7-pages writing work

bgloss.indd 312 11/26/2015 7:40:39 PM

Managing and Using Information Systems

A STRATEGIC APPROACH

Sixth Edition

Keri E. Pearlson KP Partners

Carol S. Saunders W.A. Franke College of Business

Northern Arizona University

Dr. Theo and Friedl Schoeller Research Center for Business and Society

Dennis F. Galletta Katz Graduate School of Business

University of Pittsburgh, Pittsburgh, PA

ffirs.indd 1 12/1/2015 12:34:39 PM

VICE PRESIDENT & DIRECTOR George Hoffman

EXECUTIVE EDITOR Lise Johnson

DEVELOPMENT EDITOR Jennifer Manias

ASSOCIATE DEVELOPMENT EDITOR Kyla Buckingham

SENIOR PRODUCT DESIGNER Allison Morris

MARKET SOLUTIONS ASSISTANT Amanda Dallas

SENIOR DIRECTOR Don Fowley

PROJECT MANAGER Gladys Soto

PROJECT SPECIALIST Nichole Urban

PROJECT ASSISTANT Anna Melhorn

EXECUTIVE MARKETING MANAGER Christopher DeJohn

ASSISTANT MARKETING MANAGER Puja Katariwala

ASSOCIATE DIRECTOR Kevin Holm

SENIOR CONTENT SPECIALIST Nicole Repasky

PRODUCTION EDITOR Loganathan Kandan

This book was set in 10/12 Times Roman by SPi Global and printed and bound by Courier Kendallville.

This book is printed on acid free paper.

Founded in 1807, John Wiley & Sons, Inc. has been a valued source of knowledge and understanding for more than 200 years, helping people

around the world meet their needs and fulfill their aspirations. Our company is built on a foundation of principles that include responsibility to

the communities we serve and where we live and work. In 2008, we launched a Corporate Citizenship Initiative, a global effort to address the

environmental, social, economic, and ethical challenges we face in our business. Among the issues we are addressing are carbon impact, paper

specifications and procurement, ethical conduct within our business and among our vendors, and community and charitable support. For more

information, please visit our website: www.wiley.com/go/citizenship.

Copyright © 2016, 2013, 2010, 2006, 2004, 2001 John Wiley & Sons, Inc. All rights reserved. No part of this publication may be repro-

duced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or

otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission

of the Publisher, or authorization through payment of the appropriate per‐copy fee to the Copyright Clearance Center, Inc., 222 Rosewood

Drive, Danvers, MA 01923 (Web site: www.copyright.com). Requests to the Publisher for permission should be addressed to the Permissions

Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030‐5774, (201) 748‐6011, fax (201) 748‐6008, or online at: www.

wiley.com/go/permissions.

Evaluation copies are provided to qualified academics and professionals for review purposes only, for use in their courses during the next

academic year. These copies are licensed and may not be sold or transferred to a third party. Upon completion of the review period, please

return the evaluation copy to Wiley. Return instructions and a free of charge return shipping label are available at: www.wiley.com/go/

returnlabel. If you have chosen to adopt this textbook for use in your course, please accept this book as your complimentary desk copy.

Outside of the United States, please contact your local sales representative.

ISBN: 978-1-119-24428-8 (BRV)

ISBN: 978-1-119-24807-1 (EVALC)

Library of Congress Cataloging-in-Publication Data Names: Pearlson, Keri E. | Saunders, Carol S. | Galletta, Dennis F.

Title: Managing and using information systems: a strategic approach / Keri

E. Pearlson, Carol S. Saunders, Dennis F. Galletta.

Description: 6th edition. | Hoboken, NJ : John Wiley & Sons, Inc., [2015] |

Includes index.

Identifiers: LCCN 2015041210 (print) | LCCN 2015041579 (ebook) | ISBN 9781119244288 (loose-leaf : alk. paper) |

ISBN 9781119255208 (pdf) | ISBN 9781119255246 (epub)

Subjects: LCSH: Knowledge management. | Information technology—Management. |

Management information systems. | Electronic commerce.

Classification: LCC HD30.2 .P4 2015 (print) | LCC HD30.2 (ebook) | DDC 658.4/038011—dc23

LC record available at http://lccn.loc.gov/2015041210

Printing identification and country of origin will either be included on this page and/or the end of the book. In addition, if the ISBN on this

page and the back cover do not match, the ISBN on the back cover should be considered the correct ISBN.

Printed in the United States of America

10 9 8 7 6 5 4 3 2 1

ffirs.indd 2 12/1/2015 12:34:39 PM

To Yale & Hana

To Rusty, Russell, Janel & Kristin

To Carole, Christy, Lauren, Matt, Gracie, and Jacob

ffirs.indd 3 12/1/2015 12:34:39 PM

iv

Information technology and business are becoming inextricably interwoven. I don ’ t think anybody can talk meaningfully about one without the talking about the other.

Bill Gates

Microsoft 1

I ’ m not hiring MBA students for the technology you learn while in school, but for your ability to learn about, use and subsequently manage new technologies when you get out .

IT Executive

Federal Express 2

Give me a fi sh and I eat for a day; teach me to fi sh and I eat for a lifetime .

Proverb

Managers do not have the luxury of abdicating participation in decisions regarding information systems (IS).

Managers who choose to do so risk limiting their future business options. IS are at the heart of virtually every

business interaction, process, and decision, especially when the vast penetration of the Web over the last 20 years

is considered. Mobile and social technologies have brought IS to an entirely new level within fi rms and between

individuals in their personal lives. Managers who let someone else make decisions about their IS are letting

someone else make decisions about the very foundation of their business. This is a textbook about managing and

using information written for current and future managers as a way to introduce the broader implications of the

impact of IS.

The goal of this book is to assist managers in becoming knowledgeable participants in IS decisions. Becoming

a knowledgeable participant means learning the basics and feeling comfortable enough to ask questions. It does

not mean having all the answers or having a deep understanding of all the technologies out in the world today. No

text will provide managers everything they need to know to make important IS decisions. Some texts instruct on

the basic technical background of IS. Others discuss applications and their life cycles. Some take a comprehensive

view of the management information systems (MIS) fi eld and offer readers snapshots of current systems along with

chapters describing how those technologies are designed, used, and integrated into business life.

This book takes a different approach. It is intended to provide the reader a foundation of basic concepts relevant

to using and managing information. This text is not intended to provide a comprehensive treatment on any one

aspect of MIS, for certainly each aspect is itself a topic of many books. This text is not intended to provide readers

enough technological knowledge to make them MIS experts. It is not intended to be a source of discussion of any

particular technology. This text is written to help managers begin to form a point of view of how IS will help or

hinder their organizations and create opportunities for them.

The idea for this text grew out of discussions with colleagues in the MIS area. Many faculties use a series of

case studies, trade and popular press readings, and Web sites to teach their MIS courses. Others simply rely on one

of the classic texts, which include dozens of pages of diagrams, frameworks, and technologies. The initial idea for

this text emerged from a core MIS course taught at the business school at the University of Texas at Austin. That

course was considered an “appetizer” course—a brief introduction into the world of MIS for MBA students. The

course had two main topics: using information and managing information. At the time, there was no text like this

Preface

1 Bill Gates, Business @ the Speed of Thought. New York: Warner Books, Inc. 1999. 2 Source: Private conversation with one of the authors.

fpref.indd 4 11/27/2015 4:21:12 PM

vPreface

one; hence, students had to purchase thick reading packets made up of articles and case studies to provide them the

basic concepts. The course was structured to provide general MBA students enough knowledge of the MIS field so

that they could recognize opportunities to use the rapidly changing technologies available to them. The course was

an appetizer to the menu of specialty courses, each of which went much more deeply into the various topics. But

completion of the appetizer course meant that students were able to feel comfortable listening to, contributing to,

and ultimately participating in IS decisions.

Today, many students are digital natives—people who have grown up using information technologies (IT) all

of their lives. That means that students come to their courses with significantly more knowledge about things such

as tablets, apps, personal computers, smartphones, texting, the Web, social networking, file downloading, online

purchasing, and social media than their counterparts in school just a few years ago. This is a significant trend

that is projected to continue; students will be increasingly knowledgeable the personal use of technologies. That

knowledge has begun to change the corporate environment. Today’s digital natives expect to find in corporations

IS that provide at least the functionality they have at home. At the same time, these users expect to be able to work

in ways that take advantage of the technologies they have grown to depend on for social interaction, collaboration,

and innovation. We believe that the basic foundation is still needed for managing and using IS, but we understand

that the assumptions and knowledge base of today’s students is significantly different.

Also different today is the vast amount of information amassed by firms, sometimes called the “big data” prob-

lem. Organizations have figured out that there is an enormous amount of data around their processes, their interac-

tions with customers, their products, and their suppliers. These organizations also recognize that with the increase

in communities and social interactions on the Web, there is additional pressure to collect and analyze vast amounts

of unstructured information contained in these conversations to identify trends, needs, and projections. We believe

that today’s managers face an increasing amount of pressure to understand what is being said by those inside and

outside their corporations and to join those conversations reasonably and responsibly. That is significantly different

from just a few years ago.

This book includes an introduction, 13 chapters of text and mini cases, and a set of case studies, supplemental

readings, and teaching support on a community hub at http://pearlsonandsaunders.com. The Hub provides faculty

members who adopt the text additional resources organized by chapter, including recent news items with teaching

suggestions, videos with usage suggestions, blog posts and discussions from the community, class activities, addi-

tional cases, cartoons, and more. Supplemental materials, including longer cases from all over the globe, can be

found on the Web. Please visit http://www.wiley.com/college/pearlson or the Hub for more information.

The introduction to this text defends the argument presented in this preface that managers must be knowledge-

able participants in making IS decisions. The first few chapters build a basic framework of relationships among

business strategy, IS strategy, and organizational strategy and explore the links among them. The strategy chapters

are followed by ones on work design and business processes that discuss the use of IS. General managers also need

some foundation on how IT is managed if they are to successfully discuss their next business needs with IT pro-

fessionals who can help them. Therefore, the remaining chapters describe the basics of information architecture

and infrastructure, IT security, the business of IT, the governance of the IS organization, IS sourcing, project

management, business analytics, and relevant ethical issues.

Given the acceleration of security breaches, readers will find a new chapter on IS security in this sixth edition of

the text. Also, the material on analytics and “big data” has been extensively updated to reflect the growing impor-

tance of the topic. Further, the chapter on work design has been reorganized and extensively revised. Each of the

other chapters has been revised with newer concepts added, discussions of more current topics fleshed out, and old,

outdated topics removed or at least their discussion shortened.

Similar to the fifth edition, every chapter begins with a navigation “box” to help the reader understand the flow

and key topics of the chapter. Further, most chapters continue to have a Social Business Lens or a Geographic Lens

feature. The Social Business Lens feature reflects on an issue related to the chapter’s main topic but is enabled by or

fundamental to using social technologies in the enterprise. The Geographic Lens feature offers a single idea about

a global issue related to the chapter’s main topic.

No text in the field of MIS is completely current. The process of writing the text coupled with the publication

process makes a book somewhat out‐of‐date prior to delivery to its audience. With that in mind, this text is written

fpref.indd 5 11/27/2015 4:21:12 PM

vi Preface

to summarize the “timeless” elements of using and managing information. Although this text is complete in and

of itself, learning is enhanced by combining the chapters with the most current readings and cases. Faculty are

encouraged to read the news items on the faculty Hub before each class in case one might be relevant to the topic of

the day. Students are encouraged to search the Web for examples related to topics and current events and bring them

into the discussions of the issues at hand. The format of each chapter begins with a navigational guide, a short case

study, and the basic language for a set of important management issues. These are followed by a set of managerial

concerns related to the topic. The chapter concludes with a summary, key terms, a set of discussion questions, and

case studies.

Who should read this book? General managers interested in participating in IS decisions will find this a good

reference resource for the language and concepts of IS. Managers in the IS field will find the book a good resource

for beginning to understand the general manager’s view of how IS affect business decisions. And IS students will

be able to use the book’s readings and concepts as the beginning in their journey to become informed and success-

ful businesspeople.

The information revolution is here. Where do you fit in?

Keri E. Pearlson, Carol S. Saunders, and Dennis F. Galletta

fpref.indd 6 11/27/2015 4:21:12 PM

vii

Books of this nature are written only with the support of many individuals. We would like to personally thank

several individuals who helped with this text. Although we ’ ve made every attempt to include everyone who helped

make this book a reality, there is always the possibility of unintentionally leaving some out. We apologize in

advance if that is the case here.

Thank you goes to Dr. William Turner of LeftFour , in Austin, Texas, for help with the infrastructure and

architecture concepts and to Alan Shimel, Editor‐in‐Chief at DevOps.com for initial ideas for the new security

chapter.

We also want to acknowledge and thank pbwiki.com. Without its incredible and free wiki, we would have been

relegated to e‐mailing drafts of chapters back and forth, or saving countless fi les in an external drop box without

any opportunity to include explanations or status messages. For this edition, as with earlier editions, we wanted to

use Web 2.0 tools as we wrote about them. We found that having used the wiki for our previous editions, we were

able to get up and running much faster than if we had to start over without the platform.

We have been blessed with the help of our colleagues in this and in previous editions of the book. They

helped us by writing cases and reviewing the text. Our thanks continue to go out to Jonathan Trower, Espen

Andersen, Janis Gogan, Ashok Rho, Yvonne Lederer Antonucci, E. Jose Proenca, Bruce Rollier, Dave Oliver, Celia

Romm, Ed Watson, D. Guiter, S. Vaught, Kala Saravanamuthu, Ron Murch, John Greenwod, Tom Rohleder, Sam

Lubbe, Thomas Kern, Mark Dekker, Anne Rutkowski, Kathy Hurtt, Kay Nelson, Janice Sipior, Craig Tidwell, and

John Butler. Although we cannot thank them by name, we also greatly appreciate the comments of the anonymous

reviewers who have made a mark on this edition.

The book would not have been started were it not for the initial suggestion of a wonderful editor in 1999 at John

Wiley & Sons, Beth Lang Golub. Her persistence and patience helped shepherd this book through many previous

editions. We also appreciate the help of our current editor, Lise Johnson. Special thanks go to Jane Miller, Gladys

Soto, Loganathan Kandan, and the conscientious JaNoel Lowe who very patiently helped us through the revision

process. We also appreciate the help of all the staff at Wiley who have made this edition a reality.

We would be remiss if we did not also thank Lars Linden for the work he has done on the Pearlson and Saunders

Faculty Hub for this book. Our vision included a Web‐based community for discussing teaching ideas and post-

ing current articles that supplement this text. Lars made that vision into a reality starting with the last edition and

continuing through the present. Thank you, Lars!

From Keri: Thank you to my husband, Yale, and my daughter, Hana, a business and computer science student at

Tulane University. Writing a book like this happens in the white space of our lives—the time in between everything

else going on. This edition came due at a particularly frenetic time, but they listened to ideas, made suggestions, and

celebrated the book ’ s completion with us. I know how lucky I am to have this family. I love you guys!

From Carol: I would like to thank the Dr. Theo and Friedl Schoeller Research Center of Business and Society for

their generous support of my research. Rusty, thank you for being my compass and my release valve. I couldn ’ t do

it without you. Paraphrasing the words of an Alan Jackson song (“Work in Progress”): I may not be what you want

me to be, but I ’ m trying really hard. Just be patient because I ’ m a work in progress. I love you, Kristin, Russell,

and Janel very much!

From Dennis: Thanks to my terrifi c family: my wife Carole, my daughters Christy and Lauren, and my grand-

daughter Gracie. Also thanks to Matt and Jacob, two lovable guys who take wonderful care of my daughters. Finally,

thanks to our parents and sisters ’ families. We are also blessed with a large number of great, caring neighbors whom

we see quite often. I love you all, and you make it all worthwhile!

Acknowledgments

fack.indd 7 11/27/2015 4:24:53 PM

viii

Dr. Keri E. Pearlson is President of KP Partners , an advisory services fi rm working with business leaders on issues

related to the strategic use of information systems (IS) and organizational design. She is an entrepreneur, teacher,

researcher, consultant, and thought leader. Dr. Pearlson has held various positions in academia and industry. She

has been a member of the faculty at the Graduate School of Business at the University of Texas at Austin where she

taught management IS courses to MBAs and executives and at Babson College where she helped design the popular

IS course for the Fast Track MBA program. Dr. Pearlson has held positions at the Harvard Business School, CSC,

nGenera (formerly the Concours Group), AT&T , and Hughes Aircraft Company . While writing this edition, she was

the Research Director for the Analytics Leadership Consortium at the International Institute of Analytics and was

named the Leader of the Year by the national Society of Information Management (SIM) 2014.

Dr. Pearlson is coauthor of Zero Time: Providing Instant Customer Value—Every Time, All the Time (John Wiley, 2000). Her work has been published in numerous places including Sloan Management Review, Academy of Management Executive, and Information Resources Management Journal . Many of her case studies have been published by Harvard Business Publishing and are used all over the world. She currently writes a blog on issues at

the intersection of IT and business strategy. It ’ s available at www.kppartners.com.

Dr. Pearlson holds a Doctorate in Business Administration (DBA) in Management Information Systems from

the Harvard Business School and both a Master ’ s Degree in Industrial Engineering Management and a Bachelor ’ s

Degree in Applied Mathematics from Stanford University.

Dr. Carol S. Saunders is Research Professor at the W. A. Franke College of Business, Northern Arizona

University in Flagstaff, Arizona, and is a Schoeller Senior Fellow at the Friedrich‐Alexander University of

Erlangen‐Nuremberg, Germany. She served as General Conference Chair of the International Conference on

Information Systems (ICIS) in 1999 and as Program Co‐Chair of the Americas Conference of Information

Systems (AMCIS) in 2015. Dr. Saunders was the Chair of the ICIS Executive Committee in 2000. For three

years, she served as Editor‐in‐Chief of MIS Quarterly . She is currently on the editorial boards of Journal of Strategic Information Systems and Organization Science and serves on the advisory board of Business & Information Systems Engineering. Dr. Saunders has been recognized for her lifetime achievements by the Association of Information Systems (AIS) with a LEO award and by the Organizational Communication and

Information Systems Division of the Academy of Management. She is a Fellow of the AIS.

Dr. Saunders ’ current research interests include the impact of IS on power and communication, overload,

virtual teams, time, sourcing, and interorganizational linkages. Her research is published in a number of journals

including MIS Quarterly, Information Systems Research, Journal of MIS, Communications of the ACM, Journal of Strategic Information Systems, Journal of the AIS, Academy of Management Journal, Academy of Management Review, Communications Research , and Organization Science .

Dr. Dennis F. Galletta is Professor of Business Administration at the Katz Graduate School of Business,

University of Pittsburgh in Pennsylvania. He is also the Director of the Katz School ’ s doctoral program and has

taught IS Management graduate courses in Harvard ’ s summer program each year since 2009. He obtained his

doctorate from the University of Minnesota in 1985 and is a Certifi ed Public Accountant. Dr. Galletta served as

President of the Association of Information Systems (AIS) in 2007. Like Dr. Saunders, he is both a Fellow of

the AIS and has won a LEO lifetime achievement award. He was a member of the AIS Council for fi ve years.

He also served in leadership roles for the International Conference on Information Systems (ICIS): Program

Co‐Chair in 2005 (Las Vegas) and Conference Co‐Chair in 2011 (Shanghai); as Program Co‐Chair for the

About the Authors

fabout.indd 8 11/27/2015 4:25:42 PM

ixAbout the Authors

Americas Conference on Information Systems (AMCIS) in 2003 (Tampa, Florida) and Inaugural Conference

Chair in 1995 (Pittsburgh). The Pittsburgh conference had several “firsts” for an IS conference, including the first

on‐line submissions, reviews, conference registration and payment, placement service, and storage of all papers

in advance on a website. Dr. Galletta served as ICIS Treasurer from 1994 to 1998 and Chair of the ICIS Execu-

tive Committee in 2012. He taught IS courses on the Fall 1999 Semester at Sea voyage (Institute for Shipboard

Education) and established the concept of Special Interest Groups in AIS in 2000. In 2014, he won an Emerald

Citation of Excellence for a co‐authored article that reached the top 50 in citations and ratings from the fields of

management, business, and economics.

Dr. Galletta’s current research addresses online and mobile usability and behavioral security issues such as

phishing, protection motivation, and antecedents of security‐related decision making. He has published his research

in journals such as Management Science; MIS Quarterly; Information Systems Research; Journal of MIS; European Journal of Information Systems; Journal of the AIS; Communications of the ACM; Accounting, Management, and Information Technologies; Data Base; and Decision Sciences and in proceedings of conferences such as ICIS, AMCIS, and the Hawaii International Conference on Systems Sciences. Dr. Galletta’s editorship includes working as current and founding Coeditor in Chief for AIS Transactions on Human‐Computer Interaction and on editorial boards at journals such as MIS Quarterly, Information Systems Research, Journal of MIS, and Journal of the AIS. He is currently on the Pre‐eminent Scholars Board of Data Base. He won a Developmental Associate Editor Award at the MIS Quarterly in 2006. And during the off‐hours, Dr. Galletta’s fervent hobby and obsession is digital pho- tography, often squinting through his eyepiece to make portrait, macro, Milky Way, and lightning photos when he

should be writing.

fabout.indd 9 11/27/2015 4:25:42 PM

x

Contents

Preface iv

Acknowledgments vii

About the Authors viii

Introduction 1

The Case for Participating in Decisions about Information Systems 2 What If a Manager Doesn’t Participate? 5 Skills Needed to Participate Effectively in Information Technology Decisions 6 Basic Assumptions 8 Economics of Information versus Economics of Things 12 Social Business Lens 14

Summary 15

Key Terms 16

1 The Information Systems Strategy Triangle 17

Brief Overview of Business Strategy Frameworks 19

Business Models versus Business Strategy 21

Brief Overview of Organizational Strategies 25

Brief Overview of Information Systems Strategy 26

Social Business Lens: Building a Social Business Strategy 27

Summary 28

Key Terms 29

Discussion Questions 29

Case Study 1‐1 Lego 30

Case Study 1‐2 Google 31

2 Strategic Use of Information Resources 33

Evolution of Information Resources 34

Information Resources as Strategic Tools 36

How Can Information Resources Be Used Strategically? 37

Sustaining Competitive Advantage 43

Social Business Lens: Social Capital 47

Strategic Alliances 47

Risks 49

Geographic Box: Mobile‐Only Internet Users Dominate Emerging Countries 50

Co‐Creating IT and Business Strategy 50

ftoc.indd 10 11/27/2015 8:36:37 PM

xiContents

Summary 51

Key Terms 51

Discussion Questions 51

Case Study 2‐1 Groupon 52

Case Study 2‐2 Zipcar 53

3 Organizational Strategy and Information Systems 55

Information Systems and Organizational Design 58

Social Business Lens: Social Networks 63

Information Systems and Management Control Systems 63

Information Systems and Culture 66

Geographic Lens: Does National Culture Affect Firm Investment in IS Training? 70

Summary 71

Key Terms 71

Discussion Questions 71

Case Study 3‐1 The Merger of Airtran by Southwest Airlines: Will the Organizational Cultures Merge? 72

Case Study 3‐2 The FBI 73

4 Digital Systems and the Design of Work 75

Work Design Framework 77

How Information Technology Changes the Nature of Work 78

Social Business Lens: Activity Streams 84

Where Work Is Done and Who Does It: Mobile and Virtual Work Arrangements 86

Geographic Lens: How Do People Around the World Feel About Working Remotely? 88

Geographic Lens: Who Telecommutes? A Look at Global Telecommuting Habits 89

Gaining Acceptance for IT‐Induced Change 94

Summary 96

Key Terms 97

Discussion Questions 97

Case Study 4‐1 Trash and Waste Pickup Services, Inc. 97

Case Study 4‐2 Social Networking: How Does IBM Do It? 98

5 Information Systems and Business Transformation 99

Silo Perspective versus Business Process Perspective 100

Building Agile and Dynamic Business Processes 104

Changing Business Processes 105

Workflow and Mapping Processes 107

Integration versus Standardization 109

Enterprise Systems 110

Geographic Lens: Global vs. Local ERPs 113

Social Business Lens: Crowdsourcing Changes Innovation Processes 118

Summary 119

Key Terms 120

ftoc.indd 11 11/27/2015 8:36:37 PM

xii Contents

Discussion Questions 120

Case Study 5‐1 Santa Cruz Bicycles 121

Case Study 5‐2 Boeing 787 Dreamliner 122

6 Architecture and Infrastructure 124

From Vision to Implementation 125

The Leap from Strategy to Architecture to Infrastructure 126

From Strategy to Architecture to Infrastructure: An Example 133

Architectural Principles 135

Enterprise Architecture 136

Virtualization and Cloud Computing 137

Other Managerial Considerations 139

Social Business Lens: Building Social Mobile Applications 143

Summary 144

Key Terms 144

Discussion Questions 145

Case Study 6‐1 Enterprise Architecture at American Express 145

Case Study 6‐2 The Case of Extreme Scientists 146

7 Security 147

IT Security Decision Framework 149

Breaches and How They Occurred 151

The Impossibility of 100% Security 154

What Should Management Do? 155

Summary 162

Key Terms 163

Discussion Questions 163

Case Study 7-1 The Aircraft Communications Addressing and Reporting System (ACARS) 163

Case Study 7-2 Sony Pictures: The Criminals Won 164

8 The Business of Information Technology 165

Organizing to Respond to Business: A Maturity Model 167

Understanding the IT Organization 168

What a Manager Can Expect from the IT Organization 168

What the IT Organization Does Not Do 170

Chief Information Officer 171

Building a Business Case 173

IT Portfolio Management 175

Valuing IT Investments 176

Monitoring IT Investments 177

Funding IT Resources 182

How Much Does IT Cost? 184

Summary 187

ftoc.indd 12 11/30/2015 7:27:16 PM

xiiiContents

Key Terms 188

Discussion Questions 188

Case Study 8‐1 KLM Airlines 189

Case Study 8‐2 Balanced Scorecards at BIOCO 190

9 Governance of the Information Systems Organization 191

IT Governance 192

Decision‐Making Mechanisms 199

Governance Frameworks for Control Decisions 200

Social Business Lens: Governing the Content 204

Summary 205

Key Terms 205

Discussion Questions 205

Case Study 9‐1 IT Governance at University of the Southeast 205

Case Study 9‐2 The “MyJohnDeere” Platform 207

10 Information Systems Sourcing 208

Sourcing Decision Cycle Framework 209

Social Business Lens: Crowdsourcing 214

Geographic Lens: Corporate Social Responsibility 220

Outsourcing in the Broader Context 224

Summary 225

Key Terms 225

Discussion Questions 225

Case Study 10‐1 Crowdsourcing at AOL 225

Case Study 10‐2 Altia Business Park 226

11 Managing IT Projects 228

What Defines a Project? 230

What Is Project Management? 231

Organizing for Project Management 232

Project Elements 233

IT Projects 239

IT Project Development Methodologies and Approaches 240

Social Business Lens: Mashups 247

Managing IT Project Risk 247

Summary 253

Key Terms 254

Discussion Questions 254

Case Study 11‐1 Implementing Enterprise Change Management at Southern Company 254

Case Study 11‐2 Dealing with Traffic Jams in London 255

ftoc.indd 13 11/27/2015 8:36:37 PM

xiv Contents

12 Business Intelligence, Knowledge Management, and Analytics 258

Competing with Business Analytics 259

Knowledge Management, Business Intelligence, and Business Analytics 260

Data, Information, and Knowledge 261

Knowledge Management Processes 264

Business Intelligence 264

Components of Business Analytics 265

Big Data 268

Social Media Analytics 269

Social Business Lens: Personalization and Real‐Time Data Streams 271

Geographic Lens: When Two National Views of Intellectual Property Collide 272

Caveats for Managing Knowledge and Business Intelligence 274

Summary 274

Key Terms 275

Discussion Questions 275

Case Study 12‐1 Stop & Shop’s Scan It! App 275

Case Study 12‐2 Business Intelligence at CKE Restaurants 276

13 Privacy and Ethical Considerations in Information Management 278

Responsible Computing 280

Corporate Social Responsibility 283

PAPA: Privacy, Accuracy, Property, and Accessibility 284

Social Business Lens: Personal Data 289

Geographic Lens: Should Subcultures Be Taken into Account When Trying to Understand National

Attitudes Toward Information Ethics? 292

Green Computing 292

Summary 293

Key Terms 294

Discussion Questions 294

Case Study 13‐1 Ethical Decision Making 295

Case Study 13‐2 Midwest Family Mutual Goes Green 297

Glossary 299 Index 313

ftoc.indd 14 11/27/2015 8:36:37 PM

1

Introduction

Why do managers need to understand and participate in the information systems decisions of their

organizations? After all, most corporations maintain entire departments dedicated to the management

of information systems (IS). These departments are staffed with highly skilled professionals devoted

to the fi eld of technology. Shouldn’t managers rely on experts to analyze all the aspects of IS and

to make the best decisions for the organization? The answer to that question is an emphatic “no.”

Managing information is a critical skill for success in today ’ s business environment. All decisions

made by companies involve, at some level, the management and use of IS and the interpretation of

data from the business and its environment. Managers today need to know about their organization ’ s

capabilities and uses of information as much as they need to understand how to obtain and budget

fi nancial resources. The ubiquity of personal devices such as smart phones, laptops, and tablets and

of access to apps within corporations and externally over the Internet, highlights this fact. Today ’ s

technologies form the backbone for virtually all business models. This backbone easily crosses

oceans, adding the need for a global competency to the manager ’ s skill set. Further, the proliferation

of supply chain partnerships and the vast amount of technology available to individuals outside of

the corporation have extended the urgent need for business managers to be involved in information

systems decisions. In addition, the availability of seemingly free (or at least very inexpensive) appli-

cations, collaboration tools, and innovation engines in the consumer arena has put powerful tools in

everyone ’ s hands, increasing the diffi culty of ensuring that corporate systems are robust, secure, and

protected. A manager who doesn ’ t understand the basics of managing and using information can ’ t

be successful in this business environment.

The majority of U.S. adults own a smart phone and access online apps. According to the Pew

Research Center , in 2014, 90% of U.S. adults had a cell phone of some kind, and 87% of American

adults used the Internet. 1 Essentially the use of these types of devices implies that individuals now

manage a “personal IS” and make decisions about usage, data, and applications. Doesn ’ t that give

them insight into managing information systems in corporations? Students often think they are

experts in corporate IS because of their personal experience with technology. Although there is some

truth in that perspective, it ’ s a very dangerous perspective for managers to take. Certainly knowing

about interesting apps, being able to use a variety of technologies for different personal purposes,

and being familiar with the ups and downs of networking for their personal information systems pro-

vide some experience that is useful in the corporate setting. But in a corporate setting, information

systems must be enterprise‐ready. They must be scalable for a large number of employees; they

must be delivered in an appropriate manner for the enterprise; they must be managed with corpo-

rate guidelines and appropriate governmental regulations in mind. Issues like security, privacy, risk,

support, and architecture take on a new meaning within an enterprise, and someone has to manage

them. Enterprise‐level management and use of information systems require a unique perspective and

a different skill set.

1 Internet Use and Cell Phone Demographics, http://www.pewinternet.org/data‐trend/internet‐use/internet‐use‐over‐time (accessed

August 18, 2015).

cintro.indd 1 11/26/2015 7:38:29 PM

2 Introduction

Consider the now‐historic rise of companies such as Amazon.com, Google, and Zappos. Amazon.com began as

an online bookseller and rapidly outpaced traditional brick‐and‐mortar businesses like Barnes and Noble, Borders,

and Waterstones. Management at the traditional companies responded by having their IS support personnel build

Web sites to compete. But upstart Amazon.com moved ahead, keeping its leadership position on the Web by lever-

aging its business model into other marketplaces, such as music, electronics, health and beauty products, lawn and

garden products, auctions, tools and hardware, and more. It cleared the profitability hurdle by achieving a good

mix of IS and business basics: capitalizing on operational efficiencies derived from inventory software and smarter

storage, cost cutting, and effectively partnering with such companies as Toys “R” Us Inc. and Target Corporation.2

More recently, Amazon.com changed the basis of competition in another market, but this time it was the Web ser-

vices business. Amazon.com Web services offers clients the extensive technology platform used for Amazon.com

but in an on‐demand fashion for developing and running the client’s own applications. Shoe retailer Zappos.com

challenged Amazon’s business model, in part by coupling a social business strategy with exemplary service and

sales. It was so successful that Amazon.com bought Zappos.

Likewise, Google built a business that is revolutionizing the way information is found. Google began in 1999

as a basic search company but its managers quickly learned that its unique business model could be leveraged

for future success in seemingly unrelated areas. The company changed the way people think about Web content

by making it available in a searchable format with an incredibly fast response time and in a host of languages.

Further, Google’s keyword‐targeted advertising program revolutionized the way companies advertise. Then Google

expanded, offering a suite of Web‐based applications, such as calendaring, office tools, e‐mail, collaboration,

shopping, and maps and then enhanced the applications further by combining them with social tools to increase

collaboration. Google Drive is one of the most popular file‐sharing tools and Gmail one of the most popular email

apps. In 2015, Google’s mission was to “organize the world’s information and make it universally accessible and

useful.” It is offering its customers very inexpensive fiber connections. In so doing, Google further expanded into

infrastructure and on‐demand services.3

These and other online businesses are able to succeed where traditional companies have not, in part because their

management understood the power of information, IS, and the Web. These exemplary online businesses aren’t suc-

ceeding because their managers could build Web pages or assemble an IS network. Rather, the executives in these

new businesses understand the fundamentals of managing and using information and can marry that knowledge

with a sound, unique business vision to dominate their intended market spaces.

The goal of this book is to provide the foundation to help the general business manager become a knowledge-

able participant in IS decisions because any IS decision in which the manager doesn’t participate can greatly affect

the organization’s ability to succeed in the future. This introduction outlines the fundamental reasons for taking the

initiative to participate in IS decisions. Moreover, because effective participation requires a unique set of manage-

rial skills, this introduction identifies the most important ones. These skills are helpful for making both IS decisions

and all business decisions. We describe how managers should participate in the decision‐making process. Finally,

this introduction presents relevant models for understanding the nature of business and information systems. These

models provide a framework for the discussions that follow in subsequent chapters.

The Case for Participating in Decisions about Information Systems In today’s business environment, maintaining a back‐office view of technology is certain to cost market share and

could ultimately lead to the failure of the organization. Managers who claim ignorance of IS can damage their

reputation. Technology has become entwined with all the classic functions of business—operations, marketing,

accounting, finance—to such an extent that understanding its role is necessary for making intelligent and effec-

tive decisions about any of them. Furthermore, a general understanding of key IS concepts is possible without the

extensive technological knowledge required just a few years ago. Most managers today have personal technology

2 Robert Hof, “How Amazon Cleared the Profitability Hurdle” (February 4, 2002), http://www.bloomberg.com/bw/stories/2002-02-03/how-amazon-

cleared-the-profitability-hurdle (accessed on October 29, 2015). 3 For more information on the latest services by these two companies, see http://aws.amazon.com/ec2 and http://www.google.com/enterprise/cloud/.

cintro.indd 2 11/26/2015 7:38:29 PM

3The Case for Participating in Decisions about Information Systems

such as a smart phone or tablet that is more functional than many corporate‐supported personal computers provided

by enterprises just a few years ago. In fact, the proliferation of personal technologies makes everyone a “pseudo‐

expert.” Each individual must manage applications on smart phones, make decisions about applications to purchase,

and procure technical support when the systems fail. Finally, with the robust number of consumer applications

available on the Web, many decisions historically made by the IS group are increasingly being made by individuals

outside that group, sometimes to the detriment of corporate objectives.

Therefore, understanding basic fundamentals about using and managing information is worth the investment of

time. The reasons for this investment are summarized in Figure I-1 and are discussed next.

A Business View of Critical Resources

Information technology (IT) is a critical resource for today’s businesses. It both supports and consumes a significant

amount of an organization’s resources. Just like the other three major types of business resources—people, money,

and machines—it needs to be managed wisely.

IT spending represents a significant portion of corporate budgets. Worldwide IT spending topped $3.7 trillion in

2014. It is projected to continue to increase.4 A Gartner study of where this money goes groups spending into five

categories including devices (e.g., PCs, tablets, and mobile phones), data center systems (e.g., network equipment,

servers, and storage equipment), enterprise software and apps (e.g., companywide software applications), IT ser-

vices (e.g., support and consulting services), and telecommunications (e.g., the expenses paid to vendors for voice

and data services).

Resources must return value, or they will be invested elsewhere. The business manager, not the IS specialist,

decides which activities receive funding, estimates the risk associated with the investment, and develops metrics

for evaluating the investment’s performance. Therefore, the business manager needs a basic grounding in managing

and using information. On the flip side, IS managers need a business view to be able to explain how technology

impacts the business and what its trade‐offs are.

People and Technology Work Together

In addition to financial issues, managers must know how to mesh technology and people to create effective work

processes. Collaboration is increasingly common, especially with the rise of social networking. Companies are

reaching out to individual customers using social technologies such as Facebook, Twitter, Reddit, Renren, YouTube,

and numerous other tools. In fact, Web 2.0 describes the use of the World Wide Web applications that incorporate information sharing, user‐centered design, interoperability, and collaboration among users. Technology facilitates

FIGURE I-1 Reasons why business managers should participate in information systems decisions.

Reasons

IS must be managed as a critical resource since it permeates almost every aspect of business.

IS enable change in the way people work both inside and outside of the enterprise.

IS are at the heart of integrated Internet‐based solutions that are replacing standard business processes.

IS enable or inhibit business opportunities and new strategies.

IS can be used to combat business challenges from competitors.

IS enable customers to have greater pull on businesses and communities by giving them new options for voicing their concerns and opinions using social media.

IS can support data‐driven decision making.

IS can help ensure the security of key assets.

4 http://www.gartner.com/newsroom/id/2959717/ (accessed March 5, 2015).

cintro.indd 3 11/26/2015 7:38:29 PM

4 Introduction

the work that people do and the way they interact with each other. Appropriately incorporating IS into the design

of a business model enables managers to focus their time and resources on issues that bear directly on customer

satisfaction and other revenue‐ and profit‐generating activities.

Adding a new IS to an existing organization, however, requires the ability to manage change. Skilled business

managers must balance the benefits of introducing new technology with the costs associated with changing the

existing behaviors of people in the workplace. There are many choices of technology solutions, each with a different

impact. Managers’ decisions must incorporate a clear understanding of the consequences. Making this assessment

doesn’t require detailed technical knowledge. It does require an understanding of short‐term and long‐term con-

sequences risk mitigation, and why adopting new technology may be more appropriate in some instances than in

others. Understanding these issues also helps managers know when it may prove effective to replace people with

technology at certain steps in a process.

Integrating Business with Information Systems

IS are integrated with almost every aspect of business and have been for quite some time. For example, the CTO of

@WalmartLabs, Jeremy King, wrote in a blog,

There used to be a big distinction between tech companies: those that develop enterprise technology for businesses,

and the global companies that depend on those products. But that distinction is now diminishing for this simple reason:

every global company is becoming a tech company. . . . we’re seeing technology as a critical component for business

success.5

Walmart built platforms to support all of its ecommerce and digital shopping experiences around the world.

Walmart’s teams created a new search engine to enable engaging and efficient ways for on‐line customers to find

items in inventory. IS placed information in the hands of Walmart associates so that decisions could be made closer

to the customer. IS simplified organizational activities and processes such as moving goods, stocking shelves, and

communicating with suppliers. For example, handheld scanners provide floor associates with immediate and real‐

time access to inventory in their store and the ability to locate items in surrounding stores, if necessary.

Opportunities and New Strategies Derived from Rapid Changes in Technology

The proliferation of new technologies creates a business environment filled with opportunities. The rate of adop-

tion of these new technologies has increased due in part to the changing demographics of the workforce and the

integration of “digital natives,” individuals whose entire lives have been lived in an era with Internet availability. Therefore digital natives are completely fluent in the use of personal technologies and the Web. Even today, inno-

vative uses of the Internet produce new types of online businesses that keep every manager and executive on alert.

New business opportunities spring up with little advance warning. The manager’s role is to frame these oppor-

tunities so that others can understand them, evaluate them against existing business needs and choices, and then

pursue those that fit with an articulated business strategy. The quality of the information at hand affects the quality

of both decisions and their implementation. Managers must develop an understanding of what information is cru-

cial to the decisions, how to get it, and how to use it. They must lead the changes driven by IS.

Competitive Challenges

Competitors come from both expected and unexpected places. General managers are in the best position to see the

emerging threats and utilize IS effectively to combat ever‐changing competitive challenges. Further, general man-

agers are often called on to demonstrate a clear understanding of how their own technology programs and products

5 Jeremy King, “Why Every Company Is a Tech Company” (November 21, 2013), http://www.walmartlabs.com/2013/11/21/why‐every‐company‐is‐a‐

tech‐company‐by‐jeremy‐king‐cto‐of‐walmartlabs (accessed August 18, 2015).

cintro.indd 4 11/26/2015 7:38:29 PM

5What If a Manager Doesn’t Participate?

compare with those of their competitors. A deep understanding of the capabilities of the organization coupled with

existing IS can create competitive advantages and change the competitive landscape for the entire industry.

Customer Pull

With the emergence of social networks like Facebook, microblogs like Twitter, and other Web applications like

Yelp, businesses have had to redesign their existing business models to account for the change in power now

wielded by customers and others in their communities. Social media and other web apps have given powerful

voices to customers and communities, and businesses must listen. Redesigning the customer experience when inter-

acting with a company is paramount for many managers and the key driver is IS. Social IT enables new and often

deeper relationships with a large number of customers, and companies are learning how to integrate and leverage

this capability into existing and new business models.

Data‐Driven Decision Making

Managers are increasingly using evidence‐based management to make decisions based on data gathered from

experiments, internal files, and other relevant sources. Data‐driven decision making, based on new techniques for

analytics, data management, and business intelligence, has taken on increased importance. Social media have cre-

ated a rich stream of real‐time data that gives managers increased insights to the impact of decisions much faster

than traditional systems. Mid‐course corrections are much easier to make. Predictive and prescriptive analytics give

suggestions that are eerily close to what happens. Big data stores can be mined for insights that were unavailable

with traditional IS, creating competitive advantage for companies with the right tools and techniques.

Securing Key Assets

As the use of the Internet grows, so does the opportunity for new and unforeseen threats to company assets. Taking

measures to ensure the security of these assets is increasingly important. But decisions about security measures

also impact the way IS can be used. It’s possible to put so much security around IT assets that they are locked down

in a manner that gets in the way of business. At the same time, too little security opens up the possibility of theft,

hacking, phishing, and other Web‐based mischief that can disrupt business. Managers must be involved in decisions

about risk and security to ensure that business operations are in sync with the resulting security measures.

What If a Manager Doesn’t Participate? Decisions about IS directly affect the profits of a business. The basic formula Profit = Revenue − Expenses can

be used to evaluate the impact of these decisions. Adopting the wrong technologies can cause a company to miss

business opportunities and any revenues those opportunities would generate. For example, inadequate IS can cause

a breakdown in servicing customers, which hurts sales. Poorly deployed social IT resources can badly damage

the reputation of a strong brand. On the expense side, a miscalculated investment in technology can lead to over-

spending and excess capacity or underspending and restricted opportunity. Inefficient business processes sustained

by ill‐fitting IS also increase expenses. Lags in implementation or poor process adaptation reduces profits and there-

fore growth. IS decisions can dramatically affect the bottom line.

Failure to consider IS strategy when planning business strategy and organizational strategy leads to one of three

business consequences: (1) IS that fail to support business goals, (2) IS that fail to support organizational systems,

and (3) a misalignment between business goals and organizational capabilities. These consequences are discussed

briefly in the following section and in more detail in later chapters. The driving questions to consider are the poten-

tial effects on an organization’s ability to achieve its business goals. How will the consequences impact the way

people work? Will the organization still be able to implement its business strategy?

cintro.indd 5 11/26/2015 7:38:29 PM

6 Introduction

Information Systems Must Support Business Goals

IS represent a major investment for any firm in today’s business environment. Yet poorly chosen IS can actually

become an obstacle to achieving business goals. The results can be disastrous if the systems do not allow the orga-

nization to realize its goals. When IS lack the capacity needed to collect, store, and transfer critical information for

the business, decisions can be impacted and options limited. Customers will be dissatisfied or even lost. Production

costs may be excessive. Worst of all, management may not be able to pursue desired business directions that are

blocked by inappropriate IS. Victoria’s Secret experienced this problem when a Superbowl ad promoting an online

fashion show generated so many inquiries to its Web site that the Web site crashed. Spending large amounts of

money on the advertisement was wasted when potential customers could not access the site. Likewise, Toys “R”

Us experienced a similar calamity when its well‐publicized Web site was unable to process and fulfill orders fast

enough one holiday season. It not only lost those customers, but it also had a major customer‐relations issue to

manage as a result.

Information Systems Must Support Organizational Systems

Organizational systems represent the fundamental elements of a business—its people, work processes, tasks, struc-

ture, and control systems—and the plan that enables them to work efficiently to achieve business goals. If the

company’s IS fail to support its organizational systems, the result is a misalignment of the resources needed to

achieve its goals. For example, it seems odd to think that a manager might add functionality to a corporate Web

site without providing the training the employees need to use the tool effectively. Yet, this mistake—and many

more costly ones—occurs in businesses every day. Managers make major IS decisions without informing all the

staff of resulting changes in their daily work. For example, an enterprise resource planning (ERP) system often

dictates how many business processes are executed and the organizational systems must change to reflect the new

processes. Deploying technology without thinking through how it actually will be used in the organization—who

will use it, how they will use it, and how to make sure the applications chosen will actually accomplish what is

intended—results in significant expense. In another example, a company may decide to block access to the Internet,

thinking that it is prohibiting employees from accessing offensive or unsecure sites. But that decision also means

that employees can’t access social networking sites that may be useful for collaboration or other Web‐based appli-

cations that may offer functionality to make the business more efficient.

The general manager, who, after all, is charged with ensuring that company resources are used effectively,

must guarantee that the company’s IS support its organizational systems and that changes made in one system are

reflected in the other. For example, a company that plans to allow employees to work remotely needs an information

system strategy compatible with its organizational strategy. Desktop PCs located within the corporate office aren’t

the right solution for a telecommuting organization. Instead, laptop computers or tablets with applications that are

accessible online anywhere and anytime and networks that facilitate information sharing are needed. Employees

may want to use tablets or smart phones remotely, too, and those entail a different set of IS processes. If the orga-

nization allows the purchase of only desktop PCs and builds systems accessible from desks within the office, the

telecommuting program is doomed to failure.

Skills Needed to Participate Effectively in Information Technology Decisions Participating in IT decisions means bringing a clear set of skills to the table. All managers are asked to take on

tasks that require different skills at different times. Those tasks can be divided into three types: visionary tasks, or

those that provide leadership and direction for the group; informational/interpersonal tasks, or those that provide

information and knowledge the group needs to be successful; and structural tasks, those that organize the group.

Figure I-2 lists basic skills required of managers who wish to participate successfully in key IT decisions. Not only

does this list emphasize understanding, organizing, planning, and solving the business needs of the organization,

but also it is an excellent checklist for all managers’ professional growth.

cintro.indd 6 11/26/2015 7:38:29 PM

7Skills Needed to Participate Effectively in Information Technology Decisions

These skills may not look much different from those required of any successful manager, which is the main

point of this book: General managers can be successful participants in IS decisions without an extensive technical

background. General managers who understand a basic set of IS concepts and who have outstanding managerial

skills, such as those listed in Figure I-2, are ready for the digital economy.

How to Participate in Information Systems Decisions

Technical wizardry isn’t required to become a knowledgeable participant in the IS decisions of a business. Man-

agers need curiosity, creativity, and the confidence to ask questions in order to learn and understand. A solid frame-

work that identifies key management issues and relates them to aspects of IS provides the background needed to

participate in business IS decisions.

The goal of this book is to provide that framework. The way in which managers use and manage information is

directly linked to business goals and the business strategy driving both organizational and IS decisions. Aligning

business and IS decisions is critical. Business, organizational, and information strategies are fundamentally linked

in what is called the Information Systems Strategy Triangle, discussed in the next chapter. Failing to understand this relationship is detrimental to a business. Failing to plan for the consequences in all three areas can cost a manager

his or her job. This book provides a foundation for understanding business issues related to IS from a managerial

perspective.

Organization of the Book

To be knowledgeable participants, managers must know about both using and managing information. The first

five chapters offer basic frameworks to make this understanding easier. Chapter 1 uses the Information Systems

Strategy Triangle framework to discuss alignment of IS and the business. This chapter also provides a brief over-

view of relevant frameworks for business strategy and organizational strategy. It is provided as background for

those who have not formally studied organization theory or business strategy. For those who have studied these

areas, this chapter is a brief refresher of major concepts used throughout the remaining chapters of the book.

FIGURE I-2 Skills for successful IT use by managerial role.

Managerial Role Skills

Visionary Creativity

Curiosity

Confidence

Focus on business solutions

Flexibility

Informational and Interpersonal Communication

Listening

Information gathering

Interpersonal skills

Structural Project management

Analytical

Organizational

Planning

Leading

Controlling

cintro.indd 7 11/26/2015 7:38:30 PM

8 Introduction

Subsequent chapters provide frameworks and sets of examples for understanding the links between IS and business

strategy (Chapter 2), links between IS and organizational strategy (Chapter 3), collaboration and individual work

(Chapter 4), and business processes (Chapter 5).

The rest of the text covers issues related to the business manager’s role in managing IS itself. These chapters

are the building blocks of an IS strategy. Chapter 6 provides a framework for understanding the four components

of IS architecture: hardware, software, networks, and data. Chapter 7 discusses how managers might participate in

decisions about IS security. Chapter 8 focuses on the business of IT with a look at IS organization, funding models,

portfolios, and monitoring options. Chapter 9 describes the governance of IS resources. Chapter 10 explores sourc-

ing and how companies provision IS resources. Chapter 11 focuses on project and change management. Chapter 12

concerns business intelligence, knowledge management, and analytics and provides an overview of how companies

manage knowledge and create a competitive advantage using business analytics. And finally, Chapter 13 discusses

the ethical use of information and privacy.

