48 HOURS ONLY: Get 2 free months of Insider Pro!

Evaluating IT Investments

Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with

Already have an account? Sign In »

10 hours 8 minutes
Video Transcription
um, the governance of enterprise I t Which basically means that we're gonna be taking the worlds of I t. And we're going to be messing them together with the world of business. And what we always talk about is you really can't separate them anyway. So let's look at I t as a part of the business
and let's take corporate governance
and I t governance and let's look at them together so that we can math maximize the benefits of I t. And our environment.
Now we've been We picked up this course before the holidays, And so now we're coming back after a couple of weeks hiatus or break, if you will. And just a quick reminder the material that we talked about
before the break we were really just focusing in on the need
to justify the expenses of I Tina, you and I have been an i t. Perhaps for years or considering a change into the realm of I t. You know, we're believers in the necessity of technology. We understand, and we've seen help technology can revolutionize business.
We've seen the critical nature of information security
and the impact that information security has on the organization as a whole. But unfortunately, sometimes that information is not as transparent as we would think it would be to others. So when we talk about this particular session where we left all
and what we're going into, the next section is we're going to start talking about
how were able to prove their investments or worthwhile and how we ensure that we're delivering maximum value for our investments. So that's what we've been talking about leading up to this point, and we're gonna go ahead and jump in.
Excuse me with the material here with evaluating I t investments. So ultimately, when we look at the types of investments that we might make in relation toe, I t. You know, we're going to spend money on new systems. We're going to spend money on new technology. We're going to, you know, hardware.
We're going to spend money on lots of different elements.
And so ultimately, what we're gonna look at is how we show that those investments that that money spent is going to move us forward as an organization instead of moving us backwards. So when we talk about our business portfolio, weaken, see solid investments in I T.
And ideally will be able to see in track our return on investments. That's what we're looking for.
All right, So some of the things that we need to look at is when we're making these investments in information technology purchasing new technology, upgrading technology, um, you know, expanding into new spaces, spending money on information security.
We have to think about these
as investments because everything that we do in a business must deliver value
doesn't mean it has to deliver profit, but it must deliver value. So when we look at making these investments, we have to think, OK, what's the lifespan of this investment? Am I investing in a service that is only good for years? It's a service that, um
is this hardware that will be able to use for five years out 10 years out, Who knows? All right, so we start off by thinking about what are the life spans of these elements that were investing in. Then, of course, we've got to think about risks,
And when we start thinking about risks, we start to think about ideas like threat modelling
risk scenarios, because we know that everything has a certain amount of risk with it. There's just inherent risk with what we do with what we invest in with what we implement.
So we play the risk scenario. So we look at the control, perhaps that we're looking to invest in or we look at the technology and we start to look at okay, what are the threats and vulnerabilities that could be exploited or
when we look at other risks, not just security risks, but other risks. We have to think about probability and impact.
What is the likelihood that this failure this device will fail? And if it does fail, what's the impact to the business,
and then ultimately what we want is we want to return. I want to return on my investment. I don't mind putting money out, but I don't want to just throw it to the winds, right. I'll put that money out either if I profit from it or if I reduce my losses right and sometimes that's what we settle for.
All right, so developing a business case.
So one of the things we'll talk about in just a minute is that when we're managing these expenditures, we have toe approach under this, like a project. OK, so when I'm looking to implement new technology, that is a project and must be managed as such
So we need a project manager. We need scope and budget. All of those ideas, the same documents
and one of the first things that we do. Excuse me,
is we create a business case
now, Business case tells us why Why are we doing what we're doing? And this doesn't have to be, you know, 30 pages long, you can have an executive summary of the business case that essentially says, Here's the problem. And here's our solution. This is why were implementing this new technology.
This is why we're migrating to the cloud. This is what we're doing.
Okay, so we start out with a business case and I'll play if you haven't written business cases before. If this is something that you're new to just trying to get, you know, some background on enterprise governance. There are tons of templates out on the Internet. You can always ask it Google.
There are tons of project management templates, so we'll talk about ah project charter later.
If any of these documents are new to you. I would recommend that you go on out to Google and that you look for some templates just to get a feel for what they are and what they're talking about. OK, so
water, the business benefits. That's our business case
particularly. We start with problems. Statement in solution Statement In our business case, here is the problem.
