figure 8: Instituting the Investment Board35 Figure 9: Meeting Business Needs41 Figure 10: Selecting an Investment46 Figure 11: Providing Investment Oversight51 Figure 12: Capturing Investment Information58 Figure 13: The ITIM Stages of Maturity with Stage 3 Critical Processes63 Figure 14: Defining the Portfolio Criteria65 Figure 15: Creating the Portfolio71 Figure 16: Evaluating the Portfolio78 Figure 17: Conducting Postimplementation Reviews84 Figure 18: The ITIM Stages of Maturity With Stage 4 Critical Processes90 Figure 19: Improving the Portfolio s Performance92 Figure 20: Managing the Succession of Information Systems97 Figure 21.

8 The ITIM Stages of Maturity with Stage 5 Critical Processes102 Figure 22: Optimizing the Investment Process104 Figure 23: Using IT to Drive Strategic Business Change109 Figure 24: Phases in an ITIM Assessment122 This is a work of the government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Page 1 GAO-04- 394g GAO IT Investment management framework PrefaceInvestments in Information Technology (IT) can enrich people s lives and improve organizational performance.

9 For example, during the last decade the Internet has matured from being a means for academics and scientists to communicate with each other to a national resource where citizens can interact with their government in many ways, for example, by receiving services, supplying and obtaining Information , asking questions, and providing comments on proposed rules. Although they have the potential to improve lives and organizations, IT projects can also become risky, costly, unproductive mistakes. As we have described in numerous reports and testimonies, federal IT projects too frequently incur cost overruns and schedule slippages while contributing little to mission-related Paperwork Reduction Act (PRA)1 requires federal agencies to be accountable for their IT investments and responsible for maximizing the value and managing the risks of their major Information systems initiatives.

10 The Clinger-Cohen Act of 19962 establishes a more definitive framework for implementing the PRA s requirements for IT Investment management . It requires federal agencies to focus more on the results they have achieved through IT investments, while concurrently improving their IT acquisition processes. The Clinger-Cohen Act3 also introduces more rigor and structure into how agencies are to select and manage IT projects. Among other things, it lays out specific aspects of the process that agency heads are to implement in order to maximize the value of the agency s IT investments and assess, manage, and evaluate the risks of its IT The E-Government Act of 20025 provides additional guidance on IT management practices across federal our research into IT management best practices and our evaluation of agency IT management performance, we have identified a set of essential and complementary management disciplines.