CIOs are among the few executives that understand how financial information is generated and reported across multiple business processes, and thus must play a key role in their companies' compliance with the Sarbanes-Oxley law, according to Michael Carpenter, partner in charge of information risk management for KPMG's southeast region practice.

Under Section 404 of the law, which was enacted last year, executives of public companies must prove that they have adequate financial controls in place to ensure the information in their annual reports is accurate. When it comes to systems that produce financial information, Carpenter says, such controls include quality assurance, standard system configurations, access management and ways to track any changes that are made in a system. "These are foundational to good control in that without them, other controls become suspect."

In addition, section 409 of the law, requiring real-time reporting of material financial information, is likely to require systems integration and the deployment of "intelligent analytics" software.

To get started, Carpenter suggests reviewing the financial control standards recommended by the Committee of Sponsoring Organizations, an independent accounting group. Among its guidelines, COSO provides standards for risk assessment and policies and procedures for providing controls. He says the Control Objects for IT, or COBIT standard, and ISO 1799 for security and management of controls, offer additional guidance.

For more information about what CIOs need to know about Sarbanes-Oxley, see "Your Risks and Responsibilities."

¡ª Elana Varon

Arthur Says IT Will Be Growth Engine for Economy

W. Brian Arthur, a lauded economist and Citibank Professor at the Santa Fe Institute, told the CIO 100 Symposium audience Tuesday that a study of economic history and analysis of current trends show that IT is and will continue to be the engine of economic growth for the U.S. economy. This, in spite of the attack on CIOs and the contention that IT is no longer strategic in the recent Harvard Business Review article by Nicholas Carr, whom Arthur dubbed his "favorite fiction writer."

"I didn't take the article seriously enough to call [HBR Editor] Tom Stewart to offer a rebuttal," Arthur said. "I found it somewhere between ludicrous and hilarious. But I later realized it was serious for the people leading IT, and for the industry and for the economy."

"One claim rocked me," said Arthur. "Carr said the IT bubble crashing was historically a clear indicator that a technology was at the end of its build out. I spent the last 2-3 years studying the last four technology revolutions. I found repeatedly that there's a lot of jostling at the start and some shakeouts, then the media get hold of it and hype it, then there's investment mania, and finally a crash." But always following the crash, Arthur said, one to three decades later comes a massive build out that powers the economy. (For more on this historical pattern and how it applies to IT, see "."

Arthur believes the massive build out for the IT revolution is still to come, and it will be bigger than that of the industrial revolution. It will proceed through two phases. Since 1995, IT has been in a phase of connecting things to other things, enabling data to flow between systems and allowing those systems to talk to each other. Overlapping this phase is another in which IT not only works, but becomes more usable, reliable, secure and, above all, comfortable to the user. That's when technology gets adopted and spreads widely. "We're moving into an era from gee-whiz technology to the 1001 small fixes that make that technology work seamlessly in business and the economy," Arthur said. What drives the build out is usability, not just the presence of the technology.

Evidence that IT is driving the economy comes from productivity numbers. Even in the devastated economy of 2002-2003, productivity grew 5 percent -- growth attributable by most economists to business adopting IT. That may not seem like much, but that kind of growth per annum will double the size of our economy in 14 years, which is "staggering," Arthur said.

So what will happen next? "The economy is acquiring a neural system --many neural systems, some of which will be made up of agents that talk to each other," Arthur said, predicting this will become widespread around 2007-2010. Some of these neural systems, like the one that connects the country's electrical grid that failed profoundly last week, are stupid. But increasingly these connected systems will become smarter, gaining intelligence from bottom up rules-based experimentation by CIOs and engineers looking for ways to make these connected systems do more and work better.

How can this intelligence be inculcated into tomorrow's networked, integrated systems? "What you do is take them off line, simulate their environment on a computer, where each node of the network is its own program, and you build in some rules," Arthur said. For example, the Los Angeles traffic system could be replicated on a workstation, with every traffic light operating as a node. Given a set of rules to make traffic flow smoothly, the individual light nodes will operate in ways that may help move traffic along. Some of the rules won't work and will be tossed out. But some will have a positive effect, and eventually the lights will operate intelligently and respond, according to rules, to traffic patterns and real-time conditions captured by sensors on the roads.

All of this advancement along the road of the IT revolution will not be driven by CEOs, but by the CIOs who understand technology's capabilities and foresee its possibilities. (For more on how IT is changing industries, and the role of the CIO in driving the economy, see "").

