InformationWeek.com

Welcome Guest. | Log In| Register | Membership Benefits

October 4, 1999

Project Maps Minimize Risk

As technology's role in business operations increases, careful management of IT projects becomes more critical

Illustration by Dave Calver

Related links:

Builders Rely On IT For Efficiency, Profit

Project Watchers

And from our sister publications:

EETimes At Xilinx, Internet gives team design a new look
areful management of IT projects is becoming critical because of businesses' growing dependency on technology to remain competitive. As part of this process, risk management is taking on a more important role, though companies are at odds over how to assess IT risk. Some are turning to outside consulting companies and their formal risk-management tools and services, while others are keeping the process in-house.

IT executives agree that project management is the formalized process of mapping out a technology project before it begins; precisely measuring project components against available manpower, dollars, and time; and, through it all, getting input from business executives whose operations will be affected by the project. But managing the risks associated with IT projects is more elusive. "Defining exactly what risk management is and finding the silver bullet to make it happen, that's the $64,000 question," says Steve Medina, director of application development at Carlson Companies Inc., which owns Radisson Hotels International Inc. and the Thomas Cook Group Ltd.

Enterprisewide Importance
Today, IT implementations aren't just business critical, they're becoming the business model. Companies are constantly searching for ways to mitigate the risks of IT propositions, from year 2000 remediation to enterprise resource planning. And as E-commerce becomes a larger proposition, incorporating aspects of supply-chain management and customer service, risk management will be tantamount. "E-commerce will be the next area for risk management," says Lynn Edelson, head of PricewaterhouseCoopers' operational and systems risk-management practice. "Organizations are starting to understand that E-commerce is not only a financial proposition, but an enterprisewide system that needs sophisticated assessment to identify which risks can be controlled and which can't."

Photo by Robert Burroughs One of the first decisions facing IT managers is whether to enlist an outside consulting firm or to handle project-management tasks in-house. The city of San Diego hired PricewaterhouseCoopers to help manage its year 2000 remediation project when it became clear that San Diego Data Processing Corp., a subsidiary of the municipality that functions as its IT department, couldn't handle the job alone. The job was risky, involving potential outages of public services such as utilities and law enforcement if the IT infrastructure supporting them went down. "We didn't feel our project-management team was up to the task because of lack of experience with that large of a project," says Rod Moyer, San Diego's Y2K project manager. "We didn't feel there was any lack of technical expertise for programming and testing, but there was a manpower problem that had to be solved."

PricewaterhouseCoopers came up with a twofold solution that involved hiring off-shore programmers to remediate code while a PricewaterhouseCoopers team managed every aspect of the project, including the creation of a dedicated staff whose role was to determine which of the city's systems were important enough to be remediated first. "We worked together to consider things such as how critical the application is to the city in terms of financial implications and how many thousands of lines of code it contains," Moyer says.

PricewaterhouseCoopers accomplished these goals using its objective risk controls and alignment process. First, proprietary software from the consulting firm was used to scan all the city's code for date fields. Using another proprietary metric tool, PricewaterhouseCoopers plugged in information on the training level of the city's engineers, the time frame in which the code remediation had to be done, and the operating system. The program red-flagged potential high-risk areas that might prevent on-time code remediation. Engineers then be- gan work on these tasks early, so there would be enough time to deal with potential problems.

PricewaterhouseCoopers also helped San Diego assess the limitations of Satyam, the Indian company that was charged with the actual code remediation, by evaluating its procedures and quality-control policies. Most significantly, the consulting firm created a quality-assurance tracking database that tracked application work packets sent to Satyam to determine how long remediation was taking. "By doing this, we saw early on that if remediation continued at the current pace, the city would never make its deadline," says PricewaterhouseCoopers' Edelson. "We made recommendations to San Diego so project managers could go back to India and demonstrate to Satyam where to cut down on time."

Photo by Alan Blaustein Worldwide Overhaul
Sun Microsystems recently completed a worldwide Oracle implementation to replace its global manufacturing and ordering system using project-management services from Andersen Consulting. Helen Yang, the VP at Sun who headed the project, says the risks involved were extensive because Sun's North American and European facilities shared a central system that comprises multiple legacy systems. Any outage would mean worldwide downtime.

Andersen helped Sun form an executive steering committee with VP "owners"--individuals whose business units would be affected by the proposed technology. Owners were expected to inform their business units completely of project plans by a certain date and to communicate back to the IT team that their people would be ready when the time came for the system change. This included making sure that each unit cleaned up any extraneous data residing on the legacy systems and planned training on the new system for employees. To keep this process both tangible and accountable to the owners, the business units were scored on how ready and well-informed they were.

continued...page 2, 3