Basic Assumptions Every book is based on certain assumptions, and understanding those assumptions makes a difference in interpret-

ing the text. The first assumption made by this text is that managers must be knowledgeable participants in the IS

decisions made within and affecting their organizations. That means that the general manager must develop a basic

understanding of the business and technology issues related to IS. Because technology changes rapidly, this text

also assumes that today’s technology is different from yesterday’s technology. In fact, the technology available

to readers of this text today might even differ significantly from that available when the text was being written.

Therefore, this text focuses on generic concepts that are, to the extent possible, technology independent. It provides

frameworks on which to hang more up‐to‐the‐minute technological evolutions and revolutions, such as new uses of

the Web, new social tools, or new cloud‐based services. We assume that the reader will supplement the discussions

of this text with current case studies and up‐to‐date information about the latest technology.

A second, perhaps controversial, assumption is that the roles of a general manager and of an IS manager require

different skill sets and levels of technical competency. General managers must have a basic understanding of IS in

order to be a knowledgeable participant in business decisions. Without that level of understanding, their decisions

may have serious negative implications for the business. On the other hand, IS managers must have more in‐depth

knowledge of technology so they can partner with general managers who will use the IS. As digital natives take on

increasingly more managerial roles in corporations, this second assumption may change—all managers may need

deeper technical understanding. But for this text, we assume a different, more technical skill set for the IS manager

and we do not attempt to provide that here.

Assumptions about Management

Although many books have been written describing the activities of managers, organizational theorist Henry

Mintzberg offers a view that works especially well with a perspective relevant to IS management. Mintzberg’s

model describes management in behavioral terms by categorizing the three major roles a manager fills: interper-

sonal, informational, and decisional (see Figure I-3). This model is useful because it considers the chaotic nature of

the environment in which managers actually work. Managers rarely have time to be reflective in their approaches

to problems. They work at an unrelenting pace, and their activities are brief and often interrupted. Thus, quality

information becomes even more crucial to effective decision making. The classic view is often seen as a tactical

approach to management, whereas some describe Mintzberg’s view as more strategic.

Assumptions about Business

Everyone has an internal understanding of what constitutes a business, which is based on readings and experi-

ences with different firms. This understanding forms a model that provides the basis for comprehending actions,

interpreting decisions, and communicating ideas. Managers use their internal model to make sense of otherwise

cintro.indd 8 11/26/2015 7:38:30 PM

9Basic Assumptions

FIGURE I-3 Managers’ roles. Source: Adapted from H. Mintzberg, The Nature of Managerial Work (New York: Harper & Row, 1973).

Type of Roles Manager’s Roles IS Examples

Interpersonal Figurehead CIO greets touring dignitaries.

Leader IS manager puts in long hours to help motivate project team to complete project on schedule in an environment of heavy budget cuts.

Liaison CIO works with the marketing and human resource vice presidents to make sure that the reward and compensation system is changed to encourage use of the new IS supporting sales.

Informational Monitor Division manager compares progress on IS project for the division with milestones developed during the project’s initiation and feasibility phase.

Disseminator CIO conveys organization’s business strategy to IS department and demonstrates how IS strategy supports the business strategy.

Spokesperson IS manager represents IS department at organization’s recruiting fair.

Decisional Entrepreneur IS division manager suggests an application of a new technology that improves the division’s operational efficiency.

Disturbance handler IS division manager, as project team leader, helps resolve design disagreements between division personnel who will be using the system and systems analysts who are designing it.

Resource allocator CIO allocates additional personnel positions to various departments based upon the business strategy.

Negotiator IS manager negotiates for additional personnel needed to respond to recent user requests for enhanced functionality in a system that is being implemented.

chaotic and random activities. This book uses several conceptual models of business. Some take a functional view

and others take a process view.

Functional View

The classical view of a business is based on the functions that people perform, such as accounting, finance,

marketing, operations, and human resources. The business organizes around these functions to coordinate them and

to gain economies of scale within specialized sets of tasks. Information first flows vertically up and down between

line positions and management; after analysis, it may be transmitted across other functions for use elsewhere in the

company (see Figure I-4).

Process View

Michael Porter of Harvard Business School describes a business in terms of the primary and support activities that

are performed to create, deliver, and support a product or service. The primary activities are not limited to specific

functions, but rather are cross‐functional processes (see Figure  I-5). For example, an accounts payable process

O p e ra

ti o n s

A c c o u n ti n g

S a

le s

Executive Management

M a rk

e ti n g

S u p p o rt

In fo

rm a ti o n f lo

w s

FIGURE I-4 Hierarchical view of the firm.

cintro.indd 9 11/26/2015 7:38:30 PM

10 Introduction

might involve steps taken by other departments that generate obligations, which the accounting department pays.

Likewise, the product creation process might begin with an idea from R&D, which is transferred to an operations

organization that builds the actual product and involves marketing to get the word out, sales to sell and deliver the

product, and support to provide customer assistance as needed. This view takes into account the activities in each

functional area that are needed to complete a process, and any organization can be described by the processes it

performs. Improving coordination among activities increases business profit. Organizations that effectively manage

core processes across functional boundaries are often the industry leaders because they have made efficiencies that

are not visible from the functional viewpoint. IS are often the key to process improvement and cross‐functional

coordination.

Both the process and functional views are important to understanding IS. The functional view is useful when sim-

ilar activities must be explained, coordinated, executed, or communicated. For example, understanding a marketing

information system means understanding the functional approach to business in general and the marketing function

in particular. The process view, on the other hand, is useful when examining the flow of information throughout a

business. For example, understanding the information associated with order fulfillment, product development, or

customer service means taking a process view of the business. This text assumes that both views are important for

participating in IS decisions.

Assumptions about Information Systems

Consider the components of an information system from the manager’s viewpoint rather than from the technolo-

gist’s viewpoint. Both the nature of information (hierarchy and economics) and the context of an information

system must be examined to understand the basic assumptions of this text.

Information Hierarchy

The terms data, information, and knowledge are often used interchangeably, but have significant and discrete mean- ings within the knowledge management domain (and are more fully explored in Chapter 12). Tom Davenport, in his

book Information Ecology, pointed out that getting everyone in any given organization to agree on common defi- nitions is difficult. However, his work (summarized in Figure I-6) provides a nice starting point for understanding

the subtle but important differences.

The information hierarchy begins with data, or simple observations; data are sets of specific, objective facts or observations, such as “inventory contains 45 units.” Standing alone, such facts have no intrinsic meaning but can be

easily captured, transmitted, and stored electronically.

A c c o u n ti n g

O p e ra

ti o n s

M a rk

e ti n g

S a le

s

S u p p o rt

Executive Management

Accounts Payable Process

Product Development Process

Order Fulfillment Process

Information Flows

FIGURE I-5 Process view of the firm: Cross‐functional processes.

cintro.indd 10 11/26/2015 7:38:30 PM

11Basic Assumptions

Information is data endowed with relevance and purpose.6 People turn data into information by organizing data into some unit of analysis (e.g., dollars, dates, or customers). For example, a mashup of location data and housing

prices adds something beyond what the data provide individually, and that makes it information. A mashup is the term used for applications that combine data from different sources to create a new application on the Web.

To be relevant and have a purpose, information must be considered within the context in which it is received

and used. Because of differences in context, information needs vary across functions and hierarchical levels. For

example, when considering functional differences related to a sales transaction, a marketing department manager

may be interested in the demographic characteristics of buyers, such as their age, gender, and home address. A man-

ager in the accounting department probably won’t be interested in any of these details, but instead wants to know

details about the transaction itself, such as method of payment and date of payment.

Similarly, information needs may vary across hierarchical levels. These needs are summarized in Figure  I-7

and reflect the different activities performed at each level. At the supervisory level, activities are narrow in scope

and focused on the production or the execution of the business’s basic transactions. At this level, information is

focused on day‐to‐day activities that are internally oriented and accurately defined in a detailed manner. The activ-

ities of senior management are much broader in scope. Senior management performs long‐term planning and needs

FIGURE I-6 Comparison of data, information, and knowledge. Source: Adapted from Thomas Davenport, Information Ecology (New York: Oxford University Press, 1997).

Data Information Knowledge

Definition Simple observations of the state of the world

Data endowed with relevance and purpose

Information from the human mind (includes reflection, synthesis, context)

Characteristics • Easily structured • Easily captured on machines • Often quantified • Easily transferred • Mere facts

• Requires unit of analysis • Data that have been

processed • Human mediation

necessary

• Hard to structure • Difficult to capture on machines • Often tacit • Hard to transfer

Example Daily inventory report of all inventory items sent to the CEO of a large manufacturing company

Daily inventory report of items that are below economic order quantity levels sent to inventory manager

Inventory manager’s knowledge of which items need to be reordered in light of daily inventory report, anticipated labor strikes, and a flood in Brazil that affects the supply of a major component

6 Peter F. Drucker, “The Coming of the New Organization,” Harvard Business Review (January–February 1988), 45–53.

Top Management Middle Management Supervisory and Lower‐Level Management

Time Horizon Long: years Medium: weeks, months, years Short: day to day

Level of Detail Highly aggregated Less accurate More predictive

Summarized Integrated Often financial

Very detailed Very accurate Often nonfinancial

Source Primarily external Primarily internal with limited external

Internal

Decision Extremely judgmental Uses creativity and analytical skills

Relatively judgmental Heavily reliant on rules

FIGURE I-7 Information characteristics across hierarchical levels. Source: G. Adapted from Anthony Gorry and Michael S. Scott Morton, “A Framework for Management Information Systems,” Sloan Management Review 13, no. 1, 55–70.

cintro.indd 11 11/26/2015 7:38:30 PM

12 Introduction

information that is aggregated, externally oriented, and more subjective than supervisors require. The information

needs of middle managers in terms of these characteristics fall between the needs of supervisors and of senior

management. Because information needs vary across levels, a daily inventory report of a large manufacturing firm

may serve as information for a low‐level inventory manager whereas the CEO would consider such a report to be

merely data. The context in which the report is used must be considered in determining whether it is information.

Knowledge is information that is synthesized and contextualized to provide value. It is information with the most value. Knowledge consists of a mix of contextual information, values, experiences, and rules. For example,

the mashup of locations and housing prices means one thing to a real estate agent, another thing to a potential buyer,

and yet something else to an economist. It is richer and deeper than information and more valuable because someone

thought deeply about that information and added his or her own unique experience and judgment. Knowledge also

involves the synthesis of multiple sources of information over time.7 The amount of human contribution increases

along the continuum from data to information to knowledge. Computers work well for managing data but are less

efficient at managing information and knowledge.

Some people think there is a fourth level in the information hierarchy: wisdom. Wisdom is knowledge fused with intuition and judgment that facilitates the ability to make decisions. Wisdom is that level of the information

hierarchy used by subject matter experts, gurus, and individuals with a high degree of experience who seem to “just

know” what to do and how to apply the knowledge they gain. This is consistent with Aristotle’s view of wisdom as

the ability to balance different and conflicting elements together in ways that are only learned through experience.

Economics of Information versus Economics of Things In their groundbreaking book, Blown to Bits, Evans and Wurster argued that every business is in the information business.8 Even those businesses not typically considered information businesses have business strategies in which

information plays a critical role. The physical world of manufacturing is shaped by information that dominates

products as well as processes. For example, an automobile contains as much computing power as a personal com-

puter. Information‐intensive processes in the manufacturing and marketing of the automobile include design,

market research, logistics, advertising, and inventory management. The automobile itself, with its millions of lines

of code, has become a computer on wheels with specialized computers and sensors alerting the driver of its health

and road conditions. When taken in for service, maintenance crews simply plug an electronic monitor into the auto-

mobile to analyze and identify worn parts or other areas in need of upgrades and repair.

As our world is reshaped by information‐intensive industries, it becomes even more important for business strat-

egies to differentiate the timeworn economics of things from the evolving economics of information. Things wear

out; things can be replicated at the expense of the manufacturer; things exist in a tangible location. When sold, the

seller no longer owns the thing. The price of a thing is typically based on production costs. In contrast, information

never wears out, although it can become obsolete or untrue. Information can be replicated at virtually no cost

without limit; information exists in the ether. When sold, the seller still retains the information, but this ownership

provides little value if the ability of others to copy it is not limited. Finally, information is often costly to produce

but cheap to reproduce. Rather than pricing it to recover the sunk cost of its initial production, its price is typically

based on its value to the consumer. Figure I-8 summarizes the major differences between the economics of goods

and the economics of information.

Evans and Wurster suggest that traditionally the economics of information has been bundled with the economics

of things. However, in this Information Age, firms are vulnerable if they do not separate the two. The Encyclopedia

Britannica story serves as an example. Bundling the economics of things with the economics of information made

it difficult for Encyclopedia Britannica to gauge two serious threats. The first threat was posed by Encarta, an entire

encyclopedia on a CD‐ROM that was given away to promote the sale of computers and peripherals. The second

was Wikipedia, which is freely available to all and updated on a nearly real‐time basis continuously by thousands of

7 Thomas H. Davenport, Information Ecology (New York: Oxford University Press, 1997), 9–10. 8 Philip Evans and Thomas Wurster, Blown to Bits (Boston: Harvard Business School Press, 2000).

cintro.indd 12 11/26/2015 7:38:30 PM

13Economics of Information versus Economics of Things

volunteers; currently Wikipedia reports that it holds over 4.9 million articles, receives 10 edits per second globally,

and boasts 750 new pages added each day.9 In contrast, Encyclopedia Britannica published volumes every several

years and the price was between $1,500 and $2,200, covering printing and binding ($250) and sales commissions

($500 to $600).10

Britannica focused on its centuries‐old tradition of providing information in richly bound tomes sold to the public

through a well‐trained sales force. Only when it was threatened with its very survival did Encyclopedia Britannica

grasp the need to separate the economics of information from economics of things and sell bits of information

online. Clearly, Encyclopedia Britannica’s business strategy, like that of many other companies, needed to reflect

the difference between the economics of things from the economics of information.

Internet of Things

More recently, a new concept has emerged to describe the explosive growth in the data generated by sensors

traveling over the Web. The Internet of things (IoT) is the term used to refer to machines and sensors talking to each other over the network, taking Evans and Wurster’s concepts even further. Although the term IoT was coined

in1999,11 it was not widely discussed until the current decade. The earliest example of its functions was reported

before the Internet even existed—in a Coke machine at Carnegie Mellon University in the mid‐1970s. Staff mem-

bers and students in the Computer Science Department were able to use a network connecting a minicomputer

and sensors in the machine to monitor not only the machine’s inventory but even which button to push for the

coldest bottles.12

A more broadly used early application of IoT was provided by Otis Elevator in the late 1980s and later copied

by most other elevator companies.13 Sensors in elevators send alerts over a network to a service center’s computer

when parts need replacing, and service technicians arrive without the builder owner knowing about the potential

problem. Extending IoT even further, today’s elevator systems alert handheld devices of nearby repair technicians

who then visit the elevator to make the repair. Devices may connect to the Internet over a wireless connection or

through a hard‐wired connection.

Many say that we are on the brink of a new revolution that will be as impactful as the popularization of the

World‐Wide Web. The IoT has already been applied to large number of “things”—extending to home appliances,

automobiles, thermostats, lighting, pets, and even people.14 Many people can already perform futuristic functions

using smartphone apps. They can remotely check the status of their heart monitor, tire pressure, or subway train’s

location. They can locate a lost pet or valuable object. They can reset their thermostat, turn off lights, and record a

program on their DVR even after having left for vacation.

9 Wikipedia Statistics, http://en.wikipedia.org/wiki/Wikipedia:Statistics (accessed August 18, 2015). 10 Evans and Wurster, Blown to Bits. 11 K. Ashton, “That ‘Internet of Things’ Thing,” RFID Journal (June 22, 2009), http://www.rfidjournal.com/articles/view?4986 (accessed May 26, 2015). 12 Attributed to The Carnegie Mellon University Computer Science Department Coke Machine, “The ‘Only’ Coke Machine on the Internet,” https://www.

cs.cmu.edu/~coke/history_long.txt (accessed May 26, 2015). 13 D. Freedman, “The Myth of Strategic IS,” CIO Magazine (July 1991), 42–48. 14 Internet of Things, Whatis.com, http://whatis.techtarget.com/definition/Internet‐of‐Things (accessed May 26, 2015).

FIGURE I-8 Comparison of the economics of things with the economics of information.

Things Information

Wear out Doesn’t wear out but can become obsolete or untrue

Are replicated at the expense of the manufacturer Is replicated at almost zero cost without limit

Exist in a tangible location Does not physically exist

When sold, possession changes hands When sold, seller may still possess and sell again

Price based on production costs Price based on value to consumer

cintro.indd 13 11/26/2015 7:38:30 PM

14 Introduction

Management

Information Systems

People Technology Process

FIGURE I-9 System hierarchy.

Social Business Lens

The explosion of consumer‐based technologies, coupled with applications such as Facebook, Renren, Sina

Weibo, Twitter, LinkedIn, YouTube, Foursquare, Skype, Pinterest, and more have brought into focus the concept of

a social business. Some call this trend the consumerization of technology . Consumerization means that technol-

ogies such as social tools, mobile phones, and Web applications targeted at individual, personal users are cre-

ating pressures for companies in new and unexpected ways. At the same time, technologies initially intended for

the corporation, like cloud computing, are being retooled and “consumerized” to appeal to individuals outside

the corporation.

In this text, we use the term social business to refer to an enterprise using social IT for business applications,

activities and processes. We sometimes say that a social business has infused social capabilities into business

processes.

Social business is permeating every facet of business. There are new business models based on a social IT

platform that offer new ways of connecting with stakeholders in functions such as governing, collaborating, doing

work, and measuring results. In this book, we are particular about the terminology we use. Social IT is the term we

use for all technologies in this space. We defi ne social IT as the technologies used for people to collaborate, net-

work, and interact over the Web. These include social networks and other applications that provide for interaction

between people.

Many use the term social media as an overarching term for this space, but increasingly, social media refers to

the marketing and sales applications of social IT, and we use it that way. Social networks are a specifi c type of tool,

like Facebook, Ning, and similar tools. Social networking is the use of these types of social IT tools in a community.

As of the writing of this text, the social space is still like the Wild West; there are no widely accepted conventions

about the terms and their meanings or the uses and their impacts. But we have enough experience with social

IT that we know it ’ s a major force bursting on to the enterprise scene and it must be addressed in discussions of

managing and using information systems.

Look in chapters for the feature “Social Business Lens” where we explore one topic related to that chapter from

a social business perspective.

The reader might already be using the IoT with one or more of these apps. However, vendors tell us we “ain ’ t

seen nothing yet.” The potential impact of IoT is limited by the number of objects connected and apps available to

monitor and control them. As the number of devices directly connected to the Internet increases, researchers and IT

cintro.indd 14 11/26/2015 7:38:31 PM

15Summary

professionals expect an exponential increase in IoT functionality and usage.15 In the coming years, Internet traffic

will dramatically increase along with an explosion in the amount of information generated by these devices.

System Hierarchy

Information systems are composed of three main elements: technology, people, and process (see Figure I-9). When

most people use the term information system, they actually refer only to the technology element as defined by the organization’s infrastructure. In this text, the term infrastructure refers to everything that supports the flow and processing of information in an organization, including hardware, software, data, and network components whereas

architecture refers to the blueprint that reflects strategy implicit in combining these components. Information sys- tems (IS) are defined more broadly as the combination of technology (the “what”), people (the “who”), and process (the “how”) that an organization uses to produce and manage information. In contrast, information technology (IT)

focuses only on the technical devices and tools used in the system. We define information technology as all forms of technology used to create, store, exchange, and use information. Many people use the terms IS and IT inter-

changeably. In recent years, “IT” has been more fashionable, but that changes as fashions change.

S U M M A R Y

Aligning information systems and business decisions is no longer an option; it’s an imperative for business. Every business oper-

ates as an information‐based enterprise. In addition, the explosive growth of smart phones, tablets, social tools, and Web‐based

businesses provides all managers with some experience in information systems and some idea of the complexity involved in

providing enterprise‐level systems. This highlights the need for all managers to be skilled in managing and using IS.

It is no longer acceptable to delegate IS decisions to the management information systems (MIS) department alone. The

general manager must be involved to both execute business plans and protect options for future business vision. IS and business

maturity must be aligned to provide the right level of information resources to the business.

This chapter makes the case for general managers’ full participation in strategic business decisions concerning IS. It out-

lines the skills required for such participation, and it makes explicit certain key assumptions about the nature of business,

management, and IS that will underlie the remaining discussions. Subsequent chapters are designed to build on these concepts

by addressing the following questions.

Frameworks and Foundations

• How should information strategy be aligned with business and organizational strategies? (Chapter 1)

• How can a business achieve competitive advantages using its IS? (Chapter 2)

• How do organizational decisions impact IS decisions? (Chapter 3)

• How is the work of the individual in an organization affected by decisions concerning IS? (Chapter 4)

• How are information systems integrated with business processes? (Chapter 5)

IS Management Issues

• What are the components of an IS architecture? (Chapter 6)

• How are IS kept secure? (Chapter 7)

• How is the IT organization managed and funded? (Chapter 8)

• How are IS decisions made? (Chapter 9)

• What source should provide IS services and how and where should they be provided? (Chapter 10)

15 Jared Newman, “Right Now, the Internet of Things Is Like the Internet of the 1990s,” Fast Company (March 27, 2015I, http://www.fastcompany. com/3044375/sector‐forecasting/the‐future‐of‐the‐internet‐of‐things‐is‐like‐the‐internet‐of‐the‐1990s (last accessed May 26, 2015).

cintro.indd 15 11/26/2015 7:38:31 PM

16 Introduction

• How are IS projects managed and risks from change management mitigated? (Chapter 11)

• How is business intelligence managed within an organization? (Chapter 12)

• What ethical and moral considerations bind the uses of information in business? (Chapter 13)

K E Y T E R M S

architecture (p. 14)

data (p. 10)

digital natives (p. 4)

information (p. 11)

information system (p. 14)

information technology (p. 14)

infrastructure (p. 14)

internet of things (p. 13)

knowledge (p. 12)

mashup (p. 11)

social business (p. 15)

social IT (p. 15)

social media (p. 15)

social networking (p. 15)

Web 2.0 (p. 3)

wisdom (p. 12)

cintro.indd 16 11/26/2015 7:38:31 PM

17

1 chapter

The Information Systems Strategy Triangle

In February 2015, 1 health care giant Kaiser Permanente named Dick Daniels to the CIO position and

the leadership team for the next stage of the company ’ s business strategy: to provide better health care

at lower costs. To achieve those goals, Kaiser Permanente, one of the nation ’ s largest not‐for‐profi t

health care systems with over 9.5 million members and 2014 operating revenue of $56.4 billion,

invested in numerous information systems projects aimed at streamlining operations, offering new

services, and meeting government obligations. For example, in 2014, 13% of all the medical appoint-

ments were fulfi lled digitally—through e‐mail—to the delight of patients who did not have to make

a trip to the doctor ’ s offi ce and to the delight of doctors who were able to check in on their patients,

particularly those with chronic conditions, more frequently. Doctors particularly liked this because

their annual bonuses were based, in part, on improvements in patient health metrics such as lower

blood pressure, reduced blood sugar levels if at risk for diabetes, and improvement in cholesterol

scores rather than on the number of tests they ordered or the total billing they brought in. The organi-

zation invested heavily in video conferencing technology, mobile apps, and analytics as they fi nished

implementing a $4 billion electronic health records system, KP HealthConnect.

KP HealthConnect began in 2003, but by 2008, all members had online access to their health

records; by 2010, all system services were available at all medical offi ces and hospitals in the system;

and by 2012, all members had access to their health records on mobile devices. Kaiser Permanente

has been a regular innovator in the use of technologies, being one of the fi rst health care organiza-

tions to experiment with chat rooms, secure messaging, and private e‐mail correspondence between

patients, physicians, and care providers. The new system connects each member to all caregivers and

services available at Kaiser Permanente. Further, it enabled patients to participate in the health care

they received at a new level and access information directly from the system.

The organizational design supported the business strategy of better health care at lower costs. 2

At the core of this strategy was a shift from a “fi x‐me system” with which patients seek health care

when something is broken and needs repair to a system that was truly proactive and focused on pro-

moting health. Under the “fi x‐me system,” health care was expensive and often sought too late to

The Information Systems Strategy Triangle highlights the alignment necessary between decisions regarding business strategy, information systems, and organizational design. This chapter reviews models of business strategy, organizational strategy and design, and information systems strategy. It concludes with a simple framework for creating a social business strategy.

1 http://blogs.wsj.com/cio/2015/02/09/kaiser‐permanente‐names‐richard‐dick‐daniels‐cio/; http://fortune.com/2015/04/29/kaiser‐

ceo‐on‐healthcare/; http://fortune.com/2014/07/24/a‐health‐care‐model‐thats‐working/; Paul Gray , Omar Sawy , Guillermo Asper ,

and Magnus Thordarson , “ Realizing Strategic Value Through Center‐Edge Digital Transformation in Consumer‐Centric Industries ,”

MIS Quarterly Executive 12 , no. 1 ( March 2013 ) . 2 Note that the organizational design puts the organizational strategy into practice. For instance, rewarding billings, sharing little

information, and late involvement with patients are organizational design elements of a “fix‐me” organizational strategy.

c01.indd 17 11/26/2015 6:19:39 PM

18 The Information Systems Strategy Triangle

fix the problem. Instead, the Kaiser Permanente strategy focused on promoting health, enabling identification of

problems before they became serious issues. For example, those in need of more exercise may receive a prescription

to take a walk and an e‐mail reminder from health care providers to reinforce the new behavior. Staff incentive

systems were aligned with this behavior, too. Physicians were all paid a flat salary and end‐of‐year bonuses if their

patients achieved better health. All caregivers were rewarded for guiding people into making behavioral choices

that were likely to keep them well.

The success at Kaiser Permanente was achieved in part because of the alignment between its business strategy, its

information systems strategy, and its organization design. Physicians were part of the decision‐making processes.

Managers were involved in the design and implementation of the information systems. The decision to move from

a “fix‐me system” to a “proactive health system” was not made in isolation from the organization or the information

systems.

The information systems (IS) department is not an island within a firm. Rather, IS manages an infrastructure

that is essential to the firm’s functioning. Further, the Kaiser Permanente case illustrates that a firm’s IS must be

aligned with the way it manages its employees and processes. For Kaiser Permanente, it was clear that not only did

the physicians need a fast, inexpensive, and useful way to communicate with patients outside of regular in‐person

appointments but also incentive systems and patient service processes had to be updated. Information systems

provided a solution in conjunction with new operational and control processes.

This chapter introduces a simple framework for describing the alignment necessary with business systems and

for understanding the impact of IS on organizations. This framework is called the Information Systems Strategy Triangle because it relates business strategy with IS strategy and organizational strategy. This chapter also presents key frameworks from organization theory that describe the context in which IS operates as well as the business

imperatives that IS support. The Information Systems Strategy Triangle presented in Figure 1.1 suggests three key

points about strategy.

1. Successful firms have an overriding business strategy that drives both organizational strategy and IS strat- egy. The decisions made regarding the structure, hiring practices, vendor policies, and other components of

the organizational design, as well as decisions regarding applications, hardware, and other IS components,

are all driven by the firm’s business objectives, strategies, and tactics. Successful firms carefully balance

these three strategies—they purposely design their organization and their IS strategies to complement their

business strategy.

2. IS strategy can itself affect and is affected by changes in a firm’s business and organizational design. To perpetuate the balance needed for successful operation, changes in the IS strategy must be accompanied by

changes in the organizational strategy and must accommodate the overall business strategy. If a firm designs

its business strategy to use IS to gain strategic advantage, the leadership position in IS can be sustained only

by constant innovation. The business, IS, and organizational strategies must constantly be adjusted.

3. IS strategy always involves consequences—intended or not—within business and organizational strategies. Avoiding harmful unintended consequences means remembering to consider business and organizational

strategies when designing IS implementation. For example, deploying tablets to employees without an

accompanying set of changes to job expectations, process design, compensation plans, and business tac-

tics will fail to achieve expected productivity improvements. Success can be achieved only by specifically

designing all three components of the strategy triangle so they properly complement each other.

Business Strategy

Organizational Strategy Information Strategy

FIGURE 1.1 The Information Systems Strategy Triangle.

c01.indd 18 11/26/2015 6:19:39 PM

19Brief Overview of Business Strategy Frameworks

Before the changes at Kaiser Permanente, incentives for doctors were misaligned with the goals of better health

care. Its IS Strategy Triangle was out of alignment at that time. Its organizational strategy (e.g., a “fix‐me” system)

was not supported by the IS strategy (e.g., tracking and reporting billable procedures). Neither the organizational

strategy nor the IS strategy adequately supported their purported business strategy (helping patients at lower cost).

For Kaiser Permanente, success could be achieved only by specifically designing all three components of the

strategy triangle to work together.

Of course, once a firm is out of alignment, it does not mean that it has to stay that way. To correct the misalign-

ment described earlier, Kaiser Permanente used on‐line services to enable quick communications between patients,

physicians, and care providers. Further, it changed its bonus structure to focus on health rather than billing amounts.

The new systems realign people, process, and technology to provide better service, save time, and save money.

What does alignment mean? The book Winning the 3‐Legged Race defines alignment as the situation in which a company’s current and emerging business strategy is enabled and supported yet unconstrained by technology. The

authors suggest that although alignment is good, there are higher states, namely synchronization and convergence,

toward which companies should strive. With synchronization, technology not only enables current business strategy

but also anticipates and shapes future business strategy. Convergence goes one step further by exhibiting a state in

which business strategy and technology strategy are intertwined and the leadership team members operate almost

interchangeably. Although we appreciate the distinction and agree that firms should strive for synchronization and

convergence, alignment in this text means any of these states, and it pertains to the balance between organizational strategy, IS strategy, and business strategy.3

A word of explanation is needed here. Studying IS alone does not provide general managers with the appropriate

perspective. This chapter and subsequent chapters address questions of IS strategy squarely within the context of

business strategy. Although this is not a textbook of business strategy, a foundation for IS discussions is built on

some basic business strategy frameworks and organizational theories presented in this and the next chapter. To be

effective, managers need a solid sense of how IS are used and managed within the organization. Studying details

of technologies is also outside the scope of this text. Details of the technologies are relevant, of course, and it is

important that any organization maintain a sufficient knowledge base to plan for and adequately align with business

priorities. However, because technologies change so rapidly, keeping a textbook current is impossible. Instead, this

text takes the perspective that understanding what questions to ask and having a framework for interpreting the

answers are skills more fundamental to the general manager than understanding any particular technology. That

understanding must be constantly refreshed using the most current articles and information from experts. This text

provides readers with an appreciation of the need to ask questions, a framework from which to derive the ques-

tions to ask, and a foundation sufficient to understand the answers received. The remaining chapters build on the

foundation provided in the Information Systems Strategy Triangle.

Brief Overview of Business Strategy Frameworks A strategy is a coordinated set of actions to fulfill objectives, purposes, and goals. The essence of a strategy is setting limits on what the business will seek to accomplish. Strategy starts with a mission. A mission is a clear and compelling statement that unifies an organization’s effort and describes what the firm is all about (i.e., its purpose).

Mark Zuckerberg’s reflection on the mission of Facebook provides an interesting example. Originally conceived as

a product rather than a service, the CEO of Facebook commented, “after we started hiring more people and building

out the team, I began to get an appreciation that a company is a great way to get a lot of people involved in a mission

you’re trying to push forward. Our mission is getting people to connect.”4

In a few words, the mission statement sums up what is unique about the firm. The information in Figure 1.2 indi-

cates that even though Zappos, Amazon, and L.L. Bean are all in the retail industry, they view their missions quite

differently. For example, Zappos’ focus is on customer service, Amazon is about customer sets, and L.L. Bean is

3 F. Hogue, V. Sambamurthy, R. Zmud, T. Trainer, and C. Wilson, Winning the 3‐Legged Race (Upper Saddle River, NJ: Prentice Hall, 2005). 4 Shayndi Raice, “Is Facebook Ready for the Big Time?” The Wall Street Journal (January 14–15, 2012), B1.

c01.indd 19 11/26/2015 6:19:39 PM

20 The Information Systems Strategy Triangle

about the merchandise and treating people the right way. It’s interesting to note that although Amazon purchased

Zappos in 2009, the acquisition agreement specified that Zappos would continue to run independently of its new

parent. Today, Zappos continues to remain both culturally and physically separate from Amazon. Zappos is located

near Las Vegas, Nevada, and Amazon is in Seattle, Washington.

A business strategy is a plan articulating where a business seeks to go and how it expects to get there. It is the means by which a business communicates its goals. Management constructs this plan in response to market

forces, customer demands, and organizational capabilities. Market forces create the competitive context for the

business. Some markets, such as those faced by package delivery firms, laptop computer manufacturers, and credit

card issuers, face many competitors and a high level of competition, such that product differentiation becomes

increasingly difficult. Other markets, such as those for airlines and automobiles, are similarly characterized by

high competition, but product differentiation is better established. Customer demands comprise the wants and

needs of the individuals and companies who purchase the products and services available in the marketplace.

Organizational capabilities include the skills and experience that give the corporation a currency that can add value

in the marketplace.

Consider Dell, originally a personal computer company. Initially Dell’s business strategy was to sell personal

computers directly to the customer without going through an intermediary. Reaching customers in this way was

less expensive and more responsive than selling the computers in retail stores. The Internet, combined with Dell’s

well‐designed IS infrastructure, allowed customers to electronically contact Dell, which then designed a PC for a

customer’s specific needs. Dell’s ordering system was integrated with its production system and shared information

automatically with each supplier of PC components. This IS enabled the assembly of the most current computers

without the expense of storing large inventories, and inventory uncertainties were pushed back to the vendors. Cost

savings were passed on to the customer, and the direct‐to‐customer model allowed Dell to focus its production

capacity on building only the most current products. With small profit margins and new products quickly able to

replace existing products, IS aligned with Dell’s business strategy to provide low‐cost PCs. The cost savings from

the IS was reflected in the price of systems. In addition, Dell executives achieved a strategic advantage in reducing

response time, building custom computers that had one of the industry’s lowest costs, and eliminating inventories

that could become obsolete before they are sold. Thus, this business strategy was consistent with Dell’s mission of

delivering the best customer experience in the markets it serves.

But things aren’t always as they seem. If the direct‐to‐customer strategy was so effective, why is Dell now

also selling its computers at major retail outlets such as Walmart, Staples, and Best Buy? It is likely that the sales

figures and profit margins were not measuring up to Dell’s stated objectives and performance targets. And Dell

has branched out to other hardware, such as printers and servers, and more recently, providing IT services. Con-

sequently, Dell adjusted its business strategy, and we can expect to see changes in its organizational design and

information systems to reflect its altered direction.

Now consider your favorite dot‐com company. Every dot‐com company has a business strategy of delivering

its products or services over the Internet. To do so, the dot‐coms need organizations filled with individuals and

processes that support this business strategy. Their employees must be Internet savvy; that is, they must have

FIGURE 1.2 Mission statements of three retail businesses.

Company Mission Statement

Zappos To provide the best customer service possible. Internally we call this our WOW philosophy.a

Amazon We seek to be Earth’s most customer‐centric company for three primary customer sets: consumer customers, seller customers and developer customers.b

L.L. Bean Sell good merchandise at a reasonable profit, treat your customers like human beings and they will always come back for more.c

a http://about.zappos.com (accessed March 19, 2015). b http://www.amazon.com Mission Statement on Amazon Investor Relations page (accessed March 19, 2015). c http://www.llbean.com/customerService/aboutLLBean/company_values.html (accessed March 19, 2015).

c01.indd 20 11/26/2015 6:19:40 PM

21Brief Overview of Business Strategy Frameworks

Business Models versus Business Strategy

Some new managers confuse the concept of a business model with the concept of a business strategy. The

business strategy , as discussed in this chapter, is the coordinated set of actions used to meet the business goals

and objectives. It ’ s the path a company takes to achieve its goals. One of the components of the business strategy

is the business model, the design of how the business will make money and how customers will get value from its

products and services. Some might argue that a business model is the outcome of strategy. *

Some examples of business models commonly seen in the digital world include † :

• Subscription: Customers pay a recurring fee for the product or service.

• Advertising: Customers access the product or service for “free,” and sponsors or vendors pay fees for

advertising that goes with the product or service.

• Cost plus: Somewhat like a traditional retailer, customers purchase the product or service for a specific price

that is usually the cost plus some markup for profit.

• Renting/Licensing: Customers pay a fee to use the product or service for a specified period of time.

• All‐you‐can‐Eat: Customers pay one fee for access to as much of the product or service as they want to

consume, usually over a specific period of time.

• Freemium: Customers get something for “free,” and the company makes money from selling customers

something after they get the giveaway. This is similar to a business model used in brick‐and‐mortar busi-

nesses that give away something or sell something for a very low price, but the customer has to pay for

refills or upgrades such as giving razors away but making money from selling razor blades.

* For a more detailed treatment of the concepts of business models, strategy, and tactics, see Ramon Casadesus‐Masanell and Joan Ricart, “From Strategy to Business Models and to Tactics,” Harvard Business School working paper 10‐036, http://www.hbs.edu/ faculty/Publication%20Files/10‐036.pdf (accessed August 21, 2015). † For a list of 15 different business models, see http://www.digitalbusinessmodelguru.com/2012/12/15‐business‐models‐complete‐ list.html (accessed August 21, 2015).

skills and knowledge that are relevant to the dot‐com business. Their processes must support the dot‐com strategy.

Imagine what would happen if the order process for their services was not Internet based. It seems silly to even

consider a dot‐com that would insist that orders be placed in person or even by telephone. The dot‐com processes

are aligned with companies ’ on‐line‐based business strategy. Further, their IS strategy must also be aligned with

their processes. It would be equally silly to expect information to be based on paper fi les rather than electronic fi les.

A classic, widely used model developed by Michael Porter still frames most discussions of business strategy. In

the next section, we review Porter ’ s generic strategies framework as well as dynamic environment strategies. 5 We

then share questions that a general manager must answer to understand the business ’ strategy.

The Generic Strategies Framework

Companies sell their products and services in a marketplace populated with competitors. Michael Porter ’ s frame-

work helps managers understand the strategies they may choose to build a competitive advantage. In his book

Competitive Advantage , Porter claims that the “fundamental basis of above‐average performance in the long run is sustainable competitive advantage.” 6 Porter identifi ed three primary strategies for achieving competitive advantage:

(1) cost leadership, (2) differentiation, and (3) focus. These advantages derive from the company ’ s relative position

5 Another popular model by Michael Porter, the value chain, provides a useful model for discussing internal operations of an organization. Some find it a

useful model for understanding how to link two firms. This framework is used in Chapter 5 to examine business process design. For further information,

see M. Porter , Competitive Advantage , 1st ed. ( New York : The Free Press , 1985 ) . 6 M. Porter , Competitive Advantage: Creating and Sustaining Superior Performance , 2nd ed. ( New York : The Free Press , 1998 ) .

c01.indd 21 11/26/2015 6:19:40 PM

22 The Information Systems Strategy Triangle

in the marketplace, and they depend on the strategies and tactics used by competitors. See Figure 1.3 for a summary

of these three strategies for achieving competitive advantage.

Cost leadership results when the organization aims to be the lowest‐cost producer in the marketplace. The organization enjoys above‐average performance by minimizing costs. The product or service offered must be

comparable in quality to those offered by others in the industry so that customers perceive its relative value. Typ-

ically, only one cost leader exists within an industry. If more than one organization seeks an advantage with this

strategy, a price war ensues, which eventually may drive the organization with the higher cost structure out of the

marketplace. Through mass distribution, economies of scale, and IS to generate operating efficiencies, Walmart

epitomizes the cost‐leadership strategy.

Through differentiation, the organization offers its product or service in a way that appears unique in the mar- ketplace. The organization identifies which qualitative dimensions are most important to its customers and then

finds ways to add value along one or more of those dimensions. For this strategy to work, the price charged cus-

tomers for the differentiator must seem fair relative to the price charged by competitors. Typically, multiple firms

in any given market employ this strategy. Progressive Insurance is able to differentiate itself from other automobile

insurance companies.

In its earlier days, Progressive Insurance’s service was unique. Representatives responded to accident claims

24‐7, arriving at the scene of the accident with powerful laptops and software that enabled them to settle claims and

cut a check on the spot. More recently, Progressive was the first to offer a usage‐based insurance product, called

Snapshot, that bases insurance rates on the miles driven by customers. These innovations enabled a strategy that

spurred Progressive’s growth and widened its profit margins. Apple Inc. is another example of a company that com-

petes in its markets on its ability to differentiate its products. Apple’s various innovations in its operating system,

laptop design, iPads, iPhones, iPods, iTunes and iWatches have created a strategy based on the uniqueness of its

products and services.

Focus allows an organization to limit its scope to a narrower segment of the market and tailor its offerings to that group of customers. This strategy has two variants: (1) cost focus, in which the organization seeks a cost advantage within its segment and (2) differentiation focus, in which it seeks to distinguish its products or services within the segment. This strategy allows the organization to achieve a local competitive advantage even if it does

not achieve competitive advantage in the marketplace overall. Porter explains how the focuser can achieve compet-

itive advantage by focusing exclusively on certain market segments:

Breadth of target is clearly a matter of degree, but the essence of focus is the exploitation of a narrow target’s differ-

ences from the balance of the industry. Narrow focus in and of itself is not sufficient for above‐average performance.7

Marriott International demonstrates both types of focus with two of its hotel chains: Marriott has a cost focus,

and Ritz‐Carlton has a differentiation focus. To better serve its business travelers and cut operational expenses,

Marriott properties have check‐in kiosks that interface with their Marriott Rewards loyalty program. A guest can

swipe a credit card or Marriott Rewards card at the kiosk in the lobby and receive a room assignment and keycard

Strategic Advantage

S tr

a te

g ic

T a

rg e

t

Uniqueness perceived by customer Low-cost position

Industrywide Differentiation Cost leadership

Particular segment only Focus

Source: Adapted from M. Porter, Competitive Advantage, 1st ed. (New York: The Free Press, 1985) and Competitive Advantage: Creating and Sustaining Superior Performance, 2nd ed. (New York: The Free Press, 1998).

FIGURE 1.3 Three strategies for achieving competitive advantage.

7 Porter, Competitive Advantage: Creating and Sustaining.

c01.indd 22 11/26/2015 6:19:40 PM

23Brief Overview of Business Strategy Frameworks

from the machine. She can also print airline boarding passes at the kiosks. Further, the kiosks help the Marriott

chain implement its cost focus by cutting down on the personnel needed in at the front desk. The kiosk system is

integrated with other systems such as billing and customer relationship management (CRM) to generate operating

efficiencies and enhanced corporate standardization.

In contrast, stand‐alone kiosks in the lobby would destroy the feeling that the Ritz‐Carlton chain, acquired by

Marriott in 1995, creates. To the Ritz‐Carlton chain, CRM means capturing and using information about guests,

such as their preference for wines, a hometown newspaper, or a sunny room. Each Ritz‐Carlton employee is

expected to promote personalized service by identifying and recording individual guest preferences. To demon-

strate how this rule could be implemented, a waiter, after hearing a guest exclaim that she loves tulips, could log the

guest’s comments into the Ritz‐Carlton CRM system called “Class.” On her next visit to a Ritz‐Carlton hotel, tulips

could be placed in the guest’s room after querying Class to learn more about her as her visit approaches. The CRM

is instrumental in implementing the differentiation‐focus strategy of the Ritz‐Carlton chain.8 Its strategy allows the

Ritz‐Carlton chain to live up to its unique motto which emphasizes that its staff members are distinguished people

with distinguished customers.

Airline JetBlue adopted a differentiation strategy based on low costs coupled with unique customer experience.

It might be called a “value‐based strategy.” It is not the lowest cost carrier in the airline industry; at 12.3 cents per

passenger seat mile, JetBlue has one of the lowest costs, but Virgin America, Spirit, and Allegiant had even lower

per seat mile costs in 2013. But JetBlue manages its operational costs carefully, making decisions that keep its per

passenger costs among the lowest in the business, such as a limited number of airplane models in its fleet, gates at

less congested airports, paperless cockpit and many other operations, and snacks instead of meals on flights. Jet-

Blue has one of the longest stage length averages (the length of the average flight) in the industry, and the longer

the flight, the lower the unit costs. Competing network carriers, who are more well known and established, may

have different pay scales because they’ve been in the business longer and have a different composition of staff.

These carriers also have higher maintenance costs for their older, more diverse fleets. If it could realize its plans for

growth while maintaining its low cost structure, JetBlue could move from its cost focus based on serving a limited,

but growing, number of market segments to a cost leadership strategy.9

While sustaining a cost focus, JetBlue’s chairman believes that JetBlue can compete on more than price, which

is part of its unique differentiation strategy. It is why the airline continually strives to keep customers satisfied with

frills such as extra leg room, leather seats, prompt baggage delivery, DirectTV, and movies. It has been recognized

with many awards for customer satisfaction in the North American airline industry.

Dynamic Environment Strategies

Porter’s generic strategies model is useful for diagnostics, for understanding how a business seeks to profit in

its chosen marketplace, and for prescriptions, or building new opportunities for advantage. It reflects a careful

balancing of countervailing competitive forces posed by buyers, suppliers, competitors, new entrants, and substitute

products and services within an industry. As is the case with many models, dynamic environment strategies offer

managers useful tools for thinking about strategy.

However, the Porter model was developed at a time when competitive advantage was sustainable because the

rate of change in any given industry was relatively slow and manageable. Since the late 1980s, when this frame-

work was at the height of its popularity, newer models have been developed to take into account the increasing

turbulence and velocity of the marketplace. Organizations need to be able to respond instantly and change rapidly,

which requires dynamic structures and processes. One example of this type of approach is the hypercompetition

framework. Discussions of hypercompetition take a perspective different from that of the previous framework. Por-

ter’s framework focuses on creating competitive advantage in relatively stable markets, whereas hypercompetition frameworks suggest that the speed and aggressiveness of the moves and countermoves in a highly competitive and

8 Scott Berinato, “Room for Two,” CIO.com (May 15, 2002), http://www.cio.com/archive/051502/two_content.html. 9 http://www.oliverwyman.com/content/dam/oliver‐wyman/global/en/2014/nov/Airline_Economic_Analysis_Screen_OW_Nov_2014.pdf (accessed

March 23, 2015).

c01.indd 23 11/26/2015 6:19:40 PM

24 The Information Systems Strategy Triangle

turbulent market create an environment in which advantages are rapidly created and eroded. In a hypercompetitive

market, trying to sustain a specific competitive advantage can be a deadly distraction because the environment and

the marketplace change rapidly. To manage the rapid speed of change, firms value agility and focus on quickly

adjusting their organizational resources to gain competitive advantage. Successful concepts in hypercompetitive

markets include dynamic capabilities, creative destruction, and blue ocean strategy.10

Dynamic capabilities are means of orchestrating a firm’s resources in the face of turbulent environments. In particular, the dynamic capabilities framework focuses on the ways a firm can integrate, build, and reconfigure

internal and external capabilities, or abilities, to address rapidly changing environments. These capabilities are

built rather than bought. They are embedded in firm‐specific routines, processes, and asset positions. Thus,

they are difficult for rivals to imitate. In sum, they help determine the speed and degree to which the firm can

marshal and align its resources and competences to match the opportunities and requirements of the business

environment.11

Since the 1990s, a competitive practice, called creative destruction, has emerged. First predicted over 60 years ago by the economist Joseph Schumpeter, it was made popular more recently by Harvard Professor Clay Christensen.

Coincidentally (or maybe not), the accelerated competition has occurred concomitantly with sharp increases in the

quality and quantity of information technology (IT) investment. The changes in competitive dynamics are particu-

larly striking in sectors that spend the most on IT.12

One example of using dynamic models was implemented by leadership guru Jack Welch at General Electric

(GE). Often nicknamed “Neutron Jack” because of the way businesses were radically changed, Welch’s approach

to creative destruction was termed destroy your business (DYB). Welch recognized that GE could sustain its com- petitive advantage only for a limited time as competitors attempted to outmaneuver the company. He knew that

if GE did not identify its weaknesses, its competitors would relish doing so. DYB is an approach that places GE

employees in the shoes of their competitors.13 Through the DYB lenses, GE employees develop strategies to destroy

the company’s competitive advantage. Then, in light of their revelations, they apply the grow your business (GYB)

strategy to find fresh ways to reach new customers and better serve existing ones. This allows GE to protect its

business from its competitors and sustain its position in the marketplace over the long run.

A similar strategy of cannibalizing its own products was used by Apple. Steve Jobs, Apple’s founder and former

CEO, felt strongly that if a company was not willing to cannibalize its own products, someone else would come

along and do it for them. That was evident in the way Apple introduced the iPhone while iPod sales were brisk and

the iPad while its Macintosh sales were strong.14 Apple continues to exhibit this strategy with subsequent releases

of new models of all of its products.

Most discussions of strategy focus on gaining competitive advantage in currently existing industries and mar-

ketplaces, which are referred to by Kim and Mauborgne as red ocean strategy. Using a red ocean strategy, firms fiercely compete to earn a larger share of existing demand. Kim and Mauborgne recommend a better approach:

Firms adopt a blue ocean strategy in which they create new demand in untapped marketspaces where they have the “water” to themselves. When applying the blue ocean strategy, the goal is not to beat the competition but to make

it irrelevant. This is what Dell did when it challenged current industry logic by changing the computer purchasing

and delivery experiences of its customers. “With its direct sales to customers, Dell was able to sell its PCs for

40 percent less than IBM dealers while still making money.”15 Dell also introduced into unchartered seas an unprec-

edented delivery process that allowed buyers to receive their new computers within four days of ordering them as

compared to the red ocean process, which typically required 10 weeks.