¡ª Richard Pastore

IT Reaps the Benefits of Six Sigma

Six Sigma, a popular process for reducing defects in manufacturing, is increasingly being used by CIOs to improve their own operatoins. Using Six Sigma processes can lead to increased efficiency and big savings, according to two CIOs speaking Tuesday at the CIO 100 Symposium in Colorado Springs, Colo.

In a panel titled "Applying Six Sigma to IT," Doug Debrecht, CIO of Raytheon Aircraft Co. and Charles Costa, CIO, Chase Financial Services, J.P. Morgan Chase, described how their organizations have increased efficiency, reduced redundancy, decreased errors, improved quality and achieved major cost savings by using Six Sigma.

Both CIOs reported big savings from using Six Sigma. Over the two-year period that Six Sigma has been used at Chase, Costa said that company-wide, the CFO has claimed $1 billion in financial benefits, $200 million of which coming from IT. And Debrecht reported that on one warranty improvement project for aircraft, in which customer satisfaction was increased and processing costs were reduced, Raytheon realized a savings of $13 million. Another project brought a $1.3 million reduction in costs.

At Raytheon, Debrecht said Six Sigma was chosen as a "unifying force" among all the disparate business units. They use a "continual process improvement wheel" when they approach a project, including the following characteristics: visualize, commit; prioritize; characterize; improve and achieve.

The company made it clear that Six Sigma training was mandatory for any sort of career advancement so that currently, 71 percent of the staff is Six Sigma qualified; 92 percent of those staff are trained as specialists (green belts) and there are two black belts. One of the goals of the method at Raytheon is "driving down overhead rates with customer involvement" Debrecht said. For instance, many of Raytheon's suppliers now utilize Six Sigma, providing two-way benefits. He described how IT used Six Sigma to implement a storage area network, consolidating services and storage (utilizing a Six Sigma team from across the company) and redeploying existing servers, reducing lease expenses by $500,000.

Costa said that he was deeply involved in bringing Six Sigma to Chase. When the decision was made to keep the IT budget flat for three years, Six Sigma became a valuable tool in allowing forward movement on projects. Six Sigma allowed Chase to save money by reducing call center staff and improving cross-selling. Up ahead, Costa said, "We want to look for the next billion in savings and to make sure we are reengineering...We want to digitize all of our core processes and workflow imaging and document management...For CIOs, using Six Sigma in IT really positions us for leadership."

¡ªMindy Blodgett

CIOs Answer Call for Leadership

Businesses expect their executives to be leaders, but CIOs are often challenged in this regard as they face the continuously shifting factors of accountability, governance and differing organization models, according to the CIOs on Tuesday's panel on leadership at the CIO 100 Symposium in Colorado Springs, Colo.

Panel moderator Abbie Lundberg, Editor in Chief, CIO, said that IT leaders must "ratchet up our own thinking" to "exert influence" over the important decisions made in the coming months and years on the directions business and technology will take. The panelists for "Leading in an Age of Extraordinary Challenge": Stephen David, CIO and Business-to-Business Officer, Procter & Gamble; Tom Murphy, CIO, Royal Caribbean Cruise Lines; Andre Spatz, CIO, UNICEF and Bette Walker, CIO and Vice President, Delphi Corporation; all shared their unique leadership challenges and solutions. They discussed ways to lead during tough economic times, the importance of mentoring underlings and the fact that it is more important than ever that IT work closely with the business side.

David said Procter & Gamble is in the midst of an ambitious effort to reinvent its supply system, a process led by IT. To accomplish this difficult task, David said, "You have to have the confidence of the CEO... We are moving away from the silo approach with product supply and IT¡ªand IT is leading this. The primary thing we realize is that we are in business to make money. So this is about the CIO and the CEO being able to envision a better way to do things."

For UNICEF's Spatz, the challenge of running a global organization and competing for scarce government money and fundraising has not stemmed his pursuit of standardizing and upgrading systems all over the world. He said that in 1995, the organization had more than 100 WANs in New York City and offices in 162 countries with no WANs at all. Today, they are using ERP for logistics, Human Resources and financial standards "and we have a real-time help desk. That's the transformation." He said he is working on getting IT and business to engage in a cross-functional process of changing the way things are done and to create mechanisms for more collaboration.

Economic hardship that beset Royal Caribbean Cruise Lines following 9/11 forced Murphy to cut his staff of 450 nearly in half, forcing ambitions systems upgrades to cease. "Many times I was crying going home," he said, expressing empathy for his staff. But despite the obstacles, he said he felt he couldn't walk away. To handle the change, his organization shifted to quarterly performance reviews from annual ones, to stay closer to employees. And now, he said the IT leadership is slowly engaging the staff in discussions about more forward-looking work, rather than the support and maintenance mode they were forced into after 9/11.

