2008 Survey on the IT-Business Balance. How does business perceive IT s capability? How does IT perceive the needs of the business?

Transcription

1 2008 Survey on the IT-Business Balance. How does business perceive IT s capability? How does IT perceive the needs of the business?

2 Table of contents Foreword Objective of the survey Key survey findings... 5 Who responded IT governance... 9 Evolutions and trends IT management IT outsourcing Security, privacy and fraud Helpful references and links Acknowledgements Contacts This publication contains general information only, and none of Deloitte Touche Tohmatsu, its member firms, or its and their affiliates are, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your finances or your business. Before making any decision or taking any action that may affect your finances or your business, you should consult a qualified professional adviser. None of Deloitte Touche Tohmatsu, its member firms, or its and their respective affiliates shall be responsible for any loss whatsoever sustained by any person who relies on this publication. 2

3 Foreword We are delighted to present our second edition of the Deloitte IT-Business Balance survey report. When we completed the first IT-Business Balance survey in Belgium, we could not have anticipated the positive response we received not just from business and IT decision makers but equally from international market analysts. That response convinced us that this was not a one-off event. This year we also decided to broaden the scope by engaging more countries. We surveyed not only companies with a decision centre in Belgium but also companies with a decision centre in The Netherlands, France, Italy, Turkey and South Africa. This year s study shows that many of the key findings in last year s Belgian survey were also found in other countries. In an ever growing global economy, executives and business leaders often seek our advice about how to deliver value from IT initiatives, manage IT related risks and optimise IT costs. IT decision makers also look for benchmarking data on how other enterprises are improving IT governance. In response to this need we have once more taken up the challenge to compose this report and we intend to continue this tradition on an annual basis. This Deloitte IT-Business Balance survey is unique: It surveyed several hundred organisations around the themes of IT governance, IT management, evolutions and trends that drive IT strategy, and challenges such as security, privacy and fraud. The responses provide both statistical data to benchmark individual organisations and a current state of the alignment between the business and IT in Belgium, The Netherlands, France, Italy, Turkey and South Africa. Sincerely, Chris Verdonck Partner, Deloitte Enterprise Risk Services EMEA ERS Practice Leader Christian Combes Partner, Deloitte Consulting CIO Services Leader Belgium 1

4 Objective of the survey The goal of the IT-Business Balance Survey is to help Business and IT decision makers benchmark their own Information Technology (IT) environment compared to other organisations. More than ever before, benchmarking has become a means for organisations to measure and position themselves in a competitive space. Benchmarking with other organisations can assist organisations to identify those practices that, when adapted and implemented, can produce superior performance. This IT-Business Balance Survey is designed to enable organisations to provide this basis for comparison. Survey scope This 2008 report on the IT-Business relationship presents the results of an online survey organised by Deloitte member firms in The Netherlands, France, Italy, Turkey and South Africa in the fall of While last year s edition focussed on organisations with their decision centre in Belgium, this year s edition has broadened its scope and also queried next to companies with a decision centre in Belgium, also companies with a decision centre in The Netherlands, France, Italy, Turkey and South Africa. Areas covered by the survey This survey focuses in the first place on the differences in perception between business and IT representatives. It identifies the current hot issues and how they are viewed by the business versus IT decision makers. Additionally, this survey focuses on differences in practices between the participating countries and between companies of different sizes. The survey provides a benchmark for questions like: How does business perceive the support from IT? How does business believe that IT operates and should operate? How does IT perceive the demands from business? How does IT cope with the demands from business? In order to focus on specific areas of interest, 30 questions were prepared within the following five domains: IT governance Evolutions and trends IT management IT outsourcing Security, privacy and fraud In an ever growing global economy, benchmarking has become a performance indicator for organisations to position themselves in the global competitive marketplace. 2

5 Deloitte s subject matter experts enhanced last years survey questionnaire for this survey and also interpreted the results in light of experiences with Deloitte s clients throughout the world. While drafting the questions we aimed to make them understandable and meaningful to both IT and business representatives. The collection process An online version of the survey was released on the Deloitte Invision Internet survey platform. The data collection process was supported by Deloitte s international network of member firms and by multiple media campaigns realised through media partners: Trends/ Tendances, Datanews, Business ICT and Business People. Several publications in newspapers, magazines and newsletters further encouraged IT and business representatives to complete the survey in addition to direct mailings. 3

