GAO

United States General Accounting Office

Executive Guide

February 2001 Maximizing the 

Success of Chief 

Information Officers

Learning From Leading 

Organizations

GAO-01-376G

GAO-01-376G CIO Executive Guide Page 1

Preface

Information technology (IT) has become integral to providing government services, and

the management of information in the federal government has moved out of the back

office and off the mainframe into the home and office and onto the Internet. As the

federal government fully embraces e-commerce and other leading-edge implementations

of IT that benefit citizens, leadership in managing the governmentís information resources

becomes of paramount importance. The development of new service approaches and the

enhancement of old ones in this new information era require the active participation of

information management organizations from the beginning.

The efficient, effective, and innovative use of information technology requires a level of

leadership and focus that goes beyond what would be provided in a technical support

function. Congress recognized the need for greater leadership in information management

and technology in the Clinger-Cohen Act of 1996, which mandated the position of chief

information officer (CIO) for executive departments and agencies. This act and other

laws define the general responsibilities of the CIO and many of the processes required to

manage information in the federal government.

Virtually all of the major executive agencies have appointed CIOs, and many have taken

positive steps toward the implementation of important information management processes

specified by law. To reap the full benefits of information management reform, federal

agencies must utilize the full potential of CIOs as information management leaders and

active participants in the development of agency strategic plans and policies. The CIOs

themselves must meet the challenges of building credible organizations, and developing

and organizing information management capabilities to meet agency mission needs.

This guide is intended to assist federal agencies in maximizing the success of CIOs.

Principles and practices gleaned from the case studies presented in our guide offer

concrete suggestions on what agency executives can do to ensure the effectiveness of their

CIO organizations. The guide does not address all of the responsibilities which fall to

federal agency CIOs - only those which have parallels in the private sector. Moreover, we

find that practices used by federal agency CIOs tend to differ from those used by leading

organizations. We did not study the reasons for these deviations specifically, but they

likely result from the context in which federal CIOs operate. Both operational and

structural aspects of the CIOís environment can vary significantly in the federal sector

versus the private sector. Rather than dwell on differences, our study shows that there is

much common ground between public and private CIO organizations on which to build

efforts for improvement. The specific key conditions and strategies described in this

guide can be used as suggestions for federal CIOs to apply or adapt to their environments,

where appropriate.
Page 2 GAO-01-376G CIO Executive Guide

We would like to thank the Private Sector Council and the leading practice organizations

we selected for our study, which are listed on page 59, for providing us with the

information about their practices and assisting us in producing this executive guide. We

would like to thank members of GAOís Executive Council on Information Management

and Technology for their comments and suggestions in the development of this guide. We

would also like to thank the individuals who provided helpful comments on the exposure

draft of this guide.1

This guide was prepared under the direction of Lester Diamond, Assistant Director,

Information Technology Management Issues, who can be reached at (202) 512-7957 or

DiamondL@GAO.GOV. Key contributors were Tamra Goldstein, Sondra F. McCauley,

and Tomas Ramirez.

David L. McClure

Director, Information Technology Management Issues

 

1 Executive Guide: Maximizing the Success of Chief Information Officers (Exposure Draft) (GAO/AIMD00-83, March 31, 2000).
GAO-01-376G CIO Executive Guide Page 3

Contents

Page

Preface 1

Federal Information Management Reform 5

Overview of Fundamental Principles 7

The Federal CIO Environment Today 12

Critical Success Factor 1: Align Information Management Leadership for

 Value Creation 17

Principle I: Recognize the Role of Information Management in

 Creating Value 18

Principle II: Position the CIO for Success 23

Critical Success Factor 2: Promote Organizational Credibility

29

Principle III: Ensure the Credibility of the CIO Organization 30

Principle IV: Measure Success and Demonstrate Results 35

Critical Success Factor 3: Execute CIO Responsibilities 41

Principle V: Organize Information Resources to Meet Business Needs 42

Principle VI: Develop Information Management Human Capital 47

Using This Guide 52

Appendix I: Federal Legislation Affecting Information Management 55

Appendix II: Objectives, Scope, and Methodology 58

Appendix III: Related GAO Documents 60

Appendix IV: Selected CIO Resources 61

Appendix V: Selected Books and Articles 63

Appendix VI: Selected Information Management Reports and Guidance 65

Appendix VII: Project Adviser Acknowledgments 67
Page 4 GAO-01-376G CIO Executive Guide

Figures

Page

Figure 1: Six Principles and Key Characteristics of CIO Management

 in Leading Organizations 8

Figure 2: Critical Success Factors and Organizational Relationships 9

Figure 3: Steps for Transforming Business Operations Using

 Information Management 21

Figure 4: Matrix Management Organization in a Leading Organization 26

Figure 5: Performance Measurement Framework 38

Figure 6: Comparison of Decentralized, Centralized, and Hybrid Structures 43

Figure 7: Strategy for Securing Human Capital in Leading Organizations 47

Table

Table 1: Comparison of Leading Practices and Federal CIO Management

 Practices 14
GAO-01-376G CIO Executive Guide Page 5

Federal Information Management Reform

The rapid pace of technological change and innovation in the current information age

poses wide-ranging opportunities for improved information management2

 and enhanced

performance in achieving agency missions and goals. At the same time, however, the

proliferation of technology has brought with it a range of thorny issues surrounding

managing and integrating complex processes, computer equipment, and

telecommunications networks. In its oversight role, Congress has established a series of

laws to define the role of information management in government and to mandate basic

processes to manage the government information technology (IT) investment. This

section provides a brief overview of that legislative history.

The federal governmentís management of its information resources to date has produced

mixed results. Consistent with reform legislation, agencies have taken constructive steps

to implement modern IT strategies, systems, and management practices and policies

directed toward achieving cost savings, increasing productivity, and improving the

timeliness and quality of federal service delivery. To the extent that the nearly $27 billion

in annual planned obligations for information technology can be invested and managed

more wisely, federal programs will operate more effectively and at less cost.

For years, Congress has been working to increase the effectiveness of information and

technology management in the federal government. An early effort was the Brooks Act,

enacted in 1965, which called for centralized oversight of federal information technology

acquisitions by the General Services Administration (GSA). The Paperwork Reduction

Act of 1980 (PRA) applied life cycle management principles to information management

and focused on reducing the governmentís information-collection burden. To help

accomplish this, PRA designated senior information resources manager positions in the

major departments and agencies with responsibility for a wide range of functions

including information resource planning, budgeting, organizing, controlling, training, and

ensuring the absence of duplication in information systems. PRA also created the Office

of Information and Regulatory Affairs within the Office of Management and Budget

(OMB) to provide central oversight of information management activities across the

federal government.

In the 1990s, Congress enacted additional laws holding agencies accountable for effective

management of public information resources. In particular, the Chief Financial Officers

(CFO) Act of 1990 and the Government Management Reform Act of 1994 spelled out an

ambitious agenda to remedy the governmentís lack of useful, relevant, timely, and reliable

financial information. For the governmentís major departments and agencies, these laws

(1) established senior-level CFO positions, (2) required annual financial statement audits,

and (3) set expectations for more modern systems to support integrated management of

budget, accounting, and program information. The Government Performance and Results

Act of 1993ó commonly known as GPRA or the Results Act órequired that agencies set

strategic goals, measure performance toward those goals, and report on their progress.

Effective implementation of the Results Act hinges on agenciesí ability to produce

meaningfully integrated information to manage performance and measure results.

 

2

In this guide, information management refers to all aspects of the management of all information resources,

including technology, funds, human capital, and management processes, as well as the underlying

information. IT refers to technology used to support the management of information.
Page 6 GAO-01-376G CIO Executive Guide

Further, amendments to the PRA in 1995 required that agencies indicate in strategic

information resources management plans how they are applying information resources to

improve the productivity, efficiency, and effectiveness of government programs, including

improvements in the delivery of services to the public.

With this increased focus on agency accountability also came recognition of the need to

elevate the agenciesí information management positions to more strategic, executive,

levels, comparable to the CFO positions created in 1990. The Clinger-Cohen Act of 1996

amended the PRA, renaming and elevating former information resources manager

positions to executive-level CIOs who report directly to the agency head and have

information management as a primary responsibility. The new information management

leaders are accountable for not only the range of information management activities

outlined in the PRA, but also for more strategic IT functions such as developing

architectures, managing portfolios, and measuring the performance of information

technology investments. Among other things, the Clinger-Cohen Act also (1) required

senior executive involvement in IT decision-making, (2) imposed much-needed discipline

in acquiring and managing technology resources, (3) called for the redesign of inefficient

work processes before investing in technology, and (4) repealed the Brooks Act,

eliminating GSAís central acquisition authority. Primary procurement responsibility now

rests directly with federal agencies.

Together with a number of other laws enacted over the past several years to foster

improvements in such areas as financial management, acquisition, and computer security,

this legislation discussed above composes a statutory framework for achieving

performance-based management and accountability in not just information management,

but overall federal management.3

 (Appendix I provides a list of these key federal laws

affecting information management.) As the executive leaders for information and

technology management, federal CIOs have a key role in helping their agencies fulfill

many of the provisions embodied in this management reform framework.

Even with the guidance provided by OMB for establishing the new information

technology management leadership positions, agencies face distinct challenges in

effectively positioning federal CIOs and supporting organizations to ensure that

information management adds value in their business/mission performance .

4

 CIOs in the

federal sector face structural and cultural hurdles generally not found elsewhere. Some of

these additional challenges are described in the final section of this guide.

 

3

Managing for Results: The Statutory Framework for Performance-Based Management and Accountability

(GAO/GGD/AIMD-98-52, January 28, 1998) and Managing for Results: The Statutory Framework for

Improving Federal Management and Effectiveness (GAO/T-GGD/AIMD-97-144, June 24, 1997).

4

OMB guidance on implementing federal CIO positions includes Memorandum for the Heads of Executive

Departments and Establishments, ìImplementation of the Information Technology Management Reform Act

of 1996,î M-96-20, April 4, 1996; and Memorandum for the Presidentís Management Council, ìWhat

Makes a Good CIO?,î June 28, 1996.
GAO-01-376G CIO Executive Guide Page 7

Overview of Fundamental Principles

The basis for this guide is the belief that federal agencies could benefit from examples set

by a few leading organizations whose CIO organizations have gained a reputation for

outstanding information management in their enterprises. This work is intended to

provide pragmatic guidance that federal agencies can consider in determining how best to

integrate CIO functions into their respective organizations. Our target audience includes

senior federal executives and managers, although our observations can also provide

insights for senior information management officials throughout the public and private

sectors. (Appendix II provides more details on the objectives, scope, and methodology of

our work.) Based on interviews with private-sector and state CIOs and other research, we

have developed a framework of critical success factors and leading principles. The

balance of this guide describes this framework and its application to CIOs in the federal

government.

CIOs of leading organizations we interviewed described a consistent set of key principles

of information management that they believed contributed to the successful execution of

their responsibilities. These principles touch on specific aspects of their organizational

management such as formal and informal relationships among the CIO and others,

business practices and processes, and critical CIO functions and leadership activities. The

specific nature of these principles varied depending on the organizationís mission, size,

culture, and other factors, but each underlying key principle was consistently observed.

The CIOs interviewed considered these principles instrumental because they address

critical organizational and operational aspects of the CIOís role. Notably, the principles

address senior executivesí responsibility for creating an effective management context for

their CIOs, as well as the CIOsí responsibilities for building credibility and organizing

information technology and management to meet business needs. The practices are not

new ideas in the general management of organizations, but rather are the application of

well-founded principles in the maturing area of information technology and management.

These principles are most effective when implemented together in a mutually reinforcing

manner. As ad hoc efforts, each individual principle addresses a single aspect that is

necessary, but is not sufficient for success by itself. The failure to execute a single

principle may render the others less effective. Further, although there is no precedence

among the principles, organizational conditions may make it more feasible to address one

principle before another. For example, the chief executive officer (CEO) may ìposition

the CIO for successî in advance of hiring a new CIO while the other principles await the

CIOís attention.

Figure 1 illustrates the six fundamental principles described by the CIOs interviewed

during the development of this guide. In addition, for each principle, several key

characteristics of organizations that successfully execute these principles are listed. These

key characteristics can provide insights into what constitutes successful CIO

organizations.
Page 8 GAO-01-376G CIO Executive Guide

Figure 1: Six Principles and Key Characteristics of CIO Management in

Leading Organizations

• Information management organizational functions and processes are

incorporated into the overall business process

• Mechanisms and structures are adopted that facilitate an

understanding of information management and its impact on the

organizationís overall strategic direction

• The CIO model is consistent with organizational and business needs

• The roles, responsibilities, and accountabilities of the CIO position are

clearly defined

• The CIO has the right technical and management skills to meet

business needs

• The CIO is a full participant of the executive management team

• The CIO has a legitimate and influential role in leading top managers

to apply information management to meet business objectives

• The CIO has the commitment of line management and its cooperation

and trust in carrying out projects and initiatives

• The CIO accomplishes quick, high-impact, and visible successes in

balance with longer term strategies

• The CIO learns from and partners with successful leaders in the

external information management community

• Managers engage both their internal and external partners and

customers when defining measures

• Management at all levels ensures that technical measures are

balanced with business measures

• Managers continually work at establishing active feedback between

performance measures and businesses

• The CIO organization has a clear understanding of its responsibilities

in meeting business needs

• The extent of decentralization of information management resources

and decision-making is driven by business needs

• The structure of the CIO organization is flexible enough to adapt to

changing business needs

• Outsourcing decisions are made based on business requirements and

the CIO organizationís human capital strategy

• The CIO organization executes its responsibilities reliably and

efficiently

• The CIO organization identifies the skills necessary to effectively

implement information management in line with business needs

• The CIO organization develops innovative ways to attract and retain

talent

• The CIO organization provides training, tools, and methods that allow

skilled IT professionals to use in performing their duties

Recognize the

Role of

Information

Management in

Creating Value

Position the CIO

for Success

Ensure the

Credibility of the

CIO Organization

Measure Success

and Demonstrate

Results

Organize

Information

Resources to Meet

Business Needs

Develop

Information

Management

Human Capital

Principles Key Characteristics
GAO-01-376G CIO Executive Guide Page 9

Evaluating the intent of the six principles, we observed that they naturally fell into three

distinct sets, which we refer to as critical success factors. Figure 2 illustrates the six

principles and their relationship with the three critical success factors and their respective

organizational foci.