Okay. Ah, the compliance regulations for HIPPA have recently changed and as per the most recent assessment, were no longer compliant.
That's our problem than our solution is. We will move towards a position of compliance. Bye, blah, blah, blah, blah, blah. OK problems statement in solution statement Make up the business case. Here's the problem. Here is the solution
and often the problem comes from being out of compliance.
Ah, having to meet new regulations having Teoh keep up with industry standards. You know, those air very frequently causes profit. Of course, right. But
you know, improving customer goodwill and and all of those ideas can be many reasons that we would undertake one of thes projects.
Now, when you're doing Mawr,
when your value is gonna be more soft targets, if you know what I mean, Like improving customer goodwill was gonna be really hard to, you know, to measure doesn't mean that it's not part of a business case, right? It just means we'll have to go some extra steps to ensure
that we're meeting our objectives. Because even if you have those sort of soft targets,
you still have to have objectives, and you still have to have ways of measuring your success.
All right, um, and then we ask ourselves what impact will what we're doing have on our existing operations, our systems, our staff.
So when we look at our existing operations, you know, it's pretty hard to implement something totally new without having a breaking operations. Maybe this is something we're gonna install and configure and initiate overnight so we can minimize the disruption to our day to day operations.
What's gonna be the impact on systems? Don't forget. We got to think about risks in relation to this. You know, I'm just thinking about installing new applications or performing an upgrade. Sometimes thes things that seem very basic can actually interfere with other processes. Other systems
I don't know. For those of you that that work in i t. But
for me as soon as I hear the phrase Oh, this should be easy coming out of my mouth. I just cringe
because honestly, it seems like it's those things that should be the simplest tend to cause the most problems. It's just the way it is, all right. So, staff, this is a tricky one because as a general rule, people do not like change.
You know, you could walk into an organization and I will guarantee you, if you told every employee in the business you were going to give them a $1,000,000
10% of those employees would dio
Great. Now I have to buy bigger wallet and and that really is the case. People do not like change. So what we have to do is to make sure that that change is as unobtrusive as possible.
And the reason people don't like changes they've seen change negatively affect their environment time and time again.
So it's our job to minimize that, because disruption to staff, resistance of staff,
when you don't have by end of staff, that can really break your project, right? Your staffer stakeholders, And if your stakeholders aren't satisfied, you're not gonna have a successful product project.
Okay, so the benefits of I t investment so several different ways. The four types of
that will see of It's funny. I only have three bullet points, but there are four types. You're just gonna have to trust me on this. Uh, no. I need a bullet point for direct benefits.
There are direct benefits. When you implement I t. You may see that you develop a piece of software that immediately cells and brings in profit. Right. That's a direct benefit of I t technology.
More likely you're going to see productivity increases. New technology should support the business. Should make business processes easier, more efficient. So we should see increase in productivity
increased in cost savings, Fewer man hours. Um,
you know, those are some of the big things that I think about
now. There are also some incremental Ben offense where you may not realize the full benefit of the investment. It may just be something that you see over time you see little improvements, little improvements where, ultimately, just those little improvements, what necessary just necessarily justify the expense.
But when you look at the big
picture often you'll see that lots of little pieces add up to a much, you know, sometimes you'll hear people say the whole is greater than the sum of its parts, right? So there's incremental benefits when they measure up, can be very meaningful.
And then there also monetary benefits that are not necessarily
the direct result
the new system, but they are enabled because of the the new system, if you will. So, for instance, I have a new database tracking system that enables us to store more product into, um,
increase the
with which transactions were processed and how we interact with their customers. So you can't necessarily say exactly what's new to that system. However, we're moving in the right direction, and a big part of that is because of the new system.
So there are lots of ways that
before we make an investment in a product, we have to determine which of these benefits is going to come from I t
okay. So again, what we're trying to do is justify our investments. So if I have the goal of a direct increase in profit, that should be documented. But if this is gonna be something that's kind of an indirect result or somewhere else again. We document
document, document, document and cost avoidance if I don't profit, but I lose less. Well, that's a benefit as well, right? That's just the significance, significant in a lot of areas. So when we talk about information security,
that's more than cost avoidance category, right? We don't generate money or profit from information security.
It's not like I install a new firewall. When people come in, I get to charge and sell tickets, come to you. My new firewall, right? That doesn't happen.