10 For more information, please see Don Goeltz, “Hypercompetition,” vol. 1 of The Encyclopedia of Management Theory, ed. Eric Kessler (Los Angeles: Sage, 2013), 359–60. 11 D. J. Teece, G. Pisano, and A. Shuen, “Dynamic Capabilities and Strategic Management,” Strategic Management Journal 18 (1997), 509–33; David Teece, “Dynamic Capabilities,” vol. 1 of The Encyclopedia of Management Theory, ed. Eric Kessler (Los Angeles: Sage, 2013), 221–24. 12 Andrew McAfee and Erik Brynjolfsson, “Investing in the IT That Makes a Competitive Difference,” Harvard Business Review (July–August 2008), 98–107. 13 M. Levinson, “GE Uses the Internet to Grow Business,” CIO (October 15, 2001), http://www.cio.com/article/30624/HOT_TOPIC_E_BUSINESS_ GE_Uses_the_Internet_to_Grow_Business_ (accessed May 5, 2012). 14 Walter Isaacson, Steve Jobs (New York: Simon and Shuster, 2011). 15 W. Chan Kim and Renee Mauborgne, Blue Ocean Strategy (Cambridge, MA: Harvard Business School, 2005), 202.

c01.indd 24 11/26/2015 6:19:40 PM

25Brief Overview of Organizational Strategies

Why Are Strategic Advantage Models Essential to Planning for Information Systems?

A general manager who relies solely on IS personnel to make IS decisions may not only give up any authority over

IS strategy but also hamper crucial future business decisions. In fact, business strategy should drive IS decision

making, and changes in business strategy should entail reassessments of IS. Moreover, changes in IS potential

should trigger reassessments of business strategy—as in the case of the Internet when companies that understood

or even considered its implications for the marketplace quickly outpaced their competitors who failed to do so.

For the purposes of our model, the Information Systems Strategy Triangle, understanding business strategy means

answering the following questions:

1. What is the business goal or objective?

2. What is the plan for achieving it? What is the role of IS in this plan?

3. Who are the crucial competitors and partners, and what is required of a successful player in this marketplace?

4. What are the industry forces in this marketplace?

Porter’s generic strategies framework and the dynamic frameworks (summarized in Figure 1.4) are revisited in

the next few chapters. They are especially helpful in discussing the role of IS in building and sustaining competitive

advantages (Chapter 2) and for incorporating IS into business strategy. The next section of this chapter establishes

a foundation for understanding organizational strategies.

Brief Overview of Organizational Strategies Organizational strategy includes the organization’s design as well as the choices it makes to define, set up, coor- dinate, and control its work processes. How a manager designs the organization impacts every aspect of opera-

tions from dealing with innovation to relationships with customers, suppliers, and employees. The organizational

strategy is a plan that answers the question: “How will the company organize to achieve its goals and implement

its business strategy?”

A useful framework for organizational design can be found in the book Building the Information Age Orga- nization by Cash, Eccles, Nohria, and Nolan.16 This framework (Figure  1.5) suggests that the successful execu- tion of a company’s organizational strategy comprises the best combination of organizational, control, and cultural

variables. Organizational variables include decision rights, business processes, formal reporting relationships, and

informal networks. Control variables include the availability of data, nature and quality of planning, effectiveness

of performance measurement and evaluation systems, and incentives to do good work. Cultural variables comprise

the values of the organization. These organizational, control, and cultural variables are managerial levers used by decision makers to effect changes in their organizations. These managerial levers are discussed in detail in Chapter 3.

FIGURE 1.4 Summary of strategic approaches and IT applications.

Strategic Approach Key Idea Application to Information Systems

Porter’s generic strategies Firms achieve competitive advantage through cost leadership, differentiation, or focus.

Understanding which strategy is chosen by a firm is critical to choosing IS to complement the strategy.

Dynamic environment strategies Speed, agility, and aggressive moves and countermoves by a firm create competitive advantage.

The speed of change is too fast for manual response, making IS critical to achieving business goals.

16 James I. Cash, Robert G. Eccles, Nitin Nohria, and Richard L. Nolan, Building the Information Age Organization (Homewood, IL: Richard D. Irwin, 1994).

c01.indd 25 11/26/2015 6:19:40 PM

26 The Information Systems Strategy Triangle

Our objective is to give the manager a framework to use in evaluating various aspects of organizational design.

In this way, the manager can review the current organization and assess which components may be missing and

what future options are available. Understanding organizational design means answering the following questions:

1. What are the important structures and reporting relationships within the organization?

2. Who holds the decision rights to critical decisions?

3. What are the important people‐based networks (social and informational), and how can we use them to get work done better?

4. What are the characteristics, experiences, and skill levels of the people within the organization?

5. What are the key business processes?

6. What control systems (management and measurement systems) are in place?

7. What are the culture, values, and beliefs of the organization?

The answers to these questions inform the assessment of the organization’s use of IS. Chapters 3, 4, and 5 use

the Managerial Levers model to assess the impact of information systems (IS) on the firm. Chapters 8 and 9 use this

same list to understand the business and governance of the IS organization.

Brief Overview of Information Systems Strategy IS strategy is the plan an organization uses to provide information services. IS allow a company to implement its business strategy. JetBlue’s former Vice President for People explains it nicely: “We define what the business needs

and then go find the technology to support that.”17

Business strategy is a function of competition (What does the customer want and what does the competition

do?), positioning (In what way does the firm want to compete?), and capabilities (What can the firm do?). IS help

Organizational effectiveness

Strategy

Organization Control

Culture

Performance measurement

and evaluation

Incentives and rewards

Values

Formal reporting

relationships Planning

Business processes

Decision rights

Data

Informal networks

People, Information, and

Technology

Execution

FIGURE 1.5 Managerial Levers model. Source: J. Cash, R. G. Eccles, N. Nohria, and R. L. Nolan, Building the Information Age Organization (Homewood, IL: Richard D. Irwin, 1994).

17 Hogue et al., Winning the 3‐Legged Race, 111.

c01.indd 26 11/26/2015 6:19:40 PM

27Brief Overview of Information Systems Strategy

determine the company ’ s capabilities. An entire chapter is devoted to understanding key issues facing general man-

agers concerning IT architecture, but for now a more basic framework is used to understand the decisions related

to IS that an organization must make.

The purpose of the matrix in Figure  1.6 is to give the manager a high‐level view of the relation between the

four IS infrastructure components and the other resource considerations that are keys to IS strategy. Infrastructure

FIGURE 1.6 IS strategy matrix.

What Who Where

Hardware The physical devices of the system System users and managers Physical location of devices (cloud, data center, etc.)

Software The programs, applications, and utilities

System users and managers The hardware it resides on and physical location of that hardware

Networking The way hardware is connected to other hardware, to the Internet, and to other outside networks

System users and managers; company that provides the service

Where the nodes, the wires, and other transport media are located

Data Bits of information stored in the system

Owners of data; data administrators

Where the information resides

Social Business Lens: Building a Social Business Strategy

Some companies use social IT as point solutions for business opportunities, but others build a social business

strategy that considers the application of social IT tools and capabilities to solve business opportunities holisti-

cally. A social business strategy is a plan of how the fi rm will use social IT that is aligned with its organizational strat-

egy and IS strategy. Social business strategy includes a vision of how the business would operate if it seamlessly

and thoroughly incorporated social and collaborative capabilities throughout the business model. It answers the

same type of questions of what, how, and who, as do many other business strategies.

Social businesses infuse social capabilities into their business processes. Most of the social business opportu-

nities fall into one of three categories:

Collaboration —using social IT to extend the reach of stakeholders, both employees and those outside the

enterprise walls. Social IT such as social networks enable individuals to find and connect with each other to

share ideas, information, and expertise.

Engagement —using social IT to involve stakeholders in the traditional business of the enterprise. Social IT such as

communities and blogs provide a platform for individuals to join in conversations, create new conversations,

and offer support to each other and other activities that create a deeper feeling of connection to the company,

brand, or enterprise.

Innovation —using social IT to identify, describe, prioritize, and create new ideas for the enterprise. Social IT offers

community members a “super idea box” where individuals suggest new ideas, comment on other ideas, and

vote for their favorite idea, giving managers a new way to generate and decide on products and services.

National Instruments (ni.com) is an example of a company that has embraced social IT and created a social

business strategy. Managers developed a branded community consisting of a number of social IT tools like Face-

book, Twitter, blogs, forums, and more. By thinking holistically about all the ways that customers and employees

might interact with one another, the branded community has become the hub of collaboration, engagement, and

idea generation.

Source: Adapted from Keri Pearlson , “ Killer Apps for a Social Business ” (February 17, 2011 ) , http://instantlyresponsive.wordpress. com/2011/02/27/killer‐apps‐for‐a‐social‐business/ (accessed March 19, 2015). For more information on National Instruments, see Harvard Business school case study 813001, “National Instruments” by Lynda Applegate, Keri Pearlson, and Natalie Kindred.

c01.indd 27 11/26/2015 6:19:40 PM

28 The Information Systems Strategy Triangle

includes hardware, such as desktop units and servers. It also includes software, such as the programs used to do

business, to manage the computer itself and to communicate between systems. The third component of IS infra-

structure is the network, which is the physical means by which information is exchanged among hardware com-

ponents. Examples include fiber networks such as Google Fiber, cable networks such as those provided by Time

Warner, AT&T, and Comcast, WiFi provided by many local services, and 3G/4G/WiMax technologies (which are

actually Internet communication standards, but some phone companies adopt those terms as the name of networks

they offer). Some communications are conducted through a private digital network, managed by an internal unit).

Finally, the fourth part of the infrastructure is the data. The data include the bits and bytes stored in the system.

In current systems, data are not necessarily stored alongside the programs that use them; hence, it is important to

understand what data are in the system and where they are stored. Many more detailed models of IS infrastructure

exist, and interested readers may refer to any of the dozens of books that describe them. For the purposes of this

text, the IS strategy matrix provides sufficient information to allow the general manager to assess the critical issues

in information management.

Because of the advanced state of technology, many managers are more familiar with the use of platforms and

applications, or apps. Platforms are technically any set of technologies upon which other technologies or appli-

cations run. Often they are a combination of hardware and operating system software. Microsoft Windows and

Apple’s Macintosh with its latest operating system are two examples of platforms. Also common are mobile plat-

forms such as the iPhone and Samsung/Android phone. Applications or apps, on the other hand, are self‐contained software programs that fulfill a specific purpose and run on a platform. The term “apps” became popular from the

smart phone industry, beginning when Apple offered an online marketplace for customers to download small pro-

grams to run on their devices. But more recently, because all platforms have applications that run on them, the term

apps has taken on a broader meaning.

S U M M A R Y

The Information Systems Strategy Triangle represents a simple framework for understanding the impact of IS on businesses. It

relates business strategy with IS strategy and organizational strategy and implies the balance that must be maintained in business

planning. The Information Systems Strategy Triangle suggests the following management principles.

Business Strategy

Business strategy drives organizational strategy and IS strategy. The organization and its IS should clearly support defined

business goals and objectives.

• Definition: A well‐articulated vision of where a business seeks to go and how it expects to get there

• Example Models: Porter’s generic strategies model; dynamic environment models

Organizational Strategy

Organizational strategy must complement business strategy. The way a business is organized either supports the implementation

of its business strategy or it gets in the way.

• Definition: The organization’s design, as well as the choices it makes to define, set up, coordinate, and control its work processes

• Example Model: managerial levers

IS Strategy

IS strategy must complement business strategy. When IS support business goals, the business appears to be working well. IS

strategy can itself affect and is affected by changes in a firm’s business and organizational strategies. Moreover, IS strategy

always has consequences—intended or not—on business and organizational strategies.

c01.indd 28 11/26/2015 6:19:40 PM

29Discussion Questions

• Definition: The plan the organization uses in providing information systems and services

• Models: A basic framework for understanding IS decisions for platform, applications, network and data‐relating architecture (the “what”), and the other resource considerations (“who” and “where”) that represent important planning

constraints

Strategic Relationships

Organizational strategy and information strategy must complement each other. They must be designed so that they support,

rather than hinder, each other. If a decision is made to change one corner of the triangle, it is necessary to evaluate the other two

corners to ensure that balance is preserved. Changing business strategy without thinking through the effects on the organization

and IS strategies will cause the business to struggle until balance is restored. Likewise, changing IS or the organization alone

will cause an imbalance.

D I S C U S S I O N Q U E S T I O N S

1. Why is it important for business strategy to drive organizational strategy and IS strategy? What might happen if the business strategy was not the driver?

2. In 2015, the NFL decided to hand out Microsoft Surface tablets to all coaches for use during games, and there are reports that in the future, they will add HoloLens devices to provide augmented reality.18 A HoloLens device is a high‐definition,

head‐mounted display that allows coaches to see the plays with text and animation superimposed right on the live images. If

the NFL simply handed them out without making any other formal changes in organizational strategy or business strategy,

what might be the outcome? What unintended consequences might occur?

3. Consider a traditional manufacturing company that wants to build a social business strategy. What might be a reasonable business strategy, and how would organization and IS strategy need to change? How would this differ for a restaurant chain?

A consumer products company? A nonprofit?

4. This chapter describes key components of an IS strategy. Describe the IS strategy of a consulting firm using the matrix framework.

5. What does this tip from Fast Company mean: “The job of the CIO is to provide organizational and strategic flexibility”?19

K E Y T E R M S

apps (p. 27)

blue ocean strategy (p. 24)

business model (p. 20)

business strategy (p. 21)

collaboration (p. 28)

cost leadership (p. 22)

creative destruction (p. 24)

differentiation (p. 22)

dynamic capabilities (p. 24)

engagement (p. 28)

focus (p. 22)

hypercompetition (p. 23)

Information Systems Strategy

Triangle (p. 18)

innovation (p. 28)

IS strategy (p. 26)

managerial levers (p. 25)

mission (p. 19)

organizational strategy (p. 25)

red ocean strategy (p. 24)

social business strategy (p. 27)

strategy (p. 19)

18 Sean Michael, “NFL Teams Will Use Surface Pro 3s in 2015 and May Use HoloLens in the Future,” WinBeta (August 7, 2015), http://www.winbeta.

org/news/nfl‐teams‐will‐use‐surface‐pro‐3s‐2015‐and‐may‐use‐hololens‐future (accessed August 21, 2015). 19 “Technology: How much? How fast? How revolutionary? How expensive?” Fast Company (March 2002), http://www.fastcompany.com/44651/ technology‐how‐much‐how‐fast‐how‐revolutionary‐how‐expensive (accessed August 21, 2015).

c01.indd 29 11/26/2015 6:19:40 PM

30 The Information Systems Strategy Triangle

Lego has long been an industry leader in children ’ s toys with its simple yet unique building block‐style products. A Danish

carpenter whose family still owns Lego today founded the privately held company in 1932. But by 2004, the company found

itself close to extinction, losing $1 million a day. A new CEO was brought in, and within fi ve years sales were strong, profi ts

were up, and naysayers who felt the new strategy was going to fail were proved wrong. In fact, sales, revenues and profi ts

continued to be strong. Revenues grew from 16 billion Danish krone (DKK) in 2010 to over 28 billion DKK in 2014, and in

the same period, profi t almost doubled from 3.7 billion DKK to 7 billion DKK.

With the advent of high‐tech forms of entertainment, such as the iPod and PlayStation, Lego found itself more antique

than cutting edge in the toy world. When new CEO Jorgen Vig Knudstorp, a father and former McKinsey consultant, took

over, the company was struggling with poor performance, missed deadlines, long development times, and a poor delivery

record. The most popular toys frequently would be out of stock, and the company was unable to ship enough products or

manage the production of its more complicated sets. Retail stores were frustrated, and that translated into reduced shelf

space and ultimately to business losses.

Knudstorp changed all of that. He reached out to top retailers, cut costs, and added missing links to the supply chain. For

example, prior to the new strategy, 90% of the components were used in just one design. Designers were encouraged to reuse

components in their new products, which resulted in a reduction from about 13,000 different Lego components to 7,000.

Because each component ’ s mold could cost up to 50,000 euros on average to create, this reduction saved signifi cant expense.

Lego was known for its traditional blocks and components that would allow children to build just about anything their

imagination could create. The new strategy broadened the products, targeting new customer segments. Lego managers cre-

ated products based on themes of popular movies, such as Star Wars and the Indiana Jones series. The company moved into video games, which featured animated Lego characters sometimes based on movies. The company created a product

strategy for adults and engaged the communities who had already set up thousands of Web sites and blogs featuring Lego

creations. It embraced the community who thought of Lego as a way to create art rather than simply as a building toy. And

the company designed a line of Legos aimed at girls because the majority of its products had primarily targeted boys.

The culture of Lego changed to one that refused to accept nonperformance. The company ’ s past showed a tendency to

focus on innovation and creativity, often at the expense of profi ts. But that changed. “Knudstorp . . . made it clear that results,

not simply feeling good about making the best toys, would be essential if Lego was to succeed. . . . Its business may still be

fun and games, but working here isn ’ t,” 20 describes the current culture at Lego .

Some of the most drastic changes came from within the Lego organization structure. After its massive losses in 2004,

Lego switched its employee pay structure, offering incentives for appropriate product innovation and sales. Key performance

indicators encourage product innovation that catalyzes sales while decreasing costs. Development time dropped by 50%, and

some manufacturing and distribution functions were moved to less expensive locations, but the focus on quality remained.

The creation of reusable parts alleviated some of the strain on Lego ’ s supply chain, which in turn helped its bottom line.

Lego also expanded into the virtual world, extending into video gaming and virtual‐interaction games on the Internet.

Thinking outside the company ’ s previous product concepts cut costs while encouraging real‐time feedback from customers

across a global market. Additionally, Lego created brand ambassadors who organized conventions across the world to dis-

cuss product innovation and to build communities of fellow customers. With increased revenue, Lego managers considered

entering the movie‐making business—a risky proposition for a toy company. However, Lego ’ s success with Hollywood‐type

action fi gures fueled its interest in a movie‐making endeavor.

The growth put strains on the IS supporting the business. Order management and fulfi llment were particularly affected,

resulting in the inability to meet customer demand. Employee management systems were stretched as new employees were

added to support the growth and additional locations. Product design and development, especially the virtual and video

games, required new technology, too.

To solve some of these problems, Lego managers used the same approach they used for their blocks. They created a

modularized and standardized architecture for their IS, making it possible to expand more quickly and add capacity and

functionality as it was needed. They implemented an integrated enterprise system that gave them new applications for

human capital management, operations support, product life cycle management, and data management. The new systems

and services, purchased from vendors such as SAP and IBM , simplifi ed the IT architecture and the management processes

needed to oversee the IS.

■ CASE STUDY 1‐1 Lego

20 Nelson D. Schwartz , “ Turning to Tie‐Ins, Lego Thinks Beyond the Brick ,” The New York Times , September 5, 2009 , http://www.nytimes. com/2009/09/06/business/global/06lego.html?pagewanted=all&_r=0 (accessed August 21, 2015) .

c01.indd 30 11/26/2015 6:19:41 PM

31Case Study

One manager at Lego summed it up nicely, “The toy world moves onwards constantly, and Lego needs to re‐invent itself

continuously. Signifi cant corporate re‐shaping introduced new energy to the company.” 21 He went on to say that simplifying

Lego ’ s IT systems and implementing an effi cient product development process that was able to maintain quality and cost

favorably positioned Lego to respond to the fast changing pace of the toy industry.

Discussion Questions

1. How did the information systems and the organization design changes implemented by Knudstorp align with the changes

in business strategy?

2. Which of the generic strategies does Lego appear to be using based on this case? Provide support for your choice.

3. Are the changes implemented by Knudstorp an indication of hypercompetition? Defend your position.

4. What advice would you give Knudstorp to keep Lego competitive, growing, and relevant?

Sources: Adapted from http://www.nytimes.com/2009/09/06/business/global/06lego.html (accessed August 21, 2015) ; Brad Wieners , “ Lego Is for Girls ” (December 19, 2011 ), 68 – 73 ; information from Lego ’ s 2012 annual report, http://www.lego.com/en‐us/aboutus/news‐ room/2013/february/annual‐result‐2012 (accessed March 29, 2015); and “Lego Case Study,” http://thelegocasestudy.com (accessed March 29, 2015).

Started in the late 1990s, Google grew rapidly to become one of the leading companies in the world. Its mission is “to

organize the world ’ s information and make it universally accessible and useful.” It is operating on a simple but innovative

business model of attracting Internet users to its free search services and earning revenue from targeted advertising. In the

winner‐takes‐all business of Internet search, Google has captured considerably more market share than its next highest rival,

Yahoo . This has turned Google ’ s Web pages into the Web ’ s most valuable real (virtual) estate. Through its two fl agship pro-

grams, AdWords and AdSense, Google has capitalized on this leadership position in searching to capture the lion ’ s share in

advertisement spending. AdWords enables businesses to place ads on Google and its network of publishing partners using

an auction‐engine algorithm to decide which ad will appear on a given page. On the other hand, Google uses AdSense to

push advertisements on publishing partners ’ Web sites targeting a specifi c audience and share ad revenue with the publishing

partner. This creates a win–win situation for both advertisers and publishers; Google makes more than 90% of its revenue

from ads.

Even as a large company, Google continues to take risks and expand into new markets. Innovation is at the core of their

enterprise. Sergey Brin and Larry Page, the founders, declared in Google ’ s IPO prospectus, “We would fund projects that

have a 10% chance of earning a billion dollars over the long term. . . We place smaller bets in areas that seem very specula-

tive or even strange. As the ratio of reward to risk increases, we will accept projects further outside our normal areas.” They

add that they are especially likely to fund new types of projects when the initial investment is small.

Google promotes a culture of creativity and innovation in a number of ways. It encourages innovation in all employees

by allowing them to spend 20% of their time on a project of their own choosing. In addition, the company offers benefi ts

such as free meals, on‐site gym, on‐site dentist, and even washing machines at the company for busy employees.

Despite an open and free work culture, a rigid and procedure‐fi lled structure is imposed for making timely decisions and

executing plans. For example, when designing new features, the team and senior managers meet in a large conference room.

They use the right side of the conference room walls to digitally project new features and the left side to project any tran-

scribed critique with a timer clock giving everyone 10 minutes to lay out ideas and fi nalize features. Thus, Google utilizes

rigorous, data‐driven procedures for evaluating new ideas in the midst of a chaotic innovation process.

Nine notions of innovations are embedded in the organizational culture, processes, and structure of Google: 22

1. “Innovation Comes from Anywhere”: All Google employees can innovate.

2. “Focus on the User”: When focus is on the user, the money and all else will follow.

■ CASE STUDY 1‐2 Google

21 https://www.vmware.com/files/pdf/partners/sap/sap‐vmware‐lego‐cs‐en.pdf (accessed September 11, 2015). 22 Kathy Chin Long , “ Google Reveals its Nine Principles of Innovations ,” Fast Company , http://www.fastcompany.com/3021956/how‐to‐be‐a‐success‐ at‐everything/googles‐nine‐principles‐of‐innovation (accessed March 30, 2015 ) .

c01.indd 31 11/26/2015 6:19:41 PM

32 The Information Systems Strategy Triangle

3. “Aim to be Ten Times Better”: To get radical and revolutionary innovation, think 10 times improvement to force

out‐of‐the‐box thinking.

4. “Bet on Technical Insights”: Trust your organization ’ s unique insights and bet on them for major innovation.

5. “Ship and Iterate”: Do not wait for perfection; let users help you to “iterate.”

6. “Give Employees 20 Percent Time”: Employees will delight you with their creative thinking. Give them 20 percent

of their work time to pursue projects they are passionate about.

7. “Default to Open Processes”: Make processes open to all to tap into the collective energy of the user base to find

great ideas.

8. “Fail Well”: Do not attach stigma to failure. If you do not fail often, you are not trying hard enough. Let people and

projects fail with pride.

9. “Have a Mission That Matters”: Google believes that its work has a positive impact on millions of people and that

this is motivating its people every day.

Keeping up with the organizational strategy of Google , its IT department provides free and open access to IT for all

employees. Rather than keeping tight control, Google allows employees to choose from several options for computer and

operating systems, download software themselves, and maintain offi cial and unoffi cial blog sites. Google ’ s intranet provides

employees information about every piece of work at any part of the company. In this way, employees can fi nd and join hands

with others working on similar technologies or features.

In building the necessary IT infrastructure, Google ’ s IT department balances buying and making its own software depend-

ing on its needs and off‐the‐shelf availability. Google thinks of every IT decision “at Web Scale” to make sure its technology

works well for its customers. Given the nature of business, security of information resources is critical for Google . For

instance, its master search algorithm is considered a more valuable secret formula than Coca‐Cola ’ s. However, rather than

improving IT security by stifl ing freedom through preventive policy controls, Google puts security in the infrastructure and

focuses more on detective and corrective controls. Its network management software tools combined with a team of security

engineers constantly look for viruses and spyware as well as strange network traffi c patterns associated with intrusion.

Discussion Questions

1. How is Google ’ s mission statement related to its business strategy?

2. How does Google ’ s information systems strategy support its business strategy?

3. How does Google ’ s organizational strategy support its business strategy?

4. Which of Porter ’ s three generic strategies does Google appear to be using based on this case? Provide a rationale for

your response.

5. Analyze Google ’ s strategy and the type of market disruption it has created using a dynamic environment perspective.

Sources: Adapted from Michelle Colin , “ Champions of Innovation ,” Businessweek 3989 (June 1 8 , 2006 ), 18–26 , http://www.bloomberg. com/bw/stories/2006‐06‐18/champions‐of‐innovation; Vauhini Vara , “ Pleasing Google ’ s Tech‐Savvy Staff ” (March 18, 2008 ) , B6; Jason Bloomberg , “ Google ’ s Three‐Pronged Enterprise Strategy ,” Forbes Online (December 12, 2014 ) ; and Connor Forrest , “ Four Ways Google Makes Money ,” TechRepublic (January 16, 2015 ) , http://www.techrepublic.com/article/four‐ways‐google‐makes‐money‐ outside‐of‐advertising/ (accessed August 21, 2015 ).

c01.indd 32 11/26/2015 6:19:41 PM

33

2 chapter

This chapter introduces the concept of building competitive advantage using information systems‐based applications. It begins with a discussion of a set of eras that describe the use of information resources historically. It then presents information resources as strategic tools, discussing information technology ( IT ) assets and IT capabilities. Michael Porter ’ s Five Com- petitive Forces model then provides a framework for discussing strategic advantage, and his Value Chain model addresses tactical ways organizations link their business processes to create strategic partnerships. We then introduce the Piccoli and Ive ’ s model to show how strategic advantage may be sustained in light of competitive barriers while the Resource‐ Based View focuses on gaining and maintaining strategic advantage through information and other resources of the fi rm. The chapter concludes with a brief discussion of strategic alliances, co‐opetition, risks of strategic use of IT, and cocreating IT and business strategy. Just as a note: this chapter uses the terms competitive advantage and strategic advantage interchangeably.

1 Inditex Web site, http://www.inditex.com/en/who_we_are/concepts/zara (accessed February 20, 2012); http://www.marinabaysands.

com/shopping/zara.html (accessed May 2, 2015).

Strategic Use of Information Resources

Zara , a global retail and apparel manufacturer based in Arteixo, Spain, needed a dynamic business

model to keep up with the ever‐changing demands of its customers and industry. At the heart of its

model was a set of business processes and an information system that linked demand to manufactur-

ing and manufacturing to distribution. The strategy at Zara stores was simply to have a continuous

fl ow of new products that were typically in limited supply. As a result, regular customers visited

their stores often—an average of 17 times a year whereas many retail stores averaged only four

times a year. When customers saw something they liked, they bought it on the spot because they

knew it would probably be gone the next time they visited the store. The result was a very loyal and

satisfi ed customer base and a wildly profi table business model.

How did Zara do it? It was possible in part because the company aligned its information system

strategy with its business strategy. Its corporate Web site gave some insight:

Zara ’ s approach to design is closely linked to our customers. A non‐stop fl ow of information from

stores conveys shoppers ’ desires and demands, inspiring our 200‐person strong creative team. 1

The entire process from factory to shop fl oor is coordinated from Zara ’ s headquarters by using

information systems. The point‐of‐sale (POS) system on the shop fl oor records the information from

each sale, and the information is transmitted to headquarters at the end of each business day. Using

a handheld device, the Zara shop managers also report daily to the designers at headquarters to let

them know what has sold and what the customers wanted but couldn ’ t fi nd. The information is used

to determine which product lines and colors should be kept and which should be altered or dropped.

c02.indd 33 11/26/2015 6:20:48 PM

34 Strategic Use of Information Resources

The designers communicate directly with the production staff to plan for the incredible number of designs—more

than 30,000—that will be manufactured every year.2

The shop managers have the option to order new designs twice a week using handheld computers. Before order-

ing, they can use these devices to check out the new designs. Once an order is received at the manufacturing plant at

headquarters, a large computer‐controlled piece of equipment calculates how to position patterns to minimize scrap

and cut up to 100 layers of fabric at a time. The cut fabric is then sent from Zara factories to external workshops for

sewing. The completed products are sent to distribution centers where miles of automated conveyor belts are used

to sort the garments and recombine them into shipments for each store. Zara’s Information Systems (IS) department

wrote the applications controlling the conveyors, often in collaboration with vendors of the conveyor equipment.

As the Zara example illustrates, innovative use of a firm’s information resources can provide it substantial

and sustainable advantages over competitors. Every business depends on IS, making its use a necessary resource

every manager must consider. IS also can create a strategic advantage for firms who bring creativity, vision, and

innovation to their IS use. The Zara case is an example. This chapter uses the business strategy foundation from

Chapter  1 to help general managers visualize how to use information resources for competitive advantage. This

chapter highlights the difference between simply using IS and using IS strategically. It also explores the use of

information resources to support the strategic goals of an organization.

The material in this chapter can enable a general manager to understand the linkages between business strategy

and information strategy on the Information Systems Strategy Triangle. General managers want to find answers to

questions such as: Does using information resources provide a sustainable and defendable competitive advantage?

What tools are available to help shape strategic use of information? What are the risks of using information resources

to gain strategic advantage?

Evolution of Information Resources The Eras model (Figure 2.1) summarizes the evolution of information resources over the past six decades. To think

strategically about how to use information resources now and in the future within the firm, a manager must under-

stand how the company arrived at where it is today. This model provides a good overview of trends and uses that

have gotten the company from simple automation of tasks to extending relationships and managing their business

ecosystems to where it is today.

IS strategy from the 1960s to the 1990s was driven by internal organizational needs. First came the need to

lower existing transaction costs. Next was the need to provide support for managers by collecting and distributing

information followed by the need to redesign business processes. As competitors built similar systems, organi-

zations lost any advantages they had derived from their IS, and competition within a given industry once again

was driven by forces that existed prior to the new technology. Most recently, enterprises have found that social IT

platforms and capabilities drive a new evolution of applications, processes, and strategic opportunities that often

involve an ecosystems of partners rather than a list of suppliers. Business ecosystems are collections of interacting participants, including vendors, customers, and other related parties, acting in concert to do business.3

In Eras I through III, the value of information was tied to physical delivery mechanisms. In these eras, value was

derived from scarcity reflected in the cost to produce the information. Information, like diamonds, gold, and MBA

degrees, was more valuable because it was found in limited quantities. However, the networked economy beginning

in Era IV drove a new model of value—value from plenitude. Network effects offered a reason for value derived from plenitude; the value of a network node to a person or organization in the network increased when others joined

the network. For example, an e‐mail account has no value without at least one other e‐mail account with which to

communicate. As e‐mail accounts become relatively ubiquitous, the value of having an e‐mail account increases

as its potential for use increases. Further, copying additional people on an e‐mail is done at a very low cost (virtu-

ally zero), and the information does not wear out (although it can become obsolete). As the cost of producing an

2 Shenay Kentish, Zara (October 18, 2011), http://unilifemagazine.com.au/special‐interest/zara/ (accessed April 10, 2012). 3 For further discussion of business ecosystems, please refer to Nicholas Vitalari and Hayden Shaughnessy, The Elastic Enterprise (Longboat Key, FL: Telemachus Press, 2012).

c02.indd 34 11/26/2015 6:20:48 PM

35Evolution of Information Resources

additional copy of an information product within a network becomes trivial, the value of that network increases.

Therefore, rather than using production costs to guide the determination of price, information products might be priced to reflect their value to the buyer.4

As each era begins, organizations adopt a strategic role for IS to address not only the firm’s internal circum-

stances but also its external circumstances. Thus, in the value‐creation era (Era V), companies seek those appli-

cations that again provide them an advantage over their competition and keep them from being outgunned by

start‐ups with innovative business models or traditional companies entering new markets. For example, companies

like Microsoft, Google, Apple, and Facebook have created and maintained a competitive advantage by building

technical platforms and organizational competencies that allow them to bring in partners as necessary to create

new products and services for their customers. Their business ecosystems give them agility as well as access to

talent and knowledge, extending the capabilities of their internal staff. Other firms simply try to solve all customer

requests themselves.

Era VI has brought another paradigm shift in the use of information with an era of hyperplenitude: seem-

ingly unlimited availability of information resources such as the Internet and processing and storage through

FIGURE 2.1 Eras of information usage in organizations.

Era I 1960s Era II 1970s Era III 1980s Era IV 1990s Era V 2000s Era VI 2010+

Primary Role of IT

Efficiency Effectiveness Strategy Strategy Value creation

Value extension

Automate existing paper‐based processes

Solve problems and create opportunities

Increase individual and group effectiveness

Transform industry/ organization

Create collaborative partnerships

Create community and social business

Connecting intelligent devices

Justify IT Expenditures

Return on investment

Increase in productivity and better decision quality

Competitive position

Competitive position

Added value Creation of relationships

Automated information exchange

Target of Systems

Organization Organization/ Group

Individual manager/ Group

Business processes

Customer/ Supplier relationships

Customer/ Employee/ supplier ecosystem

Intelligent devices

Information Models

Application specific

Data driven User driven Business driven

Knowledge driven

People driven (or relationship driven)

Data exchange driven

Dominant Technology

Mainframe, “centralized intelligence”

Minicomputer, mostly “centralized intelligence”

Microcomputer, “decentralized intelligence”

Client server, “distributed intelligence”

Internet, global “ubiquitous intelligence”

Social platforms, social networks, mobile, cloud

Intelligent devices, sensors, electronics

Basis of Value

Scarcity Scarcity Scarcity Plenitude Plenitude Hyperplenitude

Underlying Economics

Economics of information bundled with economics of things

Economics of information bundled with economics of things

Economics of information bundled with economics of things

Economics of information separated from economics of things

Economics of information separated from economics of things

Economics of relationships bundled with economics of information

Economics of informa tion bundled with economics of things

4 Adapted from M. Broadbent, P. Weill, and D. Clair. “The Implications of Information Technology Infrastructure for Business Process Redesign,” MIS Quarterly 23, no. 2 (1999), 163.

c02.indd 35 11/26/2015 6:20:48 PM

36 Strategic Use of Information Resources

cloud computing sparked new value sources such as community and social business and the Internet of Things

(connecting intelligent devices, sensors, and other electronics).

The Information System Strategy Triangle introduced in Chapter 1 reflects the linkages between a firm’s IS strat-

egy, organizational strategy, and business strategy. A link between IS strategy and business strategy focuses on the

firm’s external requirements whereas a link between IS strategy and organizational strategy fulfills and enhances

internal requirements of the firm. Maximizing the effectiveness of the firm’s business strategy requires that the

general manager be able both to identify and use information resources. This chapter describes how information

resources can be used strategically by general managers.

Information Resources as Strategic Tools Crafting a strategic advantage requires the general manager to cleverly combine all the firm’s resources, includ-

ing financial, production, human, and information, and to consider external resources such as the Internet and

opportunities in the global arena. Information resources are more than just the infrastructure. This generic term,

information resources, is defined as the available data, technology, people, and processes within an organization to be used by the manager to perform business processes and tasks. Information resources can either be assets or

capabilities. An IT asset is any thing, tangible or intangible, that can be used by a firm to create, produce, and/or offer its products (goods or services). Examples of IT assets include a firm’s Web site, data files, or computer equip-

ment. An IT capability is something that is learned or developed over time for the firm to create, produce, or offer its products. An IT capability makes it possible for a firm to use its IT assets effectively.5 The ability and knowledge

to create a Web site, work with data files, and take advantage of IT equipment are examples of capabilities.

An IS infrastructure (a concept that is discussed in detail in Chapter  6) is an IT asset. It includes each of an information resource’s constituent components (i.e., data, technology, people, and processes). The infrastructure

provides the foundation for the delivery of a firm’s products or services. Another IT asset is an information repos- itory, which is logically related data captured, organized, and retrieved by the firm. Some information repositories are filled with internally oriented information designed to improve the firm’s efficiency. Other repositories tap the

external environment and contain significant knowledge about the industry, the competitors, and the customers.

Although most firms have these types of information repositories, not all firms use them effectively.

In the continually expanding Web space, the view of IT assets is broadening to include potential resources that

are available to the firm but that are not necessarily owned by it. These additional information resources are often

available as a service rather than as a system to be procured and implemented internally. For example, Internet‐

based software (also called software as a service, or SAAS), such as SalesForce.com, offers managers the opportu- nity to find new ways to manage their customer information with an externally based IT resource. Social networking

systems such as Facebook and LinkedIn offer managers the opportunity to find expertise or an entire network of

individuals ready to participate in the corporate innovation processes using relatively little capital or expense.

The three major categories of IT capabilities are technical skills, IT management skills, and relationship skills.

Technical skills are applied to designing, developing, and implementing information systems. IT management skills are critical for managing the IS department and IS projects. They include an understanding of business processes,

the ability to oversee the development and maintenance of systems to support these processes effectively, and the

ability to plan and work with the business units in undertaking change. Relationship skills can be focused either externally or internally. An externally focused relationship skill includes the ability to respond to the firm’s market

and to work with customers and suppliers. The internal relationship between a firm’s IS managers and its business

managers is a spanning relationship skill and includes the ability of IS to manage partnerships with the business

units. Even though it focuses on relationships in the firm, it requires spanning beyond the IS department. Rela-

tionship skills develop over time and require mutual respect and trust. They, like the other information resources,

can create a unique advantage for a firm. Figure 2.2 summarizes the different types of information resources and

provides examples of each.

5 G. Piccoli and B. Ives, “IT‐Dependent Strategic Initiatives and Sustained Competitive Advantage: A Review and Synthesis of the Literature,” MIS Quarterly 29, no. 4 (2003), 747–76.

c02.indd 36 11/26/2015 6:20:48 PM

37How Can Information Resources Be Used Strategically?

Information resources exist in a company alongside other resources. The general manager is responsible for

organizing all resources so that business goals are met. Understanding the nature of the resources at hand is a pre-

requisite to using them effectively. By aligning IS strategy with business strategy, the general manager maximizes

the company’s profit potential. To ensure that information resources being deployed for strategic advantage are used

wisely, the general manager must identify what makes the information resource valuable (and the Eras model may

provide some direction) and sustainable. Meanwhile, the firm’s competitors are working to do the same. In this

competitive environment, how should the information resources be organized and applied to enable the organiza-

tion to compete most effectively?

How Can Information Resources Be Used Strategically? The general manager confronts many elements that influence the competitive environment of his or her enterprise.

Overlooking a single element can bring about disastrous results for the firm. This slim tolerance for error requires

the manager to take multiple views of the strategic landscape. Three such views can help a general manager align

IS strategy with business strategy. The first view uses the five competitive forces model by Michael Porter to look at the major influences on a firm’s competitive environment. Information resources should be directed strategically

to alter the competitive forces to benefit the firm’s position in the industry. The second view uses Porter’s value chain model to assess the internal operations of the organization and partners in its supply chain. Information resources should be directed at altering the value‐creating or value‐supporting activities of the firm. We extend this

view further to consider the value chain of an entire industry to identify opportunities for the organization to gain

competitive advantage. The third view specifically focuses on the types of IS resources needed to gain and sustain competitive advantage. These three views provide a general manager with varied perspectives from which to iden-

tify strategic opportunities to apply the firm’s information resources.

Using Information Resources to Influence Competitive Forces

Porter provides the general manager a classic view of the major forces that shape the competitive environment of an

industry, which affects firms within the industry. These five competitive forces are shown in Figure 2.3 along with

some examples of how information resources can be applied to influence each force. This view reminds the general

FIGURE 2.2 Information resources. Source: Adapted from G. Piccoli and B. Ives, “IT‐Dependent Strategic Initiatives and Sustained Competitive Advantage: A Review and Synthesis of the Literature,” MIS Quarterly 29, no. 4 (2005), 755.

IT Assets IT Capabilities

IT Infrastructure

• Hardware • Software and company apps • Network • Data • Web site

Information Repository

• Customer information • Employee information • Marketplace information • Vendor information

Technical Skills

• Proficiency in systems analysis • Programming and Web design skills • Data analysis/data scientist skills • Network design and implementation skills

IT Management Skills

• Business process knowledge • Ability to evaluate technology options • Project management skills • Envisioning innovative IT solutions

Relationship Skills

• Spanning skills such as business‐IT relationship management

• External skills such as vendor management

c02.indd 37 11/26/2015 6:20:48 PM

38 Strategic Use of Information Resources

manager that competitive forces result from more than just the actions of direct competitors. We explore each force

in detail from an IS perspective.

Potential Threat of New Entrants

Existing firms within an industry often try to reduce the threat of new entrants to the marketplace by erecting bar-

riers to entry. New entrants seem to come out of nowhere; established firms can diversify their business models and

begin to compete in the space occupied by existing firms, or an enterprising entrepreneur can create a new business

that changes the game for existing firms. Barriers to entry— including a firm’s controlled access to limited distribu-

tion channels, public image of a firm, unique relationships with customers, and an understanding of their industry’s

government regulations—help the firm create a stronghold by offering products or services that are difficult to dis-

place in the eyes of customers based on apparently unique features. Information resources also can be used to build

barriers that discourage competitors from entering an industry. For example, Google’s search algorithm is a source

of competitive advantage for the search company, and it’s a barrier of entry for new entrants that would have to cre-

ate something better to compete against Google. New entrants have failed to erode Google’s market share, which

holds fast at 65% in the United States and at over 90% in Europe.6 Walmart, another example, effectively blocks

competition with its inventory control system, which helps it drive down expenses and ultimately offer lower costs

to customers. Any company entering Walmart’s marketplace would have to spend millions of dollars to build the

inventory control system and IS required to provide its operations with the same capabilities. Therefore, the system

at Walmart may be a barrier to entry for new companies.

Search engine optimization (actions that a firm can take to improve its prominence in search results) has served

as a barrier to entry for some businesses. Consider the Web site that has the number one position in a user’s search.

There is only one number one position, making it an advantage for the company enjoying that position and a barrier

for all other Web sites seeking that position.

Bargaining Power of Suppliers

3

Bargaining Power of Buyers

2

Strategic use • Cost effectiveness • Market access • Differentiation of product or service

Strategic use • Switching costs • Access to distribution channels • Economies of scale

Strategic use • Selection of supplier • Threat of backward integration

Strategic use • Buyer selection • Switching costs • Differentiation

Strategic use • Redefine products and services • Improve price/performance

Potential Threat of New Entrants

1

Threat of Substitute Products

4

Industry Competitors

5

FIGURE 2.3 Five competitive forces with potential strategic use of information resources. Sources: Adapted from M. Porter, Competitive Strategy (New York: The Free Press, 1998); and Lynda M. Applegate, F. Warren McFarlan, and James L. McKenney, Corporate Information Systems Management : The Issues Facing Senior Executives, 4th ed. (Homewood, IL: Irwin, 1996).

6 “Viewed as a Monopoly in Europe, Google Takes on Role as a Wireless Trust‐Buster in U.S.,” New York Times (May 8, 2015), B1, B6.

c02.indd 38 11/26/2015 6:20:49 PM

39How Can Information Resources Be Used Strategically?

Bargaining Power of Buyers

Customers often have substantial power to affect the competitive environment. This power can take the form of

easy consumer access to several retail outlets to purchase the same product or the opportunity to purchase in large

volumes at superstores like Walmart. Information resources can be used to build switching costs that make it less

attractive for customers to purchase from competitors. Switching costs can be any aspect of a buyer’s purchas-

ing decision that decreases the likelihood of “switching” his or her purchase to a competitor. Such an approach

requires a deep understanding of how a customer obtains the product or service. For example, Amazon.com’s

patented One Click option encourages return purchases by making buying easier. Amazon.com stores buyer

information, including a default credit card number, shipping method, and “ship‐to” address so that purchases

can be made with one click, saving consumers the effort of data reentry and further repetitive choices. Similarly,

Apple’s iTunes simple‐to‐use interface and proprietary software for downloading and listening to music makes

it difficult for customers to use other formats and technologies, effectively reducing the power of the buyers, the

customers.

Bargaining Power of Suppliers

Suppliers’ bargaining power can reduce a firm’s options and ultimately its profitability. Suppliers often strive to

“lock in” customers through the use of systems (and other mechanisms). For example, there are many options for

individuals to back up their laptop data, including many “cloud” options. The power of any one supplier is low

because there are a number of options. But Apple’s operating system enables easy creation of backups and increases

Apple’s bargaining power. Millions of customers find it easy to use the iCloud, and they do.

The force of bargaining power is strongest when a firm has few suppliers from which to choose, the quality of

supplier inputs is crucial to the finished product, or the volume of purchases is insignificant to the supplier. For

example, steel firms lost some of their bargaining power over the automobile industry because car manufacturers

developed technologically advanced quality control systems for evaluating the steel they purchase. Manufacturers

can now reject steel from suppliers when it does not meet the required quality levels.

Through the Internet, firms continue to provide information for free as they attempt to increase their share of

visitors to their Web sites and gather information about them. This decision reduces the power of information sup-

pliers and necessitates finding new ways for content providers to develop and distribute information. Many Internet

firms are integrating backward or sideways within the industry, that is, creating their own information supply and

reselling it to other Internet sites. Well‐funded firms simply acquire these content providers, which is often quicker

than building the capability from scratch. One example of this was Amazon.com’s purchase of Zappos, the shoe

retailer. More recently, in 2015 LinkedIn acquired online learning company Lynda.com to add a capability to offer

professional development to the company’s business of networking, recruitment, and advertising.

Threat of Substitute Products

The potential of a substitute product in the marketplace depends on the buyers’ willingness to substitute, the

relative price‐to‐performance ratio of the substitute, and the level of switching costs a buyer faces. Information

resources can create advantages by reducing the threat of substitution. Substitutes that cause a threat come from

many sources. Internal innovations can cannibalize existing revenue streams for a firm. For example, new iPhones

motivate current customers to upgrade, essentially cannibalizing the older product line revenue. Of course, this is

also a preemptive move to keep customers in the iPhone product family rather than to switch to another competi-

tor’s product. The threat might come from potentially new innovations that make the previous product obsolete.

Tablets have reduced the market for laptops and personal computers. GPS systems have become substitutes for

paper maps, digital cameras have made film and film cameras obsolete, and MP3 music has sharply reduced the

market for vinyl records, record players, CDs, and CD players. Free Web‐based applications are a threat to soft-

ware vendors who charge for their products and who do not have Web‐based delivery. Revolutions of many kinds

and levels of maturity seem to be lurking everywhere. Cloud services are a substitute for data centers. Uber offers a

substitute for taxicabs. Managers must watch for potential substitutes from many different sources to fully manage

this competitive threat.

c02.indd 39 11/26/2015 6:20:49 PM

40 Strategic Use of Information Resources

Industry Competitors

Rivalry among the firms competing within an industry is high when it is expensive for a firm to leave the industry,

the growth rate of the industry is declining, or products have lost differentiation. Under these circumstances, the

firm must focus on the competitive actions of rivals to protect its own market share. Intense rivalry in an industry

ensures that competitors respond quickly to any strategic actions. Facebook enjoys a competitive advantage in the

social networking industry. Other sites have tried to compete with Facebook by offering a different focus, either a

different type of interface or additional ways to network. Competition is fierce and many start‐ups hope to “be the

next Facebook.” However, Facebook continues to lead the industry, in part by continued innovation and in part by

its huge customer base, which continues to raise the bar for competitors.

The processes that firms use to manage their operations and to lower costs or increase efficiencies can provide

an advantage for cost‐focus firms. However, as firms within an industry begin to implement standard business

processes and technologies—often using enterprisewide systems such as those of SAP and Oracle—the industry

becomes more attractive to consolidation through acquisition. Standardizing IS lowers the coordination costs of

merging two enterprises and can result in a less competitive environment in the industry.

One way competitors differentiate themselves with an otherwise undifferentiated product is through creative use

of IS. Information provides advantages in such competition when added to an existing product. For example, the

iPod, iPhone, iPad, and iWatch are differentiated in part because of the iTunes store and the applications available

only to users of these devices. Competitors offer some of the same information services, but Apple was able to take

an early lead by using information systems to differentiate their products. Credit card companies normally compete

on financial services such as interest rate, fees, and payment period. But Capital One differentiated its credit cards

by adding information to its services; it provided customers their credit scores.

Each of the competitive forces identified by Porter’s model is acting on firms at all times, but perhaps to a greater

or lesser degree. There are forces from potential new entrants, buyers, sellers, substitutes, and competitors at all

times, but their threat varies. Consider Zara, the case discussed in at the beginning of this chapter. See Figure 2.4

for a summary of these five forces working simultaneously at the retailer and manufacturer.

General managers can use the five competitive forces model to identify the key forces currently affecting compe-

tition, to recognize uses of information resources to influence forces, and to consider likely changes in these forces

FIGURE 2.4 Application of five competitive forces model for Zara.

Competitive Force IT Influence on Competitive Force

Threat of New Entrant Zara’s IT supports its tightly knit group of designers, market specialists, production managers, and production planners. New entrants are unlikely to be able to provide IT to support such relationships that have been built over time at Zara. Further, it has a rich information repository about customers that would be hard to replicate.

Bargaining Power of Buyers Recently, Zara has employed laser technology to measure 10,000 women volunteers so that it can add the measurements of “real” customers into its information repositories. This means that the new products will be more likely to fit Zara customers.

Bargaining Power of Suppliers Its computer‐controlled cutting machine cuts up to 1,000 layers at a time. A large number of sellers are available for the simple task of sewing the pieces together. Zara has great flexibility in choosing the sewing companies.

Industry Competitors Zara tracks breaking trends and focuses on meeting customer preferences for trendy, low‐cost fashion. The result is the highest sales per square foot in its industry, virtually no advertising, only 10% of stock remaining unsold, very low inventory levels, new products offered in 15 days from idea to shelves, and extremely efficient manufacturing and distribution operations.

