E-Commerce Security: Advice from Experts (IT Solutions series)

So far, the author has described operating assumptions about IT planning, resource management, and service and project delivery. These models and examples may resonate with the reader's own experiences. Even so, a concern may arise that these models and processes carry too high a price tag, putting them beyond the means of smaller enterprises and their IT organizations. Admittedly, these methods carry their own level of IT commitment and investment. As I will demonstrate, however, the cost of developing and maintaining these processes prove insignificant when balanced against their payback: high-quality customer relationships and consistent success in the delivery of IT products and services. Even if one were to set aside these lofty goals as unobtainable, one might be satisfied at an operational level with an IT organization that can achieve the level of self-management prescribed here. Could the synchronization of service and project delivery management modeled here work within your organization? Do you and your team have the interest, commitment, and will to make it happen? These are valid questions that need answering. The mechanism of the PMO (virtual or staffed) and its associated tools and techniques can contribute substantially to enhancing your IT team's performance.

To assist you in selecting a course of action, the author offers a series of ROI measures of his own, posed as questions. My premise is that answering these questions in the particular context of your own business will justify your investment in a PMO. Since there are many ways to approach and scope the deliverables of a PMO, I will then consider the potential components and service offerings of a PMO in more detail before returning to the calculation of an ROI for the PMO. To begin, consider the following questions as indicators of the current state of your IT team's service and project delivery performance. What are the cost implications of noncompliance with a PMO model? Is absence of planning and poor execution depleting your human and financial capital and wearing your welcome thin with your employer? You judge:

• What is the state of your current IT planning process? Is the allocation of IT organization resources properly aligned with enterprise priorities? Are your executive customers concerned with the nature, direction, and growth of IT expenditures?

• If you have an IT planning process in place, what percentage of IT management time is devoted to that process? Are the leadership's time and effort in this process well spent or should their work be supplemented by a staff function?

• How are IT's relations with your key customers (i.e., sponsors)? Does the IT organization fully understand their needs and concerns? Do your sponsors in turn fully appreciate the constraints under which the IT team operates? What is the cost to IT (financially, operationally, and politically) in maintaining these relationships or failing to do so?

• How does your organization measure and report on its performance to those who fund your activities? Are your sponsors satisfied with both the metrics and your reporting process? How might a process that more accurately reflects the concerns and interests of your customers and is delivered in a more timely and effective manner affect your standing among sponsors and the enterprise as a whole?

• Are your customers satisfied with your service delivery? How do you know? Are your measures and responses reactive (i.e., after a service has broken down) or proactive (i.e., anticipating and correcting points of failure before they occur)? Are you managing customer expectations, and if not, what does it cost you every time you disappoint a sponsor? How many resources do you currently devote to reactive problem correction (e.g., call center, CREs, maintenance and support personnel)?

• Are your customers satisfied with your project delivery? Do you deliver your projects on time, within budget, and in keeping with customer requirements? How often are IT resources misdirected because of a misunderstanding about customer specifications? What are the true costs and impacts of project change orders? How do you know, and what are your measures of success in this area?

• How much IT staff time is devoted to finding out who on the team owns particular expertise, manages particular IT assets, or holds the responsibility for a particular area of service or project delivery?

• How much does your team pay for scrap and rework, for reinventing the wheel, and for failing to learn from past service and project delivery mistakes?

• What skills and experiences are needed for your team's success? How are these requirements captured and addressed today? How are they learned on the job? What internal resources do you draw upon to train and develop your staff — not just in technical areas but also in terms of their people skills?

• Does your enterprise suffer from the proliferation of information technologies, or do you promote architected IT solutions built around recognized standards? What is the total cost of IT solution ownership? Do you know? Do your sponsors know? Will the leveraging of core technologies, rather than the addition of new technologies, make a difference to you, your team, and the bottom line of your parent organization?

These questions explore the territory where a PMO or some other process-focused support team can make a difference for the IT organization. For example, the first two sets of questions consider technology planning, asking how these functions are conducted within your enterprise and whether the right roles and skills are in place to ensure the desired outcome. Next, the diagnostic examines the quality of your team's customer relationship management efforts, the benefits of attending to these activities, and the costs of their neglect. Next are considered the dimensions of successful service and project delivery, including coordinated management, reporting, and accountability. Your IT organization undoubtedly invests heavily in these areas, but are you satisfied with your return on the investment? Are getting the results and value for each dollar spent? More importantly, are your customers satisfied with the outcomes of these efforts? The diagnostic concludes by touching upon activities that relate to your team's communication, leveraging, and reuse of lessons learned. Effective and efficient IT organizations also invest in internally generated knowledge management, the fostering of team work, technology standardization, and the deployment of architected solutions. Together, these characteristics define a truly outstanding IT organization.