6 4

7 Key survey findings This second edition of the Deloitte IT-Business Balance Survey is the first European survey querying both business and IT representatives on information technology governance. We processed responses from 300 organisations to provide a current state of the alignment between business and IT and statistical data to benchmark individual organisations in Belgium, The Netherlands, France, Italy, Turkey and South Africa. The publication builds on concepts and viewpoints discussed in the series, The Risk Intelligent Enterprise : ERM Done Right. You may access these whitepapers in the series free of charge at The key findings can be summarised as follows: 1 IT Governance: If held, top level discussions on IT focus on financial alignment In this survey, almost two thirds of the responding organisations lack a formal IT steering committee to provide direction to IT. Without an IT steering committee and when IT topics are not structurally dealt with at Board or Management Committee level, an organisation may expect a self-steering IT organisation deciding on its own priorities. Additionally, in all participating countries, alignment of corporate and IT strategies remains a topic rarely discussed at top level. In the 33% of organisations where strategic alignment sessions are regularly being held, both business and IT representatives indicate that the primary focus is on financial alignment of the investment portfolio and to a lesser extent evolution activities and IT changes. 2 Evolutions and Trends: IT is seen as a cost centre to drive further automation Our survey results clearly show that it is mainly the request for more automation and new technologies that have driven the changes in IT policy and strategy in the past two years. Surprisingly, when looking 3 years into the future, business and IT respondents indicate that also process automation and process optimisation projects will be the future dominant drivers. Less than 25% respondents believe that IT projects will contribute significantly to business growth, such as product innovation, revenue growth and accelerated go-to-market. On the other hand, 30% of IT representatives believe they often or even always are the driving force in starting up innovative projects. This is in sharp contrast to business representatives: only 7% of them share this view. 3 IT Management: Is IT ran like a business? 4 out of 10 business respondents are rather pessimistic on the IT project success rate indicating that 1 out of 3 projects fail. IT has a more positive perception on project success compared to the business representatives since 32% of IT versus 25% of business representatives believe that over 2 out of 3 projects are successful. Are business and IT communicating efficiently on IT project success? 3 out of 10 business respondents indicate a high level of maturity for the IT processes (level 4 or 5). The participating IT representatives are less optimistic on their own IT department s maturity since 2 out of 3 of them indicate that the maturity of their department is at level 3 or below. Are business and IT communicating efficiently on IT process maturity? 4 IT Outsourcing: Dominated by insourcing and bodyshopping Nearly 6 out of 10 of all respondents indicate that annual staff turnover in their IT department is less then 5% demonstrating an acceptable level of stability of IT staff in many organisations, at least in the past years. The survey indicates that most organisations perceive that the time is right to (out)source some of their activities. 71% believe their senior management is moderately or very comfortable with outsourcing. With 38%, insourcing and bodyshopping are by far the most popular way of sourcing. The survey responses indicate that senior management does not consider outsourcing as a strategic initiative but merely as a delivery means. We suppose that this is the main reason why senior management has an increased comfort feeling with outsourcing activities. 5 Security, Privacy and Fraud: A matter of knowing On the positive side, 31% of business respondents believe that procedures and guidelines on information security and data protection are very well monitored by senior management. However, only 19% of IT representatives share that view; in fact, 42% of them believe that senior management is hardly monitoring security and privacy. But, a staggering 3 out of 10 respondents indicate never to have been the victim of IT-related incidents. One may wonder if this result reflects the actual reality and whether it may rather be explained by the lack of transparency around incidents. 5

8 Who responded Organisational facts and figures Internationally, over 400 respondents participated in this 2008 IT Business Balance Survey. Incomplete, duplicate or inconsistent responses have been excluded from the final data set, resulting in a final statistical population of 294 valid responses. On average, 1 out of 3 respondents were business representatives, the other respondents representing IT. Few respondents preferred not to provide an indication of their role in the organisation; their responses have been excluded when comparing business and IT responses. Balance between IT and business respondents Number of users directly relying on IT services 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% Business profiles 0% The Netherlands Belgium France Italy Turkey South Africa Small (< 50) Medium (51-500) Large (> 501) IT profiles 64% 36% The pool of respondents reflects a good sample of small, medium and large organisations. On average 1 out of 10 respondents represents a small organisation with less than 50 IT users; over 3 out of 10 represent a medium sized organisation with less than 500 IT users, and over half the respondents represent a large organisation with more than 500 IT users. n = 294 Expressing the size of the organisation as the number of users directly relying on IT services, the following chart shows the distribution of responding organisations in the different countries: 6

9 We also surveyed the size of the IT department in terms of Full Time Equivalents (FTE). The following chart shows that, compared to the other countries, relatively more respondents of Turkey and South Africa represent large IT divisions. Number of full time equivalents in the IT department 100% 90% Not surprisingly, when comparing the number of IT users and the size of the IT organisation, most large IT divisions (many IT employees) also serve large organisation (many IT users). However, some of these large and mid-sized companies indicate to rely on smaller IT departments. A correlation analysis of the survey results percentage of the IT budget spent on outsourcing and size of the IT department did not reveal these organisations to rely on a higher degree of outsourced IT activity. 80% 70% 60% 50% Organisation Size Small Medium Large < > % 30% 20% 10% IT Department Small Medium Large < >100 47% 12% 5% 0% 0% 26% 2% 0% 4% 2% 17% 64% 33% 0% 7% 5% 12% 21% 4% 2% 4% 10% 41% 92% 90% 100% 100% 100% 100% 100% 0% The Netherlands Belgium France Italy Turkey South Africa Small (< 5) Medium (5-50) Large (> 50) Financial facts and figures Last year s Belgian results showed that over 20% of the respondents did not have financial information available. Most of this year s participants, however, indicated that they are informed or do have an idea about the percentage of annual turnover spent on IT. Moreover, there were no significant differences between business and IT respondents. This provides an indication that financial and IT expenditure information is shared amongst business and IT decision makers. Financial and IT expenditure information is shared amongst business and IT decision makers. 7

10 8

11 IT governance Preface When technology was first making inroads into business, the IT leader s traditional job was keeper of the infrastructure. The CIOequivalent (the title did not exist at the time) presided over huge mainframes (and the requisite data punch cards), but little else. Over time, as technology advanced into almost every aspect of the enterprise and became indispensable to the functioning of the organization, the CIO s profile began to rise. If a single phrase could sum up the mission of technology executives during this phase, it might be this: Get it done. Likewise, their technology departments were basically miniature software companies. If traditional CIOs were unfamiliar with business strategy, it didn t much matter; the executive branch didn t understand IT either. Thus, technology and strategy were rarely uttered in the same breath. The fortunes of the CIO took another turn ten-plus years ago with the rise of the Internet. As e-channels were changing everything, CIOs seemed to be in a perfect position to become a true strategic partner in the business. But somehow the opportunity slipped away. Our survey queried whether today s organisations are ready for the 21st century CIO whereby IT is viewed the Risk Intelligent way. Previous Deloitte surveys (ìbringing IT into the Boardroomî survey) show that CIOs are not experienced to operate at board level and position IT in the context of the business. Survey findings Governing IT 9,130,000. That is the figure returned when IT governance is googled. Needless to say that based on this large number of search results, one may expect that IT governance covers a wide range of topics and is interpreted in many ways. Our greatest challenge is to avoid silo behaviour since it affects our decision making capabilities A CFO in South Africa indicate they always address IT in such meetings whereas 4 out of 10 of all respondents indicate to never or rarely deal with IT topics in such meetings. The only notable difference as shown in the chart is that business decision makers have a somewhat more positive perception of dealing with IT matters in executive meetings compared to their IT counterparts. This could indicate that the IT decision makers may not always be engaged in such meetings when business is deciding on strategic IT matters. How frequently do IT issues appear on the agenda of the Board of Directors or Management Committee? Always Often The purpose of the IT governance survey section is neither to provide a definition nor an exhaustive list of actions related to IT governance. It is mainly focused on issues related to bringing IT into the Boardroom and considering technology as a strategic resource and asset by the Board. Our survey concludes that overall business and IT decision makers in all countries have no significantly different opinions on how frequently IT topics appear on the agenda of Board or Management Committee meetings. Only 1 out of 10 business and IT respondents Regulary Rarely Never IT 0% 10% 20% 30% 40% Business 9