Walker has been leading Delphi Group from one where 100 percent of the IT was outsourced to one in which strategic IT is being insourced. When the economy soured, the IT department was faced with deploying ERP globally, making various decisions to decentralize some functions and centralize others and to cut $85 million from its budget. Walker said this challenge was actually an opportunity to work more efficiently.

"It's not about cost reductions, it's about asset management," she said. "We decided we could create a different model of behavior, more effective use of resources."

Murphy urged CIOs not to focus just on leadership within IT. "This is about leadership across the whole company," he said. "We can come up with excuses about how we can't do things but we are one of a multitude of leaders, we all have to articulate a vision together."

¡ªMindy Blodgett

Honorees Share Methods for Prioritizing Projects

The classic dilemma of the IS organization is too much to do with too little resources. But now, as pent up demand for systems increases while IT budgets remain flat or take another hit, the situation can be overwhelming. CIO 100 honorees Intel and Northeastern University developed unique methodologies to evaluate and prioritize project requests. The benefits have been the ability to surface the most beneficial projects, weed out the rest, mitigate risk and eliminate the finger pointing and second guessing that haunts organizations with poor governance processes. Both organizations discussed their methods in separate sessions Monday at the CIO 100 conference in Colorado Springs, Colo.

Intel's method plots prospective projects on a 3-by-3 matrix, whose axes are Business Value and IT Operational Efficiency. Each project is rated as having either a positive, neutral or negative impact in these two areas. The ideal quadrant is where a project rates positive in both IT efficiency and business value. Projects with neutral or negative ratings fall off the table.

But Intel doesn't stop there, according to CIO Douglas F. Busch. Projects that survive the matrix are accorded a score for value¡ªthe Business Value Index. Financial metrics include capital expense avoidance and direct revenue. Non-financial measures include product development agility and risk reduction. Intel follows up on this process by measuring post-implementation payoff.

Busch says he's already plotted and prioritized IT projects for 2004, with e-workforce capability investments and e-learning winding up in the win-win quadrant.

Northeastern University in Boston also developed a way to prioritize projects of all sizes that are competing for the 20 percent of the IT budget allotted for new development. With the help of an outside consultant, Northeastern created a grid with one axis plotting Value on a scale of 1-100, and the other axis measuring Risk, also on a scale of 1-100.

The scores are derived from a 60-question questionnaire that IS administers to the business leader requesting the project. Half the questions are on value and half on risk, and each is weighted differently for scoring purposes. Some of the value questions probe for competitive advantage, service to the Northeastern community and enhanced decision support. Risk questions focus on such criteria as end-user acceptance and scope.

The scoring system shows relative merit and risk of each project, but there's more to whittling down the overwhelming number of requests than a relative score index, according to Bob Weir, Northeastern's vice president of information services. Weir requires function heads to force rank their project wish-lists. Based on one-paragraph summations and their grid scores, the executive committee spends two hours evaluating the bunch, ultimately building consensus on which ones move forward. In the most recent exercise, 37 projects came to the table, and 19 were recommended for further action. The remainder were designated as requiring no action for the next 12 months. Weir then guides project sponsors in building more detailed business cases for their projects, ranging from three to seven pages. From these, Weir recommends a final IT project portfolio for the year.

Some unexpected benefits of this methodology, Weir observed, include a new uniform lexicon for discussing project value, applied throughout the university even to projects that are not IT-related. And because it brought IS and its constituents together to score and build business cases, it's fostered a new, closer relationship between the groups.

¡ªRichard Pastore

Boost Morale Without Breaking Your Budget

Just because large cash bonuses and dotcom-era perks are scarce in this uncertain economy doesn't mean CIOs can't revive dampened morale on their IT staffs; they just have to get creative -- this was the message of the Monday's panel at the CIO 100 Symposium in Colorado Springs, Colo.

Martha Heller, Director, CIO Best Practice Exchange and CIO Select led the discussion titled, "Motivating Employees and Boosting Morale," which included panelists: Steven W. Agnoli, CIO Kirkpatrick & Lockhart LLP; Mary Fonder, CIO and Vice President, Maysteel LLC and J.A. Gottron II, Executive Vice President and CIO, the Huntington National Bank.