Unfortunately, the coordination of planning, customer relationship management, service and project delivery, performance measurement, and knowledge management does not readily fit within the skill set, focus, or perhaps the interest of most IT operating units. These tasks call for nonlinear-thinking, multitasking, process-oriented professionals with strong people skills. Product and service delivery would also benefit from the objectivity and perspective that transcends the siloed orientation of the rest of the IT organization. In short, they call for an independent body of experts whose mission is to support, enable, and facilitate the effectiveness of service and project delivery teams. This working group may serve as a stand-alone organization or may comprise contributors drawn from various IT departments and brought together as dictated by circumstances. Whatever your strategy for staffing this team, it is essential that the PMO have a clear charter and mandate and that the rest of IT understands and supports the rationale for bringing the PMO function into existence.

My own model for the project management office begins with a broad definition of roles and responsibilities, as depicted in Exhibit 4. The main roles of the PMO include

Exhibit 4: Areas of Competence and the Overlap of Responsibilities within the PMO

• Strategic responsibilities, i.e., coordination of such services as planning, benchmarking, management training and development, and other staff support functions

• Knowledge management of information specific to the enablement of IT delivery

• Service and project management

See Exhibit 4 for an illustration. ^[11]

Note that these domains deliberately overlap. Planning, measurement, and training inform and are guided by the results of service and project delivery. The experiences in service and project execution contribute to the vast body of tacit and explicit knowledge that will enable future IT team performance. The measures of past performance, customer requirements, and IT organization capabilities are all elements that feed the planning for future prioritization of IT customer commitments and resource allocations.

Each set of PMO activities involves different combinations of participants. ^[12] The strategic services function may be staffed by a single individual, possibly the manager of the PMO working with the leadership from across the IT organization. Based on the action plans generated through the planning process, the manager of the PMO would work with his or her project manager or business analyst team to define and assign portfolios of work to individual contributors. Business analysts and project managers, working alongside their IT colleagues to deliver products and services to IT's customers, will generate artifacts, such as project plans, business requirements, technical specifications, training materials, and the like. These artifacts document the experiences associated with a particular IT deliverable and therefore constitute the team's recorded knowledge of that activity. By passing on these materials to the knowledge management function within the PMO, the office can catalog this information for repurposing and reuse at some future date. ^[13]

Even this brief introduction into the structure of a PMO suggests how the roles and responsibilities of participants overlap and reinforce one another. In effect, the PMO has many masters depending upon the service. For strategic and staff services, the PMO's customers are the IT executive team; for project and service delivery, they are those cross-functional IT teams accountable for projects and services; for knowledge management, the customers are first and foremost the rest of the IT organization, but perhaps also the enterprise's extended management team. See Exhibit 5. ^[14]

Exhibit 5: The Distribution of Labor within a PMO

As Exhibit 5 illustrates, the PMO can and should touch all aspects of IT operations while remaining unattached to any particular operating unit. In its support role, the PMO may remain invisible to outside customers and partner providers. To maintain its independence and its comprehensive yet objective view of IT delivery, the PMO should report directly to the chief executive or operations officer of the IT organization. The specific tasks assigned to the office might include these:

• Ensure alignment between IT commitments and the enterprise's business objectives

• Collect, codify, and disseminate best practices among IT's service delivery and project teams

• Collect, document, and disseminate reusable components (such as project plans and budgets, commitment documents, technical specification templates, scripts and software components, and the like) to project teams

• Oversee the reporting and performance measurement needs of IT

• Oversee the articulation and updating of SLAs between IT operations and its various customers

• Support the CRE function

• Discover and share benchmarking and best practices data as this informs measures and models of IT service and project delivery

• Support IT management's continuous improvement and process change efforts

• Assist in the management development and training of IT personnel ^[15]

These assignments embrace the overall support of service and project delivery management, as well as the associated knowledge management component, leaving to IT operating units the responsibility for actual service and project delivery and for the underlying technical expertise to address customer needs. As suggested earlier and depending upon the resources allocated to the Project Management Office, the PMO function could also provide project managers and business analysts as support staff to project teams. Project leadership would typically remain with the project directors, who would come from the information technology organization's line units and who would ultimately own the IT service emerging as a project outcome. As part of a project team, the services of PMO personnel might include the following:

• Assist in maintaining the project plan

• Maintain the project issue lists

• Maintain any project change of scope documentation (i.e., change orders) and the associated management processes

• Attend the weekly project team meetings and take minutes

• Attend the CRE and project director meetings with working clients and business sponsors as needed and take minutes

• Collect project artifacts (e.g., plans, scripts, best practices, system components) for reuse

• Promote reuse of IT project knowledge and encourage the use of best practices within project teams

Because the PMO focuses on process competence, leaving the technical side of the assignment to other IT personnel, the office's independence and objectivity position it to encourage the reuse of project artifacts and compliance with established best practices. Bear in mind that nothing about these processes is static. As the IT organization and its customers employ PMO templates and tools, they will adapt and refine these materials based upon practical field experience. PMO personnel will become the keepers and the chroniclers of this evolving institutional knowledge. Because they operate outside the reporting structure of other IT service delivery teams, PMO staff are in a position to advocate for and monitor the success of process improvements. In short, this team will help IT run like a business, facilitating and supporting the greater team's focus on successfully meeting customer requirements.