12 Other differences in perception on how frequently IT issues appear on the agenda of the Board or Board of Directors can be found amongst the participating countries. How frequently do IT issues appear on the agenda of the Board of Directors or Management Committee? The Netherlands Belgium France Italy Turkey South Africa Infrequent (nevel + rarely) Frequent (regularly + often + always) It is worthwhile to note that only France and Italy report they may deal infrequently with IT topics at top management level (on average 70% infrequent vs 30% frequent). In other countries, IT topics may be frequently dealt with in Board or Management Committee meetings (on average 35% infrequent vs 65% frequent). These results demonstrate on the one hand that IT gains attention from top management. On the other hand, the results equally demonstrate that some regions could still be subject to improvement. Is there an IT steering committee or council in place to oversee and provide direction to IT activities? The Netherlands Belgium France Italy Turkey South Africa Informal (no + informal) Formal (formal + formal with reporting Similar to last year s Belgian IT Business Balance survey results, this year s results show that mainly large organisations have a more formalised IT steering committee. Yet, nearly 4 out of 10 respondents indicate not to have such IT steering committee or council. Companies with an IT steering committee versus company size > Autonomy of IT Except for South African respondents, an average of nearly 7 out 10 respondents indicates to have either no or only an informal IT steering committee or council in place that oversees and provides direction to the IT activities. Further analysis shows that slightly more IT respondents than business representatives were optimistic about the formalisation of the committee or council < 50 No Informal Formal Formal with reporting Without an IT steering committee and when IT topics are not structurally dealt with at Board or Management Committee level, an organisation may expect a self-steering IT organisation deciding on its own priorities. To test this statement, our survey asked what level of autonomy the IT organisation has been given (see chapter IT Management). 10

13 Nearly two thirds of the organisations surveyed lack a formal IT steering committee to steer IT. It becomes even more interesting when comparing different perceptions of the participating countries. How frequently is the IT strategy aligned with company strategy? 100% 90% 80% Strategic alignment of IT On average, over a quarter of the respondents report that their IT strategy is rarely or even never aligned with the company strategy. Another quarter of the respondents align strategies only during the annual budgeting cycle. On average, in over 40% of the responding organisations, strategic discussions and alignment of strategies are held structurally and independently of budget discussions (i.e. on an annual, half-yearly or 3-mothly basis). Business respondents are rather more positive about dealing with the alignment on either an annually, a half-yearly or a 3-monthly basis. This can be related back to a previous question where business also indicated to be a bit more positive about dealing with IT topics on the agenda of Board or Management Committee meetings. The chart also demonstrates that IT decision makers have a more financial focus when aligning the IT to the company strategy since 31% of them indicates to align their strategy during the annual budgeting cycle. How frequently is the IT strategy aligned with company strategy? 70% 60% 50% 40% 30% 20% 10% 0% The Netherlands Belgium France Italy Turkey South Africa Structurally (monthly + 3-monthly + half-yearly + annually) Annually during budget Ad Hoc or Never Don t know The chart above shows that The Netherlands and Belgium have a comparable strategy alignment pattern. The same can be said for Turkey and South Africa. These countries indicated to mainly structurally align IT to company strategy. However, over 40% of the Italian respondents have responded that alignment is mainly done during the financial budget cycle. And 50% of French respondents have indicated never or on an ad hoc basis to align IT to the company strategy. Not surprisingly, these two countries also have indicated that very infrequently IT topics appear on the agenda of Board or Management Committee meetings. Never Ad Hoc Annually during budget Annually Half-yearly 3-monthly Monthly 0% 10% 20% 30% 40% Our strategy is to be sufficiently reactive while keeping business and IT strategy aligned during our international group systems harmonisation. A CIO in France IT Business 11

