Presentation to CAREGROUP Board of Directors Governing Your Networked IT Organization Ken Peffers Applicable IT Research, Inc. November 21, 2002

AITR’s Charge You have asked us to investigate the circumstances surrounding the recent network failure and to You have asked us to investigate the circumstances surrounding the recent network failure and to Determine the material facts Determine the material facts Draw the appropriate inferences Draw the appropriate inferences Describe alternative solutions Describe alternative solutions Recommend the most appropriate solution Recommend the most appropriate solution

Management Problem As the Caregroup’s business processes become more dependent on IT, how do you make sure that the risks associated with this dependency are acceptable? As the Caregroup’s business processes become more dependent on IT, how do you make sure that the risks associated with this dependency are acceptable? How do you manage new service requests? How do you manage new service requests? How to you manage infrastructure implementations? How to you manage infrastructure implementations? How do you insure that you can recover from a disaster? How do you insure that you can recover from a disaster? How should IT be governed overall to manager your answers to the above questions? How should IT be governed overall to manager your answers to the above questions?

Material Facts Caregroup part of an industry increasingly under pressure to reduce prices and costs. Caregroup part of an industry increasingly under pressure to reduce prices and costs. You have seen integration using IT as a means to achieve cost savings. You have seen integration using IT as a means to achieve cost savings. By your own evaluation of your situation you have achieved the best integration in the industry. By your own evaluation of your situation you have achieved the best integration in the industry. Medical personnel dependent on systems to make decisions and implement them. Medical personnel dependent on systems to make decisions and implement them.

Precursors to the crisis Capital IT budget reduced by 90% in three years. Capital IT budget reduced by 90% in three years. Operating IT budget increased slightly. Operating IT budget increased slightly. Chief network guru left. Chief network guru left. No one in the organization competent network expert. No one in the organization competent network expert. Research environment. Experiments allowed involving network. Research environment. Experiments allowed involving network.

Inferences When the business is dependent upon systems, systems needed to manage risk because a calamity to the systems means a calamity to the business. When the business is dependent upon systems, systems needed to manage risk because a calamity to the systems means a calamity to the business. Separate development, experimental systems from production systems Separate development, experimental systems from production systems No new system is integrated with the production systems until it is thoroughly documented and tested. No new system is integrated with the production systems until it is thoroughly documented and tested. Clear organizational structure to insure responsibility for system. Clear organizational structure to insure responsibility for system. Management of staff resources, training, etc. Management of staff resources, training, etc. Backup data, architecture, systems, business processes Backup data, architecture, systems, business processes Limits to the use of resources. Limits to the use of resources. Life cycle for hardware and software Life cycle for hardware and software

Caregroup’s Governance Caregroup needs a full time professional IT executive to act as its CIO Caregroup needs a full time professional IT executive to act as its CIO Managing its IT personnel resources Managing its IT personnel resources Planning IT investments Planning IT investments Monitoring service levels Monitoring service levels Managing risk Managing risk IT Steering Committee IT Steering Committee A leadership committee comprised of senior managers of the operating business units, the CIO, and the new Network Change Control Board and supported by staff experts, e.g., technologies, finance, legal, etc. A leadership committee comprised of senior managers of the operating business units, the CIO, and the new Network Change Control Board and supported by staff experts, e.g., technologies, finance, legal, etc. This unit would be responsible for screening and preliminary approval for proposed new services and applications This unit would be responsible for screening and preliminary approval for proposed new services and applications Network Change Control Board Network Change Control Board Focuses on changes in the network Focuses on changes in the network The Project Team The Project Team To implement new applications To implement new applications

Management of Major New Service Requests These are requests that will require new applications that are integrated with the network and/or require network modifications. These are requests that will require new applications that are integrated with the network and/or require network modifications. Proposals approved by the Network Change Control Board Proposals approved by the Network Change Control Board If requiring major investments, approval by the IT steering committee If requiring major investments, approval by the IT steering committee

Managing Infrastructure Implementations Project Team Project Team Functional Unit representation to insure that the resulting system meets the business needs Functional Unit representation to insure that the resulting system meets the business needs Technical representation for design and implementation Technical representation for design and implementation Development Environment Development Environment Develop new applications in a development environment that is isolated from the production environment Develop new applications in a development environment that is isolated from the production environment Appropriate authority determines when application has been adequately tested and can be installed in the production environment Appropriate authority determines when application has been adequately tested and can be installed in the production environment

Alternative Sourcing Choices Outside vendor for network maintenance Outside vendor for network maintenance Outside vendor to supervise network development Outside vendor to supervise network development Outside vendor to develop and operate network Outside vendor to develop and operate network Develop in-house network expertise Develop in-house network expertise

Recommendation Hire an outside vendor to own, operate, and develop the network infrastructure Hire an outside vendor to own, operate, and develop the network infrastructure Caregroup’s core competency is patient care and research, not running a IT network. Caregroup’s core competency is patient care and research, not running a IT network. Consider Caregroup’s culture Consider Caregroup’s culture Also, a hospital isn’t an ideal employer for IT specialists Also, a hospital isn’t an ideal employer for IT specialists In a hospital, if you’re doctor, you’re special. Otherwise, you’re never quite as good. In a hospital, if you’re doctor, you’re special. Otherwise, you’re never quite as good. Hire Cisco or another competent vendor and outsource the network Hire Cisco or another competent vendor and outsource the network

Postscript Presentation guidelines Presentation guidelines Take on an appropriate identity Take on an appropriate identity Speak to the decisionmakers Speak to the decisionmakers Rehearse and plan an effective presentation. It isn’t required that everyone speak. Rehearse and plan an effective presentation. It isn’t required that everyone speak. Identify the decision problem Identify the decision problem Identify and analyze the material facts Identify and analyze the material facts Identify alternate solutions, if possible Identify alternate solutions, if possible Recommend a solution Recommend a solution Don’t Don’t Give us a laundry list of the stupid things that the managers did Give us a laundry list of the stupid things that the managers did Don’t summarize the case or give us a history of the firm (would you give the board of directors a history lesson?). Don’t summarize the case or give us a history of the firm (would you give the board of directors a history lesson?).

Postscript 2 Halamka is a physician. Did this entice executives in the organization to overlook his weaknesses? Halamka is a physician. Did this entice executives in the organization to overlook his weaknesses? “…I know all the technologies…I’m a doctor so I understand the clinical domain and the technical requirements.” “…[I’ve] never built anything beyond a home network…” [p. 3]. “They call me the ‘Chief Information Officer,’…but I’m really the ‘Chief Integration Officer;’ I make everything talk to everything else.” [p. 12]. “…I know all the technologies…I’m a doctor so I understand the clinical domain and the technical requirements.” “…[I’ve] never built anything beyond a home network…” [p. 3]. “They call me the ‘Chief Information Officer,’…but I’m really the ‘Chief Integration Officer;’ I make everything talk to everything else.” [p. 12].