Figure 2: Critical Success Factors and Organizational Relationships

Participants

Collaborators

Align Information

Management

Leadership for

Value Creation

Promote

Organizational

Credibility

Execute CIO

Responsibilities

Critical Success

Factors

I. Recognize the

 Role of Information

 Management in

 Creating Value

III. Ensure the

 Credibility of the

 CIO Organization

V. Organize Information

 Resources to Meet

 Business Needs

Principles

II. Position the CIO

 for Success

IV. Measure Success

 and Demonstrate

 Results

VI. Develop Information

 Management

 Human Capital

Senior executive

management,

especially the CEO

CIO peers and

senior management CIO organization

Organizational

Foci

CEO, CFO, COOa Senior executives

and division heads

Client and CIO

organizations

a COO-Chief Operating Officer
Page 10 GAO-01-376G CIO Executive Guide

Understanding the six principles in terms of critical success factors is particularly useful

because of characteristics that are shared by principles within the same success factor.

Following is a brief description of each critical success factor.

Align Information Management Leadership for Value Creation

The principles under the first critical success factor, ìAlign Information Management

Leadership for Value Creation,î advocate the need to recognize the role of information

management in creating value and positioning the CIO for success; both of these

principles address issues of senior executive support. Both principles require that the

leaders of the enterprise embrace the critical role information management can play in the

success of the organization and the leadership role the CIO must play in order for

information technology and management to meet its potential. The first principle

addresses the acceptance of this premise by senior executive management, and the second

ensures that the CIO has the organizational legitimacy to execute his or her role.

Promote Organizational Credibility

While the first success factor refers to legitimacy at a strategic planning level, this success

factor addresses a more operational level. The principle that addresses the need to ensure

the credibility of the CIO organization and the principle that encourages measuring

success and demonstrating results, if executed successfully, will lead to the confidence of

those with operational responsibility in the enterprise. Without credibility, the CIO

organization will struggle to be accepted as a full participant in the development of new

organizational systems and processes.

Execute CIO Responsibilities

The last critical success factor, ìExecute CIO Responsibilitiesî addresses the need to

organize information resources to meet business needs and to develop the associated

human capital. These two principles provide the foundation for the CIOís effectiveness in

carrying out the CIO organizationís specific responsibilities. Once executive management

endorses the centrality of the CIO organization and becomes a partner in the development

of new systems, the CIO organization must execute its responsibilities successfully.

The last section in figure 2, ìOrganizational Foci,î illustrates how both principles within a

single critical success factor require the same organizational units to collaborate in their

execution. Both principles within a critical success factor also focus on the same

organizational units as targets of their implementation. For example, in the case of,

ìPromote Organizational Credibility,î both principles rely on the collaboration of senior

executives and division heads for success and have as their target the senior management

of the enterprise.

The common features within a critical success factor can become especially significant as

the CIO, and other players, plan the execution of the six principles described in this guide.

As this group plans its strategy, it can utilize the commonality among principles to link

initiatives and utilize the synergy between related efforts. For example, while organizing

information resources to meet enterprise needs and developing human capital are distinct

initiatives, they share extensive areas of commonality. Executing both principles in
GAO-01-376G CIO Executive Guide Page 11

conjunction with each other can create opportunities for efficiency and effectiveness not

otherwise available.

Finally, the organization of principles into critical success factors illustrates the extent to

which the work of a successful CIO must extend throughout the enterprise. In particular,

the role that the CEO and other senior managers play in ensuring the success of the CIO

should be noted. While it is the responsibility of the CIO to execute the specific

responsibilities of his or her position, it became clear to us during our case studies that the

successful CIO relies extensively on both vertical and horizontal relationships within the

enterprise in order to carry out these responsibilities.

This executive guide includes examples from our case study organizations as well as

information from selected federal organizations, which helped us confirm the applicability

of our findings to federal government experience. At the conclusion of each principle, we

provide a case study to describe the principle in practice at one of the organizations we

visited, as well as strategies to consider when implementing the principle. Although this

guide focuses on fundamental practices rather than detailed guidance, the examples

illustrate and complement much of the specific guidance contained in similar and related

GAO documents cited in appendix III.
Page 12 GAO-01-376G CIO Executive Guide

The Federal CIO Environment Today

The CIO position in the federal government is still evolving. Agencies are learning how

a CIO can help improve effectiveness and efficiency and better realize the benefits of their

information resources. Current federal CIOs are learning how to carry out their

responsibilities in the federal environment with all of the incumbent expectations and

constraints. Both the agencies and the CIOs are working to meet the letter and intent of

the Clinger-Cohen Act and associated legislation effectively. The principles offered in

this guide are intended to provide insight into what CIOs at leading organizations consider

critical to their success, and provide advice to federal CIOs and senior agency

management as they work to improve the use of information technology and management

in the federal government.

The federal CIO faces an environment that includes many of the elements encountered by

CIOs interviewed for this guide. At the same time, the federal CIO faces additional

challenges as a result of specific legislative responsibilities (e.g., records management and

defined contracting requirements). The federal CIO is also subject to a funding process

that is more complex and uncertain than in most other organizations. The effect of the

appropriations process and the highly distributed management structures found in several

federal agencies tend to move some of the control of processes having to do with

information management away from the CIO. Together, these characteristics, among

others, differentiate the federal CIO environment from other environments. These

differences, and their impact on the framework developed in this guide, will be discussed

in the ìUsing this Guideî section. The following discussion focuses on the common

elements among the private, state, and federal sectors, and the application of the

framework across all three.

In a series of one-on-one interviews with half of the Federal CIO Council, we found that

federal organizations face many of the same issues as their private-sector and state

government counterparts. Specifically, federal organizations must overcome the

challenges of effectively linking information technology and management to agency

missions, positioning and legitimizing information management leadership, measuring

performance, and building capabilities and skills. Our meeting with five members of the

Federal Small Agency CIO Council and a number of independent studies provide similar

conclusions.5

 The six principles that emerged from our discussions with private-sector

and state government CIOs also describe the general areas that federal CIOs agreed

needed to be addressed. However, the specific approaches to executing those principles

tended to differ among the various sectors.

 

5

The Federal Chief Information Officer: Third Annual Top Ten Challenges Survey, Association for Federal

Information Resources Management, November, 1998; Implementing Best Practices, Capital Planning and

IT Investment Committee, Federal CIO Council, June 1998; The Impact of Change: Clinger-Cohen Act

Implementation, Laying the Foundation for Year 2000 and Beyond, Eighth Annual ITAA Survey of Federal

CIOs, Grant Thornton LLP, December 1997; and IAC/CIO Task Force Draft Report, Federal Chief

Information Officerís Working Group and Industry Advisory Council, July 9, 1996.
GAO-01-376G CIO Executive Guide Page 13

In three of the principle areas, the level to which practices of leading private versus

federal organizations have evolved is significantly different. For example, in principle I,

while leading organizations generally include their CIOs in executive business decisionmaking, in the federal government setting information management is still often viewed as

a support function rather than a strategic activity. Leading organizations also consider

various leadership models and position their CIOs at a clear, executive level, as in

principle II. In contrast, federal CIO implementation is in more nascent stages, lacking

criteria for matching CIO types with organizational needs. Further, in principle V, while

leading organizations are flexible in reassigning staff and structuring capabilities across

business and technology lines, federal staffing practices and organizational structures are

less flexible in nature.

Performance measurement (principle IV) and information management human capital

development (principle VI) are two areas that private, state, and federal CIOs all agreed

must be addressed in order for the CIO and the supporting organization to be successful.

Practices used by both the private and public sectors in the area of performance

measurement are still evolving. In both performance measurement and human capital

development, practices used by the federal CIOs differed from those of CIOs in leading

organizations, though federal CIOs were actively trying to address the issues. Differences

in the approaches used probably resulted from specific constraints in the federal CIO

environment, including a focus on nonfinancial program benefits, rather than financial

return on investments.

Credibility building, principle III, is the one area in which CIOs in both the public and

private sector have all adopted similar practices. The precise application of the practices

depended on the specific contexts of their organizations, but the approaches were

consistent. It may be noted that this is one of the few principles that CIOs may address

themselves, without regard to organizational constraints or CEO support. Of course, as

stated earlier, the effectiveness of this principle is moderated by the extent to which the

other principles have been implemented.

The following table summarizes the practices of our sample organizations in each

principle area and compares them with practices in the federal CIO environment.
Page 14 GAO-01-376G CIO Executive Guide

Table 1: Comparison of Leading Practices and Federal CIO Management Practices

Critical

Success Factor Principle

What a Leading Organization

Does

What the Federal Government

Does

Recognize the

Role of

Information

Management in

Creating Value

• CEOs and governors ensure

that the CIO organization is

a key business player

• CIO is a full participant in the

executive decision making

process

• Information management

generally still viewed as a

support function instead of a

strategic activity

• CIO is not always involved in

strategic and policymaking

decisions Align Information

Management

Leadership for

Value Creation

Position the CIO

for Success

• Defines clear CIO role and

authorities

• Matches CIO type and skills

set with business needs

• Forges CIO partnership with

CEO and other senior

executives

• Does not always clearly

define CIO role or authority

• Does not always match CIO

selection with agency needs

• Does not always provide

executive support for the

CIO position

Ensure the

Credibility of the

CIO Organization

• CIO builds credibility through

effective leadership, good

working relationships, track

records, and partnering with

customers and peers

• Uses practices similar to

leading organizations

Promote

Organizational

Credibility

Measure Success

and Demonstrate

Results

• Strong links exist between

business objectives and

performance measures

• Performance management

structure still evolving

• Weak links between agency

goals and information

technology and

management performance

measures

• Required annual

performance plans still in

early stages

Organize

Information

Resources to

Meet Business

Needs

• Reassigns staff as needed

to best serve interests of

customers

• Structures the organization

along business lines as well

as information management

functional areas

• Tries to meet needs of

customers with a fixed

organizational structure

• Structures the organization

primarily along information

management functional

areas

Execute

CIO

Responsibilities

Develop

Information

Management

Human Capital

• Maintains up-to-date

professional skills in

technology management

• Outsources entry-level

positions but largely hires at

all levels of experience

• Provides limited amount of

training in technology

management

• Assumes entry-level staff

will remain in federal service

as a career

In terms of critical success factors, federal CIO organizations tend to trail the CIOs

interviewed for this guide in the ìAlign Information Management Leadership for Value

Creationî and ìExecute CIO Responsibilitiesî factors. The successful execution of these

two critical success factors depends to a great extent on officials other than the CIO. In

the first success factor, the CIO depends to a great extent on the other senior executive

officers to support the inclusion of the CIO in critical strategic discussions. In the other

factor, the federal CIO tends to be constrained by organizational attributes typical of the

federal sector. These attributes include, but are not limited to, relatively little flexibility in

financial reward systems and highly distributed organizational structures in a number of

federal agencies.
GAO-01-376G CIO Executive Guide Page 15

This is not to say that there are no examples of progress in the federal sector in either of

these two success factors. The federal response to the year 2000 computing challenge

created an opportunity in many agencies for CIO and program organizations to partner in

responding to specific agency mission needs. This partnering took place at the senior

executive level and contributed to the success of the federal Y2K effort. In addition, the

CIO Council, the Office of Personnel Management, and individual agencies have been

working together to develop new approaches to compensating and retaining information

technology and management workers.

It is interesting to note that the remaining critical success factor, ìPromote Organizational

Credibility,î is executed about the same within all sectors, since all sectors approach

principle III similarly, and no sector executes principle IV well. As noted, it is within this

critical success factor that the CIO is able to operate with the greatest individual

flexibility.

Table 1 indicates that a gap exists between the practices of federal CIOs and CIOs of

leading organizations. Areas in which gaps exist should be examined carefully to

understand the basis for the differences as well as opportunities for greater

implementation of the principles. It is possible that the business context for federal CIOs

is sufficiently different from that of CIOs in leading organizations that lessons learned

may not be applicable. Some of these differences are described in the final section of this

guide. At the same time, an understanding of the information technology and

management practices of leading organizations could contribute to the development of

improved CIO management practices in the federal sector.

The following sections describe each of the general principles and practices discovered in

our work with leading CIO organizations.
Page 16 GAO-01-376G CIO Executive Guide

CIO organization

Client and CIO

organizations

Promote

Organizational

Credibility

Execute CIO

Responsibilities

Critical Success

Factors

III. Ensure the

 Credibility of the

 CIO Organization

V. Organize Information

 Resources to Meet

 Business Needs

Principles

IV. Measure Success

 and Demonstrate

 Results

VI. Develop Information

 Management

 Human Capital

CIO peers and

senior management

Organizational

Foci

Senior executives

and division heads

Collaborators

Participants

Senior executive

management,

especially the CEO

CEO, CFO, COO

Align Information

Management

Leadership for

Value Creation

I. Recognize the

 Role of Information

 Management in

 Creating Value

II. Position the CIO

 for Success
GAO-01-376G CIO Executive Guide Page 17

Critical Success Factor 1:

Align Information Management Leadership for

Value Creation

The CIO and supporting organization must have active support and commitment at the

very top of the enterprise or they will remain limited and tangential to the business,

despite their potential contribution to mission accomplishment. This first critical success

factor focuses on the role of the senior executive of the enterprise in developing a culture

that includes the CIO in senior-level decision making and that assumes the potential of IT

in creating value for the enterprise. Executive leadership is essential to the successful

execution of this factor.