14 It is worthwhile to note that only very few of the respondents did not have sufficient information to answer this question. When looking at the topics discussed during these strategic alignment sessions, both business and IT representatives indicate that financial alignment of the investment portfolio, including IT projects, is the leading topic. In addition, the evolution in company activities and desired IT changes are coming in at a close second above pure IT-related What are the top issues normally covered in the strategic alignment processes between business and IT? Financial Evolution activities and IT changes IT Trends Long term vision IT Processes and procedures Harmonization of governances Staff Training User satisfaction Results 0% 5% 10% 15% 20% 25% topics, such as technology trends, IT processes, staff training, etc. The only notable difference in responses between business and IT representatives can be found in staff training with 1 out of 10 business respondents compared to 1 out of 100 IT respondents. Alignment of corporate and IT governance remains a topic rarely discussed in all participating countries. IT as driver of strategy The survey indicates that business and IT have a different opinion on who is the driving force when initiating innovative projects. 30 % of IT representatives believe they often, regularly or even always are the driving force in starting up innovative projects. This is in sharp contrast to business representatives: only 7% of them share the IT representatives view. This difference in opinion between business and IT can be related to the level of autonomy given to IT departments. As mentioned above, IT can mainly decide on technological choices. And technology is probably often seen as innovative by the business if they have a lower level of technological comprehension. And vice versa, IT representatives could believe to be innovative with the many technical projects they drive. This confirms the importance of an IT steering committee and aligned business and IT strategies, since this provides some clarity as to what exactly is understood as innovative to the business (as opposed to the technology). How often is the IT department a driving force in starting up innovative projects? Always (in 100% of projects) Regulary (more than 75% of projects) Often (in 50% to 75% of projects) Sometimes (in 25% to 50% of projects) Occasionally (fewer than 25% of projects) Never 0% 10% 20% 30% 40% In all participating countries, alignment of corporate and IT governance remains a topic rarely discussed. IT Business It is useful to know that there are no notable differences between the participating countries. Additionally, these results are very comparable to last year s Belgian IT Business Balance survey results. 12

15 Do CEOs want to go beyond financial discussions with IT? To answer this question, our survey reveals some interesting conclusions: What kind of business case initiates projects? Comparable with the results of the 2007 IT Business Balance survey, on average only half of the respondents state that a business case justified for both business and IT is mandatory to start up an IT project. Moreover, business and IT representatives responded similarly. How are IT projects initiated? 100% Organisations often lack a formal forum to provide direction to IT (66% of responses). The primary focus of strategic discussions between top management and IT is on financial alignment of the investment portfolio (25 % of responses). Only few indicate long term vision and user satisfaction as a regular topic. This means that in many of the organisations surveyed, top management does not wish or cannot discuss strategic issues with IT, other than budget and investments. 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% The Netherlands Belgium France Italy Turkey South Africa Started without Business Case Justified Business Case for IT Don t know Justified Business Case for Business Justified Business Case for Business and IT However, large differences between the participating countries can be noted. Mainly The Netherland, Belgium, Turkey and South Africa are just above or below the average 50% figure for a justified business and IT business case. France and Italy are significantly below that average figure. Not surprisingly, it is also those two countries who indicated that IT topics do not frequently appear on the agenda of Board or Management Committee meetings. Business and IT have different views on who is the driving force in starting up innovative projects. 13

16 14

17 Evolutions and trends Preface Today, CIOs are pulled in many directions: by auditors, who want carefully documented evidence of strong IT controls; by CFOs, who want immaculate data, compressed closing cycles, and real-time information; and by CEOs, who want information upon which to base their strategic decisions. And tomorrow s CIOs will have to take risks to respond to these business requests. Risk taking for reward can assume many forms, from strategic acquisitions to research and product development to entering new markets. Today s organisations face quite an array of risk factors. Here s a partial list: growing merger and acquisition activity increases in technology-related litigation and intellectual property lawsuits increasing outsourcing and offshoring needs network security concerns around customer information and organisational secrets greater dependence on third parties increasing international, federal and local government regulations. Our survey queried whether today s organisations are evolving themselves to become ready for the 21st century CIO and strategically positioning IT the Risk Intelligent way. Survey findings External events that influence IT More than ever before, our consumer market is driven by an ever growing supply of high tech gadgets which come at lower prices and are equipped with functionalities even beyond our imagination. But what is driving the corporate community? Comparable to the Belgian IT Business Balance 2007 survey results, this year s survey clearly shows that it is mainly the request for more automation and new technologies that have driven the changes in IT policy in the past 2 years (indicated by nearly 40% of the surveyed organisations in all participating countries). What events influenced the IT policy in the past 2 years? More automation New technologies New management Mergers & Acquisitions Product portfolio Technology Price New risks SOX Competition ISO certification 0% 5% 10% 15% 20% 25% Conversely, the competitive market (5%) or the need for innovation (9% product portfolio) have been less of a driver for IT in the past 2 years. Our focus is to migrate from legacy systems to open systems. A Financial Director in Belgium 15

18 Are CEOs ready to let IT influence their business? To answer this question, our survey reveals some interesting conclusions: In the past two years, IT strategy was mainly influenced by the need for more automation (20% of responses) and by new technologies (18% of responses). Only few indicate that business drivers such as M&A, product innovation or new markets drove IT strategy. For the coming 3 years the role of IT in influencing the business is still focused on faster execution (34% of responses) and automation of processes (23% of responses). We have found no significant differences in opinion between business and IT respondents. Nevertheless, IT respondents more than business respondents indicate that the IT policy was influenced by Mergers and Acquisitions. Business respondents on the other hand indicated more than their IT counterparts that changes in technology prices influenced the IT policy. What events influenced the IT policy in the past 2 years? More automation New technologies Technology Price New management Product portfolio IT New risks Mergers & Acquisitions Competition SOX ISO certification 0% 5% 10% 15% 20% 25% Business This means that in many of the organisations surveyed, top management does not view IT as an enabler for business growth and believe that IT has only a supporting role. This may explain why IT strategy is hardly a topic on the CEO s agenda as revealed in the first chapter. 16