The panel sparked a lively exchange among themselves and the audience on how to inspire employees during tough times. The panelists all agreed that they've taken financial hits since the downturn began in 2000: shrinking budgets, lower headcounts and they're being forced to do more with less. But they said that the lack of resources had forced them to get creative in dealing with both the staff and users. They agreed that morale extended beyond the scope of Human Resources. In this critical time, unmotivated employees could stifle innovation and sabotage projects.

The panel stressed that one of the most important aspects of keeping the staff is motivated is open and honest communication, even when the news is bad, as a way to head off damaging rumors. At the Huntington National Bank Gottron put together a "behind the scenes team" -- that does not include managers -- that tells him what the mood is on the floor and what the issues are, so that he can address them before they fester. "No news is bad news," Gottron said, in arguing that the CIO not only has to share information with his staff but needs to be willing to hear their concerns as well.

Kathy Starkoff, CTO and Vice President of Limited Brands, Inc., said a designated HR director-level staffer conducts confidential interviews with employees on an annual basis.

"We've been getting good results, because we are responding to suggestions (from these interviews)," Starkoff said.

Agnoli said that he sends out an "accomplishments" newsletter every month at Kirkpatrick & Lockhart, singling out employees and successful projects for particular praise. This both enhances employee morale and shares IT accomplishments with the rest of the firm.

The panelists agreed that it's important for IT employees to be deeply aware of their company's businesses. "We can't do as many new initiatives as we would like to," Maysteel's Fonder said, but she added that she makes it clear to her staff that their technology knowledge is important but "it's their business knowledge that is key."

Finding creative ways to conduct training and offsite meetings is key, the panelists said. Agnoli said one way he trains and mentors is through a process in which he matches a senior analyst to a junior analyst. The junior analyst benefits by tapping into the experience of the senior analyst. Meanwhile, the senior analyst learns valuable management skills.

Sheila Beauchesne, CIO at Martha Stewart Living Omnimedia, Inc., urged CIOs to look for outside sources of funding for training. She said she found some New York and Connecticut state grants that helped with training at her organization and that she also works with vendors when the contracts are being signed to slip in training requirements.

But Jeff Chasney, CIO of CKE Restaurants, Inc., had one of the most creative suggestions of all. He annually takes two percent of his own paycheck and sets it aside to a fund managed by his executive assistant to pay for morale boosters like small staff bonuses or ice cream socials.

¡ªMindy Blodgett

FedEx CIO Preaches Focus

Whether running an IT organization or an entire company, corporate executives should not make everything their number-one priority. Rather, they must focus on one or two domains where their companies can excel and differentiate themselves, Rob Carter, executive vice president and CIO of FedEx, told more than 450 people at the CIO 100 conference Monday in Colorado Springs, Colo.

"You can't do everything and be successful," said Carter, citing Fred Crawford's best-selling book, The Myth of Excellence, in his talk Monday. "There has to be a hierarchy of priorities."

At FedEx, for example, company officials chose to excel or dominate in the area of customer experience and differentiate themselves from competitors in service quality. In the three other domains of price, product and customer access to products and services, FedEx is happy to remain "on par" with its competitors, but it doesn't feel it has to dominate in these areas.

Similarly, in the company's IT sphere, Carter said he has chosen to focus his priorities on speed and innovation. As a result, FedEx dominates the market in the speed at which it can deliver technological solutions that give it a "first advantage" in the marketplace.

Carter says he is not just talking about the speed at which the package shipping company can deliver packages, trace orders and provide timely customer assistance. He has also made it a priority to be able to quickly and "dynamically re-allocate IT staff and resources" as the company's needs shift, he explained.

"Another key dimension of speed is to be able to engage third parties - offshore workers - to get things done quickly," he said. "IT managers don't like to lose line-of-sight management over developers, but we simply can't work that way."

Carter says he uses rewards such as bonuses and constant communication to ensure that IT managers understand the need for fast re-allocation so they don't try to hold onto staff for particular projects.

As a result of his department's focus on speed, FedEx was able to win and retain the U.S. Postal Service's transportation contract and build a real-time website (fedex.com) that allows customers to fill out shipping forms online and track inbound shipments on their way to their destination. This service provides tremendous value to organizations such as a bone marrow lab that doesn't always know what kind of bone marrow samples it will be receiving on a given day and thus can't always line up bone marrow transplants in advance.

"With FedEx Insight [the online tracking service], they can see inbound shipments and schedule the correct number of bone marrow procedures based on which shipments are coming in when," Carter said. "FedEx Insight is a tremendous boon for such organizations, and it's given us first-mover advantage in this area."