A common theme among the CIOs we interviewed was that the message of the

importance of IT to the organization must be communicated at the highest levels. Senior

executives must embrace the central role of technology, and the CIO must be a full

participating member at the table with them as business strategy is discussed. This

behavior begins with the CEO, who sets the example for senior and mid-level executives

and, through them, the rest of the organization. In addition, the participation of the CIO in

long-range strategic planning is necessary to take full advantage of the opportunities IT

can provide and to ensure that the technology infrastructure is in place as business

strategies develop.
Page 18 GAO-01-376G CIO Executive Guide

Principle I:

Recognize the Role of Information Management in Creating Value

ìThe CIOís ability to add value is

the biggest single factor in determining

whether the organization views IT as an

asset or a liability.î

Instituting an effective CIO organization does not start with selection or placement of an

information technology and management leader, nor does it begin with establishing a

structure for managing information resources and activities. Rather, it begins with

consideration on the part of executive-level managers of the role of IT and how vital it is

to accomplishing mission objectives. It also entails thinking about ways to incorporate the

information technology and management leader in the executive-level management

structure and create an environment that facilitates business/technology sharing and

exchange of ideas. Moreover, CEOs and governors can set powerful examples through

their own strong relationships with CIOs. Such relationships symbolize the importance of

information technology and management within their organizations.

Key Characteristics

Senior executives have primary responsibility for setting the business context for their

CIOs and formulating strategies for integrating information technology and management

into their business operations. Executives of leading organizations no longer regard

technology management as a separate support function and instead strive to understand

how investments in information resources are made and how they integrate with other

investments and the overall business vision. These executives also increasingly focus on

the management, operations, program and service delivery benefits, and performance of

their major strategic information systems. CEOs have a key role in setting the example

for the rest of the agency to follow in seeking to understand information technology and

management concepts and appreciating the strategic role that information technology and

management can play in helping to accomplish business objectives. Viewing information

and technology not just as assets to manage, these CEOs assign their information

technology and management leaders a prominent role in business decision making.

Recognizing the business transformation potential of IT, these executives also position

their CIOs as change agents with responsibility for applying technology to achieve major

improvements in fundamental business processes and operations. With CEO support, the

CIOs are in a good position to have significant impact on not just IT, but the entire

business enterprise.

Following the CEOís lead, members of the senior executive team learn to value the advice

of the CIO in setting business directions and developing strategies for improving

organizational capabilities and competitiveness. They seek to embrace fundamental

information technology and management principles and work with their CIOs to develop a

shared vision of the role of IT within the business context. They engage in dialogue on

Key Characteristics

• Information management organizational functions

and processes are incorporated into the overall

business process

• Mechanisms and structures are adopted that facilitate

an understanding of information management and its

impact on the organizationís overall strategic
GAO-01-376G CIO Executive Guide Page 19

ways that technology can be incorporated to improve business processes, outputs, and

outcomes. They incorporate information management as an intrinsic part of their business

planning and decision making processes, discussing the benefits and risks associated with

specific strategies for improving service, reducing cycle time, or reducing costs.

In leading organizations, senior managers make joint decisions on information resources,

formulate business plans, and set performance expectations. Increasingly, managers make

IT investment decisions based on the value of the investments to their enterprises, not just

to a specific business unit or function. By asking strategic and operational questions at the

beginning of the planning and evaluation period, senior managers gain a better

understanding of the potential benefits and value of IT. Information and technology

managers in leading organizations are also adopting processes that help them quantify and

align projects with their organizationsí business planning and measurement processes.

They produce plans that link to overall business plans and assign managers to act as

liaisons between business units and CIO organizations. Increasingly, managers also focus

on measuring reliability, responsiveness, and customer satisfaction, which in the eyes of

senior management are just as important as strictly financial measures.

Leading organizations work to create environments that are conducive to sharing ideas on

how information technology can support the businesses and vice versa. They adopt

formal mechanisms and structures that facilitate the ability of their businesses and

information technology and management leaders to understand and communicate one

anotherís issues and work together to accomplish a shared business vision. These

mechanisms and structures include forums, councils, and boards for discussion and

exchange on business and technology issues. Such forums help promote organizationwide

perspective and facilitate the ability to achieve consensus or stakeholder buy-in to

business/technology directions. For example, one state has a strategic planning forum that

brings together major stakeholders statewide to identify strategic and tactical issues,

including IT issues confronting the state. The state prepares a strategic planning

document based on this stakeholder input. This process has helped to integrate

information management into overall business planning by aligning IT products and

services with business functions and linking technology to the stateís overall strategic

direction.

To further support the business/technology collaboration, leading organizations adopt a

common business language, skillfully avoiding technical jargon and instead using

language that general managers and legislatures can understand. They use analogies,

terminology, and processes that help fuse business and technology interests and ideas

together. Other strategies for business/technology learning include informal activities

such as newsletters, presentations, reports, and service-level results placed in common

areas to communicate the effectiveness of their CIO organizations. Leading organizations

further the two-way exchange of ideas and perspectives by bringing in experts from the

field to advise or educate managers on recent trends and developments in both the

business and technology arenas. Realizing that attitudes, expectations, and culture seldom

change quickly, they plan for whatever time and resources are necessary to create a

common ground and organizational cohesiveness. Their efforts go a long way in shoring

up commitment from across the organization to strategies for achieving common goals.
Page 20 GAO-01-376G CIO Executive Guide

Leading organizations also focus on hiring managers who bring a hybrid of business and

technical expertise to the organization. One large multinational corporation uses

ìtechnical facilitatorsî to support its initiatives. In the past, this company had experienced

problems in sharing information resources. Managers in the different lines of business

were unwilling to share information resources because each felt his or her particular line

of business was unique. Because technology was becoming critical to future success in

this business sector, top managers were increasingly assigned to support and manage the

companyís internal information management functions. Several of the managers assigned

had both business and technology acumen and had the ability to raise business issues from

a technical perspective in a nonthreatening manner. In resolving business issues, they

were sometimes able to identify more efficient technical opportunities.
GAO-01-376G CIO Executive Guide Page 21

Case Study: Recognizing the Role of Information Management in Creating Value

Due to changes in market conditions and requirements for increased productivity through using

common components, a large manufacturing company decided that it needed to make major

changes in the way it managed IT to support the business. The company had outsourced its

information management function, but lacked the infrastructure to provide strategic direction,

discipline, and overall management of information management to ensure optimal implementation

and cost. Given this situation, the company was faced with a proliferation of legacy systems and

inefficient business processes built around them. The company also met with bureaucratic

business resistance to change to a common information systems environment.

By way of improvement, senior executives adopted a new IT strategic direction and focus that

tracked back to the companyís business prioritiesñ ìcommon, lean and fast, global, and growth.î

Senior management then hired a CIO as a change agent, reporting to the Vice Chairman and the

companyís senior decision making council, and gave him responsibility for transforming the IT

function, thereby making him an enabler of the function and an integral part of the business

strategy.

The CIO recruited an IT management team that understood both the business and technical sides

of the enterprise. He instituted a matrix management organization, creating a leadership structure

that provided flexibility for meeting future information management needs as well as maintaining

existing IT systems. The new IT organization became responsible for such strategic activities as

participating in the development of overall business strategies; prioritizing IT requirements;

generating IT business plans; setting technical and architectural standards; managing user

interfaces, outsourcing contracts, suppliers, and systems engineering; and allocating IT resources.

To assess performance, the IT organization instituted several sets of measures that link directly to

the business objectives and priorities defined by the CEO in the companyís strategic plan.

The major steps that the company took to improve, are illustrated in figure 3, below.

Figure 3: Steps for Transforming Business Operations Using Information Management

Strategic

Plan

Leadership

Alignment

Communications

Team

Alignment

Common

Execution

Measurement • Defined measures and communicated business results

• Balanced measures: financial, customer, internal, and learning

• Focused on achieving effectiveness and efficiency from IT

• CIO organization provides: IT strategic direction, IT plans and architecture,

user interfaces, and resource allocation

• Implemented a matrix IT organization (functional and operational alignment)

• Established virtual organizational structure for flexibility and responsiveness

• CIO communicated IT role in fulfilling organizational priorities

• Instituted IT values and communication channels

• CEO included the CIO as an integral part of the executive team

• Positioned CIO and IT team as change agents

• Defined strategic business priorities including Common, Lean, Fast, Global 

and Growth

• Executive team shared a challenging vision of the role of IT
Page 22 GAO-01-376G CIO Executive Guide

Strategies to Consider

Instituting information technology and management as a support function separate from

the business is an ineffective and outdated model. Leading organizations recognize the

role of IT in supporting mission accomplishment and seek to integrate it with business

operations. The following outlines the strategies that senior executives in leading

organizations commonly use to promote information management leadership involvement

in business decision making and maximize the benefits from their IT investments.

Focus on efforts to incorporate the CIO organization into the overall business by

• ensuring executive leadership and commitment for the CIO organization, both at the

career and political levels;

• embracing the CIO as a full participant of the executive management team;

• developing structured approaches for exploring the broad range of opportunities and

strategies in information technology available to enhance the business; and

• focusing technology initiatives on creating value and providing the information

needed by internal and external customers.

Provide an atmosphere that supports executive understanding of IT by

• creating and using formal and informal executive communication channels to make

the business case for integrating information management into organizationwide

decision-making; and

• emphasizing returns and metrics that clearly link information management with an

organizationís business needs.
GAO-01-376G CIO Executive Guide Page 23

Principle II:

Position the CIO for Success

ìThere is no cookie-cutter approach,

so knowing what fits in an

organization is key to finding the

right CIO to match with the

organization.î

There is no one right way to establish a CIO position. Diversities in corporate missions,

structures, cultures, and capabilities prohibit a prescriptive approach to information

management leadership. There are nonetheless a number of practices and alternative

strategies that senior executives in leading organizations use to help define and institute

their CIO positions to effectively meet business needs. This section examines those

practices, providing pragmatic guidance that other organizations can also consider in

determining how best to integrate CIO functions into their respective organizations.

Key Characteristics

Senior executives in leading organizations recognize that a one-size-fits-all solution to

establishing information management leadership does not exist. Rather, they take

responsibility for ensuring that their CIO models are consistent with the business,

technical, and cultural contexts of their enterprises. Executives do so by examining their

internal environments and asking a series of questions about the problems that need

fixing, how information technology and management can help, and how a CIO might best

fit within their management structures to guide technology solutions. The answers to

these questions help them choose from a range of alternative CIO approaches.

Specifically, by defining mission improvement objectives, senior executives determine

whether their organization needs a CIO who is a networking/marketing specialist,

business change agent, operations specialist, policy/oversight manager, or any

combination thereof. Studying existing IT capabilities helps define the structure and

responsibilities of the new CIO organization. Considering the centralized or decentralized

nature of the enterprise helps determine the corporate CIOís authority level and how the

CIO shares responsibility with other managers across the agency. Further, appreciating

organizational culture and change readiness helps define the pace and extent to which

CIOs can accomplish business transformation.

Business executives keep in mind that initial CIO models adopted should not be set in

stone, but may have to be adjusted over time as their enterprises grow or mature. For

example, while a company may need a business strategist to build a new IT capability,

over time another type of CIO may be better suited to sustaining operations. This

evolution in the CIO role is also reflected by the introduction of variant leadership

positions in information management (i.e., chief knowledge officers or chief technical

Key Characteristics

• The CIO model is consistent with organizational and

business needs

• The roles, responsibilities, and accountability of the

CIO position are clearly defined

• The CIO has the right technical and management skills

to meet business needs

• The CIO is a full participant on the executive

management team
Page 24 GAO-01-376G CIO Executive Guide

officers) that diffuse responsibility across several senior-level managers. For example,

one industry organization that we visited has multiple product line CIOs. The most senior

information management executive positioned at a level above these CIOs asserts that he

is not the ìcorporate CIOî and does not want to be. With the belief that one person cannot

embody all the knowledge needed to effectively direct information technology and

management in an organization, this executive uses an executive-level technology

committee as a forum for building consensus for IT initiatives.

In conjunction with determining their CIO models, senior executives clearly define up

front the roles, responsibilities, and accountability of their CIOs for enterprisewide

information management, better enabling their CIOs to operate effectively within the

parameters of their positions vis-‡-vis those of their senior management counterparts (i.e.,

CFO, COO). Typically, CIOs serve as a bridge between top managers, IT professionals,

and end users. CIOs provide leadership and vision, focusing senior executives on highvalue information technology issues, investments, and decisions. They may also serve as

business change agents, challenging conventional approaches and developing new

methods and systems for delivering mission benefits. The case study at the end of this

section provides an example of a CIO hired specifically to help transform information

management and business operations.

In this strategic capacity, CIOs take the lead role in integrating information and

technology management and performance across the entire information life cycle. They

are responsible for such activities as planning, setting standards and policies, and

designing and managing architectures to guide introduction of technology products and

services. While not all CIOs necessarily have hands-on responsibility, their purview may

also incorporate any or all of the operational elements of information and technology

management, such as data processing, infrastructure management, and systems

acquisition.

Senior executives provide their CIOs with the authority they need to effectively carry out

their diverse responsibilities. Executives ensure this by giving the CIO a key role in IT

investment decision-making, providing budget control, or ensuring leadership backing for

information technology and management programs and initiatives. Formally documenting

or, in the case of public-sector organizations, legislating, CIO roles and responsibilities

can help in managing performance and expectations of both the enterprise and the CIO.

For example, the position of one state government CIO that we interviewed was based on

a specific statute establishing the CIO at the cabinet level and assigning clear-cut

responsibilities for funding and overseeing IT operations statewide.

While there is no single template for doing so, senior executives in leading organizations

apply consistent criteria in selecting their CIOs. The most obvious criterion is relevant IT

expertise. Rather than being technical experts specifically, their CIOs intuitively

understand IT principles and trends and act as strategists, applying technology and

approaches skillfully to help resolve or overcome daunting business challenges. But even

while IT expertise is important, their CIOs are business managers as well, with experience

in administrative, financial, and corporate management. Such experience better enables

the CIOs to work with business managers to build a shared vision for meeting mission

needs. For instance, one state government CIO attributed his success to his breadth of

experience across a variety of financial, retail, and IT units, which facilitates his ability to
GAO-01-376G CIO Executive Guide Page 25

get buy-in from stakeholders in the state. Additional proficiencies critical to CIO success

include leadership ability, innovation and flexibility, effective communications skills,

interpersonal skills, and political astuteness. The weight that senior executives assign to

each of these criteria in selecting a CIO depends on the information management

leadership model and the needs of the enterprise.