19 In comparing the top 5 answers given in the participating countries, we find the following differences. What events influenced the IT policy in the past 2 years? Effects of IT on the organisation What are the main effects of IT projects on the organisation in the past and in the future? 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% The Netherlands Belgium France Italy Turkey South Africa Product portfolio New management Mergers & Aquisitions New technologies More automation Automation of processes Faster execution of processes Better products Cost saving 5% Cost saving 10% Faster Go to market Turnover increase None above Past 2 Years 0% 10% 20% 30% Coming 3 Years The Netherlands and Belgium show, again, comparable results and have indicated that the IT policy was influenced mainly by more automation and new technologies. In France however, the respondents indicate that the IT policy was mainly influenced by Mergers & Acquisitions and new management. Italian respondents indicated that M&A, new technologies, more automation and new management nearly equally influenced the IT policy in the past 2 years. Turkey and South Africa on the other hand indicate that mainly the product portfolio and new technologies were the IT policy influencers in the last 2 years. It is not so surprising to see that different countries and regions have diverse IT policy influencers. The IT landscape often is highly dependent on events happening in the local market. The chart above shows that in the last 2 years, business drivers such as revenue growth, efficient go-to-market campaigns, cost savings and better products score significantly lower compared to IT projects to improve internal (business and IT) processes. Detailed analysis revealed some differences between the results of business and IT respondents and were also found amongst the participating countries. We need to further support the company growth through integration of newly purchased business units. An IT Manager in The Netherlands 17

20 On the one hand, the business respondents stress somewhat more that business driven IT projects related to revenue growth and efficient go-to-market campaigns had a more important impact on the organisation in the past. The IT respondents stress a little more that cost savings were more a result of IT projects executed in the past 2 years. This could be related back to a previous question where IT respondents have a more financial focus since they indicated that aligning IT strategy to the company strategy was done annually during the budget cycle. On the other hand, the French and Italian business and IT respondents indicate that the organisation was served with better products as a result of IT projects executed in the past 2 years. Automation of processes and faster execution of processes was for these two countries nearly equally as important as better products. When looking 3 years into the future, business and IT respondents indicate again process automation and process optimisation projects to be the future dominant drivers. This is very similar to the results of the 2007 Belgian IT Business Balance survey. On top of that, the IT department will have to contribute to the generation of increased cost savings and to help increase the turnover. What are the main effects of IT projects on the organisation in the past 2 years? 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% The Netherlands Belgium France Italy Turkey South Africa Automation of processes Cost saving 5% Cost saving 10 % Faster execution of processes Better products We found no notable differences between business and IT respondents. Comparing the top 5 responses of the participating countries however, we have found some notable differences. The next chart indicates where IT projects in the participating countries should focus on in the coming 3 years. The majority of all respondents indicate that IT needs to focus on operational efficiency rather than contributing to business growth. The Netherlands, Belgium and Italy show a remarkable similarity is responses in correspondence with the overall average result. France, Turkey and South Africa survey respondents indicate that IT projects in the next 3 years will have to focus on faster execution of processes in the future. With these observations, one may conclude that IT projects are not likely to contribute significantly to business growth, such as product innovation, revenue growth and accelerated go-to-market. Both business and IT respondents in all participating countries are fairly convinced that IT needs to focus on operational efficiency rather then contributing to business growth. 18

21 IT management Preface One may ask the question if CEOs are always well aware of the organisational impact of IT s decisions. Here is a set of examples that might trigger CEOs to start thinking: the choice of the organisation s ERP system might not just be a technological choice of IT but a conscious risk rewarded business decision for competitive advantage the selection of IT business partners might not just be an IT capacity increase but a well considered business partnership (e.g. some companies do not want to be associated with certain other companies for different reasons). It is therefore recommended that 21st century CEOs understand how risk intelligent CIOs fit into their organisational picture. They also better understand how much influence IT departments really have on the business related risks. And how autonomously they can leave IT in taking risks that might have a reward to their organisations. Our survey queried organisations whether senior management is reaching out to their CIOs. Survey findings Running IT like a business IT management often is referred to as running IT like a business. And running a business is a complex endeavour that needs to find a good balance between profitability, quality of delivery and personnel fit for purpose. This IT management section of the survey focuses on these three comparable business variables in the IT department: project success, process maturity and personnel turnover. 39% of the business respondents are rather pessimistic on the IT project success rate indicating that 1 out of 3 projects fail. The survey shows notable differences in the responses from business and IT representatives relative to the project success triangle. What percentage of IT projects is delivered on time, on budget and with the planned functionality? IT None 0% - 33% 33% - 66% 66% - 100% All 0% 10% 20% 30% 40% Business An accumulated 39% of the business respondents are very pessimistic on the IT project success rate indicating that 1 out of 3 IT projects fail. Only 1 out of 4 business representatives are positive that the vast majority of IT projects (over 66% of all IT projects) is successful. On top of this, IT has a slightly more positive perception on project success compared to the business representatives. 1 out 3 of IT decision makers believes that more than 2 out of 3 IT projects are successful. On average, only 1 out of 10 of all respondents could not answer this question. Detailed analysis shows an equal amount of business and IT representatives lacked the information on project success. Multiple sources are most probably the reason for this disconnect. We could conclude that this provides an indication that IT may adhere to other measurement standards on project success. It could equally mean that IT does not communicate well on the completion of projects leaving business with insufficient information or even a very negative perception on project success. We could also conclude that companies require more IT governance to steer IT projects (e.g. relating back to the lack of IT steering committees in many organisations). 19

22 How much do CEOs want to influence IT? To answer this question, our survey reveals some interesting conclusions: Very often, IT can autonomously decide on technology selection (26% of responses) and its business partners (17% of responses). Many business respondents are rather pessimistic and say that only two thirds of IT projects ran as planned (39% of responses). Country analysis shows that no significant differences have been put forward amongst the participating countries. On average, a considerable 60% of all respondents believe that less than 2 out of 3 IT projects is capable of delivering within budget, time and planned functionality. IT s autonomous decision power Similar to last year s results in Belgium, most of the IT autonomy for all participating countries relates to selection of technology and their IT business partners. What topics can IT decide upon autonomously? Technology selection IT Business partners Change request priorities Expenses lower 5% of budget User interface This means that in many of the organisations surveyed, top management may be faced with IT choices that are not in line with their business partnerships. All expenditures Project priorities Roll out Expenses lower 10% of budget 0% 5% 10% 15% 20% 25% Additionally, top management is often faced with budget overruns or time slippages. Yet, the first chapter reveals that many organisations lack a formal forum to provide direction to IT and challenge their priorities, choices and performance. Still 1 out of 10 respondents indicates that IT can autonomously change priorities and determine the user interface. Sound IT governance, however, would assume a positive engagement from the business and would not leave these as the responsibility of solely the IT department. We need to create the ability to define and track the expected benefits of projects and align project goals to business goals. A CIO in Turkey 20