Threat of Substitute Products IT helps Zara offer extremely fashionable lines that are expected to last for approximately 10 wears. IT enables Zara to offer trendy, appealing apparel at hard‐to‐beat prices, making substitutes difficult.

c02.indd 40 11/26/2015 6:20:49 PM

41How Can Information Resources Be Used Strategically?

over time. The changing forces drive both the business strategy and IS strategy, and this model provides a way to

think about how information resources can create competitive advantage for a business unit and, even more broadly,

for the firm. The forces also can reshape an entire industry—compelling general managers to take actions to help

their firm gain or sustain competitive advantage.

Using Information Resources to Alter the Value Chain

A second lens for describing the strategic use of information systems is Porter’s value chain. The value chain model

addresses the activities that create, deliver, and support a company’s product or service. Porter divided these activ-

ities into two broad categories (Figure 2.5): support and primary activities. Primary activities relate directly to the

value created in a product or service whereas support activities make it possible for the primary activities to exist

and remain coordinated. Each activity may affect how other activities are performed, suggesting that information

resources should not be applied in isolation. For example, more efficient IS for repairing a product may increase

the possible number of repairs per week, but the customer does not receive any value unless his or her product is

repaired, which requires that the spare parts be available. Changing the rate of repair also affects the rate of spare

parts ordering. If information resources are focused too narrowly on a specific activity, then the expected value may

not be realized because other parts of the chain have not adjusted.

The value chain framework suggests that competition stems from two sources: lowering the cost to perform

activities and adding value to a product or service so that buyers will pay more. To achieve true competitive

advantage, a firm requires accurate information on elements outside itself. Lowering activity costs achieves an

advantage only if the firm possesses information about its competitors’ cost structures. Even though reducing

isolated costs can improve profits temporarily, it does not provide a clear competitive advantage unless the

firm can lower its costs below a competitor’s. Doing so enables the firm to lower its prices as a way to grow its

market share.

For example, many Web sites sell memory to upgrade laptops. But some sites, such as crucial.com, have an

option that automates the process prior to the sales process. These sites have the “Crucial System Scanner Tool,”

which scans the customer’s laptop, identifies the current configuration and the capacity, and then suggests com-

patible memory upgrade kits. The customer uses the scanner, which identifies the configuration of the laptop, and

automatically opens a Web page with the appropriate memory upgrades. The customer does not have to figure out

the configuration or requirements; it’s done automatically. By combining a software program like its configurator

with the sales process, crucial.com has added value to the customer’s experience by automating a key process.

Organization

Human Resources

Technology

Purchasing

Inbound

Logistics

Outbound

Logistics

Operations Marketing

and Sales

Service

Materials handling Delivery

Manufacturing Assembly

Order processing Shipping

Product Pricing Promotion Place

Customer service Repair

P ri

m a ry

A c ti

v it

ie s

S u

p p

o rt

A c ti

v it

ie s

FIGURE 2.5 Value chain of the firm. Source: Adapted from Michael Porter and Victor Millar, “How Information Gives You Competitive Advantage,” Harvard Business Review (July–August 1985), reprint no. 85415.

c02.indd 41 11/26/2015 6:20:49 PM

42 Strategic Use of Information Resources

Although the value chain framework emphasizes the activities of the individual firm, it can be extended, as

in Figure 2.6, to include the firm in a larger value system. This value system is a collection of firm value chains

connected through a business relationship and through technology. From this perspective, a variety of strategic

opportunities exist to use information resources to gain a competitive advantage. Understanding how information is

used within each value chain of the system can lead to new opportunities to change the information component of

value‐added activities. It can also lead to shakeouts within the industry as firms that fail to provide value are forced

out and as surviving firms adopt new business models.

Opportunity also exists in the transfer of information across value chains. For example, sales forecasts gener-

ated by a manufacturer, such as a computer or automotive company, and linked to supplier systems create orders

for the manufacture of the necessary components for the computer or vehicle. Often this coupling is repeated from

manufacturing company to vendor/supplier for several layers, linking the value chains of multiple organizations. In

this way, each member of the supply chain adds value by directly linking the elements of its value chains to others.

Optimizing a company’s internal processes, such as its supply chain, operations, and customer relationship

processes, can be another source of competitive advantage. Tools are routinely used to automate the internal oper-

ations of a firm’s value chain, such as supply chain management (SCM) to source materials for operations, enterprise resource planning (ERP) systems to automate functions of the operations activities of the value chain, and customer relationship management (CRM) systems to optimize the processing of customer information. These systems are discussed in more detail in Chapter 5.

In an application of the value chain model to the Zara example discussed earlier, Figure 2.7 describes the value

added to Zara’s primary and support activities provided by information systems. The focus in Figure  2.7 is on

value added to Zara’s processes, but suppliers and customers in its supply chain also realize the value added by

information systems. Most notably, the customer is better served as a result of the systems. For example, the stores

place orders twice a week over personal digital assistants (PDAs). Each night, managers use their PDAs to learn

about newly available garments. The orders are received and promptly processed and delivered. In this way, Zara

can be very timely in responding to customer preferences.

Unlike the five competitive forces model, which focuses on industry dynamics, the focus of the value chain is

on the firm’s activities. Yet, using the value chain as a lens for understanding strategic use of information resources

affects competitive forces because technology innovations add value to suppliers, customers, or even competitors

and potential new entrants.

Supplier’s

Value

Chains

Firm’s

Value

Chain

Channel’s

Value

Chains

Buyer’s

Value

Chains

FIGURE 2.6 The value system: Interconnecting relationships between organizations.

c02.indd 42 11/26/2015 6:20:49 PM

43Sustaining Competitive Advantage

Sustaining Competitive Advantage It might seem obvious that a firm would try to sustain its competitive advantage. After all, the firm might have

worked very hard to create advantages, such as those previously discussed. However, there is some controversy

about trying to sustain a competitive advantage.

On one side are those who warn of hypercompetition as discussed in Chapter  1.7 In an industry facing hyper-

competition, recall that trying to sustain an advantage can be a deadly distraction. Consider the banking industry as

a good example that has undergone much change over the past five decades. In the 1960s, people needed to visit a

physical bank for all transactions, including withdrawing from or depositing to their accounts and transferring among

accounts. In the 1970s, some banks took a chance and invested in automated teller machines (ATMs) and were

among the innovators in the industry. In the 1980s, some banks pioneered “bank‐by‐phone” services that enabled

customers to pay bills by phone, attempting to establish competitive advantage with technology. In the late 1990s,

Web sites served to augment banking services, and “bank‐by‐web” was the new, exciting way to compete. Most

recently, many banks are providing mobile banking, enabling customers to make deposits by using their smartphone

camera to take photos of checks that previously needed to be turned in physically. Then the checks can be destroyed.

The obvious picture to paint here is that competitors caught up with the leaders very quickly, and competitive

advantage was brief. When ATMs were introduced, it did not take long for others to adopt the same technology.

Even small banks found that they could band together with competitors and invest in the same technologies. The

same imitation game took place with “bank by phone,” “bank by Web,” and mobile banking.

More interestingly, what sounds like an exciting way to show off the power of technology can also be interpreted

as a way to increase the cost of doing business. Although some investments, such as using ATMs to replace tellers,

lowered costs, other investments raised costs (such as needing to offer phone, Web, and mobile banking options to customers).

FIGURE 2.7 Application of value chain model to Zara.

Activity Zara’s Value Chain

Primary Activities

Inbound Logistics IT‐enabled just‐in‐time (JIT) strategy results in inventory being received when needed. Most dyes are purchased from its own subsidiaries to better support JIT strategy and reduce costs. Many suppliers are located near its production facilities.

Operations Information systems support decisions about the fabric, cut, and price points. Cloth is ironed and products are packed on hangers so they don’t need ironing when they arrive at stores. Price tags are already on the products. Zara produces 60% of its merchandise in house. Fabric is cut and dyed by robots in 23 highly automated Spanish factories.

Outbound Logistics Clothes move on miles of automated conveyor belts at distribution centers and reach stores within 48 hours of the order.

Marketing and Sales Limited inventory allows low percentage of unsold inventory (10%); POS at stores linked to headquarters track how items are selling; customers ask for what they want, and this information is transmitted daily from stores to designers over handheld computers.

Service No focus on service on products.

Support Activities

Organization IT supports tightly knit collaboration among designers, store managers, market specialists, production managers, and production planners.

Human Resources Managers are trained to understand what’s selling and report data to designers every day. The manager is key to making customers feel listened to and to communicating with head- quarters to keep each store and the entire Zara clothing line at the cutting edge of fashion.

Technology Technology is integrated to support all primary activities. Zara’s IT staff works with vendors to develop automated conveyors to support distribution activities.

Purchasing Vertical integration reduces amount of purchasing needed.

7 Don Goeltz, “Hypercompetition,” vol. 1 of The Encyclopedia of Management Theory, ed. Eric Kessler (Los Angeles: Sage, 2013), 359–60.

c02.indd 43 11/26/2015 6:20:49 PM

44 Strategic Use of Information Resources

Rather than arguing that sustaining a competitive advantage is a deadly distraction, Piccoli and Ives8 provide

a framework that outlines the ways in which a firm can provide barriers to competitors, which would build sus-

tainability. The framework outlines four types of barriers: IT project barrier, IT resources and capabilities barrier,

complementary resources barrier, and preemption barrier. See Figure 2.8 for a brief definition and a few examples

of each.

So, should a firm focus attention on building barriers to the competition, or should it just give up on the

established competitive advantage and focus on seeking the next revolution? Given that some technologies can be

copied quickly, or even just purchased from the same well‐known vendor who supplied it to the leader, it seems

prudent to spend some time to explore each technological option in the Piccoli and Ives’ framework and determine

where the firm can increase sustainability. If the project is rather small, then the firm should focus on the other

three barriers. If the firm can build loyalty with customers who appreciate innovation, a two‐month competitive

advantage might turn into a two‐year or longer advantage (thus building a preemption barrier). If a firm can capture

valuable data right at the beginning, a copycat firm may fall further behind. Also, building partnerships or securing

exclusive rights to some of the technologies can further slow down a competitor.

It would not be wise to stop there, however. The firm should continue to seek ways in which IT can improve

offerings or service to customers. And the firm should go beyond those steps, focusing on how it might change

its entire industry. One example is the way in which Netflix continued to speed its DVD delivery service while

focusing on movie streaming, a technology that will someday make the delivery service obsolete. Netflix was more

than aware that its revenue was falling every quarter, but it expected and embraced the shortfall with its strategic

move into streaming.9 Given that other services such as Amazon and many cable companies had begun streaming,

Netflix has created original series offerings such as House of Cards and Orange Is the New Black. Therefore, a firm might (1) seek ways to build sustainability by looking into each of the four potential barriers

to identify promising ways to block the competition and at the same time (2) continue to innovate and change the

industry. Netflix has done both by building a dependable and efficient mailing business and creating new business

models such as streaming and series production. Focusing only on building sustainability has the potential effect of

fighting a losing battle, and focusing only on new business models might be too risky as the sole source of growth.

The last strategic framework, resource‐based view, is more general and emphasizes ways in which to exploit its

many potential resources. The framework, described next, can be helpful for sustaining and creating competitive

advantage.

FIGURE 2.8 Barriers to competition and building sustainability.

Barrier Definition Examples

IT project barrier It would be a large undertaking for a competitor to build the system to copy the capability.

• Requires a large investment • Requires a long time to build • Complicated to build

IT assets and capabilities barrier Competitors might lack the IT resources to copy the capability.

• Database of customers that cannot be copied

• Expert developers or project managers

Complementary resources barrier The firm has other resources that create a synergy with the IT that provides competitive advantage.

• Respected brand • Partnership agreements • Exclusivity arrangements • Good location

Preemption barrier The firm “got there first.” • Loyal customer base built at the beginning

• Firm known as “the” source

8 Piccoli and Ives, “IT‐Dependent Strategic Initiatives and Sustained Competitive Advantage,” 755. 9 Greg Sandoval, “Netflix CEO, DVD Subscribers to Decline Now and Forever,” CNET, http://www.cnet.com/news/netflix‐ceo‐dvd‐subscribers‐to‐ decline‐now‐and‐forever (accessed August 19, 2015).

c02.indd 44 11/26/2015 6:20:50 PM

45Sustaining Competitive Advantage

Using the Resource‐Based View (RBV)

A fourth framework, the resource‐based view (RBV),10 is useful for determining whether a firm’s strategy has created value by using IT. Like the value chain model, the RBV concentrates on areas that add value to the firm.

Whereas the value chain model focuses on a firm’s activities, the resource‐based view focuses on the resources that

it can manage strategically in a rapidly changing competitive environment. Like the Piccoli and Ives framework,

the RBV focuses on sustaining competitive advantage but through use of resources rather than by raising compet-

itive barriers.

The RBV has been applied in the area of IS to help identify two types of information resources: those that enable

a firm to attain competitive advantage and those that enable a firm to sustain the advantage over the long term. From the IS perspective,11 some types of resources are better than others for creating attributes that enable a firm to

attain competitive advantage (i.e., value, rarity) whereas other resources are better for creating attributes to sustain

competitive value (e.g., low substitutability, low mobility, low imitability).

Resources to Attain Competitive Advantage

Valuable and rare resources that firms must leverage to establish a superior resource position help companies attain

competitive advantage. A resource is considered valuable when it enables the firm to become more efficient, effec-

tive, or innovative. It is a rare resource when other firms do not possess it. For example, many banks today would

not think of doing business without a mobile banking app. Mobile banking apps are very valuable to the banks in

terms of their operations. A bank’s customers expect it to provide a mobile banking app that can be used on any

mobile device. However, because many other banks also have mobile banking apps, they are not a rare resource,

and they do not offer a strategic advantage. Some call them table stakes or resources required just to be in the business. Many systems in Eras I and II, and especially Era III, were justified on their ability to provide a rare and

valuable resource. In some cases these very systems have become table stakes.

Resources to Sustain Competitive Advantage

Many firms that invested in systems learned that gaining a competitive advantage does not automatically mean that

they could sustain it over the long term. The only way to do that is to continue to innovate and to protect against

resource imitation, substitution, or transfer. For example, Walmart’s complex logistics management is deeply

embedded in both its own and its suppliers’ operations so that imitations by other firms is unlikely. The Oakland

Athletics’ use of information systems propelled it to victory, as depicted in the movie Moneyball, but as soon as other teams learned about the secret behind the success Oakland was having with analytics and information sys-

tems, they, too began to use similar techniques, reducing the advantage Oakland initially enjoyed. Finally, to sustain

competitive advantage, resources must be difficult to transfer or replicate, or relatively immobile. Some information

resources can be easily bought. However, technical knowledge—especially that which relates to a firm’s opera-

tion—an aggressive and opportunistic company culture, deep relationships with customers, and managerial experi-

ence in the firm’s environment is less easy to obtain and, hence, considered harder to transfer to other firms.

Some IT management skills are general enough in nature to make them easier to transfer and imitate. Although

it clearly is important for IS executives to manage internally oriented resources such as IS infrastructure, systems

development, and running cost‐effective IS operations, these skills can be acquired in many different forms. They

are basic IT management skills possessed by virtually all good IS managers. Other skills, however, are unique to a

firm and require considerable time and resources to develop. For example, it takes time to learn how the firm oper-

ates and to understand its critical processes and socially complex working relationships. However, the message sug-

gested by the RBV is that IS executives must look beyond their own IS shop and concentrate on cultivating resources

10 The resource‐based view was originally proposed by management researchers, most prominently Jay Barney, “Firm Resources and Sustained Compet-

itive Advantage,” Journal of Management 17, no. 1 (1991), 99–120 and “Is the Resource‐Based ‘View’ a Useful Perspective for Strategic Management Research? Yes,” Academy of Management Review 26, no. 1 (2001), 41–56; M. Wade and J. Hulland, “Review: The Resource‐Based View and Information Systems Research: Review, Extension and Suggestions for Future Research,” MIS Quarterly 28, no. 1 (2004), 107–42. This article reviewed the resource‐ based view’s application in the MIS literature and derived a framework to better understand its application to IS resources. 11 http://www.minonline.com/best_of_web/Best‐of‐the‐Web‐CommunitySocial‐Networking_10185.html (accessed January 1, 2012).

c02.indd 45 11/26/2015 6:20:50 PM

46 Strategic Use of Information Resources

that help the firm understand changing business environments and allow it to work well with all its external stake-

holders. Even when considering internally oriented information resources, there are differences in the extent to

which these resources add value. Many argue that IS personnel are willing to move, especially when offered higher

salaries by firms needing these skills. Yet, some technical skills, such as knowledge of a firm’s use of technology to

support business processes, and technology integration skills are not easily exported to, or imported from, another

firm. Further, hardware and many software applications can be purchased or outsourced, making them highly imita-

ble and transferrable. Because it is unlikely that two firms have exactly the same strategic alternatives, resources at

one firm might have only moderate substitutability in the other firm.

Zara and RBV

Figure  2.9 indicates the extent to which the attributes of each information resource may add value to Zara, the

company discussed earlier in the chapter. Zara’s advantage did not come from the specific hardware or software

technologies it employed. Its management spent five to ten times less on technology than its rivals. In contrast,

FIGURE 2.9 Information resources at Zara, by attribute. Source: Based on M. Wade and J. Hulland, “The Resource‐Based View and Information Systems Research: Review, Extension and Suggestions for Future Research,” MIS Quarterly 28, no. 1 (2004), 107–42.

Value Creation Value Sustainability

Resource/Attribute Value Rarity Imitation Substitution Transfer

IT ASSET

IT Infrastructure Moderate because of its skillful use of the POS equipment, handheld computers, automated conveyors, and computer‐controlled equipment to cut patterns, but similar technology could be purchased and used by competitors

Easy to imitate and transfer its infrastructure

Moderate for substitution of infrastructure (automated conveyers)

Information Repository

High value and rarity because of its information about customers’ preferences and body types, which Zara leverages strategically; well integrated with Zara’s operations and personnel; retail information analyzed by designers to identify future products

Difficult to imitate and transfer

Extremely difficult to substitute because of the volume and nature of the data

IT CAPABILITY

Technical Skills Low value/rarity because IS professionals could be hired relatively easily to perform the technical work

Moderately difficult to imitate, substitute, or transfer; some sustainability results because the skills are used to integrate across a range of systems

IT Management Skills

High value/rarity because they were acquired over time

Difficult to imitate, substitute, or transfer; resources leveraged well

Relationship Skills—Externally Focused

High value from relationships with European manufacturers

Moderate rarity because other companies also have relationships with manufacturers although required time to develop the relationship

Difficult to imitate, substitute, or transfer; turnaround time of under 5 weeks from conception to distribution

Relationship Skills—Spanning

High rarity of spanning Difficult to imitate, substitute, or transfer spanning; unusual tight‐knit teams at headquarters not easy to imitate or purchase in the marketplace, allowing the ability to correctly interpret and quickly respond to customer needs

c02.indd 46 11/26/2015 6:20:50 PM

47Strategic Alliances

Zara has created considerable value from the other information asset—its valuable information repository with cus-

tomers ’ preferences and body types.

In terms of information capability, much of Zara ’ s value creation is from its valuable and rare IT management

skills. Zara ’ s relationship skills also serve as a tool for value creation and sustainability. Overall, Zara is able to

create high value from its IT management and relationship skills. It would be moderately to extremely diffi cult to

substitute, imitate, or transfer them.

The resource‐based theory, although highly cited, has received its share of criticism. 12 The major criticism is that

it doesn ’ t clearly distinguish between value and strategic competitive advantage. Another criticism of the original

theory is that it doesn ’ t consider different types of resources. However, IS researchers addressed this concern when

they categorized resources into assets and capabilities and then provided examples of each. In applying the theory,

it is important to recognize that it is focused on internal sources of a fi rm ’ s competitive advantage and, thus, does

not thoroughly take into account the environment in which the fi rm is embedded, especially when the environment

is quite dynamic.

Most fi rms don ’ t really have a choice of creating competitive advantage by manipulating industry forces either

through their use of information resources or IT‐enhanced activities. Yet, like Zara , they can leverage the IT

resources they do have to create and sustain strategic value for their fi rms.

Strategic Alliances The value chain helps a fi rm focus on adding value to the areas of most value to its partners. The resource‐based

view suggests adding value using externally oriented relationship skills. The Eras framework emphasizes the

importance of collaborative partnerships and relationships. The increasing number of Web applications focused on

collaboration and social networking only foreshadow even more emphasis on alliances. These relationships can

take many forms, including joint ventures, joint projects, trade associations, buyer–supplier partnerships, or car-

tels. Often such partnerships use information technologies to support strategic alliances and integrate data across

Social Business Lens: Social Capital

A management theory that is gaining in popularity as a tool in understanding a social business is the social capital

theory. Social capital is the sum of the actual and potential resources embedded within, available through, and

derived from the network of relationships possessed by an individual or social unit. Relationships associated with

networks have the potential of being a valuable resource for businesses. The theory ’ s focus is not on managing

individuals but on managing relationships.

The value from networks may be derived in one of three interrelated ways: structural, relational, and cognitive.

The structural dimension is concerned with the pattern of relationships in the network—who is connected to whom.

The relational dimension looks at the nature of relationships among members in the network (i.e., respect, friend-

ship)—how the connected people interact. The third cognitive dimension looks at the way people think about

things in the network, in particular whether they have a shared language, system of meanings or interpretations—

how the connected people think. The unusual thing about social capital is that no one person owns it. Rather, the

people in the relationship own it jointly. Thus, it can ’ t be traded easily, but it can be used to do certain things more

easily. In particular, in social business applications, social capital may make it easier to get the information needed

to perform a task or connect with certain key people. In IS development teams, social capital may improve the

willingness and ability of team members to coordinate their tasks in completing a project.

Source: J. Nahapiet and S. Ghosal , “ Social Capital, Intellectual Capital and the Organizational Value , “ Academy of Management Review , 23 , no. 2 ( 1998 ), 242 – 66 .

12 For an excellent discussion of criticisms of the resource‐based view, see J. Kraaijenbrink , J‐C Spender , and A. J. Groen “ The Resource‐Based View:

A Review and Assessment of Its Critiques ,” Journal of Management , 36 , no. 1 , ( 2010 ), 349 – 72 .

c02.indd 47 11/26/2015 6:20:50 PM

48 Strategic Use of Information Resources

partners’ information systems. A strategic alliance is an interorganizational relationship that affords one or more companies in the relationship a strategic advantage. An example is the strategic alliance between game maker

Zynga and Facebook. As documented in Facebook’s IPO filing in January 2012, the relationship is a mutually

beneficial one. Zynga developed some of the most popular games found on Facebook, including Mafia Wars,

Farmville, and WordsWithFriends. Facebook has exclusive rights to Zynga’s games, many of which have generated

thousands of new members for Facebook. It also gained access to Zynga’s customer database. The alliance gen-

erates significant revenue for both parties because players of these games purchase virtual goods with real money

and Zynga purchases significant advertising space from Facebook to promote its games. Zynga benefits from the

revenue resulting from its gamers on Facebook community.13

Business ecosystems are often groups of strategic alliances in which a number of partners provide important ser-

vices to each other and jointly create value for customers. The Facebook ecosystem could be said to include many

of the companies that use that platform to deliver their apps, that allow customers to post directly on their Facebook

page from the app, or that allow customers to log on to their site using their Facebook account. This adds value

for customers by providing greater convenience, and by offering the ability to automatically update their activity

stream with information from the app, and both Facebook and the app provider benefit from their alliance.

IS often provides the platform upon which a strategic alliance functions. Technology can help produce the prod-

uct developed by the alliance, share information resources across the partners’ existing value systems, or facilitate

communication and coordination among the partners. Because many services are information based today, an IS

platform is used to deliver these services to customers. The Facebook– Zynga alliance is an example of this type of

IS platform. Further, linking value chains through supply chain management (SCM) is another way that firms build

an IT‐facilitated strategic alliance.

Co‐opetition

Clearly, not all strategic alliances are formed with suppliers or customers as partners. Rather, co‐opetition is an

increasingly popular alternative model. As defined by Brandenburg and Nalebuff in their book of the same name,

co‐opetition is a strategy whereby companies cooperate and compete at the same time with companies in their value net.14 The value net includes a company and its competitors and complementors as well as its customers and

suppliers and the interactions among all of them. A complementor is a company whose product or service is used in conjunction with a particular product or service to make a more useful set for the customer. For example, Goodyear

is a complementor to Ford and GM because tires are a complementary product to vehicles. Likewise, Amazon is a

complementor to Apple in part because the Amazon reading application, the Kindle, the reading tablet that Amazon

sells, is one of the most popular apps for the iPad. Finally, a cellular service is a complementor to Google’s search

engine because the service allows more consumers to use Google’s search function.

Co‐opetition, then, is the strategy for creating the best possible outcome for a business by optimally combining

competition and cooperation. It can also be used as a strategy for sourcing as discussed in Chapter  10. It fre-

quently creates competitive advantage by giving power in the form of information to other organizations or groups.

For example, Covisint.com hosts the auto industry’s e‐marketplace, which grew out of a consortium of compet-

itors, including General Motors, Ford, DaimlerChrysler, Nissan, and Renault. By addressing multiple automo-

tive functional needs across the entire product life cycle, Covisint offers support for collaboration, supply chain

management, procurement, and quality management. Covisint.com has extended this business‐to‐partner platform

to other industries including health care, manufacturing, life sciences, food and beverage, and oil and gas. Thus,

co‐opetition as demonstrated by Covisint not only streamlines the internal operations of its backers but also has the

potential to transform an industry.

13 Adapted from N. Wingfield, “Virtual Products, Real Profits” The Wall Street Journal (September 9, 2011), A1, 16; L. B. Baker, “Zynga’s Sales Soar on Facebook Connection,” Reuters News (February 2, 2012), http://www.reuters.com/article/2012/02/02/us‐zynga‐shares‐idUSTRE8111PO20120202 (accessed September 14, 2015); Jackie Cohen, “So Much for the Facebook Effect: Zynga Sees $978.6 Million Loss In 2011,” Yahoo News (February 14, 2012), http://www.allfacebook.com/facebook‐zynga‐eps‐2012‐02 (accessed February 20, 2012). 14 A. Brandenburg and B. Nalebuff, Co‐opetition (New York: Doubleday, 1996).

c02.indd 48 11/26/2015 6:20:50 PM

49Risks

Risks As demonstrated throughout this chapter, information resources may be used to gain strategic advantage even if that

advantage is fleeting. When information systems are chosen as the tool to outpace a firm’s competitors, executives

should be aware of the many risks that may surface. Some of these risks include the following:

• Awakening a sleeping giant: A firm can implement IS to gain competitive advantage only to find that it nudged a larger competitor with deeper pockets into implementing an IS with even better features. FedEx

offered its customers the ability to trace the transit and delivery of their packages online. FedEx’s much

larger competitor, UPS, rose to the challenge. UPS not only implemented the same services but also added

a new set of features eroding some of the advantages FedEx enjoyed, causing FedEx to update its offerings.

Both the UPS and FedEx sites passed through multiple Web site iterations as the dueling delivery companies

continue to struggle for competitive advantage.

• Demonstrating bad timing: Sometimes customers are not ready to use the technology designed to gain strategic advantage. For example, Grid Systems created the GRiDPAD in 1989. It was a tablet computer

designed for businesses to use in the field and was well reviewed at that time. But it didn’t get traction.

Three decades later, in 2010, Apple introduced the iPad, and tablet computing took off.

• Implementing IS poorly: Stories abound of information systems that fail because they are poorly imple- mented. Typically, these systems are complex and often global in their reach. An implementation fiasco took

place at Hershey Foods when it attempted to implement its supply and inventory system. Hershey devel-

opers brought the complex system up too quickly and then failed to test it adequately. Related systems prob-

lems crippled shipments during the critical Halloween shopping season, resulting in large declines in sales

and net income. More recently, in 2012, more than 100,000 Austin Energy customers received incorrect util-

ity bills due to problems with the company’s vendor‐supplied bill collection system. Some customers went

months without a bill, and others were incorrectly billed. Some businesses that owed $3,000 were billed

$300,000. Still others tried to pay their bill online only to be told that the payment had not recorded when it

had been. The utility calculated that the problems cost it more than $8 million.15

• Failing to deliver what users want: Systems that do not meet the needs of the firm’s target market are likely to fail. For example, in 2011, Netflix leadership divided the company into two, calling the DVD‐rental

business Qwikster and keeping the streaming business under Netflix. But customers complained, and worse,

closed their accounts, and less than a month later, Qwikster was gone. Netflix reunited both businesses

under the Netflix name.16

• Running afoul of the law: Using IS strategically may promote litigation if the IS results in the violation of laws or regulations. Years ago, American Airlines’ reservation system, Sabre, was challenged by the airline’s

competitors on the grounds that it violated antitrust laws. More recently, in 2010, Google said it was no

longer willing to adhere to Chinese censorship. The Chinese government responded by banning searching

via all Google search sites (not only google.cn but all language versions, e.g., google.co.jp. google.com.au),

including Google Mobile. Google then created an automatic redirect to Google Hong Kong, which stopped

June 30, 2010, so that Google would not lose its license to operate in China. Today, Google, Inc. is acting

in compliance with the Chinese government’s censorship laws and Chinese users of Google.cn see filtered

results as before. More recently, European antitrust officials claimed that Google’s search engine unfairly

generates results that favor its shopping sites over those of its competitors and that its Android mobile phone

operating system unfairly features Google as the default search engine.17

15 Marty Toohey, “More Than 100,000 Austin Energy Customers Hit by Billing Errors from $55 Million IBM System,” Statesman (February 18, 2012), http://www.statesman.com/news/local/more‐than‐100‐000‐austin‐energy‐customers‐hit‐2185031.html (accessed February 20, 2012). 16 Qwikster = Gonester (October 10, 2011), http://www.breakingcopy.com/netflix‐kills‐qwikster (accessed February 20, 2012). 17 “Viewed as a Monopoly in Europe, Google Takes on Role as a Wireless Trust‐Buster in U.S.,” The New York Times (May 8, 2015), B1, B6.

c02.indd 49 11/26/2015 6:20:50 PM

50 Strategic Use of Information Resources

Every business decision has risks associated with it. However, with the large expenditure of IT resources needed

to create sustainable, strategic advantages, the manager should carefully identify and then design a mitigation strat-

egy to manage the associated risks.

Co‐Creating IT and Business Strategy This chapter has discussed the alignment of IT strategy with business strategy. Certainly, the two strategies must

be carefully choreographed to ensure receiving maximum value from IT investments and obtaining the maximum

opportunity to achieve the business strategy. However, in the fast‐paced business environment where information

is increasingly a core component of the product or service offered by the fi rm, managers must co‐create IT and

business strategy. That is to say that IT strategy is business strategy; one cannot be created independently of the other. In many cases, they are now one in the same.

For companies whose main product is information, such as fi nancial services companies, it ’ s clear that information

management is the core of the business strategy itself. How an investment fi rm manages the clients ’ accounts, how

its clients interact with the company, and how investments are made are all done through the management of

information. A fi nancial services company must co‐create business and IT strategy.

But consider a company like FedEx , most well known as the package delivery company. Are customers paying

to have a package delivered or to have information about that package ’ s delivery route and timetable? One could

argue that they are one in the same and that increasingly the company ’ s business strategy is its IS strategy. Certainly, there are components of the operation that are more than just information. There are actual packages to be loaded

on actual trucks and planes, which are then actually delivered to their destinations. However, to make it all work,

the company must rely on IS. Should the IS stop working or have a serious failure, FedEx would be unable to do

business. A company like this must co‐create IT strategy and business strategy.

This was not true a few years ago. Companies could often separate IS strategy from business strategy in part

because their products or services did not have a large information component. For example, a few years ago,

should the IS of a trucking company stop working, the trucks would still be able to take their shipments to their

destination and pick up new ones. It might be slower or a bit more chaotic, but the business wouldn ’ t stop. Today,

that ’ s not the case. Complicated logistics are the norm, and IS are the foundation of the business as seen at FedEx .

With the increasing number of IS applications on the Web and on mobile devices, fi rms increasingly need to

co‐create business and IT strategy. Managers who think they can build a business model without considering the

opportunities and impact of information systems, using both the resources owned by the fi rm and those available on

the Web, will fi nd they have signifi cant diffi culties creating business opportunities as well as sustainable advantage

in their marketplace.

Geographic Box: Mobile‐Only Internet Users Dominate Emerging Countries

More than 25% of mobile Web users in emerging markets connect to the Internet solely through mobile devices.

This is the case for 70% of mobile Web users in Egypt, 59% in India, and 50% in Nigeria but only for 25% of U.S. and

22% of U.K. mobile Web users. Malaysia is emerging as a test case for a mobile‐only Internet. It has rolled out a

next‐generation, high‐speed broadband network that covers most of its population. This infrastructure makes it

possible to make video calls with Apple ’ s FaceTime application in locations throughout the country using a tiny

pocket router that accesses a WiMAX wireless‐broadband network set up by a local conglomerate, YTL Corp.

Bhd . To further encourage the spread of Internet, Malaysia ’ s leaders have pledged not to censor the Internet.

Sources: G. Dunaway , “ Mobile‐Only Internet Users Dominate Emerging Markets ” Adotas.com (October 24, 2011), http://www.adotas. com/201w1/10/mobile‐only‐internet‐users‐dominate‐emerging‐markets/ (accessed August 19, 2015) ; J. Hookway , “ Broadband in the Tropics ,” The Wall Street Journal (September 21, 2011 ) , B6.

c02.indd 50 11/26/2015 6:20:50 PM

51Discussion Questions

S U M M A R Y

• Information resources include data, technology, people, and processes within an organization. Information resources can be either assets or capabilities.

• IT infrastructure and information repositories are IT assets. Three major categories of IT capabilities are technical skills, IT management skills, and relationship skills.

• Using IS for strategic advantage requires an awareness of the many relationships that affect both competitive business and information strategies.

• The five competitive forces model implies that more than just the local competitors influence the reality of the business situation. Analyzing the five competitive forces—threat of new entrants, buyers’ bargaining power, suppliers’ bargaining

power, industry competitors, and threat of substitute products—from both a business view and an information systems

view helps general managers use information resources to minimize the effect of these forces on the organization.

• The value chain highlights how information systems add value to the primary and support activities of a firm’s internal operations as well as to the activities of its customers and of other components of its supply chain.

• The resource‐based view (RBV) helps a firm understand the value created by its strategy. RBV maintains that compet- itive advantage comes from a firm’s information resources. Resources enable a firm to attain and sustain competitive

advantage.

• IT can facilitate strategic alliances. Ecosystems are groups of strategic alliances working together to deliver goods and services. Supply chain management (SCM) is a mechanism that may be used for creating strategic alliances.

• Co‐opetition is the complex arrangement through which companies cooperate and compete at the same time with other companies in their value net.

• Numerous risks are associated with using information systems to gain strategic advantage: awaking a sleeping giant, demonstrating bad timing, implementing poorly, failing to deliver what customers want, avoiding mobile‐based alterna-

tives, and running afoul of the law.

K E Y T E R M S

business ecosystem (p. 34)

co‐opetition (p. 48)

customer relationship management

(CRM) (p. 42)

enterprise resource planning

(ERP) (p. 42)

information resources (p. 36)

IT asset (p. 36)

IT capability (p. 36)

network effects (p. 34)

resource‐based view (RBV) (p. 45)

strategic alliance (p. 48)

social capital (p. 47)

supply chain management

(SCM) (p. 42)

D I S C U S S I O N Q U E S T I O N S

1. How can information itself provide a competitive advantage to an organization? Give two or three examples. For each example, describe its associated risks.

2. Use the five competitive forces model as described in this chapter to describe how information technology might be used to provide a winning position for each of these businesses:

a. A global advertising agency b. A local restaurant c. A mobile applications provider d. An insurance company e. A Web‐based audio book service

c02.indd 51 11/26/2015 6:20:50 PM

52 Strategic Use of Information Resources

3. Using the value chain model, describe how information technology might be used to provide a winning position for each of these businesses:

a. A global advertising agency b. A local restaurant c. A mobile applications provider d. An insurance company e. A Web‐based audio book service

4. Use the resource‐based view as described in this chapter to describe how information technology might be used to provide and sustain a winning position for each of these businesses:

a. A global advertising agency b. A local restaurant c. A mobile applications provider d. An insurance company e. A Web‐based audio book service

5. Some claim that the only sustainable competitive advantage for an organization is its relationships with its customers. All other advantages eventually erode. Do you agree or disagree? How can information systems play a role in maintaining the

organization ’ s relationship with its customers? Defend your position.

6. Cisco Systems has a network of component suppliers, distributors, and contract manufacturers that are linked through Cisco ’ s extranet. When a customer orders a Cisco product at its Web site, the order triggers contracts to manufacturers of

printed circuit board assemblies when appropriate and alerts distributors and component suppliers. Cisco ’ s contract manu-

facturers are aware of the order because they can log on to its extranet and link with Cisco ’ s own manufacturing execution

systems. What are the advantages of Cisco ’ s strategic alliances? What are the risks to Cisco? To the suppliers?

Groupon, Inc. raised $700 million at its IPO in the fall of 2011, instantly providing a valuation of almost $13 billion for a

company that was only three years old at the time. Some question the value, claiming Groupon has no sustainable compet-

itive advantage. Others see Groupon as an innovative company with high potential.

Groupon sells Internet coupons for events, services, and other popular items that customers might want to buy. Customers

sign up for daily e‐mails targeted to their local market. The daily deal, offered for one‐day only and only if a predetermined

minimum number of customers buy it, gives customers 50% off the “retail” price. For example, a $100 three‐month health

club membership would sell for $50 on Groupon . The customer pays $50 to Groupon and prints a certifi cate to redeem at the

health club. Groupon keeps 50% of the revenue, or $25 in this case, and gives the rest to the health club. Effectively, retailers

are offering 75% off with the customer saving 50% and Groupon taking the rest.

Groupon pays the retailer when the coupon is redeemed, making money both on the fl oat between the time revenue is

collected and the time the retailer is paid and on the certifi cates that are never redeemed at all, which the industry calls break- age. Retailers make money in the long run by introducing customers to their products, selling them additional products and services when they come in to redeem their coupons, and turning them into repeat customers. And retailers benefi t from the

buzz created when their business is on Groupon .

In August 2010, Groupon launched its fi rst national deal, a coupon worth $50 of Gap apparel and accessories for $25.

It sold over 440,000 coupons, netting Groupon and the Gap close to $11 million. But not all vendors are the size of the

Gap , and smaller vendors have been overwhelmed with too many coupons. One local business owner said the company lost

$8,000 on its Groupon promotion when too many coupons were issued. In fact, a study of 150 retailers showed that only

66% found their deals profi table.

Around the time of the IPO, analysts and observers alike claimed that Groupon ’ s business model was not sustainable. In

addition to the large number of retailers who found their deals unprofi table, observers noted that Groupon does not produce

anything of value, and it isn ’ t adding value to the retailers. Further, there are no barriers to entry to stop competitors. In May

2011, more than 450 competitors offering discounts and deals included LivingSocial , another daily deal site; restaurant.com,

a site for restaurant gift certifi cates at a deep discount; and overstock.com and woot.com , sites offering discounted merchan-

dise, not to mention deep‐pocketed competitors like Amazon.com .

■ CASE STUDY 2‐1 Groupon

c02.indd 52 11/26/2015 6:20:50 PM

53Case Study

Zipcar is an answer for customers who want to rent a car for a few hours in their home city rather than for a few days from

a traditional rental agency. Car reservations are for a specifi c pick‐up time and location around the city, often in neighbor-

hoods so the customers need only to walk to pick up their reserved car. Customers apply for a Zipcard, which enables them

to reserve a car online and unlock their car when they arrive at its location.

The company operates with a very small staff compared to traditional rental agencies. Very little human interaction is

required between the customer and Zipcar for a transaction. A customer reserves a car online, enters into the reserved car by

waving the RFID‐enabled Zipcard against the card reader mounted behind the driver ’ s side windshield, returns the car to the

same location, and is billed on the credit card already on fi le. The customer can check all rental records and print receipts

from the online reservation system. The system also has a color‐coded time chart showing the availability and location of all

rental cars in the vicinity. This transparent information exchange allows a customer to pick the car he or she wants, if avail-

able, or delay the reservation until that car is returned by another customer. Zipcar also created and installed a GPS‐enabled

wireless device in each car, which allows members to fi nd and reserve a vehicle nearby using a cell phone. Customers also

can use an iPhone or Android app on their iPhone or Android mobile device to fi nd and reserve a Zipcar on a 24/7 basis.

Zipcar sends text alerts near the end of the rental period, and customers can text back if they want to extend their rental time.

All cars were outfi tted with patented wireless technology. Zipcar ’ s proprietary IT platform carries information fl ow bet-

ween customers, vehicles, and the company. It is used to monitor car security, fulfi ll reservations, record hourly usage, and

maintain mileage information. The platform also relays vital technical information such as battery voltage and fuel level. It

even informs the central system if a customer forgot to turn off headlights, which can quickly drain battery power.

This business model provides unique advantages over traditional car rentals. Customers do not have to stand in line or

fi ll out papers to rent a car. They know exactly which make and model they will be getting. Unlike most off‐airport rental

agency locations, which are open only during business hours, Zipcar locations are open 24 hours. The company ’ s rates also

include the cost of gas and insurance as well as reserved parking spots at some locations.

Additionally, the company uses social networking technologies to develop an online community of Zipcar members—

Zipsters. It encourages Zipsters to talk about their Ziptrips (i.e., share their personal experiences with Zipcar ).

Thus, information technology is not only the key enabler of this business model but also a facilitator in creating a

buzz and encouraging community development around the concept. Zipcar changed the rules of the rental car industry by

■ CASE STUDY 2‐2 Zipcar

But Groupon added to its business strategy with mobile capability and new services. In February 2012, it purchased

Kima Labs , a mobile payment specialist, and Hyperpublic , a company that builds databases of local information. In May

2011, in a few cities, the company launched Groupon Now, a time‐based local application that gives customers instant deals

at merchants nearby using location‐based software. CEO Andrew Mason told Wall Street analysts in February 2012 that he

saw signifi cant growth potential, including working on new features that will help customers personalize offers and avoid

deals they don ’ t want.

Discussion Questions

1. How does information technology help Groupon compete?

2. Do you agree or disagree with the statement that “Groupon has no sustainable competitive advantage?” Please explain

your point of view.

3. How does Groupon add value to the companies whose offers are sold on the site?

4. What impact, if any, will Groupon Now have on Groupon ’ s competitive position? Explain.

5. What would you advise Groupon leaders to consider as their next application?

6. Analyze the business model of Groupon using Porter ’ s five forces model.

Sources: Adapted from http://mashable.com/2010/08/19/gap‐groupon/ (accessed February 21, 2012); http://www.forbes.com/sites/ petercohan/2011/06/06/memo‐to‐sec‐groupon‐has‐no‐competitive‐advantage‐stop‐its‐ipo/ (accessed February 21, 2012); http://blogs. wsj.com/venturecapital/2010/09/29/rice‐university‐study‐groupon‐renewal‐rate‐not‐so‐hot/ (accessed February 21, 2012); http://articles. chicagotribune.com/2011‐05‐18/business/ct‐biz‐0519‐groupon‐now‐20110518_1_groupon‐chief‐executive‐andrew‐mason‐fi rst‐phase (accessed February 21, 2012); http://www.reuters.com/article/2012/02/09/us‐groupon‐idUSTRE81727 B20120209 (accessed February 21, 2012).

c02.indd 53 11/26/2015 6:20:50 PM

54 Strategic Use of Information Resources

bringing the new Web 2.0 mind‐set of focusing on automation, customer empowerment, transparency, and community.

Zipcar is very successful; as of August 2015, its Website boasts over 900,000 paying members and renting over 10,000

vehicles in 30 major metro markets in the United States, Canada, and the United Kingdom, as well as 400 college cam-

puses and 50 airports.

Discussion Questions

1. Apply the resource‐based view to Zipcar ’ s business model to show how information resources may be used to gain and

sustain competitive advantage.

2. Discuss the synergy between the business strategy of Zipcar and information technology.

3. What network effects are part of Zipca r ’ s strategy? How do they add value?

4. As the CEO of Zipca r, what is your most threatening competition? What would you do to sustain a competitive

advantage?

Sources: Adapted from Paul Boutin , “ A Self‐Service Rental Car ,” Businessweek (May 3 , 2006 ), http://www.bloomberg.com/bw/ stories/2006‐05‐03/a‐self‐service‐rental‐car (accessed August 19, 2015) ; Mary K. Pratt , “ RFID: A Ticket to Ride ,” Computerworld (Decem- ber 18, 2006 ), http://www.computerworld.com/article/2554153/mobile‐wireless/rfi d—a‐ticket‐to‐ride.html (accessed August 19, 2015) ; “Zipcar: Our Technology Downloaded,” http://www.zipcar.com/how/technology; Zipcar: “Zipcar Overview,” http://www.zipcar.com/ press/overview (accessed August 19, 2015).

c02.indd 54 11/26/2015 6:20:51 PM

55

3 chapter

In order for information systems (IS) to support an organization in achieving its goals, the organization must refl ect the business strategy and be coordinated with the organizational strategy. This chapter focuses on linking and coordinating the IS strategy with the three components of organizational strategy:

• Organizational design (decision rights, formal reporting relationships and structure, informal networks)

• Management control systems (planning, data collection, performance measurement, evaluation, incentives, and rewards)

• Internal culture (values, locus of control)

Organizational Strategy and Information Systems

After 20 years of fast growth, in 2014 Cognizant Technology Solutions was a company with $8.84

billion in revenues from providing IS outsourcing services. However, growing at such a breakneck

speed, it had to reinvent its organizational structure many times to make sure that it facilitated the

fl ow of information. Initially, its India‐centric structure located managers of each group in India

along with software engineers. Employees at customer locations worldwide reported to the man-

agers. As the company grew and its focus shifted from simple, cost‐based solutions to complex,

relationship‐based solutions, this structure had to be changed to be more customer oriented. Under

the redesigned reporting structure, managers were moved to customer locations but software engi-

neers remained in India. This change improved customer relations but brought about new headaches

on the technical side. Under the new arrangement, managers had to spend their days with cus-

tomers and unexpectedly ended up spending their nights with software engineers to clarify customer

requirements and fi x bugs. This created a tremendous strain on managers, who threatened to quit.

It also hampered the company ’ s business of systems development. Thus, neither of these organiza-

tional structures was working well. Neither structure was well aligned with the business strategy

and the IS strategy.

However, Cognizant found that despite these problems, some work teams were working and

performing well. Upon an extensive analysis of those groups, the company decided to adopt a matrix

structure of comanagement throughout the company. In this matrix structure, each project has two

managers equally responsible for the project in a location. One manager is in India and the other

is at the client site. They work out among themselves how and when to deal with issues. And both

managers are equally responsible for customer satisfaction, project deadlines, and group revenue.

The new structure (Figure  3.1 ) enables Cognizant to work more closely with its clients to focus on

improving operations. That is, the new matrix structure makes it possible to build IS that the cus-

tomers wanted.

During the same time period in 2008, the largest outsourcing company and software exporter

in India, Tata Consultancy Services (TCS), also found that growth led to problems. “As we scale

up over 100,000 employees, TCS needs a structure that allows us to build a nimble organization to

c03.indd 55 11/26/2015 6:22:12 PM

56 Organizational Strategy and Information Systems

capture new growth opportunities,” said then TCS CEO and Managing Director S. Ramadorai.1 Growth led to a

high volume of issues that needed the attention of the CEO and COO, and eventually it was difficult to keep up.

At the same time, there was a need to spend significantly more time investigating new potential markets and new

strategic initiatives than the CEO/COO could spare. In 2011, the new TCS CEO N. Chandrasekaran modified the

structure and added a new layer of leaders to oversee the businesses and free up their time to work on strategy (see

Figure 3.2). The new layer focuses on customers and aims to boost revenue growth.2

While both Cognizant and TCS are large Indian outsourcing companies that found they needed to reorganize

to respond to problems resulting from growth, their problems were profoundly different. Cognizant’s main prob-

lem was its lack of necessary information flows between the software engineers in India and the customer service

managers on the client location. Its complex problems resulted in a correspondingly complex matrix structure. It

focused on the delivery of information systems that reflect refined technical solutions to their problems to its cus-

tomers. Its new organization structure both improves customer responsiveness and necessary information flows.

It focuses on system development and delivery and seeks to address the information flow problem that Cognizant

previously experienced in building systems.

In contrast, TCS’s organization chart reflects a focus not only on current customers but also on future markets.

That is why it added major units called “New Growth Markets” and “Strategic Initiative Unit.” The Business Pro-

cess Outsourcing and Small and Medium Enterprise solutions in this latter major unit indicate the strategic direc-

tions that TCS wants to take. The organizational structure is designed to emphasize these new growth areas and

facilitate information flows along these lines in the organization. Its focus is on building an ever bigger market for

its IS and the IS services that it provides.

CEO

Vertical Functions

Software Engineer

Business Manager

Customer 1 USA

H o

ri z o

n ta

l F

u n

c ti

o n

s

Business Manager

Customer 2 UK

Business Manager

Customer 3 China

Database Manager Telecommunication

Specialist

FIGURE 3.1 Example of possible cognizant matrix structure. Source: Adapted from “The Issue: For Cognizant, Two’s Company,” Businessweek (January 17, 2008), http://www.bloomberg. com/bw/stories/2008‐01‐17/the‐issue‐for‐cognizant‐twos‐companybusinessweek‐business‐news‐stock‐market‐and‐financial‐advice (accessed August 20, 2015).