CIOs are no longer tied to a single functional unitói.e., the ìIT shop.î Instead, they are

positioned as senior executives with the ability to strategically view and apply IT to the

best advantage of the enterprise. CIOs generally report to and partner with their agency

heads, forging relationships that ensure high visibility and support for far-reaching

information management initiatives. As active members of the CEOsí executive teams,

these CIOs are well situated to provide advice and direction, integrate IT with the business

vision, and take part in high-level decision-making. Active participation in executive

processes and committees facilitates the CIOsí ability to build effective executive-level

working relationships.
Page 26 GAO-01-376G CIO Executive Guide

Case Study: Positioning the CIO for Success

In 1996, this manufacturing company instituted a CIO position to help build its information

management capability after deciding to split its former internal IT service provider off as an

independent business. For years, the manufacturing company had relied on a wholly owned

subsidiary to provide IT products and services. With minimal IT talent left in the company

following the split-off, the CIO had to create a new IT leadership staff.

The company used a consultant to search for a CIO to build the in-house information management

capability. Essentially, the company wanted a CIO with IT expertise, strong management skills,

and background experience in managing large, centralized companies. The current CIO exceeded

their requirements. He came highly recommended due to his prior success in transforming two

other companies and his skill in outsourcing, which would be needed to manage the

manufacturerís continued reliance on information technology contract services. The CIO accepted

the position only after obtaining senior executivesí commitment to his vision for transforming not

just information technology and management, but processes in the entire company.

Senior executives set the CIO up to succeed. They positioned him as a member of the senior

decision-making board, reporting to the Vice-Chairman of the company. They gave him the

flexibility to bring in managers from the outside and set up a matrix management organization

consisting of multiple business sector CIOs aligned with functional CIOs across the company, all

reporting to the corporate CIO. They required that any IT initiative include collaboration between

a sector CIO and a process-responsible CIO, as illustrated in figure 4. Senior executives also

made the CIO the final authority on all IT budget, operations, and process management issues.

During the period from 1996 through 1999, the CIO has been effective in lowering projected

annual IT costs, for 1999 the total reduction was over $450 million, when taking into account both

cost avoidance and cost reduction, while enhancing the provision of IT services to the company.

Figure 4: Matrix Management Organization in a Leading Organization

Global Processes and Systems

Marketing & Customer

Service CIO

Internal Services

CIO

Manufacturing

CIO

Design Team

CIO

Product A Sub - GroupProduct B Sub - GroupProduct C Sub - GroupProduct D Sub - Group

Product

Line D

CIO

Product

Line C

CIO

Product

Line B

CIO

Product

Line A

CIO

Company

President

Chief Operating Officer

Sector

President

Sector

President

Sector

President

Sector

President

Corporate

CIO
GAO-01-376G CIO Executive Guide Page 27

Strategies to Consider

In the absence of a single model for instituting a CIO, senior executives take precautions

to ensure that their information management leadership positions are appropriately

defined and implemented to meet their unique business needs. The following is an outline

of the strategies that senior executives in these organizations use to determine the types of

CIOs they need, select individuals to carry out these roles, and position them as effective

and influential members of the senior executive decision-making team.

Determine the CIO model by

• examining the current environment and identifying what the enterprise expects to

accomplish through information management before establishing a CIO position to

lead improvements; and

• making the CIO type (i.e., business strategist, marketing specialist, policy and

oversight manager, operations specialist, etc.) consistent with the enterpriseís mission,

history, current environment, culture, and change readiness.

Define clear roles and accountability for the CIO by

• delineating CIO roles and responsibilities vis-‡-vis those of other senior managers;

• ensuring that the CIO has the authority needed to be effective; and

• documenting CIO roles, responsibilities, and accountabilities to help manage

expectations and performance.

Select a CIO with the right skills set by

• choosing someone with information technology and management expertise and the

potential to help in business transformation, consistent with the CIO model selected;

and

• ensuring that the individual also has the leadership and communications skills and

other proficiencies needed to effectively carry out the CIO position.

Make the CIO a business partner by

• having the CIO partner with other senior executive managers,

• empowering the CIO to work with other senior executives to discuss and decide

among alternative IT products and strategies for meeting business needs, and

• ensuring that the CIO is involved in strategy discussions at the highest levels so that

he or she can lead the enterprise in using information management to corporate

advantage rather than merely responding to client requests.
Page 28 GAO-01-376G CIO Executive Guide

Align Information

Management

Leadership for

Value Creation

Execute CIO

Responsibilities

Critical Success

Factors

I. Recognize the

 Role of Information

 Management in

 Creating Value

V. Organize Information

 Resources to Meet

 Business Needs

Principles

II. Position the CIO

 for Success

VI. Develop Information

 Management

 Human Capital

Senior executive

management,

especially the CEO

Organizational

Foci

CEO, CFO, COO

Collaborators

Client and CIO

organizations

Participants

CIO peers and CIO organization

senior management

Senior executives

and division heads

Participants

Collaborators

III. Ensure the

 Credibility of the

 CIO Organization

IV. Measure Success

 and Demonstrate

 Results

Promote

Organizational

Credibility
GAO-01-376G CIO Executive Guide Page 29

Critical Success Factor 2:

Promote Organizational Credibility

The second critical success factor focuses on the CIOís ability to establish the CIO

organization as a central player in the enterprise. The legitimacy of the CIO and the CIO

organization must be developed for the CEOís message of information technology and

managementís central role to be accepted and for the CIO organization to become a full

participant in formulating corporate strategy.

Both principles in this critical success factor pertain to the demonstration of the CIO

organization as an entity that can complete critical projects successfully and contribute to

the well being of the enterprise. This effort is largely the responsibility of the CIO, and

the focus is lateral and downward. The CIO must create an environment in which the

ability of the CIO organization to contribute to the success of the enterprise is recognized.

Success, to be appreciated, has to be demonstrable and measurable. If the CIO is not able

to demonstrate that he or she deserves the support of the CEO and makes a valuable

contribution to the corporate mission, the CIO will not be effective as a full participant in

the corporate decision-making process.
Page 30 GAO-01-376G CIO Executive Guide

Principle III:

Ensure the Credibility of the CIO Organization

ìWhile placement of the CIO position

at a high level within the organization

may carry some weight, the CIO

generally must earn credibility by

making things happen.î

Instituting a CIO position consistent with organizational needs and finding a capable

leader to fill the job are no guarantee of CIO success. Rather, the burden of ensuring

information technology and management effectiveness shifts from senior executives to the

CIO and his or her supporting organization. Given the relative newness of the position

vis-a-vis the rest of the business, the CIO is faced with having to gain the attention and

respect of managers at all levels across the organization and build the support and

cooperation needed to effectively execute the information management leadership role.

The following is a discussion of the strategies that CIOs in leading organizations use to

legitimize their roles and successfully collaborate with their business counterparts to guide

IT solutions to meet mission needs.

Key Characteristics

CIOs in leading organizations recognize that providing effective information management

leadership and vision is a principal means of building credibility for their CIO positions.

CIOs do this in a number of ways. Foremost, they do not manage IT in a vacuum, but

rather make sure that the information management program is well integrated with what

senior executives want to accomplish. CIOs work with their executive peers to jointly

produce a vision educating senior managers on the strategic value of IT, providing advice

and direction, and setting expectations of what can be achieved. CIOs express this vision

in business rather than technical terms, and in such a manner as to generate enthusiasm,

buy-in, and motivation for managers to strive together toward the achievement of common

goals. Further, CIOs participate on executive committees and boards that provide forums

for promoting and building consensus for IT strategies and solutions. We found this to be

true for each of the case study organizations that we visited. Having achieved senior

management interest and backing, CIOs can leverage this support as needed to help ensure

cooperation for carrying out information technology and management and business

change initiatives across the enterprise.

Key Characteristics

• The CIO has a legitimate and influential role in leading

top managers to apply information technology and

management to meet business objectives

• The CIO has the commitment of line management and

its cooperation and trust in carrying out projects and

initiatives

• The CIO accomplishes quick, high-impact, and visible

successes in balance with longer term strategies

• The CIO learns from and partners with successful

leaders in the external information technology and

management community
GAO-01-376G CIO Executive Guide Page 31

Effective CIOs, and their supporting organizations, do not set out to force their ideas and

solutions on their business counterparts. Instead, they seek to bridge the gap between

technology and the business by networking informally, forming alliances, and building

friendships that help ensure support for information technology and management. CIO

organizations then work with rather than for the businesses, getting them involved in

projects and driving ownership and accountability to line management, rather than to the

IT shop. For example, in one case study, the state legislature placed the CIO organization

in charge of managing the planning, funding, and implementation of a project to develop a

single telecommunications network to serve the stateís entire education community.

Rather than a technical challenge, the project has been a huge coordination effort,

requiring that the CIO organization overcome rivalries and achieve the commitment and

cooperation of traditionally autonomous education sectors.

CIOs retain the support of their business colleagues by following through on

commitments to effectively lead business transformation projects, provide needed IT

products and services, and train and educate the user community. Through it all, CIOs

strive to maintain open communications and build trust. They do so by being accessible

to the businesses, listening to user feedback, and focusing on user needs.

CIOs recognize that balancing short-term successes with longer-term business change

initiatives is key to keeping their business customers satisfied. In the initial months of

tenure, CIOs set out to understand their enterprisesí needs and tackle tough issues (i.e.,

runaway projects and crisis situations such as year 2000 management) that demand

immediate attention or could pose immediate obstacles to success. In the short term, they

also focus on building relationships, addressing business imperatives (i.e., process

streamlining and consolidation), and demonstrating success by promptly providing highimpact products and services (i.e., commercial off-the-shelf software and desktop

equipment) that allow them to achieve positive and visible accomplishments fairly

quickly. CIOs recognize that showing interim results concurrent with more protracted

efforts such as multiyear systems developments, ìbig-ticketî infrastructure projects, or

business process reengineering can have significant positive impact on CIO credibility.

Often, CIOs outline plans of attack or roadmaps to help guide them in effectively

implementing their short- and long-term strategies. Documenting their courses of action

helps them manage schedules and expectations and provides baselines against which to

assess progress and performance. These CIOs are careful not to get caught in the cycle of

continual planning, but take steps to ensure effective progression from planning to

implementation. They return to their plans iteratively, updating them as progress is made

and business needs evolve.

Finally, CIOs in leading organizations recognize that there is too much going on in the

area of information technology and management for them to absorb all of the issues alone.

Rather than allowing their technology ideas and programs to stagnate, they keep abreast of

changes in the fast-paced environment that might be applied to enhance capability and

improve mission performance in their own organizations. They do so through avid

reading, working with vendors, and following market directions. CIOs also benchmark,

partner with, or seek advice from successful peers and competitors on initiatives that

provide opportunities for exchanging ideas, sharing capability and expertise, and

achieving mutual benefits in the larger information technology and management

community. For example, one state CIO with whom we met said that he values the
Page 32 GAO-01-376G CIO Executive Guide

guidance received from a CIO advisory board of private industry representatives,

convened by the governor to facilitate learning from business organizations. This CIO

also partners with a major IT corporation on a project to acquire standard desktop

equipment for all agencies under the governorís purview. Participation in key councils,

advisory groups, and government, trade, and professional associations such as the Industry

Advisory Council and the National Association of State Information Resource Executives

is also useful for exchanging ideas, sharing information, and identifying new ways to meet

common challenges.
GAO-01-376G CIO Executive Guide Page 33

Case Study: Ensuring the Credibility of the CIO Organization

This stateís Justice Network (JNET) illustrates how implementation of many of the practices

discussed in this section has enhanced the credibility of the CIO and his supporting organization.

JNET is a highly successful project started by the CIO organization enabling agencies to jointly

develop a single, secure, web-based system to support administration of criminal justice across the

state. The project responds to the governorís priority for consolidated agency projects, thereby

ensuring high-level support for CIO efforts. The CIO organization conceived the idea for JNET

after receiving multiple requests from criminal justice agencies for funding to develop redundant

systems. The organization identified the joint project as a good opportunity to save on costs, share

information, and reduce redundancy and errors by making it possible to enter new offender

information only once as subjects proceed through the criminal justice process. Historically, the

stateís justice agencies have been highly autonomous and distrustful of outsiders. Prior attempts

to get the agencies to work together failed. IT managers recognize that success with the current

initiative goes a long way in increasing CIO credibility with the state agencies.

The CIO organization launched JNET by bringing together stakeholders from across the state in a

series of meetings over the course of 2 months to establish a vision for a shared system that would

also meet individual justice agency information needs. Under executive order, a senior-level

leadership committee, including the CIO, is responsible for establishing JNET policy, direction,

and standards and for authorizing the release of JNET funds. A steering committee consisting of

justice agency representatives works with information management professionals and consultants

to refine project details. Its biweekly meetings provide a good opportunity for the CIO

organization to build relationships with the state agencies and for agency representatives to get

acquainted and learn about one anotherís operations and data resources. With central

responsibility for controlling contracts and funding drawn from the agenciesí budgets, the CIO

organization is credited with being the ìglueî that holds JNET together. A JNET office,

established to administer the project on a day-to-day basis, also reports directly to the CIO.

Under CIO guidance, JNET has been planned as a multiphase, multiyear development effort with

interim products and results. The CIO organization has helped agencies successfully complete a

pilot phase to prototype initial JNET content and applications, also demonstrating the CIO

organizationís ability to help deliver on commitments. Three additional phases involve testing the

systemís basic data-sharing function and adding new capabilities such as data importing, on-line

processing, and document management. Initially, the justice agencies thought JNET was a bad

idea; agency representatives were pessimistic and merely went through the motions of working

together. They posed such resistance that at one point, the CIO had the lieutenant governor make

a surprise visit to a steering committee meeting to oversee project progress, demonstrate senior

management support, and ensure agency cooperation toward meeting common objectives. Once

the agencies saw the operational prototype and the projectís potential, they realized that their

individual sacrifices had paid off.

Today, JNET continues to grow in scope and popularity. Along with it, CIO credibility has

increased. The CIO organization is currently working with several counties to help link them with

JNET. Next steps include instituting JNET at the local level and ultimately partnering with other

states to construct a nationwide justice network. JNETís success has served to legitimize and

increase the value of the CIO function to its business counterparts. Now, other agencies, including

the departments of Health and Public Welfare, also want to work with the CIO organization on

similar cross-functional information management initiatives.
Page 34 GAO-01-376G CIO Executive Guide

Strategies to Consider

While senior executives are responsible for creating the environments and positions likely

to ensure CIO success, it is the responsibility of the CIOs themselves to make that success

a reality. Regardless of all the promising skills, strategies, and technologies they may

bring to bear, no CIO can be effective without first building credibility with business

executives, IT professionals, and user communities alike to ensure commitment and

support for their information management leadership and initiatives. The following

practices, commonly used by CIOs in leading organizations to build credibility, can also

be considered and applied by CIOs in federal departments and agencies to better

legitimize their positions and help ensure success in their individual business/cultural

environments.