23 When comparing the top three responses of all participating countries, we noted some significant differences. What topics can IT decide upon autonomously? 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% The Netherlands Belgium France Italy Turkey South Africa In Turkey and South Africa, the chart above shows that autonomous decision power may mainly be given to IT when it comes to technology selection. In The Netherlands, Belgium and France, it looks like IT can decide more on change priorities compared to the other companies. What percentage of IT projects is delivered on time, on budget and with the planned functionality? 100% Technology selection IT Business partners Change request priorities A matter of process maturity The survey equally queried business and IT decision makers on the perceived maturity of the IT department based on the following defined levels: Level 0: IT processes are dependent on the enthusiasm of staff and senior management fails to recognise this; Level 1: IT processes support existing procedures in certain business units and senior management has not indicated any priorities; Level 2: IT processes support existing procedures in certain business units and senior management is not fully committed to them; Level 3: IT processes support existing policies and procedures for the entire organisation and senior management is committed to them; Level 4: IT processes are measurable for the entire organisation and senior management uses this as a differentiator; Level 5: IT processes have proven effective for the entire organisation, and senior management is integrating them into the business processes. Our survey shows that the concept of maturity has gained more awareness amongst business and IT representatives since they both have in one way or another a measurable baseline about the maturity of the IT department. This is in contrast with last year s Belgian results where over 40% of respondents did not have sufficient information. Only 1 out of 10 respondents has insufficient information to answer to this question. 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% The Netherlands Belgium France Italy Turkey South Africa All 66%-100 % 33 %-66% 0%-33 % None Don t know Business and IT respondents are informed on a measurable baseline of the IT department s maturity. 21

24 30% of the business representatives have the impression that their IT processes have a high level of maturity (level 4 or 5). This is in contrast to responses to a previous question where business representatives were rather negative on the IT project success rate. Project management often is a key IT process with high visibility to the business. IT representatives, however, are less optimistic on their own IT department s maturity since 2 out of 3 of them indicate that the maturity of their department is at level 3 or below. Our valuable human IT capital Nearly 60% of all respondents indicate that annual staff turnover in their IT department is less then 5% demonstrating an acceptable level of stability of IT staff in many organisations. Further detailed analysis of business and IT responses shows that both respondent groups are well aligned and thus share IT staff turnover information. The annual staff turnover within the IT department is? What is the perceived maturity of the IT department? > 10% Don t know 5% - 10% Level 5 Level 4 < 5% Level 3 None Level 2 Level 1 0% 10% 20% 30% 40% IT 0% 10% 20% 30% 40% Business Detailed country analysis did not reveal significant differences in-between IT department s perceived maturity level in the participating countries. Business and IT answers showed that both respondent groups are well aligned and thus share IT staff turnover information. Compared to the results of the 2007 Belgian IT Business Balance results, the reported IT staff turnover has increased. This can be explained by the fact that economies in the participating countries have experienced growth with a need for skilled IT personnel, which generally leads to a more liquid market and thus staff turnover. We have found only minor differences amongst the participating countries. Belgium and France survey respondents indicate to have even a more stable IT environment (30% indicates to have no IT staff turnover). The Netherlands and Italy score above average. Over 50% of these respondents indicated that the average IT staff turnover is less then 5%. Additionally, no significant differences have been detected when comparing IT staff turnover in small, medium and large IT departments. 22

25 IT outsourcing Preface There are two basic components that influence the outsourcing business model: the degree of ownership and the degree of risk. The higher the degree of ownership in the outsourcing model, the lower the risk to the organisation. Understanding these business models is key if CEOs want to take a conscious risk rewarded decision concerning the outsourcing model. Therefore, it is not an option to leave the decision of both outsourcing model and IT business partners solely within the IT department. Higher degrees of ownership in the outsourcing model (e.g. body shopping and insourcing) will for most organisations remain rather unrewarded. However, stepping up from higher degree of ownership models to a lower degree of ownership model (e.g. business process outsourcing) requires decision at another level: the CEO. These decisions encompass increased risks but often generate significant rewards for the organisation. Our survey queried whether today s organisations are ready for the 21st century CIO whereby IT sourcing is viewed the Risk Intelligent way. Survey findings A positive sourcing climate In recent years, many companies increasingly depend on outsourcing and offshoring 1. These arrangements present both rewards and risks to the organisations using them. A question remains though: does senior management have a sufficient level of trust in outsourcing to strategically and structurally approach it? For 22% of the respondents, senior management does not feel very or only moderately comfortable with (out)sourcing. 1 We speak of outsourcing when work is done for a company by people not on the company s payroll. How comfortable does management feel with sourcing? 45% 40% 35% 30% 25% 20% 15% 10% 5% 0% Very uncomfortable Uncomfortable Moderately comfortable Very comfortable Yet, 27% of respondents perceived a high level of comfort relative to (out)sourcing with senior management. Only few respondents (4%) did not know the level of senior management s comfort relative to outsourcing. We found more business respondents than IT respondents who indicate their senior management to be somewhat less comfortable with (out)sourcing activities. This could indicate that most organisations in the participating countries perceive that the time is right to (out)source some of their activities. A number of success stories in the regional market may contribute to this increased sourcing comfort feeling with senior management. Our greatest challenge is to measure IT service delivery performance and translate this into SLAs. A CIO in Italy 23