¡ªAlison Bass

Offshore Outsourcing Backlash Brewing

CIOs had better prepare themselves for a Titanic-sized backlash from American politicians and the public against the growing trend toward moving IT jobs overseas to countries like India, Futurist Paul Saffo warned the more than 450 executives attending the CIO 100 conference Monday in Colorado Springs, Colo.

Unlike the blue-collar workers who lost jobs as manufacturing moved offshore in the '70s and '80s, Saffo said, the white-collar IT workers losing their jobs today are "affluent college graduates who live in the suburbs and have lots of political clout."

"This is going to hit the fan like you've never seen," said Saffo, Director of the California-based Institute for Change and moderator of the three-day conference. "We now have Phyllis Schafly - remember her? - talking about how un-American it is to outsource your jobs."

Saffo said that trying to keep IT jobs in the United States through protectionist policies would not work, since so many companies need to continue to move jobs offshore to stay competitive. But he said CIOs must take a leadership role in deciding what rational policy decisions should be made by the private and public sectors. And CIOs should also be "out in front" in determining what new jobs and opportunities will replace the ones now being moved overseas.

"We are truly a global, borderless world and companies are just making rational business decisions in deciding to move jobs offshore," he said. "We're not going to be bring those jobs back, but you should explore what new processes and opportunities you can take advantage of to replace them."

There is more at stake than rising unemployment and a lowered standard of living for many individuals who cannot find a good-paying job to replace the one they lost, Saffo said. Corporate executives must also be concerned about a deflationary economy as more products and services are produced elsewhere and the rest of the world decides they don't need to spend money in the United States.

"Since September 11, we have become a much more unfriendly place to foreigners, and that has got to change," Saffo said. "Foreigners are already going elsewhere for tourism and [higher education]. So we have to fight against protectionism and get the country back to being foreigner-friendly again."

Saffo said that the trend toward offshore outsourcing is embracing not only "low-level" IT jobs such as maintenance, help desk and call center functions, but infrastructure and entire turnkey operations. And he warned the IT executives present that even their jobs were at risk. He related the story of one prominent CIO of a major construction company who had been planning to attend CIO 100. But just before the conference started, the CIO sent an e-mail to one of the conference organizers explaining that his position was being eliminated and most of his IT staff were being outsourced overseas.

And that portends major problems for the future of IT talent nationwide.

"If we don't have low-level software jobs here, we may not be able to train the CIOs of tomorrow," Saffo said. "Your replacement may not be anyone from the U.S."

¡ªAlison Bass

To Take Risks, Employees Need Attitude

Companies that want to develop innovative IT projects when time and money are tight need to cultivate a work environment in which taking risks is encouraged and rewarded, so said panelists at the CIO 100 conference in Colorado Springs, Colo.

"Attitude drives innovation in an organization, especially from the top down," says Greg Smith, CIO with World Wildlife Fund, one of three CIO 100 honorees who shared their formulas for innovation during the CIO 100 Symposium panel "Creating a Cutting Edge Culture." Making sure end users and business executives are closely involved in new projects and that they understand the risks and potential benefits are essential to getting cutting-edge projects approved in tough times.

At Farmers Insurance, CIO Jan Franklin says one of the biggest mistakes her department made a couple of years ago was to institute a "zero tolerance" policy for bugs in software. As a result, she says, "nobody was willing to do anything," for fear of being punished for mistakes. Now, the company takes the opposite approach, rewarding a "risk taker of the month" to employees who try new things, even if they fail. "We look at what they are trying to do," she says.

One of the employees recognized for his risk taking developed the first Linux implementation at the company.

To build end-user support for a major system overhaul, Rizwan Ahmed, CIO with the Louisiana Office of Group Benefits, tapped seven end users to be on the product selection team with a single IT staff member. Then Ahmed held meetings with the users and the agency's CEO, Kip Wall, encouraging them to identify pitfalls with the project. The state agency administers health benefits for state employees. Thanks to user involvement, the agency was able to deploy the new system in six months, Ahmed said.

WWF's Smith finds creative ways to communicate business value to executives. To demonstrate the benefits of a new mobile satellite communication system he was testing to provide telecommunications services to users around the world, Smith took executives up to the roof of WWF's Washington D.C. headquarters to make a phone call. At the same time, he looks for money to support new projects by pushing his staff to think of more ways to be efficient and encouraging vendors to do the same -- passing the savings on to him through lower prices.

A rigorous governance and project management process ensures that business and IT managers address project risks and act to ensure new initiatives succeed. At Farmers, says Franklin, "we have not had a failed IT project in five years" because senior managers have been able to mitigate risks as they arise.

¡ªElana Varon