1 “Reinvented Blog by Prashanth Rai” (March 19, 2008), http://cio‐reinvented.typepad.com/cioreinvented/2008/03/tcs—new‐organ.html (accessed

December 19, 2011). 2 N. Shivapriya, “TCS CEO N Chandrasekaran Creates New Layer to Oversee Verticals” (May 25, 2011), http://articles.economictimes.indiatimes.

com/2011‐05‐25/news/29581999_1_tcs‐ceo‐n‐chandrasekaran‐tcs‐spokesperson‐structure (accessed December 19, 2011).

c03.indd 56 11/26/2015 6:22:12 PM

57 Organizational Strategy and Information Systems

Cognizant and TCS are both in the same business but chose different organizational structures to carry out

their objectives. The point is that different organizational structures reflect different organizational strategies

that are used to implement business strategies and accomplish organizational goals. These organizational strat-

egies need to be aligned with IS strategies. When used appropriately, IS leverage human resources, capital, and

materials to create an organization that optimizes performance. Companies that design organizational strategy

without considering IS strategies run into problems like those Cognizant experienced. A synergy results from

designing organizations with IS strategy in mind—a synergy that cannot be achieved when IS strategy is just

added on.

Chapter  1 introduced a simple framework for understanding the role of IS in organizations. The Information

Systems Strategy Triangle relates business strategy with IS strategy and organizational strategy. In an organization

that operates successfully, an overriding business strategy drives both organizational strategy and information strat-

egy. The most effective businesses optimize the interrelationships between the organization and its IS, maximizing

efficiency and productivity.

Organizational strategy includes the organization’s design, as well as the managerial choices that define, set up, coordinate, and control its work processes. As discussed in Chapter 1, many models of organizational strategy

are available. One is the managerial levers framework that includes the complementary design variables shown

in Figure 3.3. Optimized organizational designs support optimal business processes, and they, in turn, reflect the

firm’s values and culture. Organizational strategy may be considered as the coordinated set of actions that lever-

ages the use of organizational design, management control systems, and organizational culture to make the orga-

nization effective by achieving its objectives. The organizational strategy works best when it meshes well with

the IS strategy.

This chapter builds on the managerial levers model. Of primary concern is how IS impact the three types of

managerial levers: organizational, control, and cultural. This chapter looks at organizational designs that incorpo-

rate IS to define the flow of information throughout the organization, explores how IS can facilitate management

control at the organizational and individual levels, and concludes with some ideas about how culture impacts IS

and organizational performance. It focuses on organizational‐level issues related to strategy. The next two chapters

complement these concepts with a discussion of new approaches to work and organizational processes.

Chief Executive

Officer

Chief Operating

Officer

Director,

Industry

Solutions Unit

Director,

Organization

Infrastructure

Director,

Strategic

Initiative Unit

Director,

Major

Markets

Director, New

Growth

Markets

India

APAC

Emerging

Markets Europe

UK

USA

Business

Process

Outsourcing

Solutions

SME

Solutions

Financial

Solutions

Process

Excellence

Resource

Management

Shared

Services

Technology

Excellence

Multiple units

FIGURE 3.2 Tata Consultancy Services. Source: “TCS Plans New Organizational Structure” (February 12, 2008), http://www.livemint.com/Companies/2ODg7L1mCcRlFow K1ktX5N/TCS‐plans‐new‐organisational‐structure.html (accessed August 20, 2015).

c03.indd 57 11/26/2015 6:22:12 PM

58 Organizational Strategy and Information Systems

Information Systems and Organizational Design Organizations must be designed in a way that enables them to perform effectively. Different designs accomplish

different goals. This section examines organizational variables. It focuses on how IS are designed in conjunction

with an organization’s structure. Ideally, an organizational structure is designed to facilitate the communication

and work processes necessary for it to accomplish the organization’s goals, and the use of IS is often the way

coordination and workflow are done. The organizational structures of Cognizant and TCS, while very different,

reflect and support the goals of each company. Perhaps intuitively, organizational designers at those companies used

organizational variables described in Figure 3.3 to build their structures. Those variables include decision rights

that underlie formal structures, formal reporting relationships, and informal networks. Organizational processes are

another important design component discussed in more detail in Chapter 5.

Decision Rights

Decision rights indicate who in the organization has the responsibility to initiate, supply information for, approve, implement, and control various types of decisions. Ideally, the individual who has the most information about a

decision and who is in the best position to understand all of the relevant issues should be the person who has its

decision rights. But this may not happen, especially in organizations in which senior leaders make most of the

important decisions. Much of the discussion of IT governance and accountability in Chapter 9 is based upon who

has the decision rights for critical IS decisions. When talking about accountability, one has to start with the person

who is responsible for the decision—that is, the person who has the decision rights. Organizational design is all

about making sure that decision rights are properly assigned—and reflected in the structure of formal reporting

FIGURE 3.3 Organizational design variables. Source: Adapted from James I. Cash, Robert G. Eccles, Nitin Nohria, and Richard L. Nolan, Building the Information Age Organiza- tion (Homewood, IL: Richard D. Irwin, 1994).

Variable Description

Organizational variables

Decision rights The authority to initiate, approve, implement, and control various types of decisions necessary to plan and run the business

Business processes The set of ordered tasks needed to complete key objectives of the business

Formal reporting relationships The structure set up to ensure coordination among all units within the organization; reflects allocation of decision rights

Informal networks Mechanisms, such as ad hoc groups, which work to coordinate and transfer information outside the formal reporting relationships

Control variables

Data The facts collected, stored, and used by the organization

Planning The processes by which future direction is established, communicated, and implemented

Performance measurement and evaluation The set of measures that are used to assess success in the execution of plans and the processes by which such measures are used to improve the quality of work

Incentives The monetary and nonmonetary devices used to motivate behavior within an organization

Cultural variables

Values The set of implicit and explicit beliefs that underlies decisions made and actions taken; reflects aspirations about the way things should be done

Locus The span of the culture, i.e., local, national, regional

c03.indd 58 11/26/2015 6:22:13 PM

59Information Systems and Organizational Design

relationships. IS support decision rights by getting the right information to the decision maker at the right time and

then transmitting the decision to those who are affected. In some cases, IS enables a centralized decision maker

to pass information that has been gathered from operations and stored centrally down through the organization. If

information systems fail to deliver the right information, or worse, deliver the wrong information to the decision

maker, poor decisions are bound to be made.

Consider the case of Zara from the last chapter. Each of its 1,000 stores orders clothes in the same way, using the

same type of handheld devices, and follows a rigid weekly timetable for ordering, which provides the headquarters

commercial team with the information needed to manage fulfillment. Many other large retailers make the decision

centrally about what to send to their stores, using forecasting and inventory control models. However, at Zara, store

managers have decision rights for ordering, enabling each store to reflect the tastes and preferences of customers

in its localized area. But, the store managers do not have decision rights for order fulfillment because they have no

way of knowing the consolidated demand of stores in their area. The decision rights for order fulfillment lie with the

commercial team in headquarters because it is the team that knows about overall demand, overall supply, and store

performance in their assigned areas. The information from the commercial team then flows directly to designers

and production, allowing them to respond quickly to customer preferences.3

Formal Reporting Relationships and Organizational Structures

Organizational structure is the design element that ensures that decision rights are correctly allocated. The structure of reporting relationships typically reflects the flow of communication and decision making throughout the orga-

nization. Traditional organizational structures are hierarchical, flat, or matrix. The networked structure is a newer

organizational form. A comparison of these four types of organizational structures may be found in Figure 3.4.

Hierarchical Organizational Structure

As business organizations entered the 20th century, their growth prompted a need for systems for processing and

storing information. A new class of worker—the clerical worker—flourished. From 1870 to 1920 alone, the number

of U.S. clerical workers mushroomed from 74,200 to more than a quarter of a million.4

FIGURE 3.4 Comparison of organizational structures.

Hierarchical Flat Matrix Networked

Description Bureaucratic form with defined levels of management

Decision making pushed down to the lowest level in the organization

Workers assigned to multiple supervisors in an effort to promote integration

Formal and informal communication networks that connect all parts of the company

Characteristics Division of labor, specialization, unity of command, formalization

Informal roles, planning, and control; often small and young organizations

Dual reporting relationships based on function and purpose

Known for flexibility and adaptability

Type of Environment Best Supported

Stable, certain Dynamic uncertain Dynamic uncertain Dynamic uncertain

Basis of Structuring Primarily function Very loose Function and purpose (i.e., location, product, customer)

Networks

Power Structure Centralized Decentralized Distributed (matrix managers)

Distributed (network)

3 Andrew McAfee and Erik Brynjolfsson, “Investing in the IT That Makes a Competitive Difference, https://cb.hbsp.harvard.edu/cbmp/product/R0807J‐

PDF‐ENG (accessed August 20, 2015); James Surowiecki, The Wisdom of Crowds (New York: Anchor Books, 2005). 4 Frances Cairncross, The Company of the Future (London: Profile Books, 2002).

c03.indd 59 11/26/2015 6:22:13 PM

60 Organizational Strategy and Information Systems

Factories and offices structured themselves using the model that Max Weber observed when studying the

Catholic Church and the German army. This model, called a bureaucracy, was based on a hierarchical organiza- tional structure.

Hierarchical organizational structure is an organizational form based on the concepts of division of labor, specialization, span of control, and unity of command. Decision rights are highly specified and centralized. When

work needs to be done, orders typically come from the top and work is subjected to the division of labor. That

means it is segmented into smaller and smaller pieces until it reaches the level of the business in which it will be

done. Middle managers do the primary information processing and communicating, telling their subordinates what

to do and telling senior managers the outcome of what was done. Jobs within the enterprise are specialized and

often organized around particular functions, such as marketing, accounting, manufacturing, and so on. Span of control indicates the number of direct reports. The new TCS CEO, N. Chandrasekaran, revised the organizational structure to lower his span of control by inserting a new layer with only a few leaders reporting directly to him.

Unity of command means that each person has a single supervisor. Rules and policies are established to handle the routine work performed by employees of the organization. When in doubt about how to complete a task, employees

turn to the rules. If a rule doesn’t exist to handle the situation, employees turn to a supervisor in the hierarchy for the

decision. Key decisions are made at the top and filter down through the organization in a centralized fashion. Hier-

archical structures, which are sometimes called vertical structures, are most suited to relatively stable, certain envi- ronments in which the top‐level executives are in command of the information needed to make critical decisions.

This allows them to make decisions quickly.

IS are typically used to store and communicate information and to support the information needs of managers

throughout the hierarchy. IS convey the decisions of top managers downward and data from operations are sent

upward through the hierarchy using IS. Hierarchical structures are also very compatible with efforts to organize

and manage data centrally. The data from operations that have been captured at lower levels and conveyed through

IS increasingly need to be consolidated, managed, and made secure at a high level. The data are integrated into

databases that are designed so that employees at all levels of the organization can see the information that they need

when they need it. Often there is an information dashboard for executives, a system that provides a summary of key

performance indicators (KPIs). Each level of KPI has additional detail behind it and executives can drill down into

the details as necessary. For example, a KPI revealing lower profitability might have been caused by higher costs

or lower sales, and managers would need to drill down through additional levels of information to understand why

the KPI changed. Managers throughout the hierarchy often have similar dashboards with the KPIs for their organi-

zation so that up and down the hierarchy, managers are looking at the same information consolidated for their level

of decision making.

Flat Organizational Structure

In contrast to the hierarchical structure, the flat, or horizontal, organizational structure has a less well‐defined chain of command. You often don’t see an actual organization chart for a flat organization because the relationships

are fluid and the jobs are loosely defined. That is, drawing an organization chart for a flat organization is like trying

to tie a ribbon around a puddle. In flat organizations, everyone does whatever needs to be done to conduct business.

There are very few “middle managers.” For this reason, flat organizations can respond quickly to dynamic, uncer-

tain environments. Entrepreneurial organizations, as well as smaller organizations, often use this structure because

they typically have fewer employees, and even when they grow, they initially build on the premise that everyone

must do whatever is needed. Teamwork is important in flat organizations. To increase flexibility and innovation,

decision rights may not be clearly defined. Hence, the decision making is often decentralized because it is spread

across the organization to where the decisions are made. It is also time consuming. As the work grows, new indi-

viduals are added to the organization, and eventually a hierarchy is formed where divisions are responsible for

segments of the work processes. Many companies strive to keep the “entrepreneurial spirit,” but in reality, work is

done in much the same way as with the hierarchy described previously. Flat organizations often use IS to off‐load

certain routine work in order to avoid hiring additional employees. As a hierarchy develops, the IS become the glue

tying together parts of the organization that otherwise would not communicate. IS also enable flat organizations to

respond quickly to their environment.

c03.indd 60 11/26/2015 6:22:13 PM

61Information Systems and Organizational Design

Matrix Organizational Structure

The third popular form, which Cognizant ultimately adopted, is the matrix organizational structure. It typically assigns employees to two or more supervisors in an effort to make sure multiple dimensions of the business are

integrated. Each supervisor directs a different aspect of the employee’s work. For example, a member of a matrix

team from marketing would have a supervisor for marketing decisions and a different supervisor for a specific

product line. The team member would report to both, and both would be responsible in some measure for that mem-

ber’s performance and development. That is, the marketing manager would oversee the employee’s development of

marketing skills and the product manager would make sure that the employee develops skills related to the product.

Thus, decision rights are shared between the managers. The matrix structure allows organizations to concentrate

on both functions and purpose. The matrix structure allows the flexible sharing of human resources and achieves

the coordination necessary to meet dual sets of organizational demands. It is suited for complex decision making

and dynamic and uncertain environments. IS reduce the operating complexity of matrix organizations by allowing

information sharing among the different managerial functions. For example, a saleswoman’s sales would be entered

into the information system and appear in the results of all managers to whom she reports.

Cognizant might have moved to the matrix structure (see Figure 3.1) from a hierarchical structure because the

complexity of its projects had increased. “As part of the structure of a Cognizant engagement, we always pair our

technologists with people who have business context experience,” says Raj Mamodia, who was then the Assistant

Vice President of Cognizant’s Consumer Goods business unit. The purpose of these formally structured relation-

ships is to meet the customer’s needs, and not just focus on “how beautiful the technology is in and of itself.”5

The matrix organizational structure carries its own set of weaknesses. Although theoretically each boss has a

well‐defined area of authority, the employees often find the matrix organizational structure frustrating and confus-

ing because they are frequently subjected to two authorities with conflicting opinions. Consequently, working in

a matrix organizational structure can be time consuming because confusion must be dealt with through frequent

meetings and conflict resolution sessions. Matrix organizations often make it difficult for managers to achieve their

business strategies because they flood managers with more information than they can process.

Networked Organizational Structure

Made possible by advances in IT, a fourth type of organizational structure emerged: the networked organiza- tional structure. Networked organizations characteristically feel flat and hierarchical at the same time. An article published in the Harvard Business Review describes this type of organization: “Rigid hierarchies are replaced by formal and informal communication networks that connect all parts of the company. . . . [This type of organiza-

tional structure] is well known for its flexibility and adaptiveness.”6 It is particularly suited to dynamic, unstable

environments.

Networked organizational structures are those that rely on highly decentralized decision rights and utilize distrib-

uted information and communication systems to replace inflexible hierarchical controls with controls based in IS.

Networked organizations are defined by their ability to promote creativity and flexibility while maintaining opera-

tional process control. Because networked structures are distributed, many employees throughout the organization

can share their knowledge and experience and participate in making key organizational decisions. IS are fundamental

to process design; they improve process efficiency, effectiveness, and flexibility. As part of the execution of these

processes, data are gathered and stored in centralized data warehouses for use in analysis and decision making. In

theory at least, decision making is more timely and accurate because data are collected and stored instantly. The

extensive use of communication technologies and networks also renders it easier to coordinate across functional

boundaries. In short, the networked organization is one in which IT ties together people, processes, and units.

The organization feels flat when IT is used primarily as a communication vehicle. Traditional hierarchical lines

of authority are used for tasks other than communication when everyone can communicate with everyone else, at

5 Cognizant Computer Goods Technology, “Creating a Culture of Innovation: 10 Steps to Transform the Consumer Goods Enterprise” (October 2009),

6, http://www.cognizant.com/InsightsWhitepapers/Cognizant_Innovation.pdf (accessed August 20, 2015). 6 L. M. Applegate, J. I. Cash, and D. Q. Mills, “Information Technology and Tomorrow’s Manager,” Harvard Business Review (November–December 1988), 128–36.

c03.indd 61 11/26/2015 6:22:13 PM

62 Organizational Strategy and Information Systems

least in theory. The term used is technological leveling because the technology enables individuals from all parts of the organization to reach all of its other parts.

Portions of Zara’s organizational structure appear networked. Being networked enables the store managers to

use technology to communicate directly with designers. Zara uses the technology‐supported structure to coordinate

the actions and decisions of tens of thousands of its employees so that they can focus their attention on the same

goal of making and selling clothes that people want to buy.

Other Organizational Structures

An organization is seldom a pure form of one of the four structures described here. It is much more common to see

a hybrid structure in which different parts of the organization use different structures depending on the information

needs and desired work processes. For example, the IS department may use a hierarchical structure that allows

more control over data warehouses and hardware, whereas the research and development (R&D) department may

employ a networked structure to capitalize on knowledge sharing. In the hierarchical IS department, information

flows from top to bottom, whereas in the networked R&D department, all researchers may be connected to one

another.

Further, IS are enabling even more advanced organization forms such as the adaptive organization, the zero

time organization,7 and the elastic enterprise.8 Common to these advanced forms is the idea of agile, responsive

organizations that can configure resources and people quickly. These organizations are flexible enough to sense

and respond to changing demands. Elastic enterprises, for example, have a core competency of adding partners

as necessary to quickly respond to customer needs. They do this by creating a platform and common interfaces

to reduce the effort and friction of partnering. Building in the capability to respond instantly means designing the

organization so that each of the key structural elements is able to respond instantly.

Informal Networks

The organization chart reflects the authority derived from formal reporting relationships in the organization’s for-

mal structure. However, informal relationships also exist and can play an important role in an organization’s func-

tioning. Informal networks, in addition to formal structures, are important for alignment with the organization’s

business strategy.

Sometimes, management designs some of the informal relationships or networks. For example, when working

on a special project, an employee might be asked to let the manager in another department know what is going

on. This is considered an informal reporting relationship. Or a company may have a job rotation program that

provides employees with broad‐based training by allowing them to work a short time in a variety of areas. Long

after they have moved on to another job, employees on job rotations may keep in touch informally with former

colleagues, or call upon their past co‐workers when a situation arises that their input may be helpful. Hewlett Pack-

ard’s Decision Support and Analytics Services unit encouraged the development of work‐related informal networks

when it established focused interest group/forums known as Domain Excellence Platforms (DEPs). An IT‐enabled

DEP allows at least five people who hold a common interest related to the business to form a team to share their

knowledge on a topic (e.g., cloud computing, Web analytics). For nonbusiness related topics, the employees can

join conferences to talk about the topic and get to know one another better. The hope is that they will start thinking

beyond their work silos.9

However, not all informal relationships are a consequence of a plan by management. Some networks unintended

by management develop for a variety of other factors including work proximity, friendship, shared interests, family

ties, and so on. The employees can make friends with employees in another department when they play together on

7 For more information on zero time organizations, see R. Yeh, K. Pearlson, and G. Kozmetsky, ZeroTime: Providing Instant Customer Value Every Time, All the Time (Hoboken, NJ: John Wiley, 2000). 8 For more information on elastic enterprises, see N. Vitalari and H. Shaughnessy, The Elastic Enterprise (Longboat Key, FL: Telemachus Press, 2012). 9 T. S. H. Teo, R. Nishant, M. Goh, and S. Agarwal, “Leveraging Collaborative Technologies to Build a Knowledge Sharing Culture at HP Analytics,”

MIS Quarterly Executive 10, no. 1 (March 2011), 1–18.

c03.indd 62 11/26/2015 6:22:13 PM

63Information Systems and Management Control Systems

the company softball team, share the same lunch period in the company cafeteria, or see one another at social gath-

erings. Informal networks can also arise for political reasons. Employees can cross over departmental, functional,

or divisional lines in an effort to create political coalitions to further their goals. Some informal networks even cross

organizational boundaries. As computer and information technologies facilitate collaboration across distances,

social networks and virtual communities are formed. Many of these prove useful in getting a job done, even if not

all of the members of the network belong to the same organization. LinkedIn is an example of a tool that enables

large, global informal networks.

Information Systems and Management Control Systems Controls are the second type of managerial lever. Not only does IS change the way organizations are structured, but

also it profoundly affects the way managers control their organizations. Management control is concerned with how

planning is performed in organizations and how people and processes are monitored, evaluated, and compensated or

rewarded. Ultimately, it means that senior leaders make sure the things that are supposed to happen actually happen.

Management control systems are similar to room thermostats. Thermostats register the desired temperature.

A sensing device within the thermostat determines whether the temperature in the room is within a specifi ed range

of the one desired. If the temperature is beyond the desired range, a mechanism is activated to adjust the temper-

ature. For instance, if the thermostat is set at 70 degrees and the temperature in the room is 69, then the heater

can be activated (if it is winter) or the air conditioning can be turned off (if it is summer). Similarly, management

control systems must respond to the goals established through planning. Measurements are taken periodically and

if the variance is too great, adjustments are made to organizational processes or practices. For example, operating

processes might need to be changed to achieve the desired goals.

IS offer new opportunities for collecting and organizing data for three management control processes:

1. Data collection: IS enable the collection of information that helps managers determine whether they are satisfactorily progressing toward realizing the organization ’ s mission as refl ected in its stated goals.

Social Business Lens: Social Networks

Social networks are a form of informal networks. They even have begun to supplement and possibly replace

organization charts in enterprises. A social network is an IT‐enabled network that links individuals together in

ways that enable them to fi nd experts, get to know colleagues, and see who has relevant experience for pro-

jects across traditional organization lines. Much like the networked organization, a social network provides an IT

backbone linking all individuals in the enterprise, regardless of their formal title or position. Some might regard a

social network as a “super‐directory” that provides not only the names of the individuals but also their role in the

company, their title, their contact information, and their location. It might even list details such as their supervisor

(and their direct reports and peers), the project(s) they are currently working on, and personal information specifi c

to the enterprise.

What differentiates a social network from previous IT solutions to connect individuals is that it is integrated with

the work processes themselves. Conversations can take place, work activities can be recorded, and information

repositories can be linked or merely represented within the structure of the social network.

IBM has a good example of how a social network permeates an organization, changing its culture, structure,

and collaboration processes. With over 400,000 employees, the company has a fl urry of social activity embod-

ied in more than 17,000 individual blogs, 1 million daily page views of internal wikis and Web sites, and 400,000

employee profi les on IBM Connections. Its social network allows employees to share status updates, collaborate

on internal systems, and share fi les. There have been 15 million downloads of employee‐generated videos and

podcasts so far.

Source: http://www.forbes.com/sites/haydnshaughnessy/2011/12/09/is‐social‐business‐the‐same‐as‐social‐media/ (accessed April 5, 2012).

c03.indd 63 11/26/2015 6:22:13 PM

64 Organizational Strategy and Information Systems

2. Evaluation: IS facilitate the comparison of actual performance with the desired performance that is established as a result of planning.

3. Communication: IS speed the flow of information from where it is generated to where it is needed. This allows an analysis of the situation and a determination about what can be done to correct for problematic

situations.

When managers need to control work, IS can play a crucial role. IS provide decision models for scenario

planning and evaluation. For example, the airlines routinely use decision models to study the effects of changing

routes or schedules. IS collect and analyze information from automated processes, and they can make automatic

adjustments to the processes. For example, a paper mill uses IS to monitor the mixing of ingredients in a batch of

paper and to add more ingredients or change the temperature of the boiler as necessary. IS collect, evaluate, and

communicate information, leaving managers with time to make more strategic decisions.

Planning and Information Systems

In the first chapter, the importance of aligning organizational strategy with the business strategy was discussed.

An output of the strategizing process is a plan to guide in achieving the strategic objectives. IS can play a role in

planning in four ways:

• IS can provide the necessary data to develop the strategic plan. They can be especially useful in collecting data from organizational units and integrating the data to transform those data into information for the stra-

tegic decision makers.

• IS can provide scenario and sensitivity analysis through simulation and data analysis.

• IS can be a major component of the planning process.

• In some instances, an information system is a major component of a strategic plan. That is, as discussed in Chapters 1 and 2, information systems can be used to gain strategic advantage.

Data and Information Systems

In addition to focusing on organizational‐level planning and control, managers use information systems to build

controls for individuals. An important part of management control lies in making sure that individuals perform

appropriately. At the individual level, IS can streamline the process of data collection (usually through monitoring

and analytical processes that use the collected data, as Chapter 4 discusses) and support performance measurement

and evaluation as well as compensation through salaries, incentives, and rewards.

Monitoring work can take on a completely new meaning with the use of information technologies. IS make it

possible to collect such data as the number of keystrokes, the precise time spent on a task, exactly who was con-

tacted, and the specific data that passed through the process. The data collected from operations creates large data

stores that can be analyzed for trends. For example, a call center that handles customer service telephone calls is

typically monitored by an information system that collects data on the number of calls each representative received

and the length of time each representative took to answer each call and then to respond to the question or request for

service. Managers at call centers can easily and nonintrusively collect data on virtually any part of the process. The

organizational design challenge in data collection is twofold: (1) to embed monitoring tasks within everyday work

and (2) to reduce the negative impacts to employees being monitored. Workers perceive their regular tasks as value

adding but have difficulty in seeing how value is added by tasks designed to provide information for management

control. Research has found that monitoring does not always increase stress of the employee, especially when it fits

the task and is automatic and nonintrusive.10 But employees often avoid activities aimed at monitoring their work

10 D. Galletta and R. Grant, “Silicon Supervisors and Stress: Merging New Evidence from the Field,” Accounting, Management and Information Tech- nology 5, no. 3 (1995), 163–83.

c03.indd 64 11/26/2015 6:22:13 PM

65Information Systems and Management Control Systems

or worse, find ways to ensure that data recorded are inaccurate, falsified, or untimely. Collecting monitoring data

directly from work tasks—or embedding the creation and storage of performance information into software used to

perform work—renders the data more reliable.

A large number of software products are available for companies to monitor employees. Software monitoring

products are installed by companies to get specific data about what employees are doing. This information can help

ensure that work is being performed correctly. It can also be used to avoid barriers to employee productivity from

“cyberslacking” and “cyberslouching.”11 The intention may seem both ethical and in the best interest of business,

but in practice, the reverse may actually be true. In many cases, employees are not informed that they are being

monitored or that the information gleaned is being used to measure their productivity. In these cases, monitoring

violates both privacy and personal freedoms. Managers need to take into account employee privacy rights and try to

balance their right to privacy against the needs of the business to have surveillance mechanisms in place.

Performance Measurement, Evaluation, and Information Systems

IS make it possible to evaluate actual performance data against reams of standard and historical data, often by using

models and simulations. Analytics and big data tools have changed the way many companies use data to make

decisions. Managers can more easily and completely understand work progress and performance. In fact, the ready

availability of so much information catches some managers in “analysis paralysis”: analyzing too much or too long.

In our example of the call center, a manager can compare an employee’s output to that of colleagues, to earlier

output, and to historical outputs reflecting similar work conditions at other times. Even though evaluation consti-

tutes an important use of IS, how the information is used has significant organizational consequences. Information

collected for evaluation may be used to provide feedback so that the employee can improve personal performance;

it also can be used to determine rewards and compensation. The former use—for improvement in performance—is

nonthreatening and generally welcomed.

Using the same information for determining compensation or rewards, however, can be threatening. Suppose a

call center manager is evaluating the number and duration of calls that service representatives answer on a given

day. The manager’s goal is to make sure all calls are answered quickly, and he communicates that goal to his staff.

Now think about how the evaluation information is used.

If the manager simply provides the employees with information, then the evaluation is not threatening. If han-

dled this way, employees might respond by improving their call numbers and duration. A discussion may even

occur in which the service representative highlights other important considerations, such as customer satisfaction

and quality. Perhaps the representative takes longer than average on each call because she believes that the attention

devoted to the customer would result in higher customer satisfaction.

On the other hand, some managers use the same information to rank employees so that top‐ranked employees

are rewarded and those lower ranked are, in some way, punished or reprimanded. This may cause employees to

feel threatened and respond accordingly. The representative who is not on the top of the list might shorten calls or

deliver less quality, consequently decreasing customer satisfaction, while increasing the values of the metrics that

are measured. The lesson for managers is to pay attention to what is monitored and how the information is used.

Metrics for performance must be meaningful in terms of the organization’s broader goals, and measured, managed,

and communicated appropriately.

How feedback is communicated in the organization plays a role in affecting behavior. Some feedback can be

communicated via IS themselves. A simple example is the feedback built into an electronic form that will not allow

it to be submitted until it is properly filled out. For more complex feedback, IS may not be the appropriate vehi-

cle. For example, no one would want to be told she or he was doing a poor job via e‐mail or voice mail. Negative

feedback of significant consequence often is best delivered in person.

IS can allow for feedback from a variety of participants who otherwise could not be involved. Many companies

provide “360‐degree” feedback in which the individual’s supervisors, subordinates, and co‐workers all provide

11 Bernd Carsten Stahl, “The Impact of the UK Human Rights Act 1998 on Privacy Protection in the Workplace,” Computer Security, Privacy and Politics: Current Issues, Challenges and Solutions (Hershey, PA: Idea Group Publishing, 2008), 55–68.

c03.indd 65 11/26/2015 6:22:13 PM

66 Organizational Strategy and Information Systems

formal input. Social tools are making inroads in evaluation, too. For example, a “thumbs up” or “1–5 stars” evalu-

ation system makes it easy and fast to provide informal feedback and evaluate activities. Because that feedback is

received more quickly, improvements can be made faster.

Incentives and Rewards and Information Systems

Incentives and rewards are the ways organizations encourage good performance. A clever reward system can make

employees feel good without paying them more money. IS can affect these processes, too. Some organizations use

their Web sites to recognize high performers, giving them electronic badges that are displayed on the social network

to identify them as award recipients. Others reward them with new technology. At one organization, top performers

get new computers every year, while lower performers get the “hand‐me‐downs.”

IS make it easier to design complex incentive systems, such as shared or team‐based incentives. IS make it eas-

ier to keep track of contributions of team members and, in conjunction with qualitative inputs, allocate rewards

according to complex formulas. For example, in a call center, agents can be motivated to perform better by providing

rewards based on tracking metrics, such as average time per call, number of calls answered, and customer satis-

faction. Information systems can provide measures of all of these on a real‐time basis—even customer satisfaction

through automated audio or Web site questionnaires after a customer interaction.

When specifying reward metrics, managers must be careful because they tend to drive the behavior they specify.

For example, call center agents who know they will be evaluated only by the volume of calls they process may rush

callers and provide poorer service in order to maximize their performance according to the narrow metric. Those

measured only by customer satisfaction might spend more time than necessary on each call and perhaps try end-

lessly to solve problems that should be routed to more technical personnel.

Information Systems and Culture The third managerial lever of organizational strategy is culture. Culture plays an increasingly important role in

information system management and use. Because information systems management and use are complicated

by human factors, it is important to consider culture’s impact. Culture is defined as the set of “shared values and beliefs” that a group holds and that determines how the group perceives, thinks about, and appropriately reacts to

its various environments.12

A “collective programming of the mind” distinguishes not only societies (or nations) but also industries, profes-

sions, and organizations.13 Beliefs are the perceptions that people hold about how things are done in their community whereas values reflect the community’s aspirations about the way things should be done. Culture is something of a moving target because it evolves over time as the group solves problems adapting to the environment and internal

operations.

Culture has been compared to an iceberg because, like an iceberg, only part of the culture is visible from the

surface. In fact, it is necessary to look below the surface to understand the deep‐rooted aspects of culture that are

not visible. That is, culture may be thought of in terms of layers: observable artifacts, values, and assumptions.

Observable artifacts are the most visible level. They include such physical manifestations as type of dress, sym- bols in art, acronyms, awards, myths and stories told about the group, rituals, and ceremonies. Espoused values are the explicitly stated preferred organizational values. Ideally, they should be consistent with the enacted values, which are the values and norms that are actually exhibited or displayed in employee behavior. For example, if

an organization says that it believes in a good work–life balance for its employees but actually requires them to

work 12‐hour days and on weekends, the enacted values don’t match with the espoused ones. The deepest layer of

culture is the underlying assumption layer, or the fundamental part of every culture that helps discern what is real

12 A. Kinicki, Organizational Behavior: Core Concepts (Boston, MA: McGraw‐Hill Irwin, 2008), 183. 13 G. J. Hofstede, Culture’s Consequences: Comparing Values, Behaviors, Institutions, and Organizations Across Nations, 2nd ed. (Thousand Oaks, CA: Sage Publications, 2001).

c03.indd 66 11/26/2015 6:22:13 PM

67Information Systems and Culture

and important to the group. Assumptions are unobservable because they reflect organizational values that have become taken for granted to such an extent that they guide organizational behavior without any group members

thinking about them.14

Levels of Culture and IT

Culture can vary depending upon which group you are studying. Countries, organizations, and subgroups in orga-

nizations all have a culture. IS management and use can be impacted by culture at all these levels. IS can even play

a role in promoting it. For instance, Cognizant used IT to implement “10/10/10,” a program designed to keep its

associates focused on innovation. On the tenth workday of each month at 10 a.m., everyone’s computer screen is

frozen, allowing the entire Cognizant workforce to spend 10 minutes thinking about and sharing innovative ideas.15

With the growth of analytics and the availability of large stores of data, many organizations are adopting a data‐

driven culture in which virtually all decisions are made with the support of analytics. In a data‐driven culture, man-

agers are typically expected to provide data to support their recommendations and to back up decisions. Information

is often freely shared in this culture, and IS take on the important role of collecting, storing, analyzing, and deliver-

ing data and information to all levels of the organization. Dell, Procter and Gamble, GE, Google, and Facebook are

examples of companies that are known to have a data‐driven culture. Sometimes the employees in these companies

are said to “speak the language of data” as part of their culture.

When IS developers have values that differ from the clients in the same organization for whom they are devel-

oping systems, cultures can clash. For example, clients may favor computer‐based development practices that

encourage reusability of components to enable flexibility and fast turnaround. Developers, on the other hand, may

prefer a development approach that favors stability and control but tends to be slower. Both national and organiza-

tional cultures can affect IT management and usage and vice versa. National culture may affect IT in a variety of

ways, impacting information systems development, technology adoption and diffusion, system use and outcomes,

and management and strategy. These relationships are shown in Figure 3.5 and described next. The model and the

discussion of the impact of culture on IT issues draws heavily from the work of Leidner and Kayworth.16

14 E. Schein, Organizational Change and Leadership, 4th ed. (San Francisco, CA: Jossey‐Bass, 2010). 15 Cognizant Computer Goods Technology, “Creating a Culture of Innovation,” 1–6. 16 D. Leidner and T. Kayworth, “A Review of Culture in Information Systems Research: Toward a Theory of Information Technology Culture Conflict,”

MIS Quarterly 30, no. 2 (2006), 357–99.

Information

Systems

Development

IT Adoption

and Diffusion

IT Issues

Organizational Values

(Entire Organization and within Organization)

National Values

IT Use and

Outcomes

IT Management

and Strategy

FIGURE 3.5 Levels of culture. Source: Adapted from D. Leidner and T. Kayworth, “A Review of Culture in Information Systems Research: Toward a Theory of Information Technology Culture Conflict,“ MIS Quarterly 30, no. 2 (2006), 372, Figure 1.

c03.indd 67 11/30/2015 7:25:49 PM

68 Organizational Strategy and Information Systems

Culture and Information Systems Development

Variation across national cultures may lead to differing perceptions and approaches to IS development. In particular,

systems designers may have different perceptions of the end users and how the systems would be used. For example,

Danish designers who had more socialist values were more concerned about people‐related issues when compared

to Canadian designers with more capitalist values. The Canadian designers were more interested in technical issues.

National culture may also affect the perceptions of project risk and risk management behaviors. At the organiza-

tional level, cultural values can affect the features of new software and the way it is implemented.

Culture and Information Technology Adoption and Diffusion

National cultures that are more willing to accept risk appear to be more likely to adopt new technologies. Those

cultures that are less concerned about power differences among people (i.e., have low power distance) are more

likely to adopt technologies that help promote equality. People are more likely to adopt a new technology if they

think that the technology’s embedded values match those of their national culture. Further, if a technology is to be

successfully implemented into an organization, either the technology must fit with the organization’s culture or the

culture must be shaped to fit the behavioral requirements of the technology. For example, a dashboard that shares

analytics and key performance indicators to all employees would reduce the “power” of leaders in a hierarchical

organization in which only the senior managers have access to the data. In such organizations, implementation of

such an information system would likely be very slow or rejected altogether because the culture would not support

broad information sharing.

Culture and Information Technology Use and Outcomes

Research has shown that differences in culture result in differences in the use and outcomes of IT. At the orga-

nizational level, cultural values are often related to satisfied users, successful IS implementations or knowledge

management successes. At the national level, e‐mail adoption was much slower in Japan than in the United States.

Japanese prefer richer forms of communication such as meeting face‐to‐face. The lean e‐mail can’t accommodate

the symbols in their language as easily as a fax. Further, in countries that are more likely to avoid uncertainty like

Japan and Brazil, IT is used often for planning and forecasting, whereas in countries that are less concerned about

risk and uncertainty, IT is more often used for maintaining flexibility. Furthermore, some things are acceptable in

one country but not another. For example, DitchWitch could not use its logo globally because a witch is offensive

in some countries.

Culture and Information Technology Management and Strategy

National and organizational culture affects planning, governance, and perceptions of service quality. For example,

having planning cultures at the top levels of an organization typically signal that strategic systems investment is

important. At Adidas, a multinational sports apparel company headquartered in Germany, national culture played

a role in its multisourcing strategy. Adidas’ managers selected an Eastern European vendor because they were

looking for a provider whose culture was similar to their own. They thought that vendor’s employees were more

likely to question system requirements and to make creative, innovative contributions than the Indian vendors they

had hired.17

National Cultural Dimensions and Their Application

One of the best‐known (and prolific) researchers in the area of differences in the values across national cultures

is Geert Hofstede. Most studies about the impact of national cultures on IS have used Hofstede’s dimensions

of national culture. Hofstede18 originally identified four major dimensions of national culture: power distance,

17 Martin Wiener and Carol Saunders, “Forced Coopetition in IT Multi‐Sourcing,” Journal of Strategic Information Systems 23, no. 3 (2014), 210–25. 18 G. Hofstede, Culture’s Consequences: International Differences in Work‐Related Values (London: Sage, 1980).

c03.indd 68 11/26/2015 6:22:14 PM

69Information Systems and Culture

uncertainty avoidance, individualism‐collectivism, and masculinity‐femininity.19 To correct for a possible bias

toward Western values, a new dimension, Confucian work dynamism, also referred to “short‐term vs. long‐term

orientation,” was added.20 Many others have used, built upon, or tried to correct problems related to Hofst-

ede’s four dimensions. One notable project is the Global Leadership and Organizational Behavior Effectiveness

(GLOBE) research program, which is a team of 150 researchers who have collected data on cultural values and

practices and leadership attributes from over 18,000 managers in 62 countries. The GLOBE project has uncov-

ered nine cultural dimensions, six of which have their origins in Hofstede’s pioneering work. The Hofstede

dimensions and their relationship to the GLOBE dimensions are summarized in Figure 3.6.

19 Ibid. 20 G. Hofstede and M. H. Bond, “The Confucius Connection: From Cultural Roots to Economic Growth,” Organizational Dynamics 16 (1988), 4021.

FIGURE 3.6 National cultural dimensions.

Hofstede Dimensions (Related GLOBE Dimensions)

Descriptiona Examples of Effect on ITb

Uncertainty Avoidance (Uncertainty Avoidance)

Extent to which a society tolerates uncertainty and ambiguity; extent to which members of an organization or society strive to avoid uncertainty by reliance on social norms, rituals, and bureaucratic practices to alleviate the unpredictability of future events.

Countries with high uncertainty avoidance are less likely to adopt new IT and have higher perceptions of project risk than countries with low uncertainty avoidance.

Power Distance (Power Distance) Degree to which members of an organization or society expect and agree that power should be equally shared.

Individuals from high power distance countries are found to be less innovative and less trusting of technology than individuals from low power distance countries.

Individualism/Collectivism (Societal and In‐Group Collectivism)

Degree to which individuals are integrated into groups; extent to which organizational and societal institutional practices encourage and reward collective distribution of resources and collective action.

Individualistic cultures are more predisposed than collectivistic cultures to report bad news about troubled IT projects; companies in collectivist societies are more likely than individualistic societies to fill an IS position from within the company.

Masculinity/Femininity (General Egalitarianism and Assertiveness)

Degree to which emotional roles are distributed between the genders; extent to which an organization or society minimizes gender role differences and gender discrimination; often focuses on caring and assertive behaviors.

Australian groups (high masculinity) generated more conflict and relied less on conflict resolution strategies than Singaporean groups (low masculinity).

Confucian Work Dynamism (Future Orientation)

Extent to which society rewards behaviors related to long‐ or short‐term orientations; degree to which individuals in organizations or societies engage in future‐oriented behaviors such as planning, investing in the future, and delaying gratification.

When considering future orientation, studies found differences in the use of Executive Information Systems and the evaluation of service quality across countries.

a Adapted from R. House, M. Javidan, P. Hanges, and P. Dorfman, “Understanding Cultures and Implicit Leadership Theories across the Globe: An Introduction to Project GLOBE, “ Journal of World Business 37, no. 1 (2002), 3–10; and G. Hofstede and G. J. Hofstede, Dimensions of National Culture, http://www.geerthofstede. nl/dimensions‐of‐national‐cultures.aspx (accessed August 20, 2015). b Examples were provided in D. Leidner and T. Kayworth, “A Review of Culture in Information Systems Research: Toward a Theory of Information Technology Culture Conflict,” MIS Quarterly 30, no. 2 (2006), 357–99.

c03.indd 69 11/26/2015 6:22:14 PM

70 Organizational Strategy and Information Systems

Even though the world may be becoming “fl atter,” cultural differences have not totally disappeared. But some

leadership traits, such as being trustworthy, just, and honest; having foresight and planning ahead; being positive,

dynamic, encouraging, and motivational; and being communicative and informed are seen as universally acceptable

across cultures. 21

The generally accepted view is that the national culture predisposes citizens of a nation to act in a certain way

along a Hofstede or GLOBE dimension, such as in an individualistic way in England or in a collectivist way in

China. Yet, the extent of the infl uence of a national culture may vary among individuals, and culturally based idi-

osyncrasies may surface based upon the experiences that shape each person ’ s ultimate orientation on a dimension.

Having an understanding and appreciation for cultural values, practices, and subtleties can help in smoothing the

challenges that occur in dealing with these idiosyncrasies. An awareness of the Hofstede or GLOBE dimensions

may help to improve communications and reduce confl ict.

Effective communication means listening, framing the message in a way that is understandable to the receiver,

and responding to feedback. Effective cross‐cultural communication involves each of these plus searching for an

integrated solution that can be accepted and implemented by members of diverse cultures. This may not be as

simple as it sounds. For instance, typical American managers, noted for their high‐performance orientation, pre-

fer direct and explicit language full of facts and fi gures. However, managers in lower performance‐oriented coun-

tries like Russia or Greece tend to prefer indirect and vague language that encourages the exploration of ideas. 22

Communication differences surfaced when one of this book ’ s authors was designing a database in Malaysia. She

asked questions that required a “yes” or “no” response. In trying to reconcile the strange set of responses she

received, the author learned that Malaysians are hesitant to ever say “no.” Communication in meetings is also

subject to cultural differences. In countries with high levels of uncertainty avoidance such as Switzerland and

Geographic Lens: Does National Culture Affect Firm Investment in IS Training?

In a massive study of 6,000 fi rms in 21 countries, Hilla Peretz and Zehava Rosenblatt found that differences along

Hofstede ’ s cultural dimensions do affect employee training. In particular, fi rms in countries that embrace low

power distance (i.e., Germanic countries, Anglo‐American countries, the Netherlands, and Israel) tend to invest

more in training than fi rms in countries with high power distance (i.e., some Asian, Latin America, and Middle

Eastern countries).

Why might this be the case? Perhaps fi rms in high power distance societies view investment in training as less

favorable because it might narrow the power gaps by making a higher level of skills available across all levels of

the organization. Those in power might not want to see a leveling of power throughout the organization.

Peretz and Rosenblatt also discovered that fi rms in countries that had a strong orientation toward the future

(i.e., some Asian countries) were more likely to invest in training than fi rms in countries with a shorter‐term orien-

tation (i.e., some Anglo‐American countries). The researchers think this might be so because training is all about

helping employees develop so that they can perform better in the future. Better‐trained employees help the

fi rm ’ s competitive prospects down the line.

Finally, the researchers found that fi rms in countries with high uncertainty avoidance (i.e., some Hispanic cul-

tures, Japan, South Korea, Israel, and Russia) spend more on training than countries with low uncertainty avoid-

ance (i.e., the United Kingdom, Ireland, Hong Kong, and Singapore)—maybe because employee training may be

seen as a way to reduce uncertainty.

Although the study was about training in general, the fi ndings are even more likely to hold for IS training.

Because IS change so quickly, IS professionals need considerable training to stay current and do their jobs well.

Source: H. Peretz and Z. Rosenblatt , “ The Role of Societal Cultural Practices in Organizational Investment in Training: A Comparative Study in 21 Countries ,” Journal of Cross‐Cultural Psychology 42 , no. 5 ( 2011 ), 817 – 31 .

21 Mansour Javidan and R. J. House , “ Cultural Acumen for the Global Manager ,” Organizational Dynamics 29 , no. 4 ( 2001 ), 289 – 305 . 22 Ibid.

c03.indd 70 11/26/2015 6:22:14 PM

71Discussion Questions

Austria, meetings should be planned in advance with a clear agenda. The managers in Greece or Russia who come

from a low uncertainty avoidance culture often shy away from agendas or planned meetings.

Knowing that a society tends to score high or low on certain dimensions helps a manager anticipate how a per-

son from that society might react. However, this provides only a starting point because each person is different.

Importantly, without being aware of cultural differences, a company is unlikely to develop IS or to use it effectively.

S U M M A R Y

• Organizational strategy reflects the use of the managerial levers of an organization’s design, organizational culture, and management control systems that coordinate and control work processes.

• Organizational designers today must have a working knowledge of what information systems can do and how the choice of information system will affect the organization itself.

• Organizational structures can facilitate or inhibit information flows.

• Organizational design should take into account decision rights, organizational structure, and informal networks.

• Structures such as flat, hierarchical, matrix and, networked organizations are being enhanced by information technology. Increasingly information technology enables and supports networked organizations that can better respond to dynamic,

uncertain organizational environments.

• Information technology affects managerial control mechanisms: planning, data, performance measurement and evalua- tion, incentives and rewards.

• Management control at the individual level is concerned with monitoring (i.e., data collection), evaluating, providing feedback, compensating, and rewarding. It is the job of the manager to ensure that the proper control mechanisms are

in place and the interactions between the organization and the information systems do not undermine the managerial

objectives.

• Organizational and national culture should be taken into account when designing, managing, and using IS.

K E Y T E R M S

assumptions (p. 67)

beliefs ( p. 66)

bureaucracy (p. 60)

culture (p. 66)

decision rights (p. 58)

enacted values (p. 66)

espoused values (p. 66)

flat organizational structure (p. 60)

hierarchical organizational

structure (p. 60)

matrix organizational

structure (p. 61)

networked organizational

structure (p. 61)

observable artifacts (p. 66)

organizational strategy (p. 57)

social network (p. 63)

span of control (p. 60)

unity of command (p. 60)

values (p. 66)

D I S C U S S I O N Q U E S T I O N S

1. How might IS change a manager’s job?

2. Is monitoring an employee’s work on a computer a desirable or undesirable activity from a manager’s perspective? From the employee’s perspective? How does the organization’s culture impact your position? Defend your position.

3. Consider the brief description of the elastic enterprise. What is an example of a control system that would be critical to man- age for success in elastic enterprise? Why?

4. Mary Kay, Inc. sells facial skin care products and cosmetics around the globe. The business model is to provide one‐on‐one, highly personalized service. More than 500,000 Independent Beauty Consultants (IBCs) sell in 43 markets worldwide. Each

IBC runs his or her own business by developing a client base and then providing services and products for sale to those

clients. The IBCs were offered support through an e‐commerce system with two major components: mymk.com and Mary

c03.indd 71 11/26/2015 6:22:14 PM

72 Organizational Strategy and Information Systems

Southwest Airlines ’ merger with AirTran Airlines , valued at over US$3 billion, made Southwest the largest domestic car-

rier based on number of passengers fl own. 25 The merger increases Southwest ’ s presence in a number of major cities, most

notably New York (LaGuardia) and Washington D.C. (Ronald Reagan National Airport). Thanks to AirTran , Southwest now

fl ies into the coveted Atlanta ’ s Hartsfi eld‐Jackson Atlanta International, the world ’ s busiest airport, along with a number

of international vacation destinations such as Aruba, Puerto Rico, and the Bahamas. In all, 21 new cities were added, 7 of

which were in the international market, positioning Southwest to expand in Central and South America. The result was a

signifi cant increase in profi tability for Southwest , growing from $178 million in 2011 to $1.1 billion in 2014. 26

Southwest has grown organically, acquiring only two other smaller carriers—Morris Air and Muse Air —in the 1980s.