26 Additionally, it is remarkable to see how similar the different counties have answered to this question. How comfortable does management feel with sourcing? Are CEOs willing to use outsourcing to structure IT? The Netherlands Belgium To answer this question, our survey reveals some interesting conclusions: France Italy Turkey South Africa Uncomfortable (very uncomfortable + uncomfortable) Comfortable (moderately + very comfortable) To verify what exactly is understood under sourcing we asked business and IT representatives to indicate the type of outsourcing applied by IT: Outsourcing of complete business or IT processes (e.g. application development or infrastructure operations) Outsourcing of activities to a single supplier who assumes full responsibility but may subcontract to other suppliers (prime contractor model) Outsourcing of activities to multiple suppliers collaborating with each other (consortium model) Outsourcing of the activities of an individual, also known as bodyshopping Insourcing of a defined set of projects or services to an internal entity (often a shared services centre), with the aim to keep control internally. Over 1 out of 4 respondents indicate that sourcing is only considered depending on the needs of the organisation. This is also in line with 1 out of 5 respondents that indicate body-shopping to be the second most favourite sourcing type. The time is right to outsource some activities. Senior management is moderately or very comfortable with outsourcing (71% of responses). However, insourcing and bodyshopping are by far the most popular ways of outsourcing (38% of responses). This means that in many of the organisations surveyed, top management often view outsourcing not as a strategic initiative but merely as a delivery means. When the choice of business partners is left to IT (see previous chapter), one can expect that bodyshopping and insourcing are the dominant outsourcing models. And since these models hardly change ownership and risk, top management will feel fairly comfortable. But these models do not allow top management to think differently about the role of IT and other ways of running IT. 24

27 Could it be that most respondents consider sourcing not as a strategic initiative but merely as a delivery means? Could it also be that for these reasons senior management has increased comfort feeling with sourcing activities? What are the main types of (out)sourcing? Not Considered Insourcing The financial sourcing ambiguity 1 out of 4 business respondents indicate that less than 5% of the IT budget is spent on (out)sourcing compared to only 1 out of 10 IT respondents. IT respondents indicate that far more of the IT budget is spent on (out)sourcing activities. What percentage of the IT budget is spent on sourcing activities? None Bodyshopping Depending on Need Consortium Prime Contractor Entire processes Don't know < 5% 5% - 15% 15% - 30% 30% - 50% > 50% 0% 10% 20% 30% Don t know 0% 5% 10% 15% 20% 25% IT Business In general, there are no significant differences between business and IT responses. However, whereas 30% of IT representatives say to decide on sourcing depending on the need, only 23% of business representatives share that view. On the other hand, 8% of business decision makers considered outsourcing not an option compared to 3% IT. Both observations may be explained by the large percentage of need-to-have and body-shopping sourcing type, since these are a less structural and strategic approach towards sourcing, providing less financial transparency for business decision makers. The survey indicates that most organisations perceive that the time is right to rethink IT sourcing. 25

28 What percentage of the IT budget is spent on sourcing activities? The Netherlands Belgium How are relationships between the IT department and service providers arranged? Formal with SLA France Formal Italy Informal Turkey South Africa Verbal % 10% 20% 30% 40% 50% 60% Low % (below 15%) Large % (above 15%) IT Business The chart above shows that mainly Italy and South Africa indicate to spent larger percentages of the IT budget to (out)sourcing activities. Belgium and France indicate to spent a smaller percentage of the IT budget on (out)sourcing. Keeping control while outsourcing Concluding an (out)sourcing contract can be a very lengthy and sometimes even painful experience. These contracts can range from a verbal settlement to formally written contracts including service level agreements (SLA). Our survey shows that on average, 8 out of 10 respondents indicate that the IT department has formal relationships with outsourcing suppliers. More than half of them indicated they have formal SLAs established. Less business respondents are confident that outsourcing is done in a formal way as shown in the next chart. We have found some significant differences in opinion while analysing the responses of the participating countries more into detail. Over 80% of the Italian and South African respondents have indicated that IT manages relationships formally with SLAs whereas only 40% of the French respondents share the same opinion. How are relationships between the IT department and service providers arranged? 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% The Netherlands Belgium France Italy Turkey South Africa Verbal Informal Formal Formal with SLA Don t know 26

29 Compared to last years Belgian IT Business Balance survey results, the primary reason (over 50%) for concluding SLAs is, as shown in the chart below, to hold service providers responsible for the delivered services. This can be considered as the most basic form of contractual agreements: the utility contract with key service performance indicators. Utility contracts with formal SLAs are less visible to the business. This is also shown through only 48% of business representatives indicating SLAs compared to 61% of IT representatives. More advanced agreements, such as enhancement contracts with key business performance indicators (e.g. to render IT cost effective or to enhance the business process), represent only a small part of the respondent answers. It is not surprising that most respondents rely on utility contracts given the large number of process automation and optimisation projects (see Evolutions and trends). In these types of projects, it is obligatory to steer towards service delivery rather than steering on enhancing the (business) process. The main reasons for concluding agreements between the IT department and third parties are to? Make service provider responsible Keep business satisfied Costs allocation Demonstrate that IT delivers Three pairs of countries show a comparable pattern: (1) The Netherlands and Italy indicate to incline more towards enhancements (on average 45%); (2) Belgium and France focus more on utility contracts (on average 70%); (3) Turkey and South Africa nearly focus solely on utility contracts (on average 90%). The main reasons for concluding agreements between the IT department and third parties are to? 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% The Netherlands Belgium France Italy Turkey South Africa Make service provider responsible Demonstrate that IT delivers Keep business satisfied It is also remarkable that this agreement approach is quite correctly reflecting the focus these countries will maintain in the coming 3 years (see Evolutions and trends). Make IT costeffective Other Don't know 0% 10% 20% 30% 40% 50% Further detailed analysis shows an alignment between business and IT respondents. However, large differences can be detected in the responses of the participating countries as shown in the chart below indicating the top 3 responses. Could it be that most respondents consider sourcing not as a strategic initiative but merely as a delivery means? 27