Provide information management leadership and vision by

• ensuring that the vision encompasses senior management priorities,

• educating top managers on the value of information technology and management in

helping to accomplish mission objectives,

• articulating the vision in business terms to facilitate line management understanding

and achievement of buy-in, and

• using senior management discussion and decision-making forums as opportunities to

build consensus for IT programs and initiatives.

Establish effective working relationships by

• networking informally and forming alliances with other senior managers to help

defuse potential opposition and build commitment to new technology directions;

• getting managers from the business side of the enterprise involved and accountable for

information management projects;

• fulfilling commitments to provide effective IT goods and services; and

• establishing open communications and feedback mechanisms, such as surveys and

questionnaires, as a way to build trust.

Balance quick successes with long term impact by

• setting priorities and distinguishing between short term, high-impact initiatives and

longer term objectives that require more vested interest; and

• outlining a plan or strategy for accomplishing these priorities in an efficient and

effective manner.

Leverage external information technology and management expertise by

• keeping abreast of technological change and incorporating new products and strategies

in the enterpriseís IT program as appropriate,

• forming partnerships and building off of the success and expertise of external CIO

peers, and

• networking and participating in forums in the larger community to debate and identify

ways to address common information technology and management issues and

concerns.
GAO-01-376G CIO Executive Guide Page 35

Principle IV:

Measure Success and Demonstrate Results

ìMeasurement determines what one

pays attention to. The things that are

measured become relevant; the things

that are omitted are out of sight and

mind.î

In many organizations the value of information technology and management is considered

intangibleñdifficult to measure and mired in terms of ìsoft dollarsî or ìstrategic assets.î

For this reason, in the past, few organizations embarked on programs to measure the

effectiveness of IT systems. However, it has become increasingly evident that without a

measurement process where results can be demonstrated, not only is information

management at a disadvantage when competing for scarce resources, but also when

making its case in support of efficiency and effectiveness initiatives. For the CIO

organization to be viewed as part of the business, a structured process needs to be in place

to measure success and demonstrate results to the organization. This section discusses the

approaches that leading organizations use to measure performance and results.

Key Characteristics

While there is no standardized approach to performance measurement, leading

organizations strive to understand and measure what drives and affects their businesses

and how to best evaluate results. These organizations have generally struggled with

identifying and adopting measures to assess the value of IT, but have been able to put

some measures in place to help demonstrate performance. They use measures for a

variety of purposes. The measures are a vehicle for communicating with senior

management and stakeholders in the areas the organization deems important. Measures

also serve as vital management and decision-making tools, providing information that can

be used to make improvements in business outcomes and service delivery.

Many managers told us that the measures that capture the most attention from senior

management are simple onesñor at least simple in terms of how they are expressed. In a

number of instances, the organizations we visited used uncomplicated terms to

communicate measures, but the underlying concepts were quite involved and required a

good understanding of IT and business fundamentals. These organizations collapsed a lot

of information into a form that effectively communicated the success or failure of

information technology and management activities and, in the case of the latter, expanded

on the issues and supplied additional information. For example, one international

organization, involved in several product lines, measures its performance in line with the

following organizational business priorities:

Key Characteristics

• Managers engage both their internal and external

partners and customers when defining measures

• Managers at all levels ensure that technical measures

are balanced with business measures

• Managers continually work at establishing active

feedback between performance measurement and

business processes
Page 36 GAO-01-376G CIO Executive Guide

• Maximize performance (i.e., improve service and reduce IT and management costs)

• Improve business processes (i.e., IT projects and E-commerce)

• Increase team contributions

• Create a leading-edge electronic communications process

Even though these measures seem simple, a considerable amount of time, effort, and data

are involved in amassing and assessing the results tied to these business priorities.

To establish joint ownership for performance management, organizations strive to

construct measures jointly with their stakeholders, customers, managers, and CIO staff.

They work together to achieve a common understanding of goals, metrics, and anticipated

outcomes that are easy to understand but are aimed at adding value. Managers told us that

performance measurement systems work best when combined with established measures

that reflect customer/stakeholder needs and the activities of employees that are directly

involved in information management. The CIO organizationís responsibility does not end

with the establishment of measures, nor does the CIO organization have sole

responsibility for technological success. As a practical matter, those responsible for

judging the success of programs and their supporting functions should agree on the

measures used and become involved in monitoring the outcomes.

Although approaches vary, leading organizations develop measures with a focus toward

improving not only internal IT performance but also external relationships with

technology users and the overall business. Organizations balance various technical

measures to ensure that IT products and services are deployed in the most effective and

efficient ways and lead to desired business results. They focus on monitoring short- and

long-term IT measures that directly affect business activities and produce real business

value. This means that IT activities must be directly related to company relationships with

customers, clients, and suppliers, and also affect business results, such as direct costs or

market share.

Leading organizations use performance measures that focus on business outcomes such as

customer satisfaction levels, service levels, and in some instances total requests satisfied.

For example, one state agency commissioner requires that his departments develop

tactical plans for all areas, not just IT. All executives participate in the planning process.

The performance measures are broken down to meaningful levels as a way of holding the

ìIT shopî and other departments accountable for the services they provide. IT goals and

objectives are incorporated into the plans and IT performance outcomes are provided to

the commissioner and his executive staff on a quarterly basis. This exercise has served to

build credibility and help demonstrate the value that IT adds to the organization. The

existence of performance measures has also made a difference in how agencies behave

because the documentation they provide serves to make them accountable.

To properly collect and analyze information, leading organizations develop measurement

systems that provide insight into their IT service delivery and business processes. The

establishment of an information feedback system allows organizations to link activities

and functions to business initiatives and management goals. This feedback, in turn, leads

to increased IT productivity and organizational effectiveness. One state we visited

established an information services board to develop statewide policy standards and to

monitor projects as part of its portfolio management process. The board, however, has
GAO-01-376G CIO Executive Guide Page 37

increasingly become more involved in monitoring and making recommendations on

troubled IT projects. Some of the lessons learned from the boardís project reviews are

that:

• the board needs to get involved early in monitoring and overseeing projects before

considerable funds are spent on the projects;

• long-term, high-cost projects are no longer sustainable because sponsors tend to be

unable to sustain long-term support;

• projects are best managed in a limited-commitment, phased approach; and

• projects should quickly demonstrate results.

Once planning and decision-making structures are in place and performance results can be

used as part of the decision-making process, organizations are in a better position to

ensure that goals and objectives clearly link and align with IT performance measures.

Leading organizations also assess the readiness of their organizations to use IT measures

and their receptiveness to data collection, measurement, and analysis. Further, they

nurture a philosophy that is positive toward performance management and measurement,

and they view measures as a way to focus on business value and customer satisfaction.

In summary, managers at the organizations we studied cautioned that IT performance

measurement is in its infancy and measurement techniques are still evolving, partly due to

changes in technology. Most of the organizations are continually looking for ways to

improve their IT measurement systems as a means of supporting achievement of

organizational goals.
Page 38 GAO-01-376G CIO Executive Guide

Case Study: Measuring Success and Demonstrating Results

To measure its information technology (IT) and management initiatives, one state instituted a

performance measurement process (illustrated in figure 5) that is driven by an IT strategic plan.

The plan sets forth the goals and strategies needed to support the stateís entities in developing IT

plans, in using information resources, and in defining IT performance measures. The IT strategic

plan also aligns very closely with the stateís strategic plan, that sets forth four broad goals for the

use of IT within the state: (1) improve service delivery; (2) make information more accessible; (3)

use IT to improve productivity; and (4) invest in people, tools, and methods. The IT strategic plan

also incorporates stakeholder involvement by including perspectives by state agency executives,

legislators, educators, and other stakeholders on the use of the stateís IT resources. Also included

in the plan is information from the stateís biennial IT performance report. This report evaluates

the stateís progress toward meeting the last bienniumís IT Strategic Plan goals and includes a

summary of strategic and operational performance measures. These measures, in part, are the

result of the stateís previous IT strategic plan and are meant to measure how well IT resources are

being used to achieve the stateís overall strategic goals and operational (technical) objectives.

These results are published in the Stateís Biennial IT Performance Report and are used to

benchmark the stateís information management services. The state legislature also uses this

information to allocate future funding.

Figure 5: Performance Measurement Framework

Strategic Performance Measures Operational Performance Measures

• Progress made in deploying the stateí s Educational

Telecommunications network

• Increase in stateís use of Internet resources

• Increase in the number of courts having access to

stateís Justice Information Network.

• Number of workload transactions completed and

telephone lines installed

• Number of driverís licenses issued for specific

periods

The IT Strategic Plan helps identify what needs to be

measured and monitored

Stakeholder Involvement

State IT Strategic

Plan

Information from the Biennial IT Performance Report

is used to develop the IT Strategic Plan

State Strategic Plan

Biennial IT Performance

Report
GAO-01-376G CIO Executive Guide Page 39

Strategies to Consider

Performance measurement is a critical step in ensuring results and success from any

project, but especially from information technology and management initiatives whose

value is often difficult to capture. While performance measurement is still evolving in

principle and in practice, leading organizations have pinpointed a number of strategies that

have proven useful in gauging the impact and benefits of their IT investments. These

strategies are discussed below.

Engage internal and external stakeholders in defining and managing IT performance by

• ensuring that mission delivery and IT performance measures are integral to strategic

management and decision-making processes; and

• establishing internal and external customer groups to periodically review, validate, and

accept IT performance measures.

Ensure that processes are in place to balance business and technical measures by

• developing specific technical performance measures for IT products and services and

balancing them with business-driven measures, and

• demonstrating that the performance measurement data generated are reliable and

useful.

Establish an effective data collection and performance feedback process by

• developing well-designed performance data collection methods;

• establishing a limited set of outcome-based performance measures that link to mission

outputs and outcomes; and

• utilizing concise, understandable performance reporting tools and techniques and

conducting performance measurement reviews, as needed.
Page 40 GAO-01-376G CIO Executive Guide

Align Information

Management

Leadership for

Value Creation

Promote

Organizational

Credibility

Execute CIO

Responsibilities

Critical Success

Factors

I. Recognize the

 Role of Information

 Management in

 Creating Value

III. Ensure the

 Credibility of the

 CIO Organization

V. Organize Information

 Resources to Meet

 Business Needs

Principles

II. Position the CIO

 for Success

IV. Measure Success

 and Demonstrate

 Results

VI. Develop Information

 Management

 Human Capital

Senior executive

management,

especially the CEO

CIO peers and

senior management

Organizational

Foci

CEO, CFO, COO Senior executives

and division heads

Collaborators

Client and CIO

organizations

Participants

CIO organization
GAO-01-376G CIO Executive Guide Page 41

Critical Success Factor 3:

Execute CIO Responsibilities

The CIO and supporting organization are ultimately responsible for successfully executing

their role in the enterpriseís mission. How central this role is to the strategic plans of the

enterprise will depend on each of the first two critical success factors, but support from

the top and all efforts to build credibility will be futile unless the CIO organization is run

effectively. If the CIO organization is not able to execute its responsibilities, and if it is

not able to play the critical role for which it has been developed, the corporation will learn

to work around it, or it will be replaced.

There are many aspects to successfully organizing and running a CIO organization.

However, this critical success factor, as well as the underlying principles, focuses on the

elements that leading organizations believe are most central to the CIOís responsibility.

Determination of the CIO organization structure must fall to the CIO, as he or she is the

senior executive of that unit. Aligning the CIO organization with the needs of the

enterprise is critical to the satisfaction of those needs. Communicating enterprise

requirements to staff and making appropriate decisions to meet the needs of the enterprise

are the responsibility of the CIO. As the CIO organizationís representative in strategic

decision-making forums, the CIO must be the translator of those strategies into CIO

organization initiatives.

Along with technology, human capital is the central resource the CIO has to execute his or

her responsibilities. While the CIO is accountable for and reviews technology decisions,

staff from business areas may develop most of the investment proposals. Human capital

plans for the information management and technology area are seen as the particular

responsibility of the CIO. In the current IT environment, technology has become a

commodity. The human capital involved in applying that technology to achieve the

mission of the enterprise is a resource that requires the CIOís attention. The hiring,

retention, and training of information management and technology personnel is seen by

leading organizations as a fundamental principle of good CIO practice.
Page 42 GAO-01-376G CIO Executive Guide

Principle V:

Organize Information Resources to Meet Business Needs

ìWhile the CIO is important, it is the

operating environment for the entire

organization that will make it successful.î

Developing a CIO organization is an ongoing process that demands a clear understanding

of the organizationís responsibility for helping meet business needs. This responsibility,

along with parent business processes, market trends, internal legacy structures, and

available IT skills, drives decisions as to the structure of the CIO organization and how

the organization is aligned with the rest of the enterprise. Ultimately, the CEO controls

the assignment of information technology and management functions to the CIO, the CIO

organization, and other organizational units. Once these decisions are made, the CIO

organization must provide effective, responsive support through efficient allocation of

resources and the day-to-day execution of its responsibilities. This principle examines the

practices that leading organizations commonly use in establishing CIO organizations to

effectively meet their mission needs.

Key Characteristics

It is the duty of a CIO to manage expectations and help ensure that all members of a CIO

organization have a clear understanding of their responsibilities. In leading organizations,

evolving business processes play a key role in determining how these information

management responsibilities are structured and adapted to meet changing needs. We

found that leading organizations quickly reallocate and make information resources

available on a routine, sometimes daily or hourly basis to address changes in business

processes. External factors, such as market trends, changing technology, and available

skills as well as internal legacy structures and corporate ventures, also influence how a

CIO organization is formed, aligned, and adjusted to help support the rest of an enterprise.