This has made it easier to maintain its quirky identity. On the other hand, AirTran was created from several airlines, includ-

ing the former ValuJet , about 15 years ago. It is known mostly as a low‐cost, on‐time carrier. The Company Culture page

on AirTran ’ s Web site prior to the merger claimed that “loyal crew members keep AirTran airways customers soaring” and

who have a “timely and accommodating demeanor.” AirTran ’ s values included a total commitment to safety, technical ex-

cellence, continuous learning, fun, and profi t. 27

Southwest , headquartered at Love Field in Dallas, uses the ticker symbol LUV and uses all kinds of ways to show that

“Luv” to their customers. Southwest has cultivated a corporate culture that focuses on employees and customers having a

good time while fl ying. The company carefully selects its employees using interviews that involve creative activities and

even asking the recruits to wear tutus. Southwest ’ s training program with karaoke and amusing challenges is designed

to socialize the new recruits into the airline ’ s fun‐loving culture. According to its Web site, its cultural values include

“A Warrior Spirit, A Servant ’ s Heart, A Fun‐Luving Attitude.” 28

Wharton management professor Peter Cappelli commented just after the merger was announced in 2010 that “South-

west ’ s whole business model is built on a particular approach to managing employees. It ’ s a big bet they are making that

they can swallow AirTran  . . . . This is a very different approach, taking thousands of AirTran employees, dumping them

into the system and hoping it works. It ’ s a pretty risky move." Cappelli adds that airline mergers are always diffi cult because

integration has to take place while a carrier continues to carry out complex operations. Thousands of employees can ’ t easily

be put through an orientation program in the merger ’ s short time frame, and the information systems supporting the complex

operations of two airlines can ’ t be easily changed. 29

■ CASE STUDY 3‐1 The Merger of Airtran by Southwest Airlines: Will the Organizational Cultures Merge? 24

Kay InTouch. Mymk.com allows IBCs to create instant online sites where customers can shop anytime directly with their

personal IBC. Mary Kay InTouch streamlines the ordering process by automatically calculating discounts, detecting pro-

motion eligibility, allowing the IBCs to access up‐to‐date product catalogs, and providing a faster way to transact business

with the company. 23

a. How would the organizational strategy need to change to respond to Mary Kay ’ s new business strategy and information system?

b. What changes would you suggest Mary Kay, Inc. managers make in their management systems in order to realize the intended benefits of the new systems? Specifically, what types of changes would you expect to make in the evaluation

systems, the reward systems, and feedback systems?

23 Adapted from “ Mary Kay, Inc .,” Fortune (Microsoft supplement, November 8, 1999 ) . 24 An earlier version of this case was written by Parul Acharya.

25 “ What Has AirTran Done for Southwest Airlines ,” Forbes (December 11, 2014), http://www.forbes.com/sites/greatspeculations/2014/12/11/what‐has‐ airtran‐done‐for‐southwest‐airlines/ (accessed April 27, 2015) .

26 Charisse Jones , “ Southwest Scores Record Profit—Again ” USA Today (January 22, 2015 ), http://www.usatoday.com/story/money/2015/01/22/ southwest‐sees‐record‐profits‐in‐2014/22166225/ (accessed August 20, 2015).

27 www.airtran.com (accessed April 2011).

28 Southwest Airlines, http://www.southwest.com/html/about‐southwest/careers/culture.html (accessed January 27, 2012).

29 “ By Acquiring AirTran, Will Southwest Continue to Spread the LUV? ” Knowledge@Wharton (October 13, 2010), http://knowledge.wharton.upenn.

edu/article.cfm?articleid=2614 (accessed August 20, 2015) ; and B. Snyder , “ How the Southwest‐AirTran Merger Creates a Labor Problem ,” CBS Money (October 5, 2010 ), http://www.cbsnews.com/8301‐505123_162‐43642550/how‐the‐southwest‐airtran‐merger‐creates‐a‐labor‐problem/ (accessed April 12, 2012) .

c03.indd 72 11/26/2015 6:22:14 PM

73Case Study

The Federal Bureau of Investigation of the U.S. government, the FBI, was forced to scrap its $170 million virtual case fi le

(VCF) management system. Offi cial reports blamed numerous delays, cost overruns, and incompatible software. But a deep-

er examination of the cause of this failure uncovered issues of control, culture, and incompatible organizational systems.

Among its many duties, the FBI is charged with the responsibility to fi ght crime and terrorism. To do so requires a

large number of agents located within the United States and around the world. That means agents must be able to share

information among themselves within the bureau and with other federal, state, and local law enforcement agencies. But

sharing information has never been standard operating procedure for this agency. According to one source, “agents are accus-

tomed to holding information close to their bulletproof vests and scorn the idea of sharing information.” This turned out to

be a real problem in an investigation of DarkMarket, an Internet forum that connected buyers and sellers so that they could

exchange stolen information such as bank details and credit card numbers. When both the FBI and Secret Service agents were

investigating each other as criminals, it took their British colleagues, who knew the secrets of both agencies, to avert a crisis.

Enter the FBI ’ s efforts to modernize its infrastructure, codenamed “Trilogy.” The efforts included providing agents with

30,000 desktop PCs, high‐bandwidth networks to connect FBI locations around the world, and the VCF project to facilitate

sharing of case information worldwide. The FBI Director explained to Congress that VCF would provide “an electronic

means for agents to globally send fi eld notes, documents, pieces of intelligence and other evidence so they could hopefully

act faster on leads.” It was designed to replace a paper‐intensive process with an electronic, Web‐based process. With such

a reasonable goal, why didn ’ t it work?

■ CASE STUDY 3‐2 The FBI

In November 2011, Southwest Airlines ’ more than 6,000 pilots and AirTran Airways ’ 1,700 pilots overwhelmingly

approved a plan to combine the seniority lists of the two carriers with fi ve of six pilots voting in favor. 30 The personnel sys-

tems had to be modifi ed to refl ect the new seniority and pay systems.

The disparate cultures of Southwest and AirTran also posed problems for the merger of their online reservation systems

and their frequent‐fl yer programs. Southwest switched from Sabre to Amadeus system to better accommodate merchandis-

ing and international fl ights. AirTran ’ s reservations system vendor was Navitaire. 31 AirTran and Southwest had diametrically

opposed views on distribution through online travel agencies. Southwest usually sold its tickets via telephone or through its

Web site whereas AirTran preferred online reservation systems such as Orbitz and Expedia. 32 It took several years after to

fi gure out how to blend the two different reservations systems. The Southwest frequent‐fl yer program was the last system

to be updated to include the top customers of AirTran. In December 2014, the new merged airline was just fi nishing up the

integration. Will the cultures of Southwest and AirTran come together? People are optimistic, but the real answer lies in the

future.

Discussion Questions

1. Discuss the layers of culture that are evident in this case. Why do you think Southwest has preferred to grow organically

over its history?

2. What are the similarities and dissimilarities between the cultures, values, and beliefs of Southwest and AirTran airlines?

Where would you expect the differences to be most difficult to manage? Why?

3. What problems could arise due to the different perspectives of both airlines toward online reservation systems? What do

you recommend the managers do to solve these problems?

4. What would you recommend managers to do ensure a smooth integration of the information systems given the culture

differences?

30 T. Maxon , “ Southwest Airlines, AirTran Pilots Overwhelming Approve Plan to Combine Seniority Lists ,” Aviationblog, Dallas News (November 7, 2011 ), http://aviationblog.dallasnews.com/archives/mergers‐consolidation/ (accessed November 7, 2011) ; Snyder, “How the Southwest‐AirTran Merger

Creates a Labor Problem.” 31 D. Schall , “ Distribution Questions Loom Following US Approval of Southwest‐AirTran Merger ,” tnooz.com (April, 27, 2011 ), http://www.tnooz.

com/2011/04/27/news/distribution‐questions‐loom‐following‐us‐approval‐of‐southwest‐airtran‐merger/ (accessed April 12, 2012) . 32 J. Brancatelli , “ The Fight Stuff: Why the Airlines Are Fighting Travel Sites ,” Portfolio.com (January 5, 2011 ), http://www.portfolio.com/business‐

travel/2011/01/05/why‐legacy‐airlines‐are‐warring‐with‐expedia‐and‐orbitz/ (accessed November 7, 2011) .

c03.indd 73 11/26/2015 6:22:14 PM

74 Organizational Strategy and Information Systems

The CIO of the FBI offered one explanation. He claimed that the FBI needed to change its culture. “If the Bureau is ever

going to get the high‐tech analysis and surveillance tools it needs to. . . fi ght terrorism, we must move from a decentralized

amalgam of 56 fi eld offi ces. . . to a seamlessly integrated global intelligence operation capable of sharing information and

preventing crimes in real‐time.” He added that the Bureau personnel were also very distrustful of the technology, as well as

others not only in other organizations but also within the FBI.

A former project manager at the FBI further explained, “They work under the idea that everything needs to be kept secret.

But everything doesn ’ t have to be kept secret. To do this right, you have to share information.”

The VCF system has been shut down, but the CIO is working on a new approach. He is busy trying to win buy‐in from

agents in the fi eld so that the next case management system will work. In addition, he is working to establish a portfolio

management plan that will cover all of the FBI ’ s IT projects, even those begun in decentralized offi ces. His team has been

designing an enterprise architecture that will lay out standards for a bureauwide information system. The Director of the

FBI has helped too. He reorganized the governance of IT, taking its budget control away from the districts and giving total

IT budget authority to the CIO.

The FBI is building a new case management system called Sentinel in four phases. The fi rst two phases have been de-

ployed and, according to the Federal IT dashboard, the project is on schedule and on budget. The new system, according to

the CIO, will include workfl ow, document management, record management, audit trails, access control, and single sign‐on.

It will provide enhanced information sharing, search, and analysis capabilities to FBI agents and facilitate information

sharing with members of the law enforcement and intelligence communities. To manage the expectations of the agents, the

CIO plans to communicate often and signifi cantly increase the training program for the new system. The CIO commented,

“We want to automate those things that are the most manually cumbersome for the agents so they can see that technology

can actually enhance their productivity. That is how to change their attitudes.”

The FBI also has a billion‐dollar Next Generation Identifi cation (NGI) system with 52 million searchable facial images

and 100 million individual fi ngerprint records as well as millions of palm prints, DNA samples, and iris scans. NGI can scan

mug shots for a match and pick out suspects from a crowd scanned by a security camera or in a photograph on the Internet.

The information can be exchanged with 18,000 law enforcement agencies 24 hours a day, 365 days a year. 33 When combined

with Sentinel, NGI will further enhance the effectiveness of the FBI ’ s antiterror efforts.

Discussion Questions

1. What do you think were the real reasons why the VCF system failed?

2. What were the points of alignment and misalignment between the information systems strategy and the FBI

organization?

3. What do you think of the CIO ’ s final comment about how to change attitudes? Do you think it will work? Why or

why not?

4. If you were the CIO, what would you do to help the FBI modernize and make better use of information technology?

Sources: Adapted from Allan Holmes , “ Why the G‐Men Aren ’ t IT Men “ CIO (June 15, 2005 ), 42 – 45 ; IT Dashboard, ”FBI Sentinel,” http:// www.itdashboard.gov/investment?buscid=441 ; Marc Goodman , Future Crimes ( Toronto, Canada : Random House , 2015 ) .

33 Federal Bureau of Investigation, “FBI Announces Full Operational Capability of the Next Generation Identification System” (September 15, 2014),

https://www.fbi.gov/news/pressrel/press‐releases/fbi‐announces‐full‐operational‐capability‐of‐the‐next‐generation‐identification‐system (accessed

August 20, 2015).

c03.indd 74 11/26/2015 6:22:14 PM

75

4 chapter

New approaches to work such as workplace fl exibility and remote work combined with newer collaboration and social technologies, mobile technologies, and cloud computing have drastically changed the way we work. This chapter explores the impact technology has on the nature and design of work. A Work Design Framework is used to explore how digital technology can be used effectively to support these changes and help make employees more effective. In particular, this chapter discusses technologies to support communication and collaboration, new types of work, new ways of doing traditional work, new challenges in managing employees, and issues in working remotely and on virtual teams. It concludes with a section on change management.

Digital Systems and the Design of Work

Consumer fi nancial services powerhouse American Express viewed workplace fl exibility as a stra-

tegic lever. Its award‐winning BlueWork program was a good example of turning strategic intent

into action. In addition to receiving the Chairman ’ s Award for Innovation—Top Innovators Prize, the

BlueWork program enabled increased employee productivity and more than $10 million in annual

savings from reduced cost of offi ce space. 1 BlueWork was Amex ’ s term for arrangements for fl exi-

bility in workspace. Integrated into the company ’ s human resource policies, the fl exibility included

staggered working hours, off‐site work areas such as home/virtual offi ce arrangements, shared offi ce

space, touch‐down (laptop‐focused, temporary) space, and telecommuting. The corporate focus is on

results rather than on hours clocked in the offi ce and face‐to‐face time. But BlueWork also supported

the sustainability and corporate social responsibility objectives. According to the Amex Web site,

Our sustainable facilities story is also woven into the fabric of our employees ’ daily routine. BlueWork,

our fl exible workplace program, allows American Express employees to better utilize company work

space and work remotely. The installation of 63 telepresence studios in 46 offi ce locations encourages

virtual meetings, reduces the need for travel, and contributes positively to our carbon reduction target. 2

Employees are assigned to a type of work arrangement based on their role. Hub employees

require a fi xed desk because they work in the offi ce every day. Club employees can share time bet-

ween the offi ce and other locations because their roles involve both face‐to‐face and virtual meet-

ings. Home employees work from home at least three days a week. Roam employees are on the road

or at customer sites. Susan Chapman, SVP at American Express commented on the importance of

1 Christopher Palafax , “ American Express ’ s New Design Team ,” American Builders Quarterly (April/May/June 2014), http:// americanbuildersquarterly.com/2014/american‐express/ (accessed August 25, 2015); http://www.employeralliance.sg/toolkit/tool

kit/tk1_13_2a.html (accessed August 25, 2015); Monak Mitra , “ Best Companies to Work for 2012 ,” The Economic Times, http:// articles.economictimes.indiatimes.com/2012‐07‐16/news/32698433_1_employee‐benefits‐jyoti‐rai‐american‐express‐india (accessed

August 25, 2015) ; Jeanne Meister , “ Flexible Workspaces: Employee Perk or Business Tool to Recruit Top Talent? ” Forbes (April 1, 2013), http://www.forbes.com/sites/jeannemeister/2013/04/01/flexible‐workspaces‐another‐workplace‐perk‐or‐a‐must‐have‐to‐attract‐

top‐talent/ (accessed August 25, 2015) . 2 American Express Corporate Social Responsibility Report, Quarter 3 2014 Update , http://about.americanexpress.com/csr/crr‐2014‐

q3.aspx (accessed August 25, 2015) .

c04.indd 75 11/26/2015 7:16:44 PM

76 Digital Systems and the Design of Work

technology’s role in alternative work arrangements, “Technology drives workplace flexibility. . . . Technology has

become a strategic competency that drives revenue growth. It’s not just about enabling productivity.”3

How has BlueWork impacted the staff? In addition to the productivity improvements and savings in office expense,

overall employee satisfaction is up. American Express managers are happy with these arrangements too. They have

found employees to be more engaged while working, more committed to the company, and better able to drive needed

results.4 American Express has clearly adopted one of the most accommodating approaches to work hours, but many

employers allow their employees some flexibility in their work schedule. A third or more of IBM, Aetna, and AT&T

employees have no official desks at the company. Communications giant Cisco, which has over 75,000 employees on

six continents, uses technology‐enabled flexible work practices such as telecommuting, remote work, and flex time.5

Sun Microsystems Inc. calculates that it has saved over $400 million in real estate costs by allowing nearly half of

its employees to work anywhere they want.6 Even the U.S. Government has a flexible work program, Flexiwork, that

enables eligible employees to do their job under alternative work arrangements such as work from home.7

The American Express example illustrates how the nature of work has changed—and information technology is

supporting, if not propelling, the changes. In preindustrial societies, work was seamlessly interwoven into everyday

life. Activities all revolved around nature’s cyclical rhythms (i.e., the season, day, and night; the pangs of hunger)

and the necessities of living. The Industrial Revolution changed this. With the practice of dividing time into mea-

surable, homogeneous units for which they could be paid, people started to separate work from other spheres of life.

Their workday was distinguished from family, community, and leisure time by punching a time clock or responding

to the blast of a factory whistle. Work was also separated into space as well as time as people went to a particular

place to work.8

Technology and new work arrangements have once again enabled an integration of work activities into every-

day life. Technologies have made it possible for employees to do their work in their own homes, on the road, or

at an alternative work space at times that accommodate home life and leisure activities.9 Paradoxically, however,

employees often want to create a sense of belonging within the space where they work. That is, they wish to create a

sense of “place,” which is a bounded domain in space that structures their experiences and interactions with objects

that they use and other people that they meet in their work “place.” People learn to identify with these “places,” or

locations in space, based on a personal sharing of experiences with others within the space. Over time, visitors to

the place associate it with a set of appropriate behaviors.10 Increasingly “places” are being constructed in space with

Web tools that encourage collaboration, allowing people to easily communicate on an ongoing basis, once again

changing the nature of where work is done.

The Information Systems Strategy Triangle, discussed in Chapter  1, suggests that changing information sys-

tems (IS) results in altered organizational characteristics. Significant changes in IS and the work environments in

which they function are bound to coincide with significant changes in the way that companies are structured and

how people experience work in their daily lives. Chapter 3 explores how information technology (IT) influences

organizational design. This chapter moves the focus to the way IT is changing the nature of work, the rise of new

work environments, and IT’s impact on different types of employees, where and when they do their work, and how

they collaborate. This chapter looks at how IT enables and facilitates a shift toward collaborative and virtual work.

The terms IS and IT are used interchangeably in this chapter, and only basic details are provided on technologies used. The point of this chapter is to look at the impact of IT on the way work is done by individuals and teams.

This chapter should help managers understand the challenges in designing technology‐intensive work and develop

a sense of how to address these challenges and overcome resistance to IT in our rapidly changing world.

3 Gensler, Dialog 22, http://www.gensler.com/uploads/documents/Dialogue‐22.pdf (accessed August 25, 2015). 4 http://www.forbes.com/sites/jeannemeister/2013/04/01/flexible‐workspaces‐another‐workplace‐perk‐or‐a‐must‐have‐to‐attract‐top‐talent/. 5 http://csr.cisco.com/casestudy/flexible‐work (accessed May 30, 2015). 6 “Smashing the Clock,” Bloomberg News (December 10, 2006), http://www.bloomberg.com/bw/stories/2006‐12‐10/smashing‐the‐clock (accessed May 29, 2015). 7 The IRS is one example of these U.S. government programs. For more information, see http://www.irs.gov/irm/part6/irm_06‐800‐002.html (accessed

May 29, 2015). 8 S. Barley and G. Kunda, “Bringing Work Back In,” Organizational Science 12, no. 1 (2001), 76–95. 9 S. Harrison and P. Dourish, “Re‐Place‐ing Space: The Roles of Place and Space in Collaborative Systems,” Proceedings of the 1996 ACM Conference

on Computer Supported Cooperative Work (1996), 67–76. 10 C. Saunders, A. F. Rutkowski, M. Genuchten, D. Vogel, and J. M. Orrega, “Virtual Space and Place: Theory and Test,” MIS Quarterly 35, no. 4 (2011), 1079–98.

c04.indd 76 11/26/2015 7:16:44 PM

77Work Design Framework

Work Design Framework As the place and time of work becomes less distinguishable from other aspects of people’s lives, the concept of

“jobs” is changing and being replaced by the concept of work. Prior to the Industrial Revolution, a job meant a

discrete task of a short duration with a clear beginning and end.11 By the mid‐20th century, the concept of job

had evolved into an ongoing, often unending stream of meaningful activities that allowed the worker to fulfill a

distinct role. More recently, organizations are moving away from organization structures built around particular

jobs to a setting in which a person’s work is defined in terms of what needs to be done.12 In many organizations,

it is no longer appropriate for people to establish their turfs and narrowly define their jobs to address only specific

functions. Yet, as jobs “disappear,” IT can enable employees to better perform their roles in tomorrow’s workplace;

that is, IT can help employees function and collaborate in accomplishing work that more broadly encompasses all

the tasks that need to be done.

In this chapter, a simple framework is used to assess how emerging technologies may affect work. As is suggested

by the Information Systems Strategy Triangle (in Chapter 1), this framework links the organizational strategy with

IS decisions. This framework is useful in designing characteristics of work by asking key questions and helping

identify where IS can affect how the work is done.

Consider the following questions:

• What work will be performed? Understanding what tasks are needed to complete the process being done by the employee requires an assessment of specific desired outcomes, inputs, and transformation needed to

turn inputs into outcomes. Many types of work are based upon recurring operations such as those found in

manufacturing plants or service industries. The value chain helps in understanding the workflow for key tasks

that are performed (i.e., purchasing, materials handling, manufacturing, customer service, repair). Increas-

ingly, much work is done at a keyboard and involves managing knowledge, information, or data. Each type

of work has a unique set of characteristics and tasks that needs to be supported by information technology.

• Who is going to do the work? Sometimes the work can be automated. However, if a person is going to do the work, who should that person be? What skills are needed? From what part of the organization should that

person come? If a team is going to do the work, many of these same questions need to be asked. However, they

are asked within the context of the team: Who should be on the team? What skills do the team members need?

What parts of the organization need to be represented by the team? Will the team members be dispersed?

• Where will the work be performed? With the increasing availability of networks, Web tools, apps, mobile devices, cloud‐based computing, and the Internet in general, managers can now design work for employees

who come to the office or who work remotely. Does the work need to be performed locally at a company

office? Can it be done remotely at home? On the road?

• When will the work be performed? Traditionally, work was done during “normal business hours,” which meant 9 a.m. to 5 p.m. In many parts of the world, a job between the hours of 9 and 5 is an anomaly. Tech-

nologies also make it easier to work whenever necessary. The reality of modern technologies is that they

often tether employees to a schedule of 24 hours a day, seven days a week (24/7) when they are always

accessible to calls or other communications through their mobile devices.

• How can the acceptance of IT‐induced change be increased? In this text, the overarching questions are how to leverage IT to help improve work and how to keep IT from inhibiting work. Sometimes this means

automating certain tasks. For example, computers are much better at keeping track of inventory, calculating

compensation, and many other repetitious tasks that are opportunities for human error. On the other hand,

technologies provide increasing support for tasks at which humans excel, such as decision making, com-

munication, and collaboration tasks among employees. Using a structured change management approach to

manage IT‐induced change will increase the probability of success.

11 William Bridges, JobShift: How to Prosper in a Workplace without Jobs (New York: Addison‐Wesley, 1995). 12 Ibid.

c04.indd 77 11/26/2015 7:16:44 PM

78 Digital Systems and the Design of Work

Figure 4.1 shows how these questions can be used in a framework to incorporate technologies into the design of

work. Although it is outside the scope of this chapter to discuss the current research on either work or job design,

you are encouraged to read these rich literatures.

How Information Technology Changes the Nature of Work Advances in IT provide an expanding set of tools that make individual employees more productive and broaden

their capabilities. They transform the way work is performed—and the nature of the work itself. This section exam-

ines three ways in which new IT alters employee life: by creating new types of work, by enabling new ways to do

traditional work, and by supporting new ways to manage people.

Creating New Types of Work

IT often leads to the creation of new jobs or redefines existing ones. The high‐tech field has emerged in its entirety

over the past 60 years and has created a wide range of positions in the IT sector, such as programmers, analysts,

managers, hardware assemblers, Web site designers, software sales personnel, social media specialists, and consul-

tants. A study based on the Bureau of Labor statistics places the number of IT employees in the United States at an

all‐time high of 4.9 million.13 Even within traditional non‐IT organizations, the growing reliance on IS creates new

types of jobs, such as data scientists who mine for insights in the company’s data, community managers who man-

age the firm’s online communities, and communications managers who manage the use of communication technol-

ogies for the business. IS departments also employ individuals who help create and manage the technologies, such

WHAT:

What work will be

performed?

(e.g., operations,

sales,

management)

HOW:

How can acceptance of IT-induced

change be increased?

(e.g., unfreeze-change-refreeze,

Kotter’s 8 steps to managing

change, technology

acceptance model)

WHO:

Who is going to do the

work?

(e.g., individuals,

groups)

WHERE:

Where will the work be

performed?

(e.g., at the office,

at home,

on the road)

WHEN:

When will the work be

performed?

(e.g., 9–5, 24/7,

flexible scheduling)

FIGURE 4.1 Framework for work design.

13 TechServe Alliance, “IT Employment Grows Modestly in April,” http://www.techservealliance.org/pressroom/documents/Press_Release_May2015_

MBR.pdf (accessed May 30, 2015).

c04.indd 78 11/26/2015 7:16:44 PM

79How Information Technology Changes the Nature of Work

as systems analysts, database administrators, network administrators, and network security advisors. The Internet

has given rise to many other types of jobs, such as Web masters and site designers. Virtually every department in

every business has someone who “knows the information systems” as part of her or his job.

New Ways to Do Traditional Work

Changing the Way Work Is Done

IT has changed the way work is done. Many traditional jobs are now done by computers. For example, computers

can check spelling in documents, whereas traditionally that was the job of an editor or writer. Jobs once done by art

and skill are often greatly changed by the introduction of IT. Workers at one time needed an understanding of not

only what to do but also how to do it; now their main task often is to make sure the computer is working because the

computer does the task for them. Sadly, many cashiers no longer seem to be able to add, subtract, or take discounts

because they have grown up letting the computer in their point‐of‐sale (POS) terminal do the calculations for them.

Workers once were familiar with others in their organization because they passed work to them; now they may

never know those co‐employees because the IT routes the work. In sum, the introduction of IT into an organization

can greatly change the day‐to‐day tasks performed by its employees.

In her landmark research, Shoshana Zuboff describes a paper mill in which papermakers’ jobs were radically

changed with the introduction of computers.14 The papermakers mixed big vats of paper and knew when the paper

was ready by the smell, consistency, and other subjective attributes of the mixture. For example, one employee

could judge the amount of chlorine in the mixture by sniffing and squeezing the pulp. They were masters at their

craft, but they were not able to explicitly describe to anyone else exactly what was done to make paper. An appren-

ticeship was needed to train new generations of masters, and the process of learning how to smell and squeeze the

paper pulp was arduous. The company, in an effort to increase productivity in the papermaking process, installed

an information and control system. Instead of the employees looking at and personally testing the vats of paper,

the system continuously tested parameters and displayed the results on a panel located in the control room. The

papermakers sat in the control room, reading the numbers, and making decisions on how to make the paper.

Many found it much more difficult, if not impossible, to make the same quality paper when watching the control

panel instead of personally testing, smelling, and looking at the vats. The introduction of the information system

resulted in the need for different skills to make paper. Abstracting the entire process and displaying the results

on electronic readouts required skills to interpret the measurements, conditions, and data generated by the new

computer system.

In another example, sales and delivery people at a snack company have portable devices that not only keep

track of inventory but also help them in the selling function. Prior to the information system, the salespeople used

manual processes to keep track of inventory in their trucks. When visiting customers, it was possible only to tell

them what was missing from their shelves and to replenish any stock they wanted. With IT, the salespeople have

become more like marketing and sales consultants, helping the customers with models and data of previous sales,

floor layouts, and replenishment as well as forecasting demand based on analysis of the data histories stored in the

IS. The salespeople need to do more than be persuasive. They now must also do data analysis and floor plan design

in addition to using the computer. Thus, the skills needed by the salespeople as well as the workflow, have greatly

changed with the introduction of IT.

One of the biggest changes in workflow has been in the area of data entry. In the past, the workflow included

capturing the data, keying it into the system, rekeying it to check its accuracy, and then processing it. The workflow

has now changed to capture the data directly when it is entered by the user in a variety of ways such as from the

Web, with a GPS signal, or by reading the RFID code. A program may check its accuracy when it is captured and

then process it. Companies are moving way from entering sales data at all; customers enter it for them when they

place an order. As data entry tasks are eliminated, the steps in the workflow are drastically reduced, and the process

is much faster.

14 Shoshana Zuboff, In the Age of the Smart Machine: The Future of Work and Power (New York: Basic Books, 1988), 211.

c04.indd 79 11/26/2015 7:16:44 PM

80 Digital Systems and the Design of Work

A study by Frey and Osborn examined 702 occupations and noted that 47% of total U.S. employment is at

high risk of being automated in the next few years. Least likely to be automated are those jobs with nonroutine

tasks involving complex perception and manipulation as well as creative and social intelligence.15 Even knowledge

employees, who once felt safe in their jobs because of the high degree of analysis and diagnosis they performed,

are at risk of automation as analytics and cognitive intelligence systems become increasingly more accurate in their

predictions and diagnoses.

The Internet enables changes in many types of work. For example, within minutes, financial analysts can down-

load an annual report from a corporate Web site to their smartphones and check what others have said about the

company’s growth prospects on social networks. Librarians can check the holdings of other libraries online and

request that particular volumes be routed to their own clients or download the articles from a growing number of

databases. Marketing professionals can pretest the reactions of consumers to potential products in virtual worlds.

Technical support agents diagnose and resolve problems on remote client computers using the Internet. The cost

and time required to access information has plummeted, increasing personal productivity and giving employees

new tools. It is hard to imagine a job today that doesn’t have a significant information systems component.

For those tasks that must be done by people, companies can use information technology to find willing employees

at what may seem like bargain rates. Amazon’s Mechanical Turk has created a marketplace site on which an orga-

nization can post tasks at specified rates. Willing employees can use this site to find those tasks. For example, a

company posted that it wanted employees to enter data from photos of cash register receipts. Another company

posted a task offer of transcribing a 25‐second audiotape. Many of these task offers involve very small amounts,

often $.05 to $.25. Some tasks take a significant portion of an hour and pay up to $5 or more. Some of the employees

do very brief tasks at low pay so they can gain higher status and qualify for higher‐paying tasks. Although this isn’t

automating a task inside an organization, from the manager’s perspective, it’s another way to use IT to change the

work done by the employees of the organization.

Changing Communication Patterns

All one has to do is observe people walking down a busy downtown street or a college campus to note changes in

communication patterns over a period as short as the last decade. Some people are talking on their cell phones, but

even more are texting or using apps for all kinds of reasons, such as checking out game scores, specials at nearby

restaurants, or movie times. Or observe what happens when a plane lands. It seems that over half the people on

the plane whip out their portable devices or cell phones as soon as the plane touches down. They are busy making

arrangements to meet the people who are picking them up at the airport or checking to see the calls or e‐mails they

missed while in flight. Finally, consider meeting a friend at a busy subway station in Hong Kong. It is virtually

impossible without the aid of a cell phone to locate each other. Some may say that we are addicted to our mobile

technologies, unable to put them away even when driving or walking, unfortunately sometimes leading to dan-

gerous behaviors.

Applications (Apps) such as iMessage, Skype, Twitter, and Sina Weibo (Chinese Twitter) have changed how

people communicate. Traditionally, people found each other in person to have a conversation in the moment. With

the telephone, people called each other and both parties had to participate at the same time to have a conversation.

Along came e‐mail, which rapidly became the communication technology of choice because it eliminated the need

for those involved in the conversation to participate at the same time. Today, people have an array of communica-

tions technologies, and, once again, IT is changing communication patterns. Some rely on texting, others on video

conferences, such as Facetime or Skype, and still others on social networks such as Facebook or Renren, for their

primary communications channel. The challenge created by the large number of choices is that individuals now

must have a presence on numerous platforms to ensure that they can be contacted. Further, one must know how

not only to contact someone but also to recognize that the person’s preferred medium might change during the day,

week, or month. For example, during normal business hours, an employee might prefer to receive e‐mail or a phone

call. But after hours, he or she might prefer a text, and late at night, while surfing the Web, may prefer a message on

15 C. B. Frey and M. Osborn, “The Future of Employment: How Susceptible Are Jobs to Computerisation?” (September 17, 2013), http://www.oxfordmartin.

ox.ac.uk/downloads/academic/The_Future_of_Employment.pdf (accessed August 25, 2015).

c04.indd 80 11/26/2015 7:16:44 PM

81How Information Technology Changes the Nature of Work

Facebook Messenger or Skype. Without knowledge of the recipients’ preferences for how to receive the message,

the sender is likely to be unsuccessful in communicating with the recipients over the proper channel. A sender who

doesn’t know which medium the recipient prefers might use one medium (e.g., e‐mail) to see whether the recipient

is open to using another medium (e.g., phone).

Similarly, IT is changing the communication patterns of employees. There are still some employees who do not

need to communicate with others for the bulk of their workday. For example, many truck drivers do not interact

with others in their organization while driving to their destination. But there are other ways communication tech-

nologies have changed the work done by truck drivers. Consider the example of a Walmart driver who picks up

goods dropped off by manufacturers at the Walmart distribution center and then delivers them in small batches to

one or more Walmart stores. Walmart has provided its drivers with radios and satellite systems so that, on short

notice, on their way back to the distribution center to load up for the next delivery, they can opportunistically pick

up goods from manufacturers and take them to the distribution center. In this way, the company saves the delivery

charges from that manufacturer and conserves energy in the process. Walmart office staff and drivers therefore use

IT to save money by enhancing their communications with suppliers.16

Many changes in communication have been supported, if not propelled, by IT. Some communication technol-

ogies, such as social networking and microblogs, are rather new and unfamiliar, motivating managers in many orga-

nizations to understand how to apply them to work‐related applications in a way that adds value to their business.

These and other communication tools help make large companies feel smaller by bringing together employees

from geographic disparate locations and from a variety of divisions and levels in the organization. Large companies

can feel smaller because communications technology enables individuals to find each other despite the organiza-

tion’s size. These tools also help small companies feel like large companies because, to some degree, they level the

playing field in the ways companies communicate and collaborate. Thomas Friedman, the author of the popular

The World Is Flat and other books, argues that collaboration is the way that small companies can “act big” and flourish in today’s flat world. The key to success is for such companies “to take advantage of all the new tools for

collaboration to reach farther, faster, wider and deeper.”17 For example, any company can have a Facebook page or

a Twitter feed, making it difficult to distinguish between small and large organizations simply by interacting over

these technologies.

Changing Organizational Decision Making and Information Processing

IT changes not only organizational decision‐making processes but also the information used in making those

decisions. Data processed to create more accurate and timely information are being captured earlier in a process.

Analytics (see Chapter 12) have made it possible to mine data stores and identify insights, make predictions, and

even suggest decisions. Through information technologies, information that employees need to do their job can be

pushed to them in real time or saved and made available when they need it.

IT can change the amount and type of information available to employees. For example, salespeople can use

technology to get quick answers to customer questions. Further, IT‐based tools allow salespeople to search for

best practices on a marketing topic over a social network and to benefit from blogs and wikis written by informed

employees in their company. Organizations now maintain large comprehensive business databases, called data warehouses, that can be mined by using tools to analyze patterns, trends, and relationships. We discuss data management in Chapter 12.

Modern devices with voice interfaces have assistants that further change decision‐making processes. Apps such

as Siri, Cortana, and Google‐Now allow users to talk to their devices, often mobile ones, to access information from

either their devices or the Internet. These types of interfaces are increasingly being built into enterprise systems to

supplement ways employees gather information, increasing employee efficiency.

In their classic 1958 Harvard Business Review article, Leavitt and Whisler boldly predicted that IT would shrink the ranks of middle management by the 1980s.18 Because of IT, top‐level executives would have access

16 Thomas L. Friedman, The World is Flat (New York: Farrar, Straus and Giroux, 2005), 145. 17 Ibid. 18 Harold Leavitt and Thomas Whisler, “Management in the 1980s,” Harvard Business Review (November–December 1958), 41–48.

c04.indd 81 11/26/2015 7:16:44 PM

82 Digital Systems and the Design of Work

to information and decision‐making tools and models that would allow them to easily assume tasks previously

performed by middle managers. Other tasks clearly in the typical job description of middle managers at the time

would become so routinized and programmed because of IT that lower‐level managers could perform them. As

Leavitt and Whisler predicted, the 1980s saw a shrinking in the ranks of middle managers. This trend was partly

attributable to widespread corporate downsizing, which forced many organizations to find alternatives to getting

the work done and IT solutions to proliferate to fill the gap. However, it was also attributable to changes in decision

making induced by IT. Since the 1980s, IT has become an even more commonly employed tool of executive

decision makers. IT has increased the flow of information to them and provided tools for filtering and analyzing

the information.

Changing Collaboration

IT helps make work more team oriented and collaborative. Technologies such as texting (SMS), instant messaging

(IM), Web logs (blogs), virtual worlds, groupware, wikis, social networking, and video teleconferencing are at the

heart of collaboration today. Groups can form and share documents with less effort using these platforms. Group

members can seek or provide information from or to each other much more easily than ever before. And groups can

connect by voice or with voice and video using these platforms.

Collaboration takes place in one of four ways. Teams are collocated and work together at the same time, they are

collocated but work at different times, they are not located in the same place but work at the same time, or they work

from different places at different times. Figure 4.2 summarizes these options and lists representative technologies

that facilitate collaboration for each type of team.

Consider the New York‐based marketing firm CoActive Digital whose president decided to implement a wiki to

have a common place where 25 to 30 people could go to share a variety of documents ranging from large files to

meeting notes and PowerPoint presentations.19 An added benefit was that the wiki was encrypted, protected, and

could be used only with a virtual private network (VPN). The president recognized that the challenge for imple-

menting the wiki would be to change a culture in which e‐mail had long been the staple for communication. Conse-

quently, he decided to work closely with the leader of the business development group. This group handles inquiries

from customers and coordinates the work (i.e., marketing campaigns) internally. The group needed to hold many

meetings and share much work. He populated the wiki site with the documents that had formerly been traded over

e‐mail and asked the leader to encourage her group members to use the wikis. It took some effort, but eventually the

group learned to appreciate the benefits of the wiki for collaboration and to reduce members’ dependence on e‐mail.

Verifone’s company culture is one that encourages information sharing. A story is told of a new salesperson who

was trying to close a particularly big deal. He was about to get a customer signature on the contract when he was

asked about the competition’s system. Being new to the company, he did not have an answer, but he knew he could

FIGURE 4.2 Collaboration technologies matrix: Examples of key enabling technologies. Source: Adapted from Geraldine DeSanctis and R. Brent Gallupe, “A Foundation for the Study of Group Decision Support Systems,” Management Science 33, no. 5 (May 1987), 589–609.

Team Works at the Same Time Team Works at Different Time

Team Works in the Same Place Face‐to‐face meetings

Meeting room technologies

Document sharing systems (wikis)

Electronic bulletin boards

Document sharing systems (wikis)

Team Works in Different Places Video conferencing

Chat rooms

Texting (SMS) and instant messaging (IM)

Document sharing systems (wikis)

E‐mail

Microblogs (e.g., Twitter)

Texting (SMS) and instant messaging (IM)

Document sharing systems (wikis)

19 C. G. Lynch, “How a Marketing Firm Implemented an Enterprise Wiki,” http://www.cio.com/article/print/413063 (accessed July 9, 2008).

c04.indd 82 11/26/2015 7:16:44 PM

83How Information Technology Changes the Nature of Work

count on the company’s information network for help. He asked his customer for 24 hours to research the answer.

He then sent an e‐mail to everyone in the company asking the questions posed by the customer. The next morning,

he had several responses from others around the company. He went to his client with the answers and closed the

deal. What is interesting about this example is that others around the world treated the “new guy” as a colleague

even though they did not know him personally. He was also able to collaborate with them instantaneously. It was

standard procedure, not panic time, because of the culture of collaboration in this company. With increased use of

social networks and other social tools, instantaneous collaboration is commonplace.20

The Internet has greatly enhanced collaboration. Beyond sharing and conversing, teams can also use the Web

to create something together. An example of this is Wikipedia on which individuals who do not know each other

contribute to the information on a topic. At computer company Dell, a Web‐based site named IdeaStorm has

been used since 2008 for idea generation, discussion, and prioritization between and among individuals in the

Dell community, including staff, executives, customers, and potential customers. Recent statistics show that over

23,000 ideas have been submitted, over 747,000 votes for ideas have been recorded, and over 100,000 comments

have been posted about the ideas suggested. Dell’s management has implemented over 500 of the ideas. Ideas

can range from small incremental improvements such as adding a port to an existing product to large sweeping

changes such as creating a new product line. Some ideas, such as how to change the retail experience or support

activities, are process oriented. Some ideas are about education, the environment, and other topics related to Dell’s

business. The company has since implemented an internal version of this system, Employee Storm, only open to

internal staff. Employee Storm invites ideas on company benefits, innovations, ways to work better, and other

company‐focused issues. Many other companies have implemented similar platforms, including IBM’s Think-

Place, BestBuy’s BlueShirt Nation, and ESPN’s SportsNation.

Changing the Ways to Connect

Probably one of the biggest changes that people are experiencing as a result of new technologies is that they are

always connected. In fact, many feel tethered to their mobile phones, tablets, or laptops to such a large extent that

they must be available at all times so that they can respond to requests from their supervisors, colleagues, or cus-

tomers. As a result, the boundaries between work and play have become blurred, now causing people to struggle

even more with work–life balance.

Businesses are still trying to understand the technological advances that have become commonplace. Many in

the workforce find that their technology at home differs from that at work and prefer those at home. For example,

while although many use social media tools on their tablets, laptops, or smartphones during the weekend at home,

on Monday morning, they find themselves working on an older desktop system with slow access to the files and

Web‐based systems they want to use for their work.21 They find this quite bothersome. In fact, a Cisco Systems

survey of young professionals and college students found that one in three believes the Internet is as important as

air, water, food, and shelter. Two people in five say they would accept a lower‐paying job that had more flexibility

with regard to device choice, social media access, and mobility over a higher‐paying job with less flexibility.22 In

commenting on the survey findings, Marie Hattar, vice president, Enterprise Marketing, Cisco, stated:

The results of the Cisco Connected World Technology Report should make businesses re‐examine how they need to

evolve in order to attract talent and shape their business models. Without a doubt, our world is changing to be much

more Internet‐focused, and becomes even more so with each new generation.

CIOs need to plan and scale their networks now to address the security and mobility demands that the next generation

workforce will put on their infrastructure, and they need to do this in conjunction with a proper assessment of corporate

policies.23

20 Hossam Galal, Donna Stoddard, Richard Nolan, and Jon Kao, “VeriFone: The Transaction Automation Company,” Harvard Business School Case

Study 195–088, July 1994. 21 Cognizant, “The Future of Work Has Arrived: Time to Re‐Focus IT” (February 2011), 1–15, http://www.cognizant.com/SiteDocuments/CBC_FoW_

Time_to_Refocus_IT.pdf (accessed August 25, 2015). 22 Cisco Connected World Technology Report, 2011 Findings, http://www.cisco.com/en/US/netsol/ns1120/index.html#~2011 (accessed August 25, 2015). 23 “Air, Food, Water, Internet—Cisco Study Reveals Just How Important Internet and Networks Have Become as Fundamental Resources in Daily Life,”

http://newsroom.cisco.com/press‐release‐content?type=webcontent&articleId=474852 (accessed August 25, 2015).

c04.indd 83 11/26/2015 7:16:44 PM

84 Digital Systems and the Design of Work

Consider IBM ’ s SmallBlue—an opt‐in social network analysis tool that maps the knowledge and the connec-

tions of IBM employees. SmallBlue can be used to fi nd employees with specifi c knowledge or skills, display

employee networks on particular topics, validate a person ’ s expertise based on her or his corporate profi le, and

display a visualization of an employees ’ personal social networks. IBM claims that SmallBlue has promoted inno-

vation, effectiveness, and effi ciency. 24

The preceding examples show how technologies have become a key component in the design of work. IT has

greatly changed day‐to‐day tasks, which in turn has changed the skills needed by employees. The examples show

how adding IT to a work environment can change the way that work is done.

New Ways to Manage People

New working arrangements create new challenges in how employees are supervised, evaluated, compensated, and

even hired. When most work was performed individually in a central location, supervision and evaluation were

relatively easy. A manager could directly observe the employee who spent much of his or her day in an offi ce. It

was fairly simple to determine whether or not the employee was present and productive.

Modern organizations often face the challenge of managing a workforce that is spread across the world in iso-

lation from direct supervision and working mostly in teams. Sales work is one area in which we see this. Rather

than working in a central offi ce, external salespeople work remotely, relying on laptop computers, smart phones,

the Web and apps linking them to customers, offi ce colleagues, sales support information, and other databases.

The technical complexity of some products, such as enterprise software, necessitates a team‐based sales approach

combining the expertise of many individuals, and technologies connect the team together.

Modern organizations must also choose among three types of formal controls to ensure that work is done

properly. 25 Behavior controls involve direct monitoring and supervision of employee actions while the work is being done. Vivid depictions of behavior controls are provided in road construction projects that have one employee dig-

ging and another watching, motionless with arms folded. On the other hand, outcome controls involve examining work outcomes rather than work actions. Finally, personnel controls represent a proper fi t between the person and the job, often involving picking the right person for the task.

Social Business Lens: Activity Streams

An activity stream is a list of activities on a Web site that briefl y highlight what the individuals connected to that

stream are doing. Activity streams can include posts by individuals who share what they are doing or thinking and

posts directly by other programs, which deposit an update about what an individual is doing. By collecting all of

these posts in a single feed, the activity stream gives a reader a good sense of what is happening in a community.

Examples of activity streams are Facebook ’ s news feed and Salesforce.com ’ s Chatter. Companies that incor-

porate activity streams in their social business platform report that teams using that technology had fewer face‐to‐

face meetings, reduced e‐mail, faster information fl ows, better collaboration, and increased responsiveness. An

activity stream can keep staff updated on the happenings around an organization. For example, SAS , the interna-

tional statistics and analytics software company, implemented an activity stream for its employees. Staff were able

to keep track of what others were working on over an activity stream that mimicked the news feed that Facebook

users see on their home page. Staff could share, comment on, or “like” pages and documents they found in their

systems or on the Web and those entries would show up in the activity stream.

Source: David F. Carr , “ SAS Creates Internal Facebook with Socialcast ” (April 29, 2011 ), http://www.informationweek.com/ thebrainyard/news/social_networking_private_platforms/229402527/sas‐institute‐creates‐internal‐facebook‐with‐socialcast (accessed on April 5, 2012) .

24 For additional information on SmallBlue, see http://www.watson.ibm.com/cambridge/Projects/project8.shtml (accessed May 31, 2015). 25 L. J. Kirsch , “ Portfolios of Control Modes and IS Project Management ,” Information Systems Research 8 , no. 3 ( 1997 ), 215 – 239 ; W. G. Ouchi , “ The Transmission of Control through Organizational Hierarchy ,” Academy of Management Journal 21 , no. 2 ( 1978 ), 173 – 92 ; K. A. Merchant , Modern Management Control Systems, Text and Cases ( Upper Saddle River, NJ : Prentice‐Hall , 1998 ).

c04.indd 84 11/26/2015 7:16:45 PM

85How Information Technology Changes the Nature of Work

It is important for a firm to choose the right type of control for each position being supervised. Behavior controls

make the most sense for physical labor in which incorrect particular body movements might be inefficient or even

dangerous. Programmers would consider it quite insulting to have a supervisor exercise action control and watch

every keystroke whereas transcriptionists might understand the need to track each keystroke. Outcome controls

make more sense not only for programmers but also for many other personnel, such as engineers, sales managers,

and ad writers. However, personnel controls are more useful when it would take several years to evaluate the results

of work, which is often the case when goals are indefinable, conflicting, or confusing and the stakes are high. For

instance, when Apple was having difficulty defining a meaningful product line in the mid‐1990s, the firm resorted

to personnel controls when it determined that the right way to redefine its mission was to bring back Steve Jobs.

After two decades, hindsight shows that Jobs was the right choice. Personnel controls are useful for situations in

which it is difficult not only when to expect results but also to define what results should even be expected. When the results of work are fairly well defined, technology can change dramatically how it is monitored. One

technological solution, electronic employee monitoring (introduced in Chapter 3), can replace direct supervision

and provide detailed behavior controls, automatically logging keystrokes, listing the Web sites visited, or even

recording the contents of an employee’s screen. Technology can also provide outcome controls by tracking the

number of calls processed, e‐mail messages sent, or time spent surfing the Web. When output is monitored digi-

tally, pay‐for‐performance compensation strategies reward employees for deliverables produced or targets met as

opposed to vague subjective factors such as “attitude” or “teamwork.” Further, supervisors can spend time coaching,

motivating, and planning rather than personally monitoring performance because they can utilize the information

gathered from electronic monitoring systems for that task. The introduction of BlueWork at American Express illus-

trates the need to change from an approach in which managers watch employees and count the hours they spend at

their desks to one that focuses instead on the work they actually do. These changes are summarized in Figure 4.3.

IT has also impacted the way employees are hired, becoming an essential part of that process for many firms.

Open positions are posted on job Web sites, and applicants submit resumes over the Web, complete applications on

line, and refer potential employers to their personal Web sites. When researching candidates, companies often look

at their Facebook pages and do online searches of the candidates to see what pops up. Social networking provides

a forum for informal introductions and casual conversations in cyberspace. Interviews can be arranged in virtual

worlds or via teleconferencing to reduce travel costs. A face‐to‐face interview is usually eventually required, but

recruiters can significantly and more effectively filter the applicant pool, reducing the number of expensive site visits.

In addition, companies increasingly realize that hiring is changing and that recruiting efforts should reflect

the new approaches people are using to look for jobs. Tech‐savvy job applicants are now using business‐oriented

social networks such as LinkedIn to seek contacts for jobs and online job search engines like Monster.com and

CareerBuilder.com to find job listings. A Facebook app, BeKnown, provides a profile detailing an individual’s work

experience, a news feed for contact updates and actions, a search tool to locate people and connect with them, and

FIGURE 4.3 Changes to supervision, evaluations, compensation, and hiring.

Traditional Approach: Subjective Observation Digital Approach: Objective Assessment

Supervision It is personal and informal. Manager is usually present or relies on others to ensure that the employee is present and productive.

It is electronic or assessed by deliverables. As long as the employee is producing value, he or she does not need direct formal supervision.

Evaluation Behavior controls are predominant. Focus is on process through direct observation. Manager sees how employee performs at work. Subjective (personal) factors are very important.

Outcome controls are predominant. Focus is on output by deliverable (e.g., produce a report by a certain date) or by target (e.g., meet a sales quota). Fewer subjective measures are used.

Compensation and Rewards

It is often individually based. It is often team based or contractually spelled out.

Hiring Hiring is done through meetings with HR personnel with little concern for computer skills.

It is often electronic with recruiting Web sites and electronic testing for more information‐based work that requires a higher level of IT skills.

c04.indd 85 11/26/2015 7:16:45 PM

86 Digital Systems and the Design of Work

a way to recommend other users or display badges earned for completing certain professional goals. The app also

is integrated with Monster.com’s job listings.26

Furthermore, the way an organization uses IT affects the array of technical and nontechnical skills needed in

its employees. For example many basic clerical tasks can be performed expeditiously with IT, so fewer employees

with those basic skills are required, making room for those with more targeted skills. Just to be sure employees are

IT savvy, too, the actual hiring process may require applicants to complete an assessment or perform other activities

online. In this way, hiring managers can raise the overall IT competency exhibited by employees in their businesses.