So what we're looking to do is we're looking to prove find a way of demonstrating that the mechanism we implemented saves us money that that return on investment. So what we have to look at is what we were losing, perhaps due to malware
with the cost of the anti Bell where software is, and then what we're losing afterwards. And if what we're losing afterwards is significantly less than what we were losing before, even accounting for the cost of the control, then we're showing that we have an improvement. We're showing the return on investment of that product.
Okay, again, ideas like maintaining a competitive edge is not being out of compliance. Just difficult to quantify. Turn on investment, Return on investment, Return on investment.
Okay, so ultimately, what we're gonna do is we're looking to see the NPV of the initiative
on the low end
do ah, the NPV or the return on investment at the high end. So what we're looking to do is we're looking to get Ah, a nice, round, accurate number.
It was Don't mean ground. I mean, you know, ah, number with which we have a good deal of confidence in
this is what we're losing on the high end. This what we're losing on the low in and let's figure out where we are in the middle.
We also have some ideas about milestones,
and milestones are flags. Milestones are markers that say, here we are at the end of phase one at the end of face tube,
and sometimes what you'll see is that you'll see milestones are often called phase gates. And when you come to a milestone in
often there's a decision where you determine whether or not we're gonna move forward or were not. Sometimes a milestone is that point where we say, pull the plug on the project or keep moving forward. And are milestones have to be determined very early on in the project
Because, like I said, you know, these air key target dates that we have to hit,
and if we're not hitting him, that's gonna be a big problem.
All right, um,
when we're trying to figure out the return on investment of a product
or a project
the return of investment isn't clear,
if the turn on investment isn't valuable to the organization, if there's no riel agreement
point moving forward right, it should be a clear, easy to demonstrate return on investment that should make sense toe all the users within the business. OK, so that's, uh,
an example of the previous slide. Net value sleazy. Excuse me. I don't think it's this one.
Is this the one you're looking for, Laura?
I'm thinking that it is. I'm gonna go ahead and go with this one. And if it's a different one, just
a So when we're looking for a return on investment, right? We're looking to figure out how much money this product has saved us, right? So often we're not going to be able to specifically say this product has saved us 300 bucks,
There's almost always a range right. Things could be very, very difficult to quantify you in the return on investments, especially that technology brings in. So ultimately, what we want to be able to do is to provide a range. You know, this has benefited us,
you know, anywhere from 50,000 to $100,000.
So we have to take a low estimate than a high estimate so that we can provide an accurate range, I guess, if that makes sense.
Okay, So talk about milestones. We need toe have a consensus on return on investment because if we don't, there's no point moving forward. You keep seeing the idea in PV NPV
and the idea about NPV
has to do with, um
yeah, the impact on revenue compared to the produce benefits. But there's also a little bit more to it in that NPV takes into account that money that we spend today may not have and probably won't have the same value as in the future. So, for instance, when I spend a dollar today.
That dollar today is gonna be worth less in five years and in 10 years.
So when you're making these long term investments and we always want a high NPV we're making these long term investments, you may see more variance between what a dollar's worth today and
in the future.
All right, so how do we calculate this return on investment? Well, they're multiple ways there multiple metrics that we can use. Um, the bottom line is how we're going to calculate this should have been determined ahead of time. Like I said,
this is gonna be managed as a project the implementation of this new technology.
And before you ever move out of the planning phase, you document your objectives and we'll talk about our baselines in just a little bit. But the idea is, we have to have determined what criteria we will use to evaluate the product. The project.
Okay, there's internal rate of return. There is payback, period. There's NPV.
You do not need to know the formulas for these elements, but certainly you want to kind of consider how they will impact
your decision, right? Sometimes it doesn't matter that you're profiting mawr later, you just want a quick return, right? So the payback period. I'd rather be paid back in a month than in six months than in the year. So ultimately, it's not that there's a writer wrong decision,
but ultimately that there is a value that's ah, or selection method. That's that's gonna dictate what I do. OK, so we keep alluding to the fact that whenever we're gonna implement a new information technology
de element, whatever that's gonna be, that we need to manage it as a project, and that's absolutely true. Project management is really the goal to product creation, and again, that product could be a tangible product that could be a service. It could be a result,
but it's the way of producing deliver bles in a timely, ordered, methodical fashion.
Okay, and that's essential. And I think everybody that's gonna be in I T. And A management needs toe have a good understanding of project management project management really essential.