For example, one organization that we studied had experienced two mergers that required

the company to quickly integrate the new businesses and restructure to meet growing

business needs. Human resources systems were consolidated and new corporate

structures were quickly defined to ensure continued support to the enlarged customer base.

The company remains prepared to restructure to meet ever-changing business

requirements.

Key Characteristics

• The CIO organization has a clear understanding of

its responsibilities in meeting business needs

• The extent of decentralization of information

resources and decision-making is driven by

business needs

• The structure of the CIO organization is flexible

enough to adapt to changing business needs

• Outsourcing decisions are made based on business

requirements and the CIO organizationís human

capital strategy

• The CIO organization executes its responsibilities

reliably and efficiently
GAO-01-376G CIO Executive Guide Page 43

In lieu of establishing either completely centralized or decentralized CIO organizations,

leading organizations manage their information resources through a combination of such

structures. In this hybrid, the CEO assigns central control to a corporate CIO and

supporting CIO organization, while delegating specific authority to each business unit for

managing its own unique information management requirements. The corporate CIO and

supporting CIO organization centrally formulate policies and standards for all IT-related

activities. They also centrally manage architectures and a core set of infrastructure

components to provide common IT services to the entire corporation. The corporate CIO

works with CIOs or other information managers in each of the business units to ensure

efficient, reliable, and interoperable technology for the entire corporation. The following

figure illustrates traditional centralized and decentralized organizational structures, in

comparison with the hybrid combination used by leading organizations today.

Figure 6: Comparison of Decentralized, Centralized, and Hybrid Structures

Leading organizations decide, as part of a sourcing strategy, whether to provide specific

information technology and management services with in-house staff or external

providers. An organizationís sourcing strategy is part of a larger human capital

development strategy, which is discussed in principle VI. The shortage of skilled IT

workers in the current market environment is often a major reason for leading

organizations to outsource. The CIO and decision-making authorities decide what type of

work is appropriate to outsource and what type of work is best performed internally.

Typically, leading organizations cultivate long-term skills such as contract management,

project management, and security management, while outsourcing short-term skills such

as application development. For example, one state capital that we visited is home to over

600 software companies. IT skills are in great demand which made hiring by the state

difficult, so this CIO looked for alternatives to in-house software development and

management. It made sense for the state to outsource tactical functions such as help desks

and mainframe management.

 (IT integrated with business)

Business

Unit

Info Mgmt

Subunit

c. Combination of centralized and decentralized structure

(IT and business units are partners)

b. Centralized structure

(customer-supplier relationship)

CIO

Organization

Info Mgmt

Subunit

Business

Unit

Business

Unit

Business

Unit

Business

Unit

Business

Unit

CIO

Organization

Business

Unit Business

Unit

Info Mgmt

Subunit

Business

Unit

Info Mgmt

Subunit

Info Mgmt

Subunit

Info Mgmt

Subunit

a. Decentralized structure
Page 44 GAO-01-376G CIO Executive Guide

On the other hand, there are responsibilities such as IT planning and oversight that must

remain in-house. As the state contracts out more of its information technology and

management functions, it is also essential that it have good contract management

expertise.

Along with effective allocation of available resources, leading organizations execute their

information management responsibilities reliably and efficiently. Technology is highly

integrated with the business processes in these organizations because technology is

viewed as an enabler for the business, not just a tool. The organizations make IT

investment decisions based on business case analyses and return-on-investment

projections. Consistent with a fundamental strategic information management approach,

the organizations also focus on continuous process improvement. The organizations

provide reliable information management capabilities on a daily basis, but also look to the

future by pursuing new initiatives that show how technology can improve the business of

tomorrow. For example, one state CIO that we interviewed said that his role was to

identify enterprisewide and strategic initiatives to improve state information management.

One initiative involved establishing strategic direction, guidelines, and standards for

instituting electronic commerce in the state government. Electronic commerce was to be

used for such activities as renewing licenses and paying taxes.

Leading organizations simplify projects by producing incremental deliverables that

quickly show success and demonstrate the impact of effective CIO management while still

focusing on long-term objectives. As discussed in principle III, carrying out successful

projects is expected in leading organizations, and adds to the credibility of the CIO and

the CIO organization.
GAO-01-376G CIO Executive Guide Page 45

Case Study: Organizing Information Resources to Meet Business Needs

Implementing a combination of centralized and decentralized information management enables

leading organizations to effectively support their business operations. One leading organization

implements a combination of centralized and decentralized IT and structures to best meet the

needs of its three diverse lines of businessóan international services division, an international

industry division, and a retail division. The organization uses a centralized IT infrastructure with

decentralized development efforts to provide efficiency and security for its corporate customers.

Efficiency is the number one priority of the organization in terms of dollars spent as well as

technology performance.

The organization has CIOs in each of its three business units. Each business unit makes IT

investment decisions based on business requirements and the technology available to support

those requirements. For example, desktop platforms and software vary among business units

depending on the unique needs of each business area. The work in the business units is all

performed in-house and is not outsourced, as business expertise is considered a core competency.

The business CIOs work together to determine how IT can be used to reach customers across

business lines. The international services and international industry divisions have some common

requirements based on the international nature of the two divisions. The international industry

division and the retail division have common requirements based on the specific industry. The

CIOs of these divisions work together, leveraging opportunities for shared IT products and

services so that each unit can invest fewer dollars to accommodate common needs.

The corporate IT organizationís role is to aggregate needs across business units and provide

solutions that can be integrated to serve the entire corporation. Common components of each

business area include data centers, human resources, payroll, a financial architecture, and a

common desktop environment. Standard processes and tools, such as contingency planning,

interdependency identification, protocols, and risk management, are used to coordinate multiple

business areas. These standard utilities evolved through two corporate mergers and are now

institutionalized across the corporation. The mergers required that the organization quickly adopt

new organizational structures and address new business requirements. The standard processes and

policies developed, applied, and improved as a result of the mergers provide this organization with

the flexibility it needs to adapt to future changes in responsibility.

This organization is constantly looking to improve its IT investment processes. All technology

investments are justified using business case analyses. The decision-making process for

establishing business cases recently evolved to include competitive needs. Competitive needs

were not considered when this organization initially postponed electronic commerce initiatives

due to low return-on-investment projections. The organization fell behind the competition in

providing this service and the delay may have cost it customers. As a result, competitive needs are

now considered part of the decision-making process.
Page 46 GAO-01-376G CIO Executive Guide

Strategies to Consider

An effective CIO organization is a dynamic structure, responding not only to business,

mission, and cultural requirements, but also to rapidly changing technologies, elusive

skills, and competing resources in the external market environment. Leading

organizations recognize the myriad forces driving their IT capabilities. The following is

an outline of the strategies that these organizations consider in deciding how to effectively

structure, source, and execute their technology management operations.

Create a clear understanding of responsibilities within the organization by

• articulating a common description of responsibilities to all levels of the CIO

organization, and

• assigning responsibilities to parts of the organization based on skills and

organizational structure.

Use a combination of centralized and decentralized organizational structures by

• centrally formulating policy and standards for all IT-related activities, and providing

common IT services through a centrally managed infrastructure; and

• delegating authority to the business units to manage individual information

management requirements.

Create an adaptable organizational structure by

• redeploying internal resources to quickly address changing business and customer

requirements.

Select appropriate sourcing strategies by

• considering outsourcing noncore responsibilities to address the shortage of skilled IT

workers in the current market environment, and

• keeping core competencies in-house.

Execute CIO responsibilities efficiently by

• providing reliable and efficient IT services and products,

• making IT investment decisions based on business case analyses and return-oninvestment, projections, and

• producing incremental deliverables to demonstrate results while still focusing on longterm objectives.
GAO-01-376G CIO Executive Guide Page 47

Principle VI:

Develop Information Management Human Capital

ìProviding good benefits packages and

building core competencies are other

ways of attracting, stimulating, and

retaining IT workersñ especially among

today's ëself-preservation-minded

generation-Xers.íî

As is true with the other principles, the business requirements of an enterprise drive

decisions related to the specific types of resources needed to implement technology

successfully. External market forces and internal legacies influence the types of skills

available to a CIO organization. Given these realities, the CIO organization must provide

an effective, responsive IT workforce to help accomplish missions and goals. This

principle discusses the strategies that leading organizations use to assess their skill bases

and attract, recruit, and retain IT professionals.

Key Characteristics

Leading organizations develop human capital strategies to assess their skill bases and

recruit and retain staff who can effectively implement technology to meet business needs.

Figure 7 provides an overview of the strategy that leading organizations use to secure

information management human capital.

Figure 7: Strategy for Securing Human Capital in Leading Organizations

Leading organizations assess their IT skills on an ongoing basis to determine what

expertise is needed to meet current responsibilities and support future initiatives. They

can evaluate the skills of their employees using methods provided by entities such as

Carnegie Mellon Universityís Software Engineering Institute6

 and the Information

 

6

 Curtis B. Hefley, W.E. & Miller, S. (1995). People Capability Maturity Model. [Technical Report

CMU/SEI-95-MM-02]. Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University.

Key Characteristics

• The CIO organization identifies the skills necessary

to effectively implement IT in line with business

needs

• The CIO organization develops innovative ways to

attract and retain talent

• The CIO organization provides training, tools, and

methods for skilled IT professionals to use in

performing their duties

Recruit

Retain

Training

Outsource

Tools & 

Technology Recognition

Assess

Skill

Base
Page 48 GAO-01-376G CIO Executive Guide

Technology Association of America. Needed skills are compared with existing

capabilities in the organization to determine gaps in the IT skills base. For example, the

state university at one of our case study locations had conducted a study revealing

continuing gaps in the stateís ability to recruit and retain IT workers vis-‡-vis industry. In

response to the governorís initiative to expand the stateís IT workforce, proposals were

made for a program to recruit and fund college and university students willing to study

technology management as a prelude to becoming part of the state governmentís labor

force. Strengthening the skills and capabilities of IT professionals through training and

innovative hiring practices is part of a formula for building information technology and

management capabilities.

Leading organizations sometimes use surveys that compare missing capabilities with

market availability to determine what skills to acquire through hired professionals. When

professionals with the necessary skills cannot be hired, these organizations supplement the

existing workforce with external information resources. More specifically, they cultivate

expertise in their internal workforces, while outsourcing skills that are available from

multiple sources at lower cost. Leading organizations may even choose to replace labor

with technology when they cannot hire the skilled professionals they need. Core

information management functions include project management, security management,

and contract management practices that can apply to a variety of projects. The various

staffing and sourcing strategies provide leading organizations with dynamic workforces

that can quickly carry out these functions to meet changing business needs.

Studies forecast an ever-increasing shortage of IT professionals, presenting a great

challenge for both industry and the federal government. Organizations are finding it

difficult to retain staff when their competitors can always offer higher salaries. For

example, one state government CIO organization that we studied experienced a 22 percent

turnover in IT professionals. Despite having higher technology wages than any other state

in the country, the state remains at a disadvantage in competing with industry and must

rely on alternative strategies and incentives to attract and retain skilled workers.

While benefits, recognition, and challenging responsibilities are also useful in securing

staff, leading organizations identify training as a major nonsalary incentive for attracting

and retaining skilled IT professionals. Leading organizations dedicate an increasing

percentage of their IT budgets to training. Sometimes such funds are devoted to retraining

existing nontechnical personnel to supply them with IT expertise. For example, one

industry case study organization sponsors a 3-month course to retrain about 2,000 legacy

employees in project management skills. The company also offers a range of formal

classroom training, less formal workshops, and informal mentoring programs. Given the

change management environment for IT in this company, staff always wants and needs to

be in a learning mode. Similarly, another industry CIO told us that he provides IT training

through a program that pays new employees 50 percent of their salaries while they attend

school. Upon completion of training, the employees each earn 75 percent of their salary

during an initial performance evaluation period, and full salary at the end of that period.
GAO-01-376G CIO Executive Guide Page 49

While managers in leading organizations are accountable for creating opportunities for

their employeesí training, individual staff are responsible for taking advantage of those

opportunities. In general, leading organizations provide training as part of a changing

high-tech work environment that includes state-of-the-art tools and methods allowing

skilled IT workers to perform their jobs to the best of their ability.

We identified additional strategies that leading organizations use to enhance their

information management workforces. Specifically, these organizations bring in

employees with desirable skills from across the enterprise to work in conjunction with IT

professionals, thereby maximizing the capability of their technical resources. These

employees make up cross-functional teams that provide an appropriate mix of business

expertise and IT skills to accomplish the various tasks of a project. Working together, the

members reflect the interests of not just information technology and management, but the

user community and the projectís stakeholders, and provide a holistic blend of technical,

project management, value management, budget, finance, and procurement skills and

capabilities to meet mission needs.
Page 50 GAO-01-376G CIO Executive Guide

Case Study: Developing Information Management Human Capital

Using a variety of staffing and sourcing strategies provides leading organizations with dynamic

workforces that can quickly meet changing business needs. One leading companyís CIO said that

recruiting information management workers with special skills in areas such as data networks and

systems administration is extremely competitive. To be successful in recruiting, his organization

has devised different offer packages to attract employees. A package might include accelerated

salary schedules or stock options. Once hired, the company sends these employees back to college

for IT training and invests in them. This CIO acknowledges, however, that his company does not

spend enough on training. Currently, approximately 1 percent of the IT operating budget is

devoted to training.

This organization also provides training to new employees through a program that pays 50 percent

of the employeeís salary while he or she attends school. Upon completion of training, the

employee enters a performance evaluation period during which the employee earns 75 percent of

his or her salary. After successfully completing the performance evaluation period, the employee

then begins earning a full salary.

The organization increased its salary base to compete with other companies in retaining and

attracting talented information management workers. Besides salaries, company managers view a

good working environment and awards and recognition as essential for retaining employees.

Recently, the CIO took over 400 employees and guests to a five-star hotel for an evening out to

celebrate the groupís accomplishments. When senior managers appreciate business

accomplishments, they are willing to spend funds for staff recognition. This CIO admits that his

IT workers are constantly asked to work long hours and undergo a lot of stress though they get

little in return for the amount of work they do.