Employees who cannot keep pace with IT are increasingly unemployable.

The design of the work needed by an organization is a function of the skill mix required for its work processes

and of the flow of those processes themselves. Thus, a company that infuses technology effectively and employs

a workforce with a high level of IT skills designs itself differently from a company that does not. The skill mix

required by an IT‐savvy firm reflects a high capacity for using the technology itself. For example, because many

clerical skills are now embedded in the technologies staff use, fewer clerical staff are needed and those who are

hired by the company often do specialized work that is not easily automated or subsumed by technology.

As workforce demographics shift, so do the IT needs and opportunities to change work. Digital natives—people

who have grown up using computers, social networking sites, texting, and the Web as a normal, integrated part of

their daily lives—are finding new and innovative ways to do their work. There are widely varying impacts from

the skills these employees bring to their work, including how to do their work in a new, and often more efficient,

manner.

IT has drastically changed the landscape of work today. As a result of IT, many new jobs have been created. In

the next section, we examine how IT can change where work is done, when it is done, and who does it.

Where Work Is Done and Who Does It: Mobile and Virtual Work Arrangements This section examines another important effect of IT on work: the ability of some employees to work anywhere

at any time. With WiFi virtually ubiquitous, individual employees can connect to the Web from almost anywhere.

And with powerful technologies available in the consumer space, employees often find the tools and apps they

have at home function as well as, or even better than, their workplace technologies. Research also suggests that

employees—especially those younger employees who have never known a world without ubiquitous access to

personal smart devices and the Web—prefer to have the work–life flexibility that remote and mobile work arrange-

ments provide. At the group level, virtual teams have become standard operating mechanisms to bring the best

individuals available to work together on a task. We explore remote work from the perspective of both individuals

and teams in the next section.

Remote Work and Virtual Teams

Flexible work arrangements, although not the norm for many organizations, have been gaining support as

technologies enable employees to be “virtually present” for their employers. The terms telecommuting, mo- bile worker, and remote worker are often used to describe flexible work arrangements. Telecommuting, some- times called teleworking, refers to employees working from home, at a customer site, or from other convenient locations instead of coming into the corporate office. The word telecommute is derived from combining “tele- communications” with “commuting,” indicating that these employees use telecommunications instead of driving,

or commuting, to the office. Mobile workers are those who work from wherever they are. They are outfitted with the technology necessary for access to co‐workers, company computers, intranets, and other information

sources. We use the term remote workers when we refer to both telecommuters and mobile workers.

26 Kristin Burnham, “Monster.com Brings Professional Social Networking to Facebook,” CIO.com (July 15, 2011), http://blogs.cio.com/print/16406

(accessed February 2, 2012).

c04.indd 86 11/26/2015 7:16:45 PM

87Where Work Is Done and Who Does It: Mobile and Virtual Work Arrangements

Phase Preparation Launch Performance Management

Team Development

Disbanding

Key Activities Mission statement

Personnel selection

Task design

Rewards system

Technology selection and installment

Kick‐off meetings

Getting acquainted

Goal clarification

Norm development

Leadership

Communication

Conflict resolution

Task accomplishment

Motivation

Knowledge management

Norm enforcement and shaping

Assessment of needs/deficits

Individual and/or team training

Evaluation of training effects

Trust building

Recognition of achievements

Re‐integration of team members

Such employees work not only on a remotely independent basis but also with remote members on virtual teams.

Virtual teams are defined as two or more people who (1) work together interdependently with mutual accountability for achieving common goals, (2) do not work in either the same place and/or at the same time, and (3) must use

electronic communication and other digital technologies to communicate, coordinate their activities, and complete

their team’s tasks. Initially, virtual teams were seen as an alternative to conventional teams that meet face‐to‐face.

However, it is simplistic to view teams as either meeting totally face‐to‐face or totally virtually. Rather, teams may

reflect varying degrees of virtuality. Virtual team members may be in different locations, organizations, time zones,

or work shifts (day, evening, or overnight). Further, like most teams, virtual teams may have distinct, relatively

permanent membership, or they may be relatively fluid as they evolve to respond to changing task requirements and

as members leave and are replaced by new members.

Virtual teams are thought to have a life cycle like most teams.27 Their lifecycle, shown in Figure 4.4, is note-

worthy because it the important activities in team development: Teams are formed; their work is completed; and,

the team is disbanded.

Factors Driving Use of Remote Work and Virtual Teams

Remote working has been around since the 1970s, but it has steadily been gaining popularity since the late 1990s.

One poll of 11,300 employees in 22 countries found that one 1 of 6 telecommute worldwide.28 And as managers

move to build teams of the best talent available, they inevitably turn to virtual teams as the mechanism to bring

people together for a task. Several factors that drive these trends are shown in Figure 4.5.

The first factor is that work is increasingly knowledge based. The United States and many other world econ-

omies continue to shift from manufacturing to service industries. Equipped with the right IT, employees can create,

assimilate, and distribute knowledge as effectively from home as they can from an office. The shift to knowledge‐

based work thus tends to minimize the need for a particular locus of activity.

The second factor is that remote workers and virtual team members often shift the time of their work to accom-

modate their lifestyles. For instance, parents modify their work schedules to allow time to take their children to

school and attend extracurricular activities. Telecommuting provides an attractive alternative for parents who might

otherwise decide to take leaves of absence from work for child rearing. Telecommuting also enables people who are

housebound by illness, disability, or the lack of access to transportation to join the workforce.

FIGURE 4.4 Key activities in the life cycle of teams.

27 G. Hertel, S. Geister, and U. Konradt, “Managing Virtual Teams: A Review of Current Empirical Research,” Human Resource Management Review 15, no. 1 (2005), 69–95. 28 The actual statistics for the number of telecommuters is hard to find. These figures were obtained from Smart Planet, http://www.smartplanet.com/blog/

business‐brains/one‐sixth‐of‐the‐worlds‐employees‐now‐telecommute‐survey/21616 (accessed June 19, 2015).

Source: Adapted from Guido Hertel, Susanne Geister, and Udo Konradt, “Managing Virtual Teams: A Review of Current Empirical Research,” Human Resource Management Review 15, no. 1 (2005), 69–95.

c04.indd 87 11/26/2015 7:16:45 PM

88 Digital Systems and the Design of Work

Geographic Lens: How Do People Around the World Feel About Working Remotely?

A recent survey by Cisco found marked national differences about how professionals viewed their ability to be

productive when working remotely. On average, 39% of the 1,303 professionals in 13 countries surveyed answered

“yes” when asked whether it was necessary for them to be in the offi ce to make decisions more effectively and

effi ciently (i.e., nothing replaces daily in‐person interaction), but only 7% answered “yes” in India whereas 56%

and 57% answered “yes” in Japan and Germany, respectively. That is, a large percentage of people in Japan and

Germany thought they had to come into the physical offi ce to be productive. This wasn ’ t the case at all in India.

A very small percentage of Indians felt they had to be tethered to a desk in a physical offi ce. They could do their

work by staying connected to their workplaces through a variety of devices including their laptops, tablets, and

smartphones.

Source: “ The Cisco Connected World Report ” (October 2010), http://newsroom.cisco.com/dlls/2010/ekits/ccwr_final.pdf (accessed February 4, 2012).

FIGURE 4.5 Driving factors of remote work and virtual teams.

Driver Effect

Shift to knowledge‐based work Eliminates requirement that certain work be performed in a specifi c place

Changing demographics and lifestyle preferences Provides workers geographic and time‐shifting fl exibility

New technologies with enhanced bandwidth Makes remotely performed work practical and cost effective

Reliance on Web Provides employees the ability to stay connected to co‐workers and customers and to access work‐related apps, even on a 24/7 basis

Energy concerns Reduces the cost of commuting (for telecommuters), energy costs associated with real estate (for companies) and travel costs (for companies and for people on virtual teams)

Remote work also provides employees and virtual team members enormous geographic fl exibility. The freedom

to live where one wishes, even at a location remote from one ’ s corporate offi ce, can boost employee morale and

job satisfaction. As a workplace policy, it may also lead to improved employee retention. For example, American

Express employees use the BlueWork program as part of its recruiting pitch. Further, productivity and employee sat-

isfaction for those on the BlueWork program are markedly higher, and voluntary turnover is down. Many employees

can be more productive at home, and they actually work more hours than if they commuted to an offi ce. Further-

more, such impediments to productivity as traffi c delays, canceled fl ights, bad weather, and mild illnesses become

less signifi cant. Companies enjoy this benefi t, too. Those who build in remote work as a standard work practice are

able to hire employees from a much larger talent pool than those companies that require geographical presence.

The third driving factor is that the new technologies, which make work in remote locations viable, are becoming

better, cheaper, and more widely available. Telecommunication and PC speeds are increasing exponentially at

the same time that their costs are plummeting. The oft‐cited time frame involved in this progression is a doubling

of computer capabilities (such as speed) every 18 months. 29 The drastic increase in capabilities of portable tech-

nologies makes small devices more powerful than the computers of yesterday, enabling effective and productive

mobile work. Applications also provide integration between applications. Virtual team members can use Skype,

Webex, Zoom, or any number of video and audio conferencing technologies to work together. Cloud computing

also has contributed to this trend because applications are moved from computers housed in company data centers

to Web‐based hosts such as Amazon Web Services (AWS), Rackspace, and other service providers.

29 Gordon Moore, head of Intel, observed that the capacity of microprocessors doubled roughly every 12 to 18 months. Even though this observation was

made in 1965, it still holds true. Eventually, it became known in the industry as Moore ’ s law.

c04.indd 88 11/26/2015 7:16:45 PM

89Where Work Is Done and Who Does It: Mobile and Virtual Work Arrangements

A fourth driving factor is the increasing reliance on Web‐based technologies by all generations, especially

younger generations, such as Generation Y and the Millennials. The younger generations are at ease with Web‐

based social relationships and are adept at using social networking tools to grow these relationships. Face‐to‐face

work arrangements are not necessary for these employees to build productive connections. Web‐based tools allow

them to stay connected with their co‐workers and customers. Further, as more and more organizations turn to

fl exible working hours in programs such as BlueWork implemented by American Express and as 24/7 becomes

the norm in terms of service, the Web becomes the standard platform to allow employees to respond to work ’ s

increasing demands.

A fi fth factor is the increasing emphasis on energy conservation. As concerns about greenhouse gasses, carbon

footprints, and even potential future gasoline price increases, employees are looking for ways to be more respon-

sible and frugal at the same time. Telecommuting is quite appealing in such a scenario, especially when public

transportation is not readily available. Companies can also experience lower energy usage and costs from telecom-

muting. SAP reduced its global greenhouse footprint by encouraging employees to shift their commuting behavior.

As a result of these ongoing efforts, emissions from employees ’ commutes dropped. In addition to telecommuting

and encouraging the use of mass transit and carpooling, SAP also began providing employees information on their

carbon footprint from commuting through a new internal dashboard aimed at ensuring greater transparency and

accountability. 30

Many employees no longer need to be tied to offi cial desks. Thus, the real estate needs of their employers are

shrinking, and companies are saving costs by reducing the offi ce space they own or rent. This reduction lowers

their energy needs by no longer needing to heat, cool, or maintain these spaces. Companies are realizing that they

can comply with the Clean Air Act and be praised for their “green computing” practices at the same time they are

reaping considerable cost savings.

Advantages and Disadvantages of Remote Work

There are clearly advantages to remote work. Employees have greater fl exibility in where they work. They can

work from home or from just about any location as long as they have a laptop and a WiFi connection. Employees

often fi nd that they are more productive because they can work in the environment of their choosing without the

distractions of the offi ce. Homebound individuals can work for a company that embraces remote work. Employees

also seem to have higher morale and lower absenteeism in part because they can work from wherever they are,

wearing whatever clothes they want. A remote employee who has a cold may not want to go into the offi ce and

risk spreading the germs to others but can work from home. Employers fi nd advantages of enabling remote work

compelling, too. They are able to hire employees who do not live in the geographic area of the offi ce. They don ’ t

have to monitor the employees the same way, freeing up their time to focus on exceptions and issues that require a

Geographic Lens: Who Telecommutes? A Look at Global Telecommuting Habits

Flexible work arrangements have been around for decades, but as technologies enable new capabilities for

work away from a traditional offi ce, telework has been gaining popularity. In 2015, advisory services fi rm EY sur-

veyed about 9,700 employees in the eight top economies across the globe—the United States, United Kingdom,

India, Japan, China, Germany, Mexico, and Brazil. The fi rm found fl exible work arrangements varied signifi cantly

by country. The report cited countries with the highest and lowest percentages of employees with fl exible work

schedules. Germany (70%), India (61%), and the United States (61%) had the highest percentage, and Japan (30%)

and China (22%) had the lowest.

Source: “EY Global Generations: A Global Study on Work‐Life Challenges Across Generations,” EY.com, http://www.ey.com/ Publication/vwLUAssets/EY‐global‐generations‐a‐global‐study‐on‐work‐life‐challenges‐across‐generations/$FILE/EY‐global‐ generations‐a‐global‐study‐on‐work‐life‐challenges‐across‐generations.pdf (accessed August 26, 2015), 6.

30 SAP Sustainability Report, Greenhouse Gas Footprint, http://www.sapsustainabilityreport.com/greenhouse‐gas‐footprint (accessed February 2, 2012).

c04.indd 89 11/26/2015 7:16:45 PM

90 Digital Systems and the Design of Work

supervisor. And employers often find that it is less expensive to provide a remote employee the tools needed than

to pay for the office space to house the employee.

Remote employees sometimes report that work–life balance often suffers. Because work can be done anyplace

and anytime, they sometimes find the option attractive because of the ability to work around the schedules of chil-

dren or other family members. Paradoxically, it is often difficult for them to separate work from their home life.

Consequently, they may work many more hours than the standard nine‐to‐five employee or experience the stress

of trying to separate work from play.

Remote work challenges managers to address performance evaluation and compensation. Managers of remote

workers must evaluate employee performance in terms of results or deliverables. Virtual offices make it more dif-

ficult for managers to appreciate the skills of the people reporting to them, which in turn makes it more difficult to

evaluate their performance. Managers must rely heavily on the remote worker’s self‐discipline to ensure that work

is done. As a result, managers may feel they are losing control over their employees, and some remote employees

do, in fact, abuse their privileges. Managers accustomed to traditional work models in which they are able to exert

control more easily may strongly resist remote working. In fact, managers are often the biggest impediment to

implementing remote work programs.

Self‐discipline is a key concern for many remote workers. Workers who go to an office or who must make

appearances at customer locations have a structure that gets them up and out of their home. But remote workers find

that working from home, in particular, is full of distractions such as personal phone calls, visitors, the television,

Facebook and other social networking sites, and inconvenient family disruptions. A remote worker must carefully

set up a home‐work environment and develop strategies to enable quality time for the work task.

Remote work also requires managers to undertake special planning and communicating activities. In terms of

planning, business and support tasks must be designed to support remote workers. Managers must also work to

coordinate schedules, ensure adequate communication among all workers, establish policies to support communi-

cations, and build business processes to support remote workers.

Working remotely can disconnect employees from their company’s culture and make them feel isolated. The

casual, face‐to‐face encounters that take place in offices transmit extensive cultural, political, and other organiza-

tional information. These encounters are lost to an employee who seldom, if ever, works at the office. Consequently,

telecommuters need to undertake special efforts to stay connected. They must engage in forms of conversation to

replace “water cooler” talk. This could take the form of instant messaging or participating in telephone calls/con-

ferences, e‐mail, social networking, blogs, or even video conferencing. The most successful remote work arrange-

ments do include regular visits to the office to solidify personal connections.

Not all jobs are suitable for remote work. Some jobs, such as server in a restaurant, a clerk in a grocery store,

and a facilities manager in a high‐rise building, require the employee to be at the work location. Further, new

employees who need to be socialized into the organization’s practices and culture are not good candidates for

remote work. Finally, some organizations’ culture does not support remote workers. Notably, when Marissa Meyer

took over as President of Yahoo, one of her first decisions was to eliminate remote work and bring everyone back

into the home office. She felt that the culture had taken a wrong turn and the only way to fix it was to have everyone

in the same place.

Remote work also raises the specter of offshoring, or foreign outsourcing of jobs once performed internally in the organization. Once a company establishes an infrastructure for remote work, it often can be performed abroad

as easily as domestically. U.S. immigration laws limit the number of foreigners who may work in the United States.

However, no such limitations exist on work performed outside this country by employees who transmit their work

to the United States electronically. Because such work is not subject to minimum wage controls, companies may

have a strong economic incentive to outsource work abroad. They find it particularly easy to outsource clerical work

related to electronic production, such as data processing and computer programming. Sourcing is further discussed

in Chapter 9. Benefits and potential problems associated with telecommuting are summarized in Figure 4.6.

Security is another issue for remote workers who might bring to the office an infected computer and plug it into

the network, posing a threat to other office computers. Further, as demonstrated by the Department of Veterans

Affairs (VA) employee whose laptop carrying unencrypted, sensitive personal information on more that 2.2 million

active‐duty military personnel was stolen from the employee’s home, remote workers can be the source of security

c04.indd 90 11/26/2015 7:16:45 PM

91Where Work Is Done and Who Does It: Mobile and Virtual Work Arrangements

breaches.31 Organizational security mechanisms are continually increasing in effectiveness; however, it is impos-

sible for organizations to make remote workers totally secure. General managers need to get involved in assessing

the areas and severity of risk and take appropriate steps, via policies, education, and technology, to reduce the risks

and make remote workers as secure as possible. IS leaders are aware that even with the best policies and tools avail-

able, breaches occur. The IS organizations typically has many levels of security to sense and respond to threats. IT

security is discussed more fully in Chapter 7.

Advantages and Disadvantages of Virtual Teams

Virtual teams clearly offer advantages in terms of expanding the knowledge base through team membership. Thanks

to new and ever‐emerging communication and information technologies, managers can draw team members with

needed skills or expertise from around the globe without having to commit to huge travel expenses. Further, virtual

teams can benefit from following the sun. One classic example of this can be found in software development. London members of a virtual team of software developers at Tandem Services Corporation initially code a project

and transmit its code each evening to a U.S. team for testing. The U.S. team forwards the tested code to Tokyo for

debugging. London team members start their next day with the code debugged by the Japanese team, and another

cycle is initiated.32 Increasingly, growing pressure for faster turn around time for systems has resulted in systems

development by global virtual teams whose members are located around the world.

There are some clear disadvantages to virtual teams. For example, different time zones, although helpful when

following the sun, can work against virtual team members when they are forced to stay up late or work in the middle

of the night to communicate with team members in other time zones. There also are a considerable number of chal-

lenges that if not correctly managed could turn into disadvantages. A summary of these challenges in comparison

with more traditional teams can be found in Figure 4.7.

Managing Remote Workers and Virtual Teams

Managers cannot manage remote workers or virtual teams in the same way that they manage in‐office workers or

traditional teams. The differences in management control activities are particularly pronounced because managers

cannot observe the actual behavior of remote workers or virtual team members. Thus, monitoring behavior is likely

to be more limited. As stated earlier, performance for both remote workers and virtual teams is more likely to be

evaluated through outcomes controls rather than behavior controls. Because team members and remote workers are

dispersed, providing feedback is especially important—not just at the end of a project, but throughout the workers’

employment and the team’s life.

FIGURE 4.6 Some advantages and disadvantages of remote work.

Advantages of Remote Working Potential Problems

Reduced stress due to increased ability to meet schedules and to have fewer work‐related distractions

Increased stress from inability to separate work life from home life

Higher morale; lower absenteeism Harder for managers to evaluate and communicate about performance

Geographic flexibility for worker; capitalization on distant expertise for organization

Employee may become disconnected from company culture

Higher personal productivity Lack of suitability for all jobs or employees

Inclusion of housebound individuals in the workforce Telecommuters more easily replaced by offshore workers

Very informal dress is acceptable Harder to achieve high security

31 Robert Lemos, “VA Data Theft Affects Most Soldiers” (June 7, 2006), http://www.securityfocus.com/brief/224 (accessed May 7, 2012). 32 Marie‐Claude Boudreau, Karen Loch, Daniel Robey, and Detmar Straub, “Going Global: Using Information Technology to Advance the Competitive-

ness of the Virtual Transnational Organization,” Academy of Management Executive 12, no. 4 (1998), 120–28.

c04.indd 91 11/26/2015 7:16:45 PM

92 Digital Systems and the Design of Work

Compensation for virtual teams must be based heavily on the team’s performance and ability to reach its goal

rather than on individually measured performance. Compensating team members for individual performance may

result in “hot‐rodding” or lack of cooperation among team members. Organizational reward systems must be

aligned with the accomplishment of desired team goals. This alignment is especially difficult when virtual team

members belong to different organizations, each with her or his own unique reward and compensation system, each

of which may affect individual performance in a different way. Managers need to be aware of differences and dis-

cover ways to provide motivating rewards to all team members. Further, policies about the selection, evaluation,

and compensation of virtual team members may need to be enacted.

In addition to management control challenges, there are other challenges as included in Figure 4.7. The rest of

this section is devoted to managing the challenges.

Managing Communication Challenges

Because virtual teams and remote workers communicate differently than workers in the office, managers must

make sure the communications policies and practices support these work arrangements. For example, holding a

team meeting in the office and expecting remote members to listen in requires the manager to prepare differently

for the meeting. Any presentation slides to be used in the meeting must also be shared with the remote participants,

either over a video conference with meeting software or beforehand. When most of the co‐workers are in the office

and only one or two are dialing in from other locations, the remote participants miss all the nonverbal communica-

tion that takes place in the meeting room. Soft‐spoken individuals are often difficult to hear. Managers must make

sure key messages are being conveyed to the remote participants or the results of the meeting are sub‐optimal.

Team leaders may decide to initiate or supplement a team’s virtual activity with a face‐to‐face meeting so that

the seeds of trust can be planted and team members feel as if they know one another on a more personal basis. Face‐

to-face meetings indeed appear to contribute to successful global virtual teams. An in‐depth study of three global

virtual teams found that the two effective teams created a rhythm organized around regularly scheduled face‐to‐face

meetings coupled with virtual meetings as needed. Before each face‐to‐face meeting, there was a flurry of com-

munication and activity as team members prepared for the meeting. After the meeting, there were many follow‐up

messages and tasks. The ineffective team did not demonstrate a similar pattern.33 Because not all teams can meet

face‐to‐face, well‐managed synchronous meetings using video teleconferencing or in a virtual world can activate

the rhythm and accelerate the workflow.

FIGURE 4.7 Comparison of challenges facing virtual teams and traditional teams.

Challenges Virtual Teams (VT) Traditional Teams

Communication • Difficulties in terms of scheduling meetings and interactions • Increased inefficiencies when passing work between time

zones • Altered communication dynamics such as facial expressions,

vocal inflections, verbal cues, and gestures

• Collocated in same time zone. Scheduling is less difficult

• Use of richer communication media, including face‐to‐face discussions

Technology • Need for proficiency across wide range of technologies • Automatic creation of electronic repository to build

organizational memory • Need for ability to align group structure and technology

with the task environment

• Support for face-to-face interaction without replacing it

• Electronic communication skills not needed by team members

• Task technology fit less critical

Team Diversity • Harder to establish a group identity • Require better communication skills • More difficult to build trust, norms, and shared meanings

about roles because team members have fewer cues about their teammates’ performance

• More likely to have different perceptions about time and deadlines

• Group identity easier to create • Easier communication among

members

33 M. L. Maznevski and K. Chudoba, “Bridging Space Over Time: Global Virtual Team Dynamics and Effectiveness,” Organization Science 11, no. 5 (2000), 373–92.

c04.indd 92 11/26/2015 7:16:45 PM

93Where Work Is Done and Who Does It: Mobile and Virtual Work Arrangements

Because team leaders cannot always see what their team members are doing or whether they are experiencing

any problems, frequent communications are important. If remote employee or team members are quiet, the team

leader must reach out to them to identify their participation and ensure that they feel their contributions are appre-

ciated. Further, team leaders can scrutinize the team’s asynchronous communications and its repository to evaluate

and give feedback about each team member’s contributions. Even when a majority of team members are in one

location, the team leader should rotate meeting times to alternate the convenience among team members. The rule

of thumb is that “more communication is better than less” because it is very difficult to “overcommunicate.” Man-

agers and team leaders with remote participants must make sure to think about how their remote colleagues are

receiving the information they need, not just how the managers are communicating it.

Managing Technology Challenges

Information and communication technologies are at the heart of the success of remote work and virtual team

accomplishments. However, managers must ensure that their remote colleagues have access to the technologies

and support they need. All team members must have the ability to connect to the information sources and com-

munications pathways used by the group. Well‐designed Web‐based conferencing applications make this easier

because any device connected to the Internet can access them. Managers must make sure meetings over video

or audio conference tools are well coordinated and all attendees have the right access codes and meeting times.

Time zone differences often confuse this issue, so it is critical to make sure everyone knows the right time for

a meeting.

Support processes for technologies must also be designed with remote employees in mind. If the only support

for them is in the office, they will find it difficult if not impossible to access the help they need. Bringing a laptop to

the office during normal business hours may not be possible if the remote worker is hundreds or thousands of miles

away. Processes must be designed to accommodate the remote employee or team member.

Managers must ensure that all employees and team members have the tools they need to do their jobs. That

might mean providing seamless telephone transfers, desktop support, network connectivity, and security support

to the remote workers. How and where information is stored must be considered because all workers must have

access to the files and applications they need to do their work. And, of course, the importance of security for remote

work cannot be overstated. A good rule of thumb is to design work processes so they work for remote workers,

and consider the office as just another location. If the process works for the remote workers, it most likely will

work for someone in the office, but the converse is not necessarily true. Unforeseen problems can develop for those

remotely located.

Further, managers must also provide the framework for using the technology. Policies and norms or unwritten

rules about how all employees should use the technology to work with one another must be established.34 These

include norms about telephone, e‐mail, and videoconferencing etiquette (i.e., how often to check for messages, the

maximum time to wait to return e‐mails, and alerting team members about absences or national holidays), work to

be performed, and so on. Such norms are especially important when team members are not in the same office and

cannot see when team members are unavailable. For example, leaving a paper note on someone’s desk works fine if

that person is in the office, but that option does not exist for remote participants. Leaving an e‐mail or sending texts

may be a better alternative because both work for everyone.

Managing Diversity Challenges

Managers may also seek to provide technologies to support diverse team member characteristics. For example,

team members from different parts of the globe may have different views of time. Team members from Anglo‐

American cultures (i.e., United States, United Kingdom, Canada, Australia, New Zealand) may view time as a

continuum from past to present and future. For such team members, each unit of time is the same. These team

members are likely to be concerned with deadlines and often prefer to complete one task before starting another

(i.e., are monochronic). For team members who are conscious of deadlines, planning and scheduling software may

34 C. Saunders, C. Slyke, and D. R. Vogel, “My Time or Yours? Managing Time Visions in Global Virtual Teams,” Academy of Management Executive 18, no. 1 (2004), 19–31.

c04.indd 93 11/26/2015 7:16:45 PM

94 Digital Systems and the Design of Work

be especially useful. In contrast, team members from India often have a cyclical view of time. They do not get

excited about deadlines and there is no hurry to make a decision because it is likely to cycle back—at which time

the team member may be in a better position to make the decision. Many people from India tend to be polychronic,

preferring to do several activities at one time. Team members who are polychronic may benefit from having instant

messaging or instant video chats available to them so that they can communicate with their teammates and still

work on other tasks.35

In addition to providing the appropriate technologies, managers with team members who have different views

of time need to be aware of the differences and try to develop strategies to motivate those who are not concerned

with deadlines to deliver their assigned tasks on time. Or the managers may wish to assign these team members to

do tasks that are not sensitive to deadlines.

Of course, views of time are only one dimension of diversity. Although team diversity has been demonstrated

to lead to more creative solutions, it can also make it harder for team members to learn to communicate, to trust

one another, and to form a single group identity. Through open communications, managers may be able to uncover

and deal with other areas of diversity, such as culture, training, gender, personality, position, and language, that

positively or negatively affect the team.36 Managers may establish an expertise directory at the start of the team’s

life or encourage other ways of getting team members to know more about one another. The rule of thumb here is

to not assume a team will work just because it has been created by management. Specific thought must be giving

to helping the team members function together and embrace, rather than reject, the differences diversity brings to

the table.

Gaining Acceptance for IT‐Induced Change The changes described in this chapter no doubt alter the frames of reference of organizational employees and may

be a major source of concern for them. Employees may resist the changes if they view the changes as negatively

affecting them. In the case of a new information system that they do not fully understand or are not prepared to

operate, they may resist in several ways:

• They may deny that the system is up and running.

• They may sabotage the system by distorting or otherwise altering inputs.

• They may try to convince themselves, and others, that the new system really will not change the status quo.

• They may refuse to use the new system when its usage is voluntary.

Managing Change

To help avoid these resistance behaviors, John Kotter37 builds upon Kurt Lewin’s38 change model of unfreezing,

changing, and refreezing. Kotter recommends eight specific steps to bring about change. Kotter’s steps are related

to Lewin’s changes and listed in Figure 4.8.

Managers can keep these eight steps in mind as they introduce change into their workplaces. It is important for

managers to make clear why the change is being made before it is implemented, and they must follow the change

with reinforcement behaviors such as rewarding those employees who have successfully adopted new desired

behaviors.

35 Ibid. 36 Terri R. Kurtzberg and Teresa M. Amabile, “From Guilford to Creative Synergy: Opening the Black Box of Team‐Level Creativity,” Creativity Research Journal 13, no. 3–4 (2001), 285–94. 37 John Kotter, Leading Change (Boston, MA: Harvard Business School Press, 1996). 38 Kurt Lewin, “Frontiers in Group Dynamics II. Channels of Group Life; Social Planning and Action Research,” Human Relations 1, no. 22 (1947), 143–53.

c04.indd 94 11/26/2015 7:16:45 PM

95Gaining Acceptance for IT‐Induced Change

Technology Acceptance Model and Its Variants

To avoid the negative consequences of resistance to change, those implementing change must actively manage

the change process and gain acceptance for new IS. To help explain how to gain acceptance for a new technology,

Professor Fred Davis and his colleagues developed the Technology Acceptance Model (TAM). Many variations of

TAM exist, but its most basic form is displayed on the right‐hand side in Figure 4.9. TAM suggests that managers

FIGURE 4.8 Stages and steps in change management. Source: Adapted from John Kotter, Leading change (Boston, MA: Harvard Business School Press, 1996).

Lewin’s Stage Unfreezing Changing Refreezing

Definition Creating motivation to change Providing stakeholders with new information, systems, products, or services

Reinforcing change by integrating stakeholders’ changed behaviors and attitudes into new operations resulting from change

Kotter’s Steps 1. Establish a sense of urgency: Create a compelling reason why change is needed.

2. Create the guiding coalition: Select a team with enough expertise and power to lead the change.

3. Develop a vision and strategy: Use the vision and strategic plan to guide the change process.

4. Communicate the change vision: Devise and implement a communication strategy to consistently convey the vision.

5. Empower broad‐based action: Encourage risk‐taking and creative problem solving to overcome barriers to change.

6. Generate short‐term wins: Celebrate short‐term improvements and reward contributions to change effort.

7. Consolidate gains and produce more change: Use credibility from short‐term wins to promote more change so that change cascades throughout the organization.

8. Anchor new approaches in the culture: Reinforce change by highlighting areas in which new behaviors and processes are linked to success.

Individual

Differences

Perceived

Usefulness

Social

Influence

Facilitating

Conditions

Perceived

Ease of Use

Technology Acceptance Model (TAM)

Behavioral

Intention

Use

Behavior

System

Characteristics

FIGURE 4.9 Simplified technology acceptance model (TAM3). Source: Viswanath Venkatesh and Hillol Bala, “Technology Acceptance Model 3 and a Research Agenda on Interventions,” Decision Sciences 39, no. 2 (2008), 276.

c04.indd 95 11/26/2015 7:16:46 PM

96 Digital Systems and the Design of Work

cannot get employees to use a system until they want to use it. To convince employees to want to use the system,

managers may need to employ unfreezing tactics to change employee attitudes about the system. Attitudes may

change if employees believe that the system will allow them to do more or better work for the same amount of effort

(perceived usefulness), and that it is easy to use. Training, documentation, and user support consultants are external

variables that may help explain the usefulness of the system and make it easier to use.

The left‐hand side of Figure 4.9 provides four categories of determinants of perceived usefulness and perceived

ease of use from the point of view of organizational users. Specifically, they are individual differences (e.g., gender, age), system characteristics (e.g., output quality and job relevance that help individuals develop favorable or unfa- vorable views about the system), social influence (e.g., subjective norms), and facilitating conditions (e.g., top management support). TAM assumes that system use is under the control of the individual users. When employees

are mandated to use the system, they may use it in the short run, but over the long run, negative consequences of

their resistance may surface. Thus, gaining acceptance of the system is important, even in those situations where

it is mandated.

S U M M A R Y

• The nature of work is changing, and IT supports, if not propels, these changes.

• Communication and collaboration are vital for today’s work. Technology to support communication includes e‐mail, intranets, instant messaging (IM), video conferences, virtual private networks (VPN), and file transfer software. Tech-

nology to support collaboration includes social networking sites, Web logs (blogs), virtual worlds, wikis, teleconference

systems, groupware, microblogs and Internet sharing sites.

• IT affects work by creating new work, creating new working arrangements, and presenting new managerial challenges in employee supervision, evaluation, compensation, and hiring.

• Newer approaches to management reflect increased use of computer and information technology in hiring and super- vising employees, a more intense focus on output (compared to behavior), and an increased team orientation.

• The shift to knowledge‐based work, changing demographics and lifestyle preferences, new technologies, growing reli- ance on the Web, and energy concerns contribute to the increase in remote work and virtual teams.

• Companies find that building telecommuting capabilities can be an important tool for attracting and retaining employees, increasing their productivity, providing flexibility to otherwise overworked individuals, reducing office

space and associated costs, responding to environmental concerns about energy consumption, and complying with the

Clean Air Act. Alternative work arrangements also promise employees potential benefits: schedule flexibility, higher

personal productivity, less commuting time and fewer expenses, and increased geographic flexibility.

• Disadvantages of remote work include increased stress from trying to maintain work–life balance; difficulties in planning, communicating, and evaluating performance; feelings of isolation among employees; easier displacement of

employees by offshoring; and limitations of jobs and employees in its application.

• Virtual teams can be defined as two or more people who (1) work together interdependently with mutual account- ability for achieving common goals, (2) do not work in either the same place and/or at the same time, and (3) must use

electronic communication technology to communicate, coordinate their activities, and complete their team’s tasks. They

are an increasingly common organizational phenomenon and must be managed differently than more traditional teams.

• Managers of remote workers and virtual teams must focus on overcoming the challenges of communication, technology, and diversity of team members.

• To gain acceptance of a new technology, potential users must exhibit a favorable attitude toward the technology. In the case of information systems, the users’ beliefs about its perceived usefulness and perceived ease of use color their atti-

tudes about the system. Kotter provides some suggested steps for change management that are related to Lewin’s three

stages of change: unfreezing, change, and refreezing.

c04.indd 96 11/26/2015 7:16:46 PM

97Case Study

D I S C U S S I O N Q U E S T I O N S

1. Why might an employee resist the implementation of a new technology? What are some of the possible consequences of asking an employee to use a computer or similar device in his or her job?

2. How can IT alter an individual ’ s work? How can a manager ensure that the impact is positive rather than negative?

3. What current technologies do you predict will show the most impact on the way work is done? Why?

4. Given the growth in telecommuting and other mobile work arrangements, how might offices physically change in the com- ing years? Will offices as we think of them today exist by 2030? Why or why not?

5. How is working at an online retailer different from working at a brick‐and‐mortar retailer? What types of jobs are necessary at each? What skills are important?

6. Paul Saffo, former director of the Institute for the Future, noted, “Telecommuting is a reality for many today, and will con- tinue to be more so in the future. But beware, this doesn ’ t mean we will travel less. In fact, the more one uses electronics,

the more they are likely to travel.” 39 Do you agree with this statement? Why or why not?

7. The explosion of information‐driven self‐serve options in the consumer world is evident at the gas station where customers pay, pump gas, and purchase a car wash without ever seeing an employee; in the retail store such as Walmart, Home Depot,

and the local grocery where self‐service checkout stands mean that customers can purchase a basket of items without ever

speaking to a sales agent; at the airport where customers make reservations and pay for and print tickets without the help of

an agent; and at the bank, where ATMs have long replaced tellers for most transactions. But a backlash is coming, experts

predict. Some say that people are more isolated than they used to be in the days of face‐to‐face service, and they question

how much time people are really saving if they have to continually learn new processes, operate new machines, and over-

come new glitches. Labor‐saving technologies were supposed to liberate people from mundane tasks, but it appears that

these technologies are actually shifting some tasks to the customer. On the other hand, many people like the convenience of

using these self‐service systems, especially because it means customers can visit a bank for cash or order books or gifts from

an online retailer 24 hours a day. Does this mean the end of “doing business the old‐fashioned way”? Will this put a burden

on the elderly or the poor when corporations begin charging for face‐to‐face services? 40

K E Y T E R M S

behavior controls (p. 84)

mobile workers (p. 86)

offshoring (p. 90)

outcome controls (p. 84)

personnel controls (p. 84)

remote workers (p. 86)

telecommuting (p. 86)

virtual teams (p. 87)

39 “Online Forum: Companies of the Future,” http://www.msnbc.com/news/738363.asp (accessed June 11, 2002). 40 Stevenson Swanson , “ Are Self‐Serve Options a Disservice? ” Chicago Tribune (May 8, 2005 ), Section H, 1d .

Martin Andersen is responsible for 143 of Trash and Waste Pickup Services, Inc. ’ s (TWPS ’ s) garbage trucks. TWPS is a

commercial and household trash hauler. When a caller recently complained to Andersen that a brown and green Trash and

Waste Pickup Services truck was speeding down Farm Route 2244, Andersen turned to the company ’ s information system.

He learned that the driver of a company front‐loader had been on that very road at 7:22 a.m., doing 51 miles per hour (mph)

in a 35 mph zone. The driver of that truck was in trouble!

The TWPS information system uses a global positioning system (GPS) not only to smooth its operations but also to

keep closer track of its employees, who may not always be doing what they are supposed to be doing during work hours.

Andersen pointed out, “If you ’ re not out there babysitting them, you don ’ t know how long it takes to do the route. The guy

could be driving around the world, he could be at his girlfriend ’ s house.”

■ CASE STUDY 4‐1 Trash and Waste Pickup Services, Inc.

c04.indd 97 11/26/2015 7:16:46 PM

98 Digital Systems and the Design of Work

IBM ’ s award‐winning developerWorks site was established in 2000 as a technical resource repository for the company ’ s

global development community. Designed to share knowledge and skills related to IBM products and other key technol-

ogies, it has been a solid success. The site attracts about 4 million unique visitors a month—including students, profes-

sionals, and developers from almost all the world ’ s countries—who search its library of 30,000 articles, demos, podcasts,

and tutorials. developerWorks is available in eight languages, including Russian, Chinese, and Spanish, and about 70% of

its visitors come from outside IBM.

My developerWorks, a social networking function, was added to the repository platform in 2009 to allow developers to

connect, communicate, and collaborate on projects. Soon the network had added more than 600,000 user profi les as well as

numerous blogs and forums. In addition to allowing established business, start‐ups, and partners to collaborate, it has also

helped users fi nd answers to support questions that would otherwise go to IBM ’ s call centers and help desks, thus saving

the company an estimated $100 million.

Alice Chou, Director of IBM developerWorks, carefully monitored the number of My developerWorks profi les and the

volume of traffi c to the site. She looked at unique visitors, developer demographics, time spent on the site, and patterns of

page views. She created a reward and recognition framework so that when users contributed a highly regarded article or

blogpost to the site, “they got the kudos they deserve.”

Discussion Questions

1. How might My developerWorks leverage changes in the way people work?

2. Why do you think Alice Chou carefully monitors the My developerWorks site? What would be an example of an insight

she would gain from the data she ’ s collecting?

3. Why do you think Alice Chou thinks a rewards program is necessary for My developerWorks because so many profiles

have already been developed. Do you agree that a reward would be necessary?

Sources: IBM, www.ibm.com/developerworks (accessed April 17, 2012); Ellen Traudt and Richard Vancil , “ Becoming a Social Business: The IBM Story ,” IDC White Paper #226706 (January 2011), 1–14 (quote on p. 6, developerWorks at http://www.ibm.com/developerworks/) .

■ CASE STUDY 4‐2 Social Networking: How Does IBM Do It?

Before TWPS installed the GPS system, the drivers of his 37 front‐loaders clocked in approximately 250 hours a week

of overtime at one and a half times pay. Once TWPS started monitoring the time they spent in the yard before and after

completing their routes and the time and location of stops that they made, the number of overtime hours plummeted to 70

per week. This translated to substantial savings for a company whose drivers earn about $20 an hour.

TWPS also installed GPS receivers in salesmen ’ s cars. Andersen was not surprised to learn that some of the company ’ s

salespeople frequented The Zone, a local bar, around 4 p.m . when they were supposed to be calling on customers. Andersen

decided to set digital boundaries around the bar.

Understandably, the drivers and salespeople aren ’ t entirely happy with the new GPS‐based system. Ron Simon, a TWPS

driver, admits: “It ’ s kind of like Big Brother is watching a little bit. But it ’ s where we ’ re heading in this society. . . . I get testy

in the deli when I ’ m waiting in line for coffee, because it ’ s like, hey, they ’ re (managers) watching. I ’ ve got to go.”

Andersen counters that employers have a right to know what their employees are up to: “If you come to work here, and

I pay you and you ’ re driving one of my vehicles, I should have the right to know what you ’ re doing.”

Discussion Questions

1. What are the positive and negative aspects of Andersen ’ s use of the GPS‐based system to monitor his drivers and sales-

people?

2. What advice do you have for Andersen about the use of the system for supervising, evaluating, and compensating his

drivers and salespeople?

3. As more and more companies turn to IS to help them monitor their employees, what do you anticipate the impact will

be on employee privacy? Can anything be done to ensure employee privacy?

Source: This is a fi ctitious case. Any resemblance to an actual company is purely coincidental.

c04.indd 98 11/26/2015 7:16:46 PM

99

5 chapter

1 Adapted from S. Balaji , C. Ranganathan , and T. Coleman , “ IT‐Led Process Reengineering: How Sloan Valve Redesigned Its New

Product Development Process ,” MIS Quarterly Executive 10 , no. 2 ( June 2011 ), 81 – 92 .

Transformation requires discontinuous thinking—recognizing and shedding outdated rules and fundamental assumptions that underlie operations. Business processes, the cross‐ functional sets of activities that turn inputs into outputs, are at the heart of how businesses operate and how transformation takes place. This chapter discusses business processes and the systems that support them. The chapter begins with a discussion of a functional (silo) versus a process perspective of a fi rm, including agile and dynamic business processes. The chapter then focuses on the way managers change business processes, including incremental and radical approaches. Information systems ( IS ) including workfl ow and business process management systems and enterprise systems that support and automate business processes follow. The chapter concludes by examining when IS drive business transformations and the complexities that arise when companies integrate systems.

Information Systems and Business Transformation

Business strategy at Sloan Valve Company , 1 a family‐owned global manufacturer of plumbing prod-

ucts, had executives launching a range of new products every year. The new product development

(NPD) process was both core and strategic for Sloan , but it was also complex and slow; over

16  functional units were involved, and it often took 18–24 months to bring a new product to

market. Sloan Valve ’ s process of initiating and screening new product ideas was broken. More

than 50% of the ideas that began the process didn ’ t make it through, resulting in wasted resources.

Further, no one was accountable for the process, making it diffi cult to get a handle on process

management and improvement. Information fl ow was blocked in part because of the structure of

the organization.

Management initially invested in an enterprise system to automate the company ’ s internal

processes, believing that IS would provide a common language, database, and platform. Despite

successful implementation, the communication and coordination problems continued. Further, the

new system did not provide an NPD process. Upon deeper analysis by a new CIO brought in to “fi x

things,” management realized that the enterprise system was working fi ne, but the underlying pro-

cess was broken. Top management decided to redesign the NPD process.

The NPD process redesign team was led by an IT manager with considerable process experience

and involved members from manufacturing, engineering, IT, fi nance, marketing, operations, and

quality assurance. The director of design engineering was made process owner to provide oversight

for all changes. The team spent nine months assessing the current way of working and proposed a

new end‐to‐end NPD process. The reengineered NPD process included six subprocesses: ideation,

business case development, project portfolio management, product development, product and pro-

cess validation, and launch. The underlying information system was the enterprise system upgraded

to include newer modules, which supported product life cycle management.

c05.indd 99 11/26/2015 6:25:53 PM

100 Information Systems and Business Transformation

The quality, timing, and output of NPD greatly improved. The new NPD process reduced time‐to‐market to less

than 12 months. New product ideas that were unlikely to work were filtered out early, eliminating problems of wast-

ing resources. Synthesis of product and process information improved. Customer feedback was easier to access.

And accountability increased, smoothing out responsibilities and workflow.

Not all IS enterprise system implementations are as successful as that at Sloan Valve. There are hundreds of

stories of companies that ran into significant problems when automating and transforming their business processes,

especially when an information system is at the heart of the change. Overstock.com’s order tracking system failed

for a full week when it rolled out a new enterprise system. By rushing to implement the new system, a glitch put

the enterprise system out of sync with the accounting system, causing the company to have to restate more than five

years of earnings, which showed lower revenue and higher losses. Clothing manufacturer Levi Strauss had simi-

lar problems with its new enterprise system, causing shipping errors and issues with its financial control systems.

The latter was blamed for the company’s 98% decrease in net income for the second quarter in 2008. Avis Europe

attempted to implement an enterprise system, but project delays and cost overruns caused the company to cancel

the project and write off £28 million on its books. With so much at risk, general managers must be informed and

involved in these types of complex information systems that change business processes.2

IS can enable or impede business change. The right design coupled with the right technology can result in

changes such as those experienced by Sloan Valve. The wrong business process design or the wrong technology,

however, can force a company into operational, and sometimes financial, crisis as the Overstock.com, Levi Strauss,

and Avis Europe examples show.

To a manager in today’s business environment, an understanding of how IS enable business change is essential.

The terms management and change management are used almost synonymously in today’s business vocabulary: To manage effectively means to manage change effectively. As IS become ever more prevalent and more power-

ful, the speed and magnitude of the changes that organizations must address to remain competitive continue to

increase. To be a successful manager, one must understand how IS enable change in a business; one must gain

a process perspective of business and must understand how to transform business processes effectively. This

chapter provides managers a view of business process change. It provides tools for analyzing how a company

currently does business and for thinking about how to effectively manage the inevitable changes that result from

competition and the availability of IS. This chapter also describes an IT‐based solution commonly known as

enterprise IS. A brief word to the reader is needed. The term process is used extensively in this chapter. In some instances, it

is used to refer to the steps taken to change aspects of the business. At other times, it is used to refer to the part of

the business to be changed: the business process. The reader should be sensitive to the potentially confusing use of

the term process.

Silo Perspective versus Business Process Perspective When effectively linked with improvements to business processes, advances in IS enable changes that make it pos-

sible to do business in a new way, one that is better and more competitive than before. On the other hand, IS can

also inhibit change, which occurs when managers fail to adapt business processes because they rely on inflexible

systems to support those processes. Finally, IS can also drive change for better or for worse. Examples abound of

industries that were fundamentally changed by advances in IS and of companies whose success or failure depended

on the ability of their managers to adapt. This chapter considers IS as an enabler of business transformation, a

partner in transforming business processes to achieve competitive advantages. We begin by comparing a process

view of the firm with a functional view.

Transformation requires discontinuous thinking—recognizing and shedding outdated rules and fundamental

assumptions that underlie operations. “Unless we change these rules, we are merely rearranging the deck chairs

on the Titanic. We cannot achieve breakthroughs in performance by cutting fat or automating existing processes.

2 Adapted from http://www.baselinemag.com/c/a/ERP/Five‐ERP‐Disasters‐Explained‐878312/ (accessed February 24, 2012).

c05.indd 100 11/26/2015 6:25:53 PM

101Silo Perspective versus Business Process Perspective

Rather, we must challenge old assumptions and shed the old rules that made the business under perform in the

first place.”3

Functional (Silo) Perspective

Many think of business by imagining a hierarchical structure (described in Chapter 3) organized around a set of

functions. Looking at a traditional organization chart allows an understanding of what the business does to achieve

its goals. A typical hierarchical structure, organized by function, results in disconnected silos that might look like

the one in Figure 5.1.

When an organization has silos, departments are organized on the basis of their core competencies. Specialized

silos allow them to focus on what they do best. For example, the operations department focuses on operations, the

marketing department focuses on marketing, and so on. Each major function within the organization usually forms

a separate department to ensure that work is done by groups of experts in that function. This functional structure

is widespread in today’s organizations and is reinforced by business education curricula, which generally follow

functional structures, that is, students take courses in functions (i.e., marketing, management, accounting) and

major in functions and then are predisposed to think in terms of these same functions.

Even when companies use the perspective of the value chain model (as discussed in Chapter 2), they still focus on

functions that deliver their portion of the process and “throwing it over the wall” to the next group on the value chain.

These silos become self‐contained functional units, which can be useful for several reasons. First, they allow an orga-

nization to optimize expertise and training. For example, all the marketing people can belong to the same department,

allowing them to informally network and learn from each other. Second, the silos allow the organization to avoid

redundancy in expertise by hiring one person who can be assigned to projects across functions on an as‐needed basis

instead of hiring an expert in each function. Third, with a silo organization, it is easier to benchmark outside organi-

zations, utilize bodies of knowledge created for each function, and easily understand the role of each silo.

On the other hand, silo organizations can experience significant suboptimization. First, individual departments

often recreate information maintained by other departments. Second, communication gaps between departments

are often wide. Third, handoffs between silos are often a source of problems, such as finger‐pointing and lost

information. Finally, silos tend to lose sight of the objective of the overall organization and operate in a way that

maximizes their local goals. The last point is illustrated by a production department that pushes the concept of a

small number of product sizes or options while the marketing department urges management to consider a larger

variety or highly customized products. Such conflicts do arise in many organizations, and it can be difficult to nego-

tiate to find a solution that is best, overall, for the firm.

