Objetivos

When multiple boards execute the organization’s IT investment governance process, criteria aligning these boards must be defined such that there are no overlaps or gaps in the boards’ authorities and responsibilities. These criteria can be based on cost, benefit, schedule, and risk thresholds, the number of users affected, the function of the business unit (e.g., CIO, human resources, or program office), the life cycle phase of an IT investment (e.g., proof of concept, full scale development, or operations and maintenance), or other comparable and useful measures. An example would be to manage investments with less than a $100,000 life cycle cost at the lowest departmental level, but to have investments with more than $100 million in life cycle costs managed by the enterprisewide investment board.

Section 5: Critical Processes for the ITIM Stages •Stage 2: Building the Investment Foundation ••Meeting Business Needs

Activities Activity 1: The enterprisewide investment board has oversight

responsibilities for the development and maintenance of the organization’s documented IT investment process.

As the board responsible for defining and implementing the organization’s IT investment management process, the enterprisewide IT investment board should also have responsibility for developing the organization- specific IT investment guide. The board’s work processes and decision- making processes (i.e., schedules, agendas, authorities, decision-making rules, etc.) are described and documented in the guidance. In addition, after the guide has been developed, the enterprisewide investment board must actively maintain it, making sure that it always reflects the board’s current structure and the processes that are being used to manage the selection, control, and evaluation of the organization’s IT investments. Activity 2: Each investment board operates in accordance with its assigned authority and responsibility.

For the whole IT investment management process to function smoothly and effectively, each investment board must operate within its assigned authority and responsibility, so that investments are properly aligned with the organization’s objectives and are reviewed by the appropriate board. Activity 3: The organization has established management controls for ensuring that investment boards’ decisions are carried out. Establishing management controls helps to ensure that management will carry out the decisions made by the IT investment board. Without these controls in place, decisions made by the investment board might not be implemented because of conflicting priorities. To ensure adherence to management controls, the structure of the relationship between upper management and the investment board must be documented and agreed to by both parties,. The investment board must have the confidence of upper management when selecting new proposals and ongoing projects for funding.

Meeting Business Needs

of the organization, providing support for highly visible core business processes. These strategically aligned IT projects and systems provide the highest value and most obvious investment benefits to an organization and are hallmarks of successful return on investment.

Section 5: Critical Processes for the ITIM Stages •Stage 2: Building the Investment Foundation ••Meeting Business Needs

To achieve such a robust level of support, the organization must

continually identify the business necessity for its IT projects and systems. Periodic identification of the business needs ensures that the correct and appropriate IT projects and systems are funded and that they directly support the organization’s strategic plan. The frequency of this business verification may range from every quarter for an R&D project to every 3 years for systems in operations and maintenance; the appropriate interval depends upon the pace of functional changes in the system and the evolution of users’ needs. Identifying business needs ensures that IT projects and systems will maintain an alignment with the organization’s strategic plans and its business goals and objectives.

To the extent that the organization has planning documents—such as a strategic plan or a target enterprise architecture—these documents should be used as a source of agreed upon business needs. In addition, other business needs may surface through the investment process itself. In all cases, these business needs should be aligned with specific strategic objectives of the organization.

The essence of identifying business needs is for the business case for every IT project and system to be periodically reviewed and verified with respect to the business need(s) it is supporting. If an IT project or system is out of alignment with its strategic plan, then the IT investment needs to be resynchronized with the strategic plan or the overall strategic plan needs to be changed. Based upon the business case review, the most promising IT projects and systems are identified for continued investment. The

investment board addresses whether business and user needs continue to be met in a cost-effective and risk-insured manner.

This critical process establishes a mechanism for verifying the business case (such as business requirements and rules, congressional mandate, and the organizational users) that drives continued support for each IT system. Ensuring that an essential link exists between the organization’s business objectives and its IT strategy and that a defined partnership exists between the sponsoring unit and the IT solution providers strengthens and

Section 5: Critical Processes for the ITIM Stages •Stage 2: Building the Investment Foundation ••Meeting Business Needs

Figure 9: Meeting Business Needs

Purpose To ensure that IT projects and systems support the organization’s

business needs and meet users’ needs.

Organizational Commitments Commitment 1: The organization has documented policies and

procedures for identifying IT projects or systems that support the organization’s ongoing and future business needs.

The organization has policies and procedures that outline a systematic process for identifying, classifying, and organizing its business needs and the IT projects used to support these needs. In many cases, this can be covered in the internal guidance that is used for documenting business cases for IT investments. These policies and procedures typically specify that

Source: GAO.

Prerequisites:

1. The organization has a documented business mission with stated goals and objectives.

2. Adequate resources, including people, funding, and tools, are provided to ensure that IT projects and systems support the organization's business needs and meet users' needs.

Activities:

1. The organization defines and documents business needs for both proposed and ongoing IT projects and systems.

2. The organization identifies specific users and other beneficiaries of IT projects and systems. 3. Users participate in project management throughout an IT project's or system's life cycle. 4. The investment board periodically evaluates the alignment of its IT projects and systems with the organization's strategic goals and objectives and takes corrective actions when

misalignment occurs.

Purpose: To ensure that IT projects and systems support the organization's business needs and meet users' needs.

Organizational commitment:

The organization has documented policies and procedures for ensuring that IT projects or systems support the organization's ongoing and future business needs.

Section 5: Critical Processes for the ITIM Stages •Stage 2: Building the Investment Foundation ••Meeting Business Needs

• a systematic process for identifying, classifying, and organizing business needs is linked to the business planning process,

• business needs or opportunities should be stated in functional terms or in terms of desired business improvement and not in product- or technology-specific terms,

• each IT project or system fits within the organization’s EA and established security standards

• IT projects or resources that do not support an identified business need (and the associated customers or end users) are further examined for possible termination,

• there is a procedure by which similar needs or opportunities within different operating units are reconciled, and

• meeting business needs occurs regularly as part of the strategic planning cycle.

Prerequisites Prerequisite 1: The organization has a documented business

mission with stated goals and objectives.

The business mission, containing the stated goals and objectives is typically identified in

• strategic management or business plans (e.g., agency strategic plans prepared for GPRA),

• business process architecture documents, • process improvement initiatives, or • performance measurement plans.

Defining these goals and objectives, however, is largely outside the scope of ITIM. (See also Section 4: Limitations and Boundaries of ITIM.)

Prerequisite 2: Adequate resources, including people, funding, and