30 28

31 Security, privacy and fraud Preface The rise in end-user computing has eliminated the relative safety of mainframe computing and replaced it with more exposed user machines. New corporate governance regulations are placing significant emphasis on general computer controls and have accelerated a shift away from manual and toward automated controls. The IT landscape has dramatically changed over the past decade and so have security, privacy and fraud. The ever-increasing sophistication of security breaches seems to know no bounds. The easy access to IT has produced some great minds which have been used positively as well as negatively. Deloitte studies where security officers and internal auditors have been interviewed, reveal that internal fraud is a major concern and that between 30% and 50% of the companies have been faced with multiple forms of and even recurring security incidents. Our survey queried whether today s organisations are ready for the 21st century CIO who takes part in risk management the Risk Intelligent way. In the Deloitte Global Survey on Security & Privacy, a respondent said: New technologies and new business models are causing us to blindly run full speed toward the unknown. And the hot breath of threats and risk is on our necks at all times. We are constantly under siege. Survey findings A difficult consensus The traditional approach to security a focus on infrastructure and technical components will likely be far less effective in the face of the technology boom. A focus on people and their awareness is also required. Question is whether today s corporate environment is aware of the need for a security protection shift. Our survey shows that there are notable differences in perception of business and IT respondents. On the positive side, 31% of business respondents believe that procedures and guidelines on information security and data protection are very well monitored by senior management. However, only 19% of IT representatives share that view; in fact, 42% of them even believe that senior management is hardly monitoring security and privacy. To what extent are procedures and guidelines on data security and data privacy monitored by top management? Not at all Very little To some extent IT High 0% 10% 20% 30% 40% Business This difference in opinion may explain why IT discussions at top level focus on financial alignment rather than on topics such as security and privacy (see chapter IT Governance). It is interesting to note that the results of most participating countries are very similar. Only one country, The Netherlands are more sceptical and 53% of the respondents indicate that senior management monitors only to some extent procedures and guidelines on data security and data privacy. How to stay compliant in an environment of ever changing legislation? An Operations Manager in South Africa 29

32 How much faith do CEOs have in IT as their information custodian? To answer this question, our survey reveals some interesting conclusions: Business and IT aligned in combating internal fraud Over 40% of both business and IT respondents believe that IT is highly committed to combating fraud. Only 1 out of 5 business decision makers did not know the extent of the countermeasures implemented by IT. This indicates a sound level of internal fraud combating awareness and engagement by business stakeholders in most organisations. To what extent is IT committed to combating internal fraud? a surprising 30% of respondents indicate never to have been the victim of IT-related incidents. IT is viewed as being very committed to combating fraud (41% of responses). The views of our IT and business respondents are in contrast to the other Deloitte studies where security officers and internal auditors have been surveyed. The latter studies reveal that internal fraud is a major concern and that between 30% and 50% of the companies have been faced with multiple forms of and even recurring security incidents. This may reveal that top management is not always fully aware of the risks and actual incidents and the less visible, long term impact these may have on their business. Not at all Very little To some extent High 0% 10% 20% 30% 40% This business awareness is also reflected in the previous question indicating that many business representatives believe security and privacy is being monitored through guidelines and procedures. This is in contrast with the perception of 40% of IT respondents indicating that top management is not or only very little monitoring security and privacy through guidelines and procedures. 30

33 An incident-free environment? Surprisingly, and very similar to last year s survey results in Belgium, 30% of this year s respondents claim they never detected an IT-related incident. Another 12% of business respondents, and only 5% of their IT counterparts, indicate not to have sufficient information about incidents. We found no correlation between these responses and the size of the organisation or the size of IT. In which areas have incidents been detected in the past? No incidents Inadequate business continuity Could it be that both business and IT are unaware of any incidents due to the lack of transparency about incidents and countermeasures? As could also be expected, respondents of large organisation indicate to suffer more from hackers whereas smaller organisations suffer more from legal data protection issues. Additionally, our survey confirms that large organisations tend to be more reluctant or unwilling to disclose this kind of detailed information in the security, privacy and fraud domain. This is an understandable reaction due to the reputational risk when detailed security, privacy or fraud breaches are made public. Prefer not to say Integrity Hackers Don t know Data theft Breach of legal data protection 0% 10% 20% 30% Our challenge is doing more business through the website supported with solid security and data management programmes. A CEO in Belgium 31

34 Further analysis of the survey data reveals large differences in survey results amongst the participating countries. In which areas have incidents been detected in the past? 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% The Netherlands Belgium France Italy Turkey South Africa Integrity Inadequate business continutity Breach of legal data protection No incidents Data theft Prefer not to say Hackers Don t know At first glance, all participating countries indicate to suffer from a very diverse set of security, privacy and fraud breaches. Respondents in The Netherlands indicate to be affected most by inadequate business continuity management and also have the least respondents that are unaware of incidents. Could it be that both business and IT are unaware of any incidents due to the lack of transparency about incidents and countermeasures? 32

35 Helpful references and links Websites Deloitte Deloitte Research Deloitte International Financial Reporting Deloitte Publications and Podcasts Resources for the Risk Intelligent Enterprise Publication: 2007 Global Security Survey Publication: Global Economic Outlook Publication: Bringing IT into the Boardroom Pod Cast: The Transformational Power of Outsourcing 33

36 34