Although Chapter 7 and Chapter 8 discuss in some detail the role and value of the knowledge management function within the PMO, it makes sense now to consider how this function relates to the rest of the PMO. First, remember that in its support role, the PMO team exercises perspective into all aspects of IT operations. Yet, as a separate organizational unit, it is somewhat above the fray. PMO staff creates many of the artifacts that document IT organization processes but is sufficiently independent to recognize the less apparent dependencies among internal and external partner providers across the IT portfolio of projects. From this vantage point, the PMO will more easily identify opportunities for collaboration, leverage, and reuse, and it should be the first to recognize the implications of a particular project's slippage for other projects in the portfolio.

Furthermore, as a byproduct of their exposure to service and project delivery processes, PMO personnel will have direct experience of what works best in dealing with a particular customer, business problem, or confluence of information technologies. With this knowledge, the PMO team can develop process workflows, forms and templates, business rules, and even standardized technology components to better enable IT delivery. Over time, these activities can ensure the repeatable success of IT efforts. No one in a line position who is focusing on simply getting the job done would have the time or perhaps the interest to codify such knowledge into reusable forms and workflow diagrams. Codifying IT successes therefore becomes the domain of the PMO's knowledge management (KM) service.

To perform this function, the PMO's knowledge workers will require particular skills, such as an understanding of business process workflow rules, familiarity with knowledge management principles and associated technologies, and an ability to design form templates and to document business processes. In addition, these folks will need the tools common to the rest of the PMO team, namely solid interpersonal communication and people skills, listening skills, and oral and written communication skills. These are some of the particular tasks of the KM specialist:

• Create and maintain collaborative environments, like Lotus Notes TeamRooms, and document databases for projects teams

• Ensure that all vital project documentation is captured, retained, cataloged, and made accessible to those with a need to know

• Build and maintain an IT intranet site for the following:

  • IT organization planning content

  • IT standards and architecture content

  • Service and project management and delivery content

  • A resource allocation database

  • IT metrics and performance data

  • IT process best practices

  • Specific project content

  • IT asset inventories

• Manage access to and communications concerning IT project and knowledge databases

• Maintain forms and template libraries

• Maintain a best-practices library of case studies and benchmarking data

• Look for opportunities to bring knowledge artifacts and related PMO services to bear for the improvement of IT team performance

• Assist delivery teams to document results, processes, and lessons learned

Although most IT organizations get by without doing any of this, those in a position to rationalize processes and to leverage what they have learned from past performance will come out ahead of the game. In these ways, the PMO will help the IT management team to better execute overall planning and performance. They will support a variety of delivery team efforts, and they can provide an organization with valuable knowledge management services. The next section considers IT's return on the investment for establishing a PMO.

^[11]For a more detailed rendering of this diagram, see The Hands-On Project Office, http://www.crcpress.com/e_products/downloads/download.asp?cat_no=AU1991, chpt2~5~PMO Operations~framework and model.

^[12]For a set of PMO project management job descriptions, see The Hands-On Project Office, http://www.crcpress.com/e_products/downloads/download.asp?cat_no=AU1991, chpt2~7~pmo~job descriptions. For those roles primarily concerned with knowledge management, see The Hands-On Project Office, http://www.crcpress.com/e_products/downloads/download.asp?cat_no=AU1991, chpt2~8~km~job descriptions.

^[13]Chapter 7 and Chapter 8 discuss the knowledge management function of the PMO in detail and illustrate practical ways a modest investment in KM pays a healthy return to the IT organization.

^[14]An electronic version of this model may be found on The Hands-On Project Office, http://www.crcpress.com/e_products/downloads/download.asp?cat_no=AU1991, chpt2~5~PMO Operations~framework and model. A more detailed breakdown of PMO roles and responsibilities is provided in a companion document on The Hands-On Project Office, http://www.crcpress.com/e_products/downloads/download.asp?cat_no=AU1991,chpt2~6~PMO work alignment~model.

^[15]For a more detailed analysis of these activities, see The Hands-On Project Office, http://www.crcpress.com/e_products/downloads/download.asp?cat_no=AU1991, chpt2~3~IT Competencies~model 2.