This CIO believes that money is not the only motivator for IT staff. He feels that an important

element to managing staff is finding ways to recognize individuals and say ìthank you.î When

the thank you comes from inside the organization, it goes a long way. The CIO uses different

means to show his appreciation. For instance, his staff publishes a monthly appreciation

newsletter through the Intranet. The CIO believes there is big payoff in these types of activities

and the costs are minimal, if any. The CIO also views time off as a good incentive bonus because

it does not cost the company very much. Other incentives his group has undertaken include taking

staff out for lunch or handing out $100 American Express checks. In todayís environment,

organizations have to be creative. One of the managers created a thank you toolkit to show her

appreciation to her staff. The CIO states, ìIf you donít have a lot of money to spend, you have to

ask yourself, what are the little things you can do to show your appreciation.î
GAO-01-376G CIO Executive Guide Page 51

Strategies to Consider

Given the increasing shortage of IT professionals in the current market environment,

securing an effective, responsive technology management workforce is a challenging task

for both business and government organizations alike. Leading organizations have

identified the following strategies that help in assessing their IT skills and recruiting,

retaining, and utilizing talent to meet their business needs. These organizations consider

and apply the various strategies as appropriate within the organizational, financial, and

cultural parameters of their individual business and government enterprises.

Assess the skill base by

• determining expertise needed to perform information management responsibilities, and

• identifying gaps between skills available and skills needed.

Identify innovative ways to attract talent by

• providing good benefits packages, and

• building core competencies.

Provide training, tools, and methods to help retain expertise, including

• directing an increasing percentage of the budget to fund training,

• evaluating staff to make sure they are achieving the desired technical skills,

• holding managers accountable for providing training opportunities for their staffs, and

• providing a high-tech environment of tools and methodologies for skilled IT

professionals.

Employ alternative methods and sources for supplying talent, including

• outsourcing and supplementing the existing workforce with external expertise,

• bringing in employees with desirable skills from across the enterprise to work with

and help maximize the capability of information technology and management

professionals, and

• replacing labor with technology.
Page 52 GAO-01-376G CIO Executive Guide

Using This Guide

The principles and practices we developed based on our interviews with leading

organizations in the private sector and state government have enabled us to construct a

framework to guide federal CIO organizations. In our discussions with about half of the

CIOs of major federal departments and agencies and five CIOs of small federal agencies,

we found that they generally agree with the leading organizations on the fundamental

management principles for information management and technology. At the same time,

we found that the practices used by federal CIOs tend to differ from those used by leading

organizations. We did not study the reasons for these deviations specifically, although

some likely result from the context in which federal CIOs operate. Both operational and

structural aspects of the CIOís environment can vary significantly between the public

sector and the private sector.

Rather than dwell on differences, it is more useful to focus on the considerable common

ground between public and private CIO organizations to build efforts for improvement.

The specific key conditions and strategies described in this guide can be used as

suggestions for federal CIOs to apply or adapt to their environments, as appropriate.

More generally, the key conditions and strategies can be thought of as addressing specific

aspects of the six primary principles, which CIOs from all sectors agree are critical to the

successful execution of their responsibilities and realization of the potential benefits of

information technology investments. Taken as areas of focus, these aspects may be

evaluated by federal CIO organizations and tackled using techniques suited to their

situations. Recognition of the differences described above, as well as others, should

influence the application of advice provided in this guide. But the advice of CIOs of

leading organizations should remain relevant regardless of the specifics of the situation.

The ideas presented in this guide may also provide the foundation for further discussion

within the federal CIO community. Many federal CIOs, in the normal course of their own

efforts, have already begun working along the lines of the advice provided in this guide.

These CIOs have gained valuable insights into applying the practices of leading

organizations to the federal sector. The CIO Council, or other organizations of federal

CIOs, can create an opportunity for sharing these experiences, using the principles

described in this guide as an organizing framework. The challenge of understanding how

the federal context influences the effectiveness of the principle may be best met with

support from managers who work in the same context.

In addition, the specific key conditions and strategies described in this guide will provide

insight when considering areas of future study. For example, specific principles may be

investigated more deeply and strategies for implementing a principle, such as developing

information technology human capital, may be proposed in more detail. Or those aspects

of the federal CIO environment that constrain the federal CIO flexibility and hinder the

ability to perform effectively may be examined more closely, and specific strategies to

cope with those aspects may be proposed. Understanding how CIOs of leading

organizations approach their work, and acknowledging those aspects of the federal CIO

environment that limit the ability to implement similar strategies, may prompt

congressional and executive board discussions about the need for future legislation and

policy changes.
GAO-01-376G CIO Executive Guide Page 53

A few dimensions in which the federal and private sector can differ are described below.

These examples largely stem from the nature of the public sector in which federal CIOs

operate. Many of these examples were mentioned by federal CIOs interviewed for this

guide. However, the extent to which the differences create additional constraints on the

CIOs depends on how they and agency leaders respond to them.

• Senior executive management in the federal sector can differ significantly from the

private sector. The agency head is a political appointee who often is more focused on

policy issues than on internal management and operations. This can deny the CIO the

ìCEOî support that is so critical for the successful integration of information

technology into business or mission functions.

• The budget decision-making process used for information technology projects can

present particular challenges for the federal CIO not found in the private sector. For

example, legislative actions, such as tax law changes and Medicare payment process

changes, may require extensive system modifications, and the CIO does not have the

flexibility to decide whether or not to pursue them. This ties up resources that might

otherwise have been expended differently. In fact, mandated projects often must be

funded by money that had been planned for other projects. Long-term investment

strategies are difficult because agencies are asked to put together funding requests 18-

24 months in advance of funding availability. In addition, IT funds may be contained

within the appropriations for a specific program or an overall administrative budget,

making them less visible and, if part of discretionary spending, more subject to

volatile changes in the federal budget. As a result, the CIO may not have control or

direct oversight over much of the IT funding within the agency.

• Personnel decisions in the federal sector are often constrained due to work rules or

organizational factors. Current information management job descriptions do not

match the occupations recognized in the industry today. Training funds are often

limited due to larger budget considerations. Recently, the Office of Personnel

Management (OPM) found salaries in the federal government to be lower than in the

private sector. On November 3, 2000 OPM implemented a governmentwide policy

increasing salaries in several IT categories in an effort to make federal employment

more competitive. Because this policy was recently implemented, we cannot yet

assess the impact of these changes on federal employment practices.

• The federal CIO may direct an organizational structure in which duties that would

typically be a CIOís responsibility in the private sector are not under his or her

direction at all. For example, some federal CIOs are in charge of large policy and

oversight functions with little operational responsibility. While this may be an

appropriate model, it is critical that any model be matched with the overall needs of

the agency in mind.
Page 54 GAO-01-376G CIO Executive Guide

• The range of responsibilities, as defined by legislation, that accrue to the CIO are very

broad in the federal sector, including areas such as records management and Freedom

of Information Act requirements, for which there is little parallel in the private sector.

While federal CIOs often may not have operational authority for the full range of

responsibilities in the legislation, they and their agencies are still subject to oversight

by the Congress in many of these areas.

Though the environment faced by a CIO in the federal sector clearly differs from that of

CIOs in other contexts, the principles that form the basis for this guide remain relevant.

The underlying principles were observed consistently in our sample of leading

organizations, and were cited as being critical to the success of their CIOs. Federal CIOs

can learn from the successes of these leading organizations and can apply the principles as

appropriate in their own organizations. In addition, agency heads and other senior leaders

in the federal government can gain an understanding of their roles in executing the critical

success factors that must be addressed as CIOs work to meet the letter and intent of the

Clinger-Cohen Act and related legislation.
GAO-01-376G CIO Executive Guide Page 55

Appendix I

Federal Legislation Affecting Information Management

Federal Financial Management Improvement Act of 1996 (Public Law 104-208) ñ This

Act requires that agency financial management systems comply with federal

financial management system requirements, applicable federal accounting

standards, and the U.S. Government Standard General Ledger (SGL) in order to

provide uniform, reliable, and more useful financial information. The act requires

that auditors for each of the 24 departments and agencies named in the CFO Act

report, as part of their annual audits of the agenciesí financial statements, whether

the agenciesí financial management systems comply substantially with federal

financial management systems requirements, applicable federal accounting

standards, and SGL at the transaction level. The act also requires that GAO report

on its implementation annually.

Clinger-Cohen Act of 1996 (Public Law 104-106) ñ This law is intended to improve the

productivity, efficiency, and effectiveness of federal programs through the

improved acquisition, use, and disposal of IT resources. Among other provisions,

it (1) encourages federal agencies to evaluate and adopt best management and

acquisition practices used by both private and public sector organizations,

(2) requires agencies to base decisions about IT investments on quantitative and

qualitative factors associated with the costs, benefits, and risks of those

investments and to use performance data to demonstrate how well the IT

expenditures support improvements to agency programs, through measurements

such as reduced costs, improved employee productivity, and higher customer

satisfaction, and (3) requires executive agencies to appoint CIOs to carry out the

IT management provisions of the act and the broader information resources

management requirements of the Paperwork Reduction Act. The Clinger-Cohen

Act also streamlines the IT acquisition process by eliminating the General Services

Administrationís central acquisition authority, placing procurement responsibility

directly with federal agencies, and encouraging the adoption of smaller, modular

IT acquisition projects.

Paperwork Reduction Act (PRA) of 1995 (Public Law 104-13) ñ PRA applies life cycle

management principles to information management and focuses on reducing the

governmentís information-collection burden. To this end, PRA designated senior

information resources manager positions in the major departments and agencies

with responsibility for a wide range of functions. PRA also created the Office of

Information and Regulatory Affairs within the OMB to provide central oversight

of information management activities across the federal government.
Page 56 GAO-01-376G CIO Executive Guide

Government Management Reform Act of 1994 (Public Law 103-356) ñ This legislation

expands the requirement for a fully audited financial statement under the CFO Act

to 24 agencies and components of federal entities designated by the Office of

Management and Budget. The act requires the Department of the Treasury to

produce a consolidated financial statement for the federal government, which

GAO is to audit annually.

Federal Acquisition Streamlining Act of 1994 (FASA) (Public Law 103-355) ñ This law

requires agencies to define cost, schedule, and performance goals for federal

acquisition programs (to include IT projects) and monitor these programs to ensure

that they remain within prescribed tolerances. If a program falls out of tolerance,

FASA requires the agency head to review, take necessary actions, and, if

necessary, terminate the program.

Government Performance and Results Act (GPRA) of 1993, Public Law 103-62 ñ GPRA

requires agencies to prepare multiyear strategic plans that describe mission goals

and methods for reaching them. The act requires agencies to develop annual

performance plans that OMB uses to prepare a federal performance plan that is

submitted to the Congress along with the Presidentís annual budget submission.

The agency plans must establish measurable goals for program activities and

describe the methods by which performance toward those goals will be measured.

The act also requires agencies to prepare annual program performance reports to

review progress toward annual performance goals

Chief Financial Officers (CFO) Act of 1990 (Public Law 101-576) ñ The CFO Act

provides a framework for improving federal government financial systems. It

centralizes within OMB, through the Deputy Director for Management and the

Office of Federal Financial Management, the establishment and oversight of

federal financial management policies and practices and requires OMB to prepare

and submit to Congress a governmentwide, 5-year financial management plan.

The act also requires the 24 major agencies to have CFOs and deputy CFOs and

lays out their authorities and functions. Further, the act sets up a series of pilot

audits under which certain agencies are required to prepare agencywide financial

statements and subject them to audit by the agenciesí inspectors general.

Computer Security Act of 1987 (Public Law 100-235, as amended by Public Law 104-

106) ñ This law addresses the importance of ensuring and improving the security

and privacy of sensitive information in federal computer systems. The act requires

that the National Institute of Standards and Technology develop standards and

guidelines for computer systems to control loss and unauthorized modification or

disclosure of sensitive information and to prevent computer-related fraud and

misuse. The act also requires that all operators of federal computer systems,

including both federal agencies and their contractors, establish security plans.
GAO-01-376G CIO Executive Guide Page 57

Federal Managersí Financial Integrity Act (FMFIA) of 1982 (Public Law 97-255) ñ

FMFIA requires agencies to establish internal accounting and administrative

controls in compliance with standards established by the Comptroller General.

The act also requires that OMB establish, in consultation with the Comptroller

General, guidelines that the agencies shall follow in evaluating their systems of

internal accounting and administrative controls.

Government Information Security Reform (P.L. No. 106-398, Div. A, Title X, subtitle G) -

This legislation amends 44 U.S.C. Chapter 35 by enacting a new subchapter on

"Information Security." The Security Act requires the establishment of agencywide information security programs, annual agency program reviews, annual

independent evaluations of agency programs and practices, agency reporting to

OMB, and OMB reporting to Congress. The Act covers programs for both

unclassified and national security systems, but exempts agencies operating

national security systems from OMB oversight. The Security Act is to be

implemented consistent with the Computer Security Act.

Government Paperwork Elimination Act (GPEA) (P.L. No. 105-277, Div. C, Title XVII) -

GPEA requires that by 2003 federal agencies provide, where practicable, for the

option of submitting, maintaining, or disclosing information in electronic form as a

substitute for paper, and for the use and acceptance of electronic signatures.

Privacy Act of 1974 (Public Law 93-579) ñ The Privacy Act protects the privacy of

individuals identified in information systems maintained by federal agencies by

regulating the collection, maintenance, use, and dissemination of information by

such agencies.

Freedom of Information Act of 1966 (Public Law 89-554) ñ This law established the right

of public access to government information by requiring agencies to make

information accessible to the public, either through automatic disclosure or upon

specific request, subject to specified exemptions.
Page 58 GAO-01-376G CIO Executive Guide

Appendix II

Objectives, Scope, and Methodology

The objective of our research was to determine how several leading organizations have

implemented their CIO positions and supporting management infrastructures. We were

interested in identifying effective CIO management practices used across a variety of

organization types and structures. In doing so, we also sought to develop specific case

study information on how CIOs have helped improve the effectiveness of their

organizationsí business operations. We have used this information to develop suggested

guidance to assist federal agencies in effectively integrating newly created CIO functions

into their respective organizations.

We synthesized a great deal of literature and research on CIO organizations to provide

ideas on effective practices in information technology and management. This body of

knowledge served as a foundation for designing our project approach. We then conducted

case studies at a number of private and public organizations. We have found that case

studies provide an abundant source of information describing management practices and

the intellectual background that led to the development of those practices. Case studies

also provide the flexibility to pursue particularly rich avenues of inquiry as they develop

during interviews. Finally, they are also an excellent means of communicating the

essence of practices that have worked well by capturing the context as well as the specific

practice.