All right, so when we do talk about project management, ultimately the goal is to meet the requirements of the project, so produce the deliver balls that are required, but also to bring that in on time on budget and producing the right stuff. Right?
So there lots of activities that a project manager is gonna be responsible for performing
A will talk about determining what the work structure is. We'll talk about different types of charts that a project manager is gonna have to interpret news.
Kurt Charts are very, very popular and per charts stand for project evaluation and review techniques. We have statements of work that we have to work with. Gant charts are bar charts that help us see the structure in the flow of our project.
So there, ah, lot of tools and techniques that we're gonna use
now, obviously just covering this for a chapter in our class today off the elements of project management. But we do want to cover some of the i e. The groundwork for you. So I think this is actually a pretty good spot to take a quick break
so that we can cover project management and have that flow throughout that whole section. OK,
so let's take a six minute break.
You know what? Let's go crazy. Take a seven minute break on me. So let's be back at 3 41 and we will pick up with the wild, wild world of project management.
All right, welcome back from break and as promised, we're up to the section on project Management. And like I said, project management isn't necessarily limited to technical projects, right? There are all sorts of projects that have to be managed as such, but it's so important
in technical organizations or
individuals that have a technical focus or technical expertise that we understand how to manage products projects. At some point in time, you go from producing stuff to managing projects, and that's really the difference between long term success and failure. So when we talk about project management,
like I said, we'll uncover several different areas and talk about, ah, lot of the benefits here that are necessary. But ah, in a lot of the tools and techniques. But let's just start off
by, uh, this is not
a me and
bear with me just one second, guys, I'm so sorry.
I really had
actually the slide that I wanted
and then I'm curious where it went.
Do you ever have one of those days?
I have ah managed to have
and entirely
the entire day of one of those days.
Okay, so
that's all right. I'm gonna, um, just talk a little bit about project management here. Since I don't have everything that I want to show you in the slide, I'm gonna talk about it a little bit
and, uh, just kind of a lab. What's on the slide? So, as I mentioned before, when we're looking at these elements managing projects, we have a lot of work to do.
Um, the skills of a project manager, we really have tohave.
Ah, an elaborate skill set. Because if you think about all the things that a PM has to do, you know, they have to be a leader.
They have to be business focused. They have to understand scope of work. They have to understand schedule. They have to understand all of those numerous elements that make up a project.
And often what you'll hear people refer to is they'll talk about knowledge areas of a project manager, and I'm just curious. What do you guys think? What do you think are some of the areas that a project manager must specifically have knowledge on what air those elements
to you guys
that make up the skill set of a PM
I'd love to hear you know what your experience has told you? Because I do want to stress it takes a whole lot more than just knowledge of a particular discipline, Right? We have to have a much wider knowledge base than just the project, right? Just the technical details of the project.
And there is a bit of a delay in case you, ah, weren't aware of that. So if you notice that there's a little bit of an awkward silence between me asking a question, you guys telling me the answer to that question. That is exactly why
I would ask you guys to bear with me just for a second.
I'm gonna pull down a different set of slides,
but I do want to hear what you guys say. So let's take a look what we have here,
all right, communication skills. That's fabulous. The PM I Project Management Institute indicates that over 90% of a project manager's job is actually communication. Now think about that for a minute. 90% of a project manager's job
is communication. That's a whole lot right.
So when we think about communication skills, those are easy to come by because you've got to think about things like active listening. You've got to think about exchange of information.
You have to think about ideas like the various elements that can deflect communication or that can impact communication. Ah, we often refer to that as noise. And it's not just tangible noise. Ah, you know, it can be noise of any type.
And the idea, of course, is noises. Anything
that's gonna limit solid communication. So that's important piece.
All right, what are some other skills you that you're aware of that can impact negatively or positively communication
negotiation? So when we talk about negotiation delegation
Ah, we think about diplomacy. We think about all sorts of ways that we can work towards getting the goals of the project, met work towards accomplishing the goals that we have,
right? So when we think about communication, that's important. Other knowledge areas, stakeholders
who are stakeholders, well stakeholders or anybody that are impacted by the results of your project
and PM I actually goes further to say anybody that's impacted by or considers themselves to be impacted by the result of your project. So I find that very interesting and very telling, because sometimes the folks that make the most noise on a project
aren't even the ones that are impacted
the strongest. And I don't know if you've ever been in an organization or been in an environment like that, where you've got a stakeholder that is always, always, always wanting, more, wanting, more wanting more. And then when it comes right down to it, that stakeholder really didn't have any influence over the project
and really didn't have any stake
that was legitimate in the project.