We identified candidate organizations for our study based on awards and recognition from

professional organizations and publications over the past several years. We conducted

multi-day visits to organizations that agreed to participate in our study to learn

• each organizationís approach to selecting, positioning, and defining the roles and

responsibilities of its CIO;

• techniques for instituting IT policies and standards, managing technical personnel and

financial resources, building customer/supplier relationships, and measuring the

performance of IT organizations in meeting business needs; and

• strategies for promoting and facilitating business and organizational change through

IT.

We visited three private and three public sector organizations recognized as leaders in

successfully managing information and technology investments to create value and

improve business performance. We selected private organizations across a range of

dimensions, including type of business, number of employees, and revenues. All private

organizations contacted had received recognition by professional organizations and

publications, corporate executives, or independent researchers. Our selection of state

organizations was based on recognition by professional publications, state CIOs, and the

National Association of State Information Resource Executives (NASIRE). In particular,

NASIRE awards recognition to states whose systems have made important contributions

to the operations of state governments. The following organizations participated in our

study:
GAO-01-376G CIO Executive Guide Page 59

• Commonwealth of Pennsylvania

• State of Texas

• State of Washington

• Chase Manhattan Bank

• General Motors Corporation

• J.C. Penney

We also interviewed the former CIO of the state of California and the current CIO at U.S.

West Communications, although we did not conduct comprehensive case studies at these

entities.

We conducted site visits to each participating organization and obtained supporting

documentation, illustrations, and examples. During the visits, we interviewed the CIO,

members of the senior executive team, IT managers, and other officials as identified by

the host organization, to obtain their individual perspectives on information and

technology management issues. Based on the documentation and interviews obtained

from our site visits, we compared practices across organizations to identify innovative

practices used by individual organizations as well as common practices used across the

variety of organizations participating in our study.

We subsequently interviewed 50 percent of the Federal CIO Council members as a means

of comparing federal CIO practices with our case study results and ensuring that practices

used in the industry and state organizations also addressed the challenges found in the

federal government. We selected a mix of federal organizations to visit, taking into

consideration their various mission types (civilian, military, or regulatory), centralized and

decentralized structures, and prior GAO study results. Further, we met with a panel of

CIOs from five small federal agencies to determine whether the practices identified are

also applicable across diverse organizational sizes (based on dimensions such as budget,

personnel, etc.). These discussions, which are summarized in the section entitled ìCurrent

Federal CIO Environment,î helped us identify similarities and differences in the CIO

management practices of federal versus leading organizations. The discussions have also

enabled us to pinpoint areas where federal agencies can benefit from integrating the

practices of such leading organizations in their respective organizations.

Our research was conducted from March through October 1999 and culminated in the

issuance of an exposure draft in March 2000. Since March 2000 we received comments

from a variety of organizations and individuals. Based on suggestions from the general

public we have considered and made changes to the text where appropriate. General

consensus of those providing input was that the CIO Guide represented leading practices

and that the document was insightful and valuable.
Page 60 GAO-01-376G CIO Executive Guide

Appendix III

Related GAO Documents

Information Security Risk Assessment: Practices of Leading Organizations

(GAO/AIMD-00-33, November 1, 1999).

Executive Guide: Creating Value Through World-class Financial Management

(GAO/AIMD-99-45, Exposure Draft, August 1999).

Executive Guide: Leading Practices in Capital Decision-Making (GAO/AIMD-99-32,

December 1998).

Executive Guide: Information Security Management: Learning From Leading

Organizations (GAO/AIMD-98-68, April 1998).

The Results Act: An Evaluatorís Guide to Assessing Agency Annual Performance Plans

(GAO/GGD-10.1.20, Version 1, April 1998).

Executive Guide: Measuring Performance and Demonstrating Results of Information

Technology Investments (GAO/AIMD-98-89, March 1998).

Agencies' Annual Performance Plans Under the Results Act: An Assessment Guide to

Facilitate Congressional Decisionmaking (GAO/GGD/AIMD-10.1.18, Version 1,

February 1998).

Business Process Reengineering Assessment Guide (GAO/AIMD 10.1.15, Version 3, May

1997).

Agenciesí Strategic Plans Under GPRA: Key Questions to Facilitate Congressional

Review (GAO/GGD-10.1.16, Version 1, May 1997).

Assessing Risks and Returns: A Guide for Evaluating Federal Agencies' IT Investment

Decision-Making (GAO/AIMD-10.1.13, Version 1, February 1997).

Executive Guide: Effectively Implementing the Government Performance and Results Act

(GAO/GGD-96-118, June 1996).

Strategic Information Management (SIM) Self-Assessment Toolkit (Exposure Draft,

Version 1.0, October 28, 1994).

Executive Guide: Improving Mission Performance Through Strategic Information

Management and Technology (GAO/AIMD-94-115, May 1994).

Meeting the Governmentís Technology Challenge: Results of A GAO Symposium

(GAO/IMTEC-90-23, February 1990).
GAO-01-376G CIO Executive Guide Page 61

Appendix IV

Selected CIO Resources

Professional Organizations

Association for Federal Information Resources Management: www.affirm.org

Chief Financial Officers Council: www.financenet.gov

Federal Chief Information Officers Council: www.cio.gov

Government Information Technology Services Board: www.gits.gov

Industry Advisory Council: www.iaconline.org

Information Systems Audit and Control Association and Foundation: www.iasca.org

Information Technology Association of America: www.itaa.org

Information Technology Resources Board: www.itrb.gov

International Federation of Accountants: www.ifac.org

National Association of State Information Resource Executives: www.nasire.org

Society for Information Management: www.simnet.org

Publications

Beyond Computing: www.beyondcomputingmag.com

CIO Magazine: www.cio.com

Federal Computer Week: www.fcw.com

Government Computer News: www.gcn.com

Government Executive: www.govexec.com

InformationWeek: www.informationweek.com

International Data Group: www.idg.com

Sloan Management Review: www.mitsloan.mit.edu/smr/index.html
Page 62 GAO-01-376G CIO Executive Guide

Research Organizations

Forrester Research, Inc.: www.forrester.com

Foundation for Performance Measurement: www.fpm.com

Gartner Group: www.gartner.com

GIGA Information Group: www.gigaweb.com

International Data Corporation: www.idc.com

IT Governance Institute: www.itgoverence.org/itgi

META Group Inc.: www.metagroup.com

Yankee Group: www.yankeegroup.com

Federal Resources

Federal Acquisition Regulation: www.ARNet.gov/far/

Critical Infrastructure Assurance Office: www.caio.gov

Federal Computer Incident Response Capability: www.fedcirc.gov

Federal Information Processing Standards: www.itl.nist.gov

General Accounting Office: http://www.gao.gov/

GSAís Policyworks: www.policyworks.gov

IT Policy On-Ramp: www.itpolicy.gsa.gov

National Partnership for Reinventing Government: www.npr.gov

Office of Management and Budget Homepage: www.whitehouse.gov/omb

Other Resources

Chief Information Officer ñ Treasury Board of Canada: http://www.ciodpi.gc.ca/home_e.html
GAO-01-376G CIO Executive Guide Page 63

Appendix V

Selected Books and Articles

ìBest Practices in Improving IT Staff Competencies,î GIGA Information Group,

December 1998.

Blodgett, Mindy, ìThe CIO Starter Kit: Ten Tools Every New CIO Needs to Succeed,î

CIO Magazine, May 15, 1999.

Boar, Bernard H., Practical Steps for Aligning Information Technology with Business

Strategies: How to Achieve a Competitive Advantage (John Wiley & Sons, Inc., New

York, New York, 1994).

Boar, Bernard H., Strategic Thinking for Information Technology (John Wiley & Sons,

Inc., New York, New York, 1996).

Bryson, John M., Strategic Planning for Public and Nonprofit Organizations: A Guide to

Strengthening and Sustaining Organizational Achievement (Jossey-Bass Publishers, San

Francisco, California, 1991).

Camp, Robert C., Benchmarking: The Search for Industry Best Practices That Lead to

Superior Performance (ASQC Quality Press, New York, New York, 1989).

Cortada, James W., Best Practices in Information Technology (Prentice Hall PTR, Upper

Saddle River, New Jersey, 1998).

Earl, Michael J., and Feeny, David F., ìDoes the CIO Add Value?î Informationweek, May

30, 1994.

Ferris, Nancy, ìCIOs on the Go,î Government Executive, March 1999.

Government Executive Magazine/Price Waterhouse, The Managerís Edge (National

Journal Group, Washington, D.C., 1998).

Hubbard, Douglas, ìThe IT Measurement Inversion,î CIO Enterprise,î April 15, 1999.

Mayor, Tracy, ìMaking a Federal Case of IT,î CIO Magazine, July 1, 1999.

Morin, Therese; Devansky, Ken; Little, Gard; and Petrun, Craig, Information Leadership:

A Guide for Government Executives (PricewaterhouseCoopers, LLP, 1999).

Stephens, Charlotte S., The Nature of Information Technology Managerial Work: The

Work Life of Five Chief Information Officers (Quorum Books, Westport, Connecticut,

1995).

Stuart, Anne, ìThe CIO Role: The New IS Role Models,î CIO Magazine, May 15, 1995.

Tapscott, Don and Caston, Art, Paradigm Shift ñ The New Promise of Information

Technology (McGraw-Hill, Inc., New York, New York, 1993).
Page 64 GAO-01-376G CIO Executive Guide

Wakin, Dr. Edward, ìThe Multifaceted CIO,î Beyond Computing, May 1995.

Wang, Charles B., Techno Vision II: Every Executiveís Guide to Understanding and

Mastering Technology and the Internet (McGraw-Hill, Inc., New York, New York, 1997).

Weill, Peter and Broadbent, Marianne, Leveraging the New Infrastructure: How Market

Leaders Capitalize on Information Technology (Harvard Business School Press, Boston,

Massachusetts, 1998).

Woldring, Roelf, ìChoosing the Right CIO,î Business Quarterly, Spring 1996.

Wreden, Nick, ìExecutive Forum: Proving the Value of Technology,î Beyond

Computing, July/August 1998.
GAO-01-376G CIO Executive Guide Page 65

Appendix VI

Selected Information Management Reports and Guidance

An Analytical Framework for Capital Planning and Investment Control for Information

Technology, U.S. General Services Administration, Office of Policy, Planning and

Evaluation, Office of Information Technology, May 1996.

ìBest IT Practices in the Federal Government,î CIO Council and IAC, October 1997.

Capital Programming Guide, Version 1.0, Supplement to Office of Management and

Budget Circular A-11, Part 3: Planning, Budgeting, and Acquisition of Capital Assets,

July 1997.

Evaluating Information Technology Investments: A Practical Guide, Version 1.0, Office

of Information and Regulatory Affairs, Information Policy and Technology Branch,

Office of Management and Budget, November 1, 1995.

Federal Enterprise Architecture Framework, Version 1.1, Federal CIO Council,

September 1999.

Federal Information Technology, Executive Order on ITMRA, The White House, July 17,

1996.

Federal IRM Training Roadmap: A Guide for Federal CIOs, (Draft), Federal CIO

Council, Education and Training Committee, January 1999

Funding Information Systems Investments, M-97-02, Office of Management and Budget,

October 25, 1996.

IAC / CIO Task Force Draft Report, Industry Advisory Council, July 9, 1996.

Implementing Best Practices: Strategies at Work, Federal CIO Council, Capital Planning

and IT Investment Committee, June 1998.

Implementing Capital Planning and Information Technology Investment Processes: An

Assessment, Federal CIO Council, Capital Planning and IT Investment Committee, Best

Practices Subcommittee, May 29, 1998.

ìMajor System Acquisitions,î Circular No. A-109, Office of Management and Budget,

April 5, 1976.

Management of Federal Information Resources, Circular No. A-130, Revised, Office of

Management and Budget, February 8, 1996.

Meeting the Federal IT Workforce Challenge, Federal CIO Council, Education and

Training Committee, June 1999.

Preparation and Submission of Budget Estimates, Circular No. A-11, Revised, Office of

Management and Budget, June 23, 1997.
Page 66 GAO-01-376G CIO Executive Guide

ROI and the Value Puzzle, Federal CIO Council, Capital Planning and IT Investment

Committee, April 1999.

Strategic Plan, Federal CIO Council, Fiscal Year 2000.

The Federal Chief Information Officer: Fourth Annual Top Ten Challenges Survey,

Association for Federal Information Resources Management, December 1999.

The Impact of Change: Clinger-Cohen Act Implementation, Laying the Foundation for

Year 2000 and Beyond, Eighth Annual ITAA Survey of Federal CIOs, December 1997.
GAO-01-376G CIO Executive Guide Page 67

Appendix VII

Project Adviser Acknowledgments

We would like to acknowledge the following individuals whose advice and assistance

throughout this project have been invaluable.

Dr. Lynda McDonald Applegate

Professor of Business Administration

Harvard Business School

Thomas V. Fritz

President & Chief Executive Officer

Private Sector Council

Laraine Rodgers

Vice President

Emerald Solutions

Paul Rummell

Senior Partner

KPMG Consulting

(310400)
Ordering Information The first copy of each GAO report is free. Additional copies of 

reports are $2 each. A check or money order should be made out to 

the Superintendent of Documents. VISA and MasterCard credit 

cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address are 

discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

Orders by visiting:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders by phone:

(202) 512-6000

fax: (202) 512-6061

TDD (202) 512-2537

Each day, GAO issues a list of newly available reports and 

testimony. To receive facsimile copies of the daily list or any list 

from the past 30 days, please call (202) 512-6000 using a touchtone 

phone. A recorded menu will provide information on how to obtain 

these lists.

Orders by Internet:

For information on how to access GAO reports on the Internet, 

send an e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web home page at: 

http://www.gao.gov

To Report Fraud, 

Waste, or Abuse in 

Federal Programs

Contact one:

• Web site: http://www.gao.gov/fraudnet/fraudnet.htm

• e-mail: fraudnet@gao.gov

• 1-800-424-5454 (automated answering system)