So when you talk about managing stakeholders, it's not only meeting stakeholders expectations, but another big part of it is negotiating your stakeholders, moving through and determining the priority of your stakeholders as well. So that's certainly challenging. What else? What are some other skills that we need?
Yep, that goes around managing stakeholder expectations. Absolutely. And Laura, if I'm not mistaken, you're taking some PNP courses. Is that correct?
Because I know that that's one area where you know things like managing stakeholder expectations so very critical to the success of a project because ultimately the product the deliver bubbles of the product
of the project are getting turned over to whom?
To the stakeholders, not all stakeholders. But like we said, not all stakeholders are created equal. So ultimately, when we think about that, stakeholder management is a critical critical element. All right, We also have to think about risk management, right?
All projects have risks.
So what we have to evaluate and examined is how the risks are going to impact our project. We have to think about risk management. We have to think about using buffers and reserves,
basically those air cushions in our estimates for our projects.
Because ultimately
we know that risks will impact our schedule. We know that risks will impact our costs. And if we don't allow for those risks, we're gonna have lots of of issues. Okay, so you're staying for prints, too?
Yeah, And you know, they're all sorts of certifications that revolve around project management today.
And that really is a good indication of how essential project management skills are
and how much they're lacking, Really, based on today's environment, because for a long time our focus has just been on the technology, and now we're gonna focus more on how we
manage the technology to increase its value and not just to increase its value. But I think a big part of this course is being able to demonstrate and prove the value off our I T expenditures. Okay, so when we talk about what a project is,
the official definition of a project is it's a temporary endeavor,
and it's gonna produce something unique, a unique product or service or result. But those two pieces, or what makes a project? So it's temporary. I'm going to manage a cloud migration or I'm gonna upgrade in infrastructure doesn't go on forever. So if you think about things like risk management, those air, not projects,
and it will produce something unique a new implementation, new product service or results.
So it is the drivers from project Management or that drive us to select projects, you know, the big ones profit,
legal compliance, standardization, market demand, right? Those are the things that drive us to take on projects. Just like if I were to ask you, what are those things that drive us to implement new technology? Well, sometimes we do it for profit. Sometimes we do it to reduce loss.
Sometimes we do it to stay competitive.
You know, in those air the many reasons that we take on projects. Now as a project manager, my job is to make sure that the needs of the project are satisfied. So if we're looking to implement a new firewall, upgrade our existing infrastructure,
move certain servers to the DMC, whatever the project is that I'm managing,
I have to meet the requirements of that project. And the responsibility of that ultimately comes down to the project manager now. Like we said, there are a lot of areas that the project manager has toe have knowledge off right? But the skill set of the PM
the project manager they have toe have a degree of technical skills. It's tough to be an I T project manager with no I t. Knowledge. You don't have to be an expert. You know, I am not a software development expert, but I've managed many software development
projects because I understand the life cycle.
I may not be able to code the fastest in the best of anybody that you'll see, but I certainly understand the elements that are necessary to produce
code that meets the requirements, including function and security, right? So we don't have to have some technical understanding. We've gotta have those leadership skills that can inspire other people to follow us and to work with us towards the common goal.
And then again, going back to the strategic in business management piece. That's what this course is all about, really.
when we look at the knowledge areas and Lara gave us several communication, you'll notice. But here we've got things like Time management. When we say time, you won't immediately think of the schedule scheduling activities, managing the schedule,
including buffering and activities based on risk.
Making sure that the project comes in on time on schedule, we've got to think about costs. So we budget I mentioned risk when we talk about procurement. Sethi understanding there is. There are elements within our project. We may have to outsource. So how those contracts get written or
how the service level agreements
are evaluated and carried out. Those pieces are important
communications. We said HR management. We addressed managing your staff earlier, keeping your team motivated, and I'll tell you, if you've got a three week project, it's much easier to keep your team motivated for three weeks than it is a three year project, right?
So being able to address that and know people get bored,
people get distracted. And if you want to keep folks motivated, that takes some effort from the project manager.
Up Next