A firm’s work changes over time. In a functionally organized silo business, each group is primarily concerned

with its own set of objectives. The executive officers jointly seek to ensure that these functions work together to

create value, but the task of providing the “big picture” to so many functionally oriented personnel can prove

extremely challenging. As time passes and business circumstances change, new work is created that relies on more

than one of the old functional departments. Departments that took different directions must now work together.

They negotiate the terms of any new work processes with their own functional interests in mind, and the “big

Typical Hierarchical Organization Structure

Operations Marketing Accounting Finance Administration

Executive Offices

CEO

President

FIGURE 5.1 Hierarchical structure.

3 Michael Hammer, “Reengineering Work: Don’t Automate, Obliterate” Harvard Business Review 68, no. 4 (July–August 1990), 104–12.

c05.indd 101 11/26/2015 6:25:54 PM

102 Information Systems and Business Transformation

picture” optimum gets scrapped in favor of suboptimal compromises among the silos. These compromises then

become repeated processes; they become standard operating procedures.

Losing the big picture means losing business effectiveness. After all, a business’s main objective is to create as

much value as possible for its shareholders and other stakeholders by satisfying its customers to stimulate repeat

sales and positive word of mouth. When functional groups duplicate work, fail to communicate with one another, or

lose the big picture and establish suboptimal processes, the customers and stakeholders are not being well served.

Business Process Perspective

A manager can avoid such suboptimization—or begin to “fix” it—by managing from a business process perspec-

tive. A business process perspective, or more simply a process perspective, keeps the big picture in view and allows the manager to concentrate on the work that must be done to ensure the optimal creation of value. A process

perspective helps the manager avoid or reduce duplicate work, facilitate cross‐functional communication, optimize

business processes, and ultimately, best serve the customers and stakeholders.

In business, a process is defined as an interrelated, sequential set of activities and tasks that turns inputs into outputs and includes the following:

• A beginning and an end

• Inputs and outputs

• A set of tasks (subprocesses or activities) that transform the inputs into outputs

• A set of metrics for measuring effectiveness

Metrics are important because they focus managers on the critical dimensions of the process. Metrics for a

business process are things like throughput, which is how many outputs can be produced per unit time, or cycle time, which is how long it takes for an entire process to execute. Examples of process measures are the number of handoffs in the process or actual work versus total cycle time. Other metrics are based on the outputs themselves,

such as customer satisfaction, revenue per output, profit per output, and quality of the output.

Examples of business processes include customer order fulfillment, manufacturing planning and execution,

payroll, financial reporting, and procurement. A procurement process might look like the sample in Figure  5.2.

The process has a beginning and an end, inputs (requirements for goods or services) and outputs (receipt of goods,

vendor payment), and subprocesses (filling out a purchase order, verifying the invoice). Metrics of the success of

the process might include turnaround time and the number of paperwork errors.

The procurement process in Figure  5.2 cuts across the functional lines of a traditionally structured business.

For example, the requirements for goods might originate in the operations department based on guidelines from

the finance department. Paperwork would likely flow through the administration department, and the accounting

department would be responsible for paying the vendor.

Focusing on business processes ensures focusing on the business’s goals (the “big picture”) because each pro-

cess has an “endpoint” that is usually a deliverable to a customer, supplier, or other stakeholder. A business process

perspective recognizes that processes are often cross‐functional. In the diagram in Figure  5.3, the vertical bars

represent functional departments within a business. The horizontal bars represent processes that flow across those

functional departments. A business process perspective requires an understanding that processes properly exist to

serve the larger goals of the business and that functional departments must work together to optimize processes in

regard to these goals.

Receive

Requirement

for Goods/

Services

Pay

Vendor

Verify

Invoice

Receive

Goods

Create and

Send

Purchase

Order

FIGURE 5.2 Sample procurement business process.

c05.indd 102 11/26/2015 6:25:54 PM

103Silo Perspective versus Business Process Perspective

For example, an order‐fulfillment process might include payment, order delivery, product implementation, and

after‐sales service tasks. This process would involve multiple functions, including operations, accounting, service,

and sales, making it a cross‐functional business process. The “sales order” would be the input for this process. A sat-

isfied customer might be the output, and a number of metrics, such as a survey of the customer’s satisfaction, time to

complete the order fulfillment process, number of defects (or other quality measure), can be used to measure success.

When managers take a business process perspective, they are able to optimize the value that customers and

stakeholders receive by managing the flow as well as the tasks. They begin to manage processes by:

• Identifying the customers of processes (who receives the output of the process?)

• Identifying these customers’ requirements (what are the criteria for successful implementation of the process?)

• Clarifying the value that each process adds to the overall goals of the organization

• Sharing their perspective with other organizational members until the organization itself becomes more pro- cess focused

The differences between the silo and business process perspectives are summarized in Figure  5.4. A silo perspective refers to self‐contained functional units such as marketing, operations, finance, and so on. Unlike a

Functions

Sample

Business

Processes

Purchasing

Customer Support

O P E R A T I O N S

M A R K E T I N G

A C C O U N T I N G

F I N A N C E

A D M I N I S T R A T I O N

FIGURE 5.3 Cross‐functional nature of business processes.

FIGURE 5.4 Comparison of silo perspective and business process perspective.

Silo Perspective Business Process Perspective

Definition Self‐contained functional units such as marketing, operations, finance, and so on

Interrelated, sequential set of activities and tasks that turns inputs into outputs

Focus Function Cross‐function

Goal Accomplishment Goals optimized for the function, which may be suboptimal for the organization

Goals optimized for the organization, or the “big picture”

Benefits Core competencies highlighted and developed; functional efficiencies

Avoidance of work duplication and cross‐functional communication gaps; organizational effectiveness

Problems Redundancy of information throughout the organization; cross‐functional inefficiencies; communication difficulties

Difficulty in finding staff who can be knowledgeable generalists; need for sophisticated software

c05.indd 103 11/26/2015 6:25:54 PM

104 Information Systems and Business Transformation

silo perspective, a business process perspective recognizes that businesses operate as a set of processes that flow

across functional departments. The business process perspective enables a manger to analyze the processes of the

business in regard to its larger goals in comparison to the functional orientation of the silo perspective. Finally, it

provides a manager with insights into how those processes might better serve these goals.

An example illustrates the problem. Using a silo perspective, a customer with a warranty issue would need to

explain a problem with a product to a customer service representative in the service department. If the problem is

technical, the call would be transferred to a technical support person (in a different department), and the customer

might need to explain the entire problem again. If the technical support representative determined that a part is

needed, the customer would be transferred to the sales department and would need to explain the issue yet another

time. Because the departments are not talking with one another, the customer might even need to provide proof of

purchase several times to avoid having to pay for a warranty problem.

In contrast, with a business process perspective, either one representative would work with the customer on all

problems or an enterprise system would enable the representative to transfer both the call and notes with the details to any specialists who are needed along the way. Having one representative handle all problems is not always pos-

sible because it is often difficult to find staff able to handle an entire process for the same reasons that support the

functional hierarchical structure: People are normally trained in a function, such as marketing or accounting, not

in a process that requires many different skill sets. For example, individuals who excel at marketing may not also

possess the accounting skills needed to fix a billing problem.

Zara’s Cross‐Functional Business Processes

Consider Spanish clothing retailer Zara (introduced in Chapter 2). With over 1,600 stores in 78 countries around

the world and a well‐designed set of cross‐functional business processes, Zara often is able to design, produce, and

deliver a garment within 15 days. For this to happen, its managers must regularly create and rapidly replenish small

batches of goods all over the world. Zara’s organization, operational procedures, performance measures, and even

its office layout are all designed to make information transfer easy.

Zara’s designers are colocated with the production team, including marketing, procurement, and production

planners. Prototypes are created nearby, facilitating easy discussion about the latest design. Large circular tables

in the middle of the production process encourage impromptu meetings where ideas are readily exchanged among

the designers, market specialists, and production planners. The speed and quality of the design process is greatly

enhanced by the colocation of the entire team because the designers can quickly check their ideas with others on

their cross‐functional teams. For example, the market specialists can quickly respond to designs in terms of the

style, color, and fabric whereas the procurement and production planners can update these specialists about manu-

facturing costs and available capacity.

Zara’s information technology provides a platform but does not preclude informal face‐to‐face conversations.

Retail store managers are linked to marketing specialists through customized handheld computers but sometimes

use the telephone to share order data, sales trends, and customer reactions to a new style. Zara’s cross‐functional

teams enable information sharing among everyone who “needs to know” and therefore creates the opportunity to

change directions quickly to respond to new market trends.

Building Agile and Dynamic Business Processes To stay competitive and consistently meet changing customer demands, organizations build dynamic business processes or agile business processes, processes that repeat through a constant renewal cycle of design, deliver, evaluate, redesign, and so on. Agile business processes are designed to simplify redesign and reconfiguration. They

are designed to be flexible and easily adaptable to changes in the business environment and can be incrementally

changed with little effort. Dynamic business processes, on the other hand, reconfigure themselves as they “learn”

and the business utilizes them.

c05.indd 104 11/26/2015 6:25:54 PM

105Changing Business Processes

To be agile or dynamic, a process necessitates a high degree of IT use. The more of the process that can be done

with software, the easier it is to change, and the more likely it can be designed to be agile or dynamic.

Examples of agile processes are often found in manufacturing operations, where production lines are reconfig-

ured regularly to accommodate new products and technologies. For example, automobile production lines produce

large numbers of vehicles, but very few are identical to the one made before or after it on the production line. Also,

vehicles are often built with space and wiring for options (such as a remote starter) that can be added by a dealer

quickly and with minimal labor. The design of the line is such that many changes in design, features, or options are

just incorporated into the assembly of the vehicle at hand.

Another common example is in software development. Agile software development methodologies underlie an

incremental and iterative development process that is often used to rapidly and collaboratively create working and

relevant software.

More recently, with the use of the Internet and social technologies, building agility into business processes is

increasingly common. Processes run entirely in the digital world. Some common examples are order management,

service/product provisioning, human resource support, and bill payment. The pervasiveness of the digital world has

necessitated rethinking many business processes; customers, employees, and other stakeholders expect to be able

to access processes on the Web and perform self‐service.

In fact, many processes have been designed as an app, as described in the Introduction. Consider smart phones

or tablets. Each app loaded on these devices is, in reality, an automated business process. And because it’s an app,

it’s relatively easy for the developer to upgrade, fix, and enhance. Apps are good examples of software that supports

agile processes.

An example of a dynamic process is a network with a changing flow of data. The network could have sensors

built in to monitor the flow, and when flow is greater than the current network configuration can handle, the net-

work automatically redistributes or requisitions more capacity to handle the additional data and reconfigures itself

to balance the flow over the new channels. Another example, with a more physical configuration, would be a call

center. Call center systems are designed to monitor the flow of calls coming into a center and the time it takes for

agents to respond to them. These systems can automatically redistribute calls to or from other centers as volume

increases or decreases. The system might be sufficiently sophisticated so that it can add additional agents to the

schedule or alert a supervisor of an increase and route calls to standby agents. Enabling the system to redistribute

incoming calls to respond to changes in the center is an important capability.

Dynamic IT applications, a component of software defined architecture, described more fully in Chapter  6,

are required for dynamic business processes. When the underlying IT is not designed with this goal in mind,

the business process itself cannot adapt as necessary to changing requirements of the business environment. The

benefits of agile and dynamic business processes are operational efficiency gained by the ease of incrementally

improving the process as necessary and the ability to create game‐changing innovative processes more quickly.

Sloan Valve’s NPD process is another example of a more flexible approach. Previously steeped in the old way of

doing things, and tied to legacy information systems, the redesigned NPD process was faster and enabled detection

of and reaction to customer feedback, process problems, and team misalignments.

Changing Business Processes Sloan Valve decided to do a complete redesign of its NPD process. After trying to incrementally change it with a

new IS, and minor changes to the process, managers realized that a complete transformation was necessary.

Transforming a business today means redesigning business processes. Two techniques used to transform a static

business process are: (1) radical process redesign, which is sometimes called business process reengineering (BPR) or simply reengineering and (2) incremental, continuous process improvement, which includes total quality management (TQM) and Six Sigma. Radical and incremental improvement concepts are important; they continue to be different tools a manager can use to effect change in the way his or her organization does business. The basis

of both approaches is viewing the business as a set of business processes rather than using a silo perspective.

c05.indd 105 11/26/2015 6:25:54 PM

106 Information Systems and Business Transformation

Incremental Change

At one end of the continuum, managers use incremental change approaches to improve business processes through

small, incremental changes. This improvement process generally involves the following activities:

• Choosing a business process to improve

• Choosing a metric by which to measure the business process

• Enabling personnel to find ways to improve the business process based on the metric

Personnel often react favorably to incremental change because it gives them control and ownership of improve-

ments and, therefore, renders change less threatening. The improvements grow from their grassroots efforts. TQM

is one such approach that incorporates methods of continuous process improvement. At the core of the TQM

method is W. Edwards Deming’s “14 Points,” or key principles to transform business processes. The principles

outline a set of activities for increasing quality and improving productivity.4 TQM has lost some of its luster in the

United States, but it continues to be very popular in Europe and Asia.

Six Sigma is an incremental and data‐driven quality management approach for eliminating defects from a process. The term six sigma comes from the idea that if the quality of all output from a process were to be mapped on a bell‐shaped curve, the tail of the curve, six sigma (standard deviations) from the mean, would

represent less than 3.4 defects per million. Such a low rate of defects would be close to perfect. The Six Sigma

methodology is carried out by experts known as Green Belts and more experienced experts known as Black Belts, who have taken special Six Sigma training and worked on numerous Six Sigma projects. Motorola was one of the first companies in the United States to use Six Sigma, but GE made the method a part of its business

culture driving significant and continuous improvement throughout the corporation. The GE Web site states “Six

Sigma is a highly disciplined process that helps us focus on developing and delivering near‐perfect products

and services.”5

Radical Change

Incremental change approaches work well for tweaking existing processes. However, they tend to be less effec-

tive for addressing cross‐functional processes. Major changes usually associated with cross‐functional processes

require a different type of management tool. At the other end of the change continuum, radical change enables

the organization to attain aggressive improvement goals (again, as defined by a set of metrics). The goal of rad-

ical change is to make a rapid, breakthrough impact on key metrics. Some businesses even have made radical

process reconfiguration a core competency so that they can better serve customers whose demands are constantly

changing.

Sloan Valve is an example of a company that set aggressive improvement goals and reached them with a rad-

ical change approach. The company set out to dramatically improve new products’ time to market and was able to

reduce it from 18–24 months to 12 months.

The difference in the incremental and radical approaches over time is illustrated by the graph in Figure 5.5. The

vertical axis measures, in one sense, how well a business process meets its goals. Improvements are made either

incrementally or radically. The horizontal axis measures time.

Not surprisingly, radical change typically faces greater internal resistance than does incremental change. There-

fore, radical change processes should be carefully planned and used only when major change is needed in a short

time. Some examples of situations requiring radical change are when the company is in trouble, when it imminently

4 For more information about TQM and Deming’s 14 Point approach to quality management, see the ASQ (Formerly known as the American Society

for Quality), a global community of experts on quality and the administrators of the Malcolm Baldrige National Quality Award program, http://asq.org/

learn‐about‐quality/total‐quality‐management/overview/overview.html (accessed August 26, 2015). 5 http://www.ge.com/en/company/companyinfo/quality/whatis.htm (accessed August 27, 2015).

c05.indd 106 11/26/2015 6:25:54 PM

107Workflow and Mapping Processes

faces a major change in the operating environment, or when it must change significantly to outpace its competition.

Key aspects of radical change approaches include the following:

• Need for major change in a short amount of time

• Thinking from a cross‐functional process perspective

• Challenge to old assumptions

• Networked (cross‐functional) organization

• Empowerment of individuals in the process

• Measurement of success via metrics tied directly to business goals and the effectiveness of new processes (e.g., production cost, cycle time, scrap and rework rates, customer satisfaction, revenues, and quality)

Workflow and Mapping Processes Workflow in its most basic meaning is the series of connected tasks and activities performed by people and com- puters that together form a business process. Consideration of workflow is a way to assess a cross‐functional

process. But the term workflow has come also to mean software products that document and automate processes. Workflow software facilitates the design of business processes and creates a digital workflow diagram. workflow

software lets the manager diagram answers to questions such as how a process will work, who will do what, what

the information system will do, and what decisions will be made and by whom. When combined with business pro-

cess management modules, processes can be managed, monitored, and modified.

The tool used to understand a business process is a workflow diagram, which shows a picture, or map, of the sequence and detail of each process step. More than 200 products are available for helping managers diagram the

workflow. The objective of process mapping is to understand and communicate the dimensions of the current pro-

cess. Typically, process engineers begin the process mapping procedure by defining the scope, mission, and bound-

aries of the business process. Next, engineers develop a high‐level overview flowchart of the process and a detailed

flow diagram of everything that happens in the process. The diagram uses active verbs to describe activities and

identifies all process actors, inputs, and outputs. The engineers verify the detailed diagram for accuracy with the

actors in the process and adjust it accordingly.

Business Process Management (BPM)

Thinking about the business as a set of processes has become more common, but managing the business as a set of

processes is another story. Some claim that to have truly dynamic or agile business processes requires a well‐defined

80

R ad

ic al

60

Time

P e rc

e n t Im

p ro

v e m

e n t

Incremental40

20

0

FIGURE 5.5 Comparison of radical and incremental improvement.

c05.indd 107 11/26/2015 6:25:54 PM

108 Information Systems and Business Transformation

and optimized set of IT processes, tools, and skills called business process management (BPM). In the 1990s, a class of systems to help manage workflows in the business emerged. The systems primarily helped track docu-

ment‐based processes where people executed the steps of the workflow. BPM systems go way beyond document

management capabilities and include features that manage person‐to‐person process steps, system‐to‐system steps,

and those processes that include a combination of them. Systems include process modeling, simulation, code gener-

ation, process execution, monitoring, and integration capabilities for both company‐based and Web‐based systems.

The tools allow an organization to actively manage and improve its processes from beginning to end.

Enterprise Rent‐a‐Car, one of the largest car rental companies in the world with 7,000 locations and more than

65,000 employees worldwide, used BPM to model, manage, and streamline its IT‐based processes. It used BPM to

build Request Online, the system through which employees requested laptops, software and applications, system

access, reports, and other services available from the IS department. The prior system was mostly manual, not

scalable as volume increased, and not automatable. Not surprisingly, it was difficult to make improvements to that

system. Using a BPM system, the IT staff developed a model that copied the way service requests were already

handled so the experience would be familiar and added features slowly to enhance the experience. The result was a

BPM‐based system that provided better management capabilities and created a common platform for rapid change

and capacity for future growth. That proved critical when Enterprise acquired National Car Rental and Alamo Rent

A Car, creating much more demand for Request Online. Enterprise was able to shift development to less costly

IT staff who could make process modifications directly through the BPM. Finally, the usability of the system was

increased as the BPM facilitated the creation of customized interfaces based on characteristics of the specific users.6

BPM systems provide a way to build, execute, and monitor automated processes that may go across organiza-

tional boundaries. Some of the functionality of a BPM may be found in enterprise applications such as enterprise

resource planning (ERP), customer relationship management (CRM), and financial software because these systems

also manage processes within a corporation. But BPM systems go outside a specific application to help companies

manage across processes. Some BPM systems manage front office applications that are often person‐to‐person

processes such as sales or ordering. These processes are people centric and incorporate social IT. Other BPM sys-

tems support back‐office processes that often are more system‐to‐system oriented and possibly extend outside the

corporation to include Web‐based components. See Figure 5.6 for a representative illustration of the components

of a BPM system.

Enterprise’s Request Online used a BPM system by Appian, which includes components to help a company

design, manage, and optimize core business processes. Appian offers sophisticated features that combine social

Social ITProcess

P ro

c e s s E

n g

in e

B u

s in

e s s R

u le

s

E v e n

ts

A n

a ly

ti c s

A c ti

v it

y M

o n

it o

ri n

g

In te

g ra

ti o

n

C o

n te

n t

P o

rt a l

C o

ll a b

o ra

ti o

n

Data

Web/Mobile/Cloud/Internal Data Center

Business Process Management (BPM) Platform

FIGURE 5.6 Sample BPM architecture. Source: Adapted from www.appian.com (accessed May 1, 2012).

6 Adapted from http://www.appian.com/about/news‐item/enterprise‐rent‐car‐goes‐live‐appian‐enterprise/ (accessed August 27, 2015).

c05.indd 108 11/26/2015 6:25:55 PM

109Workfl ow and Mapping Processes

IT capabilities with process modeling, content management, data management, and integration with existing

enterprise systems. Microsoft ’ s SharePoint, one of the most popular collaboration environments, can be managed

through Appian ’ s suite, creating a one‐stop‐shop for managing business processes in an enterprise.

Two other common vendors for BPM are IBM and SoftwareAG ’ s ARIS, which stands for architecture of

integrated information systems. ARIS has also come to mean an entire modeling approach. ARIS structures four

views of the enterprise, including an organizational view, a data view, a functional view, and a control view.

Using ARIS, managers can model the business, including its processes, using a common language and set of

procedures.

Integration versus Standardization

Processes are the ways organizations deliver goods and services to customers. Designing, building, and execut-

ing processes is one of the roles of management. Dr. Jeanne Ross, Principal Research Scientist at MIT ’ s Center for

Information Research, suggested that the level of integration and standardization of business processes, another

management decision, determines the role of IS. Ross pointed out that “Companies make two important choices

in the design of their operations: (1) how standardized their business processes should be across operational

units (business units, region, function, market segment) and (2) how integrated their business processes should

be across those units.” The resulting model defi nes important IT and business capabilities (see the following fi g-

ure). The level of process integration and standardization defi nes the necessary IS capabilities and ultimately the

investment the fi rm will need to make in IS.

Process Integration versus Standardization

Business Process Standardization

B u

si n

e ss

P ro

c e

ss

In te

g ra

ti o

n

Low High

High The business is focused on process integration, usually creating a single face to customers and suppliers but does not usually impose process standards on operating units.

The business has a centralized design with high needs for reliability, predictability, and sharing data across business units, creating a single view of the process.

Low The business has a decentralized design with which business units make local decisions on processes to meet customer needs.

The business is focused on process standardiza- tion in which tasks are done the same way with the same systems across business units, but the business units have little need to interact.

CEMEX , the multinational cement company based in Monterrey, Mexico, built a business high in process stan-

dardization and low in process integration. CEMEX standardized on eight information systems‐based business

processes to cover logistics, manufacturing, accounting, planning, operations, procurement, fi nance, and HR. Each

operating unit uses the same processes and creates similar data, but each runs autonomously, rarely sharing data.

This approach provides a competitive advantage because it enables the company to grow quickly, easing the

assimilation of acquired companies.

Merrill Lynch ’ s Global Private Client business with high integration and low standardization provides a wide

range of fi nancial services to clients across multiple channels such as fi nancial advisory services, online services,

and help center support services. The key to the company ’ s success is integration across processes to provide

a single view of the customer, which can then be leveraged when new products and services are announced. At

the same time, the company does not expect standardization across processes; each operating unit can create

what it needs as long as it uses a standardized technology platform that supports the integrated design. That is,

the separate systems need to coordinate the various information resources among themselves.

Source: J. Ross , “ Forget Strategy: Focus IT on Your Operating Model ,” MIT Center for Information Research, Research Briefing (December 2005 ), V(3C), http://cisr.mit.edu/blog/documents/2005/12/09/2005_12_3c_operatingmodels.pdf/ (accessed May 23, 2015) .

c05.indd 109 11/26/2015 6:25:55 PM

110 Information Systems and Business Transformation

Enterprise Systems Information technology is a critical component of almost every business process today because information flow

is at its core. A class of IT applications called enterprise systems is a set of information systems tools that many organizations use to enable this information flow within and between processes across the organization.

These tools help ensure integration and coordination across functions such as accounting, production, customer

management, and supplier management. Some are designed to support a particular industry such as health care,

retail, and manufacturing.

Computer systems in the 1960s and early 1970s were typically designed around a specific application. These

early systems were often not connected with each other and often had their own version of data. One of the authors

moved to another home in 1980 and visited the bank to change his address. He had to fill out a separate form for

his checking and savings account. It was lucky that the post office forwarded mail for a year after the move; four

months after moving, the bank sent a year‐end auto loan summary document via his old address, requiring another

update of the address, and nearly a year later, the bank sent his safe deposit box renewal form via his old address

too, requiring yet another update. It was obvious that each system contained its own copy of redundant data and

existed in its own silo.

Organizational computing groups faced the challenge of linking and maintaining the patchwork of loosely over-

lapping, redundant systems. In the 1980s and 1990s, software companies in a number of countries, including the

United States, Germany, and the Netherlands, began developing integrated software packages that used a common

database and cut across organizational systems. Some of these packages were developed from administrative sys-

tems (e.g., finance and human resources), and others evolved from materials resource planning (MRP) in manu-

facturing. These comprehensive software packages that incorporate all modules needed to run the operations of

a business are called enterprise information systems (EIS) or simply enterprise systems. Enterprise systems include ERP, supply chain management (SCM), CRM, and product life cycle management (PLM) systems (see

Figure  5.7). Some companies develop proprietary enterprise systems to support mission‐critical processes when

they believe these processes give them an advantage and using a vendor‐supplied system would jeopardize that

advantage. Other enterprise systems may be developed specifically to integrate organizational processes. Figure 5.8

describes some examples of the processes supported by an enterprise system.

Two of the largest vendors of enterprise systems are German‐based SAP and California‐based Oracle. Initially,

SAP defined the ERP software space, and Oracle had the database system supporting it. But more recently, SAP

has moved to its own database system, and Oracle has acquired many other smaller vendors, creating their own

suite of enterprise software solutions.

Sloan Valve, the case introduced at the beginning of this chapter, used SAP. Initially, Sloan implemented the

ERP module, but as the design emerged for the NPD process, the PLM module was key. It enabled the process

owner to keep track of targets, look at efficiencies in the process, and understand process problems. It also helped

track and allocate resources for each new product idea and enabled coordination between all the cross‐functional

team members.

Enterprise Resource Planning (ERP)

Enterprise resource planning (ERP) was designed to help large companies manage the fragmentation of information stored in hundreds of individual desktop, department, and business unit computers across the organi-

zation. These modules offered the IS department in many large organizations an option for switching from under-

performing, obsolete mainframe systems to client‐server environments designed to handle the changing business

demands of their operational counterparts. Many firms moved from their troubled systems in the late 1990s to avoid

the year 2000 (Y2K) problem7 and to standardize processes across their businesses.

7 The Y2K problem was of great concern in the 1990s because many old systems used two digits instead of four digits to represent the year, making it

impossible to distinguish between years such as 2000 and 1900.

c05.indd 110 11/26/2015 6:25:55 PM

111Enterprise Systems

FIGURE 5.8 Enterprise systems and examples of processes they support.

Enterprise System Sample Processes

Enterprise resource planning (ERP)

Financial management (accounting, financial close, invoice to pay process, receivable management); human capital management (talent management, payrolls, succession planning); operations management (procurement, logistics, requisition invoice payment, parts inventory)

Customer relationship management (CRM)

Marketing (brand management, campaign management); lead management; loyalty program management; sales planning and forecasting; territory and account management; customer service and support (claims, returns, warranties)

Supply chain management (SCM)

Supply chain design; order fulfillment; warehouse management; demand planning, forecasting; sales and operations planning; service parts planning; source‐to‐pay/ procurement process; supplier life cycle management; supply contract management

Product life cycle management (PLM)

Innovation management (strategy and planning, idea capture and management, program/ project management); product development and management; product compliance management

Implements functions of order

placement, order scheduling,

shipping and invoicing. Maximise cost savings with support

for the end-to-end procurement and

logistics processes.

Helps in planning and optimising

the manufacturing capacity and

material resources. It is evolved

from the MRP.

Control warehouse processes and

manage movements in the

warehouse and respond faster to

challenges and changes in

supply and demand.

Automate any financial operations

while ensuring regulatory compliance

and gaining real-time insight into overall

performance.

Maintain a complete employee

database and to optimally utilise of

all employees.

Aims to streamline and gain

greater control of the corporate

services.

Capture and maintain customer

relationships, facilitate the use of

customer experiences and evaluate

the knowledge management.

Analyse data and

convert to information. Focus on external strategies.

Efficiently and sustainably manage

the entire asset lifecycle, improve

asset usage and cut costs with

powerful analytics.

Customer services

(CRM)

Business Intelligence

Sales

Enterprise asset

management

e-Commerce

and others...

Procurement (SRM)

Production (PLM)

Distribution (SCM)

Accounting Human Resource

Corporate performance

and governance

Traditional ERP modules ERP II modulesIII

I

I I

II

II

II

II

II

II

II

I

FIGURE 5.7 Enterprise systems and the processes they automate. Source: Adapted from Shing Hin Yeung, http://commons.wikimedia.org/wiki/File:ERP_Modules.png (accessed August 27, 2015).

The next generation of enterprise system emerged: ERP II systems. Whereas an ERP makes company information

immediately available to all departments throughout the company, ERP II also makes company information

immediately available to external stakeholders, such as customers and partners. ERP II enables e‐business by inte- grating business processes between an enterprise and its trading partners. More recently, a move to better manage

information systems using the cloud has again called into question the design of some business processes.

c05.indd 111 11/26/2015 6:25:55 PM

112 Information Systems and Business Transformation

Today, ERP systems include all of the ERP II functionality plus social and collaboration features. A good example

is Chatter from Salesforce.com,8 which includes an activity stream interface (similar to Facebook) for employees

with easy connections to the firm’s information in its ERP. SAP’s ERP solution includes SAP ERP Financials, SAP

ERP Human Capital Management, and SAP ERP Operations. Oracle’s ERP solution, EnterpriseOne, offers these

same functions. Both vendors have integrated their ERP solutions with their supply chain/logistics solutions, their

CRM solutions, and several other modules that make them a one‐stop shop for software that provides the backbone

of an enterprise.

Characteristics of ERP Systems

ERP systems have several characteristics:9

• Integration. ERP systems are designed to seamlessly integrate information flows throughout the company. ERP systems are configured by installing various modules, such as:

• Manufacturing (materials management, inventory, plant maintenance, production planning, routing, shipping, purchasing, etc.)

• Accounting (general ledger, accounts payable, accounts receivable, cash management, forecasting, cost accounting, profitability analysis, etc.)

• Human resources (employee data, position management, skills inventory, time accounting, payroll, travel expenses, etc.)

• Sales (order entry, order management, delivery support, sales planning, pricing, etc.)

• Packages. ERP systems are usually commercial packages purchased from software vendors. Unlike many packages, ERP systems usually require long‐term relationships with software vendors because the complex

systems must typically be modified on a continuing basis to meet the organization’s needs.

• Best practices. ERP systems reflect industry best (or at least “very good”) practices for generic business processes. To implement them, businesses often have to change their processes in some way to accommo-

date the software.

• Some assembly required. The ERP system is software that needs to be integrated with the organization’s hardware, operating systems, databases, and network. Further, ERP systems often need to be integrated with

proprietary legacy systems. It often requires that middleware (software used to connect processes running in one or more computers across a network) or “bolt‐on” systems be used to make all the components opera-

tional. Vendor‐supplied ERP systems have a number of configurable components, too, which need to be set

up to best fit with the organization. Rarely does an organization use an ERP system directly “out of the box”

without configuration.

• Evolving. ERP systems were designed first for mainframe systems, then for client‐server architectures, and now for Web‐enabled or cloud‐based delivery.

Integrating ERP packages with other software in a firm is often a major challenge. For example, integrating

internal ERP applications with supply chain management software seems to create issues. Making sure the link-

ages between the systems happen seamlessly is a challenge. One important problem in meeting this challenge is to

allow companies to be more flexible in sourcing from multiple (or alternative) suppliers while also increasing the

transparency in tightly coupled supply chains. A second problem is to integrate ERP’s transaction‐driven focus into

a firm’s workflow.10

8 See http://www.salesforce.com/chatter/overview/ (accessed August 27, 2015). 9 M. Lynne Markus and Cornelis Tanis, “The Enterprise System Experience—From Adoption to Success,” Framing the Domains of IT Management: Projecting the Future Through the Past, ed. R. Zmud (Cincinnati, OH: Pinaflex Educational Resources, 2000), 176–79. 10 Amit Basu and Akhil Kumar, “Research Commentary: Workflow Management Issues in e‐Business,” Information Systems Research 13, no. 1 (March 2002), 1–14.

c05.indd 112 11/26/2015 6:25:55 PM

113Enterprise Systems

Managing Customer Relationships

A type of software package that is increasingly considered an enterprise system is customer relationship management

systems. Customer relationship management (CRM) is a set of software programs that supports management activities performed to obtain, enhance relationships with, and retain customers. They include sales, support, and

service processes. Today, CRM has come to mean the enterprise systems that support these processes, and the term

is used interchangeably with the set of activities.

CRM processes create ways to learn more about customers ’ needs and behaviors with the objective of developing

stronger relationships. CRM systems consist of technological components as well as many pieces of information

about customers, sales, marketing effectiveness, responsiveness, and market trends. Optimized CRM processes and

systems can lead to better customer service, more effi cient call centers, product cross‐selling, simplifi ed sales and

marketing efforts, more effi cient sales transactions, and increased customer revenues. The goal of CRM is to pro-

vide more effective interaction with customers and bring together all information the company has on a customer.

The top‐selling CRM systems are from Salesforce.com, SAP, Oracle, and Microsoft Dynamics . 11 Oracle and

SAP have CRM systems that integrate with their other enterprise systems. Oracle ’ s CRM system includes mod-

ules for pricing, sales force automation, sales order management, support activities, customer self‐service, and

11 Louis Columbus , “ Gartner CRM Market Share Update: 41% Of CRM Systems Are SaaS‐based, Salesforce Dominating Market Growth ,” Forbes , May 6, 2014 , http://www.forbes.com/sites/louiscolumbus/2014/05/06/gartners‐crm‐market‐share‐update‐shows‐41‐of‐crm‐systems‐are‐saas‐based‐with‐

salesforce‐dominating‐market‐growth/ (accessed August 27, 2015) .

Geographic Lens: Global vs. Local ERPs

ERP systems are usually designed around best practices—but whose best practices? SAP and Oracle , the leading

vendors of ERP systems, have a Western bias. More specifi cally, best practices at the heart of their systems are

based upon business processes that are found in successful companies in Germany and North America. How-

ever, when these systems are transplanted into Asian companies, problematic “misfi ts” have been found to occur.

An example is the use of ERP systems designed for hospitals. Western health care models are decidedly dif-

ferent from those used in Singapore. In Western countries, insurance enables patients to pay a fraction of their

medical expenses themselves, and the government or private insurance covers the rest. Singapore has a com-

pletely different model. In Singapore, health care expenses are covered primarily by the individual. Government

subsidies and other community support is minimal.

How does this affect processes embedded in ERP systems in hospitals? When ERP systems are designed for

Western hospitals, they include modules that help manage the complexity of billing and collections that result

from claims submissions and insurance verifi cation. When the primary payment is from individuals paying at the

time of service or in installments, the collections process is signifi cantly different. Further, “bed class” is important

in Singapore where patients in public hospitals can choose from a variety of plans ranging from one bed to six or

more per room. The Western model is simpler because single‐bed rooms are more common.

Because of differences and “misfi ts,” businesses in many non‐Western companies are turning to local vendors that

have developed systems refl ecting local best practices. For example, local ERP vendors in Taiwan have developed

ERP systems to support the majority of fi rms in the market space—small‐ to medium‐sized Taiwanese companies with

sophisticated, adaptive logistic networks. The local ERP vendors have adopted a strategy of customization and are

more willing to modify their systems to satisfy local needs than are their large global competitors.

These examples suggest that another factor needs to be considered when designing and implementing and

ERP: It should not be implemented if the system is based on a cultural model that confl icts with the local customs

and that cannot easily be accommodated.

Sources: C. Soh , S. K. Sia , and J. Tay‐Yap , “ Cultural Fits and Misfits: Is ERP a Universal Solution ,” Communications of the ACM 43 , no. 4 ( 2000 ), 47 – 51 ; E. T. G. Wang , G. Kleing , and J. J. Jiang , “ ERP Misfit: Country of Origin and Organizational Factors ,” Journal of Management Information Systems 23 , no. 1 ( 2006 ), 263 – 92 .

c05.indd 113 11/26/2015 6:25:55 PM

114 Information Systems and Business Transformation

service management. SAP’s CRM system has similar modules plus marketing support such as resource and brand

management, campaign management, real‐time offer management, loyalty management, and e‐marketing. There

is also an e‐commerce module that facilitates personalized interface and self‐service applications for customers.

Salesforce.com is a different type of CRM. Whereas Oracle and SAP came from the enterprise systems space and

then created a CRM module, Salesforce.com started with a CRM solution. In addition, the products by Oracle

and SAP grew from on‐premise enterprise systems, and each company eventually built Web‐based versions of its

products, but Salesforce.com started as a Web‐based cloud system. Managers who seek a CRM system for their

organizations should compare the features and delivery systems of these and other solutions provided by niche ven-

dors who specialize in systems optimized for specific industry applications.

Social IT is increasingly integrated into CRM solutions. Providing software or Web applications that extend

the brand, engage customers, allow customers to interact with each other and with employees, and provide ser-

vice options generates additional “touches” with customers. CRM systems record these touches. The information

becomes an additional channel of data useful for building customer relationships. Salesforce.com teamed with Dun

& Bradstreet to use Data.com, a cloud‐based storehouse of company and customer contact information for use in

CRM systems. Data.com uses a crowd‐sourcing model to collect up‐to‐date information with users of the server

contributing data and helping to keep that data accurate.

In Chapter  1, we described the Ritz‐Carlton’s CRM, Class, which captures information about guest pref-

erences and enables the chain to provide enhanced, customized service during future visits. Web sites collect

information from customers who visit, make purchases, or request information. That information is stored in the

company’s CRM and used in many ways to better meet customer needs and enhance the customer experience.

For example, movie site Netflix stores all the purchases and product reviews a customer makes in its CRM. Using

that information, the site recommends additional films the customer might enjoy based on analysis of the data

in the CRM.

Managing Supply Chains

Another type of enterprise system in common use is a supply chain management (SCM) system, which manages the integrated supply chain. Business processes are not just internal to a company. With the help of information

technologies, many processes are linked across companies with a companion process at a customer or supplier,

creating an integrated supply chain. Technology, especially Web‐based technology, allows the supply chains of a

company’s customers and suppliers to be linked through a single network that optimizes costs and opportunities

for all companies in the supply chain. By sharing information across the network, guesswork about order quan-

tities for raw materials and products can be reduced, and suppliers can make sure they have enough on hand if

demand for their products unexpectedly rises.

The supply chain of a business is the process that begins with raw materials and ends with a product or service

ready to be delivered (or in some cases actually delivered) to a customer. It typically includes the procurement

of materials or components, the activities to turn these materials into larger subsystems or final products, and

the distribution of these final products to warehouses or customers. But with the increase in information systems

use, the supply chain may also include product design, product planning, contract management, logistics, and

sourcing. Globalization of business and ubiquity of communication networks and information technology have

enabled businesses to use suppliers from almost anywhere in the world. At the same time, this has created an

additional level of complexity for managing the supply chain. Supply chain integration is the approach of tech- nically linking supply chains of vendors and customers to streamline the process and to increase efficiency and

accuracy.

Without such linking, a temporary increase in demand from a retailer might become interpreted by its suppliers

as permanent, and the changes can become magnified by each supplier up the chain when each supplier attempts to

add another percent or two just to be “safe.” Those erratic and wild changes are called the bullwhip effect. Linking synchronizes all suppliers to the same demand increase up and down the chain and prevents that effect.

c05.indd 114 11/26/2015 6:25:55 PM

115Enterprise Systems

Integrated supply chains have several challenges, primarily resulting from different degrees of integration and

coordination among supply chain members.12 At the most basic level, there is the issue of information integration.

Partners must agree on the type of information to share, the format of that information, the technological stan-

dards they both use to share it, and the security they use to ensure that only authorized partners access it. Trust

must be established so the partners can solve higher‐level issues that may arise. At the next level is the issue of

synchronized planning. At this level, the partners must agree on a joint system of planning, forecasting, and replen-

ishment. The partners, having already agreed on what information to share, now have to agree on what to do with

it. The third level can be described as workflow coordination—the coordination, integration, and automation of

critical business processes between partners. For some supply chains, this might mean simply using a third party

to link the procurement process to the preferred vendors or to communities of vendors who compete virtually for

the business. For others, it might be a more complex process of integrating order processing and payment systems.

Ultimately, supply chain integration leads to new business models as varied as the visionaries who think them up.

These business models are based on new ideas of coordination and integration made possible by the Internet and

information‐based supply chains. In some cases, new services have been designed by the partnership between

supplier and customer, such as new financial services offered when banks link up electronically with businesses

to accept online payments for goods and services purchased by the businesses’ customers. In other cases, a new

business model for sourcing has resulted, such as one in which companies list their supply needs and vendors elec-

tronically bid to be the supplier for that business.

Demand‐driven supply networks are the next step for companies with highly evolved supply chain capabilities.

Kimberly Clark, the 135‐year‐old consumer products company, is one such example. Its vision is for a highly

integrated suite of supply chain systems that provide end‐to‐end visibility of the supply processes in real time.

Key processes in the company’s demand‐driven supply network are forecast to stock and order to cash. Using an

integrated suite of systems allows the firm’s users to share the same information as close to real time as possible and

to use the data in their systems for continually updating their supply chain, category management, and consumer

insight processes. IS have allowed managers to reduce the problems of handing off data from one system or process

to another (because now everything is in one system), having employees work from different databases (because it’s

now one database), and working with old data (because it’s as real time as possible). This has improved managers’

ability to see what’s going on in the marketplace and evaluate the impact of promotions, production, and inventory

much more quickly.

Integrated supply chains are truly global in nature. Thomas Friedman, in his book The World is Flat, describes how the Dell computer that he had ordered for writing his book was developed from the contributions of an

integrated supply chain that involved about four hundred companies in North America, Europe, and, primarily,

Asia. However, the globalization of integrated supply chains faces a growing challenge from skyrocketing trans-

portation costs. For example, Tesla Motors, a pioneer in electric‐power cars, had originally planned the production

of a luxury roadster for the U.S. market based on an integrated global supply chain. The 1,000‐pound battery packs

for the cars were to be manufactured in Thailand, shipped to Britain for installation, and then shipped to the United

States where they would be assembled into cars. However, because of the extensive costs associated with shipping

the batteries more than 5,000 miles, Tesla decided to make the batteries and assemble the cars near its headquarters

in California. Darryl Siry, Tesla’s Senior Vice President of Global Sales, Marketing, and Service explains: “It was

kind of a no‐brain decision for us. A major reason was to avoid the transportation costs, which are terrible.” Econ-

omists warn managers to expect the “neighborhood effect” in which factories may be built closer to component

suppliers and consumers to reduce transportation costs. This effect may apply not only to cars and steel but also to

chickens and avocados and a wide range of other items.13

12 Hau Lee and Seungjin Whang, “E‐Business and Supply Chain Integration,” Stanford University Global Supply Chain Management Forum (November

2001). 13 Larry Rohter, “Shipping Costs Start to Crimp Globalization” The New York Times, 1, 10, http://www.nytimes.com/2008/08/03/business/worldbusiness/ 03global.html (accessed August 27, 2015).

c05.indd 115 11/26/2015 6:25:56 PM

116 Information Systems and Business Transformation

Dell continues to be not only a great example of an integrated supply chain but also of the neighborhood

effect. Its “build‐to‐order” strategy of building computers as they are ordered rather than to mass‐produce them for

inventory requires an integrated supply chain. One of the authors of this textbook visited a Dell plant in Malaysia

with several dozen students. An official there described how the plant’s zero inventory goal was accomplished by

ordering components only when computers were ordered, to arrive on the day of assembly. Also, suppliers were

strategically located in adjacent buildings surrounding the plant with an airport practically in walking distance. In

this way, suppliers are closely linked with the actual production process.

Product Life Cycle Management (PLM)

A less well-known type of enterprise system is a product life cycle management (PLM) system. PLM systems automate the steps that take ideas for products and turn them into actual products. PLM refers to the process that starts with the idea for a product and ends with the “end of life” of a product. It includes the innovation activities,

new product development, and management, design, and product compliance (if necessary). PLM systems con-

tain all the information about a product such as design, production, maintenance, components, vendors, customer

feedback, and marketing.

Advantages and Disadvantages of Enterprise Systems

One major benefit of enterprise systems is that they represent a set of industry best practices. One confidential

story relayed to the authors described a large university that had suffered for years with inconsistent, incomplete,

and immature processes. The university’s leader announced in advance that rather than customize a new ERP

to fit those processes, the directive was to replace completely those poor processes provided by the ERP. As a

result, the ERP’s best practices dramatically improved the university’s ability to provide information services to

faculty, staff, and students and also to track the entire “life cycle” of people from initial inquiry to graduation

and beyond.

Another major benefit of an enterprise system is that all modules of the information system easily communi-

cate with each other, offering enormous efficiencies over stand‐alone systems. In business, information from one

functional area is often needed by another area. For example, an inventory system stores information about vendors

who supply specific parts. This same information is required by the accounts payable system, which pays vendors

for their goods. It makes sense to integrate these two systems to have a single accurate record of vendors and to use

an enterprise system to facilitate that integration.

Because of the focus on integration, enterprise systems are useful tools for an organization seeking to centralize

operations and decision making. As described earlier in the Integration versus Standardization box about the Ross

framework, high integration allows units to coordinate easily and unify their data for global access. Redundant data

entry and duplicate data may be eliminated; standards for numbering, naming, and coding may be enforced; and

data and records can be cleaned up through standardization. Further, the enterprise system can reinforce the use of

standard procedures across different locations.

The obvious benefits notwithstanding, implementing an enterprise system represents an enormous amount of

work. For example, if an organization has allowed both the manufacturing and the accounting departments to keep

their own records of vendors, then most likely these records are kept in somewhat different forms (one department

may enter the vendor name as IBM, the other as International Business Machines or even IBM Corp., all of which

make it difficult to integrate the databases). Making matters worse, a simple data item’s name itself might be stored

differently in different systems. In one system, it might be named Phone_No, but in another, it might be simply

Phone. Such inconsistencies in data items and values must be recognized and fixed so that the enterprise system

can provide optimal advantage.

Moreover, even though enterprise systems are flexible and customizable to a point, most also require business

processes to be redesigned to achieve optimal performance of the integrated modules. It is rare that an off‐the‐

shelf system is perfectly harmonious with an existing business process; the software usually requires significant

modification or customization to fit with the existing processes, or the processes must change to fit the software.

c05.indd 116 11/26/2015 6:25:56 PM

117Enterprise Systems

In most installations of enterprise systems, both take place. The system is usually customized when it is installed

in a business by setting a number of parameters. Many ERP projects are massive undertakings, requiring formal,

structured project management tools (as discussed in Chapter 11).

All systems make assumptions about how the business processes work, and at some level, customization is not

possible. For example, one major Fortune 500 company refused to implement a vendor’s enterprise system because

the company manufactured products in lots of “one,” and the vendor’s system would not handle the volume this

company generated. If the company had decided to use the ERP, a complete overhaul of its manufacturing process

in a way that executives were unwilling to do would have been necessary.

Implementing enterprise systems requires organizations to make changes beyond just the processes, but also in

their organization structure. Recall from Chapter 1 that the Information Systems Strategy Triangle suggests that

implementing an information system must be accompanied with appropriate organizational changes to be effective.

Implementing an enterprise system is no different; a 2014 Panorama report stated directly that only firms that allo-

cate enough of the project budget to organizational change management will achieve the best results.14 For example,

who will now be responsible for entering the vendor information that was formerly kept in two locations? How

will that information be entered into the enterprise system? The answer to such simple operational questions often

requires managers minimally to modify business processes and more likely to redesign them completely to accom-

modate the information system.

Enterprise systems are also risky. The number of enterprise system horror stories demonstrates this risk. For

example, Kmart wrote off its $130 million ERP investment. American LaFrance (ALF), the manufacturer of highly

customized emergency vehicles, declared bankruptcy, blaming its IT vendor and its ERP implementation. The

problems with the implementation kept ALF from being able to manufacture many preordered vehicles.15 Two

months after the installation of a new ERP system, the Fort Worth Police Officers Association complained that pay-

checks were not being received correctly or on a timely basis by officers. Some officers had not been paid since the

installation, and others were shortchanged in their paychecks because the new system was not able to handle odd

hours and shift work.

Furthermore, enterprise systems and the organizational changes they induce tend to come with a hefty price tag.

In a study of the initial acquisition and implementation costs of ERP systems in primarily midsize companies (with

$100 million to $1 billion in annual revenues), half of the responding 157 chief financial officers (CFOs) admitted

spending more than $1 million for the license, service, and first year’s maintenance on their current ERP systems. Nine of 10 respondents said they spent a minimum of $250,000. Unreported were additional hidden costs in the

form of technical and business changes, likely to be necessary when implementing an enterprise system. These

include project management, user training, and IT support costs.16 Some surveys uncover negative impacts on

performance. For instance, in 2014, overruns in costs were found to plague 54% of ERP projects, and 72% of the

firms reporting encountered implementation delays. Perhaps more important were disruptions in service such as

difficulties in shipping products, experienced by 51% of the firms surveyed.17

One of the reasons that ERP systems are so expensive is that they are sold as a suite, such as financials or manu-

facturing, and not as individual modules. Because buying modules separately is difficult, companies implementing

ERP software often find the price of modules they won’t use hidden in the cost of the suite.

Seventy percent of survey respondents report that they are satisfied with their ERP systems in spite of the large

expense, overruns, delays, and disruptions experienced, largely due to the capabilities of ERP systems. However,

only 63% considered the project a “success,” perhaps due to overruns.18 A set of advantages and disadvantages of

enterprise systems is provided in Figure 5.9.

14 Panorama Consulting, “Organizational Issues Number One Reason for Extended Durations,” http://panorama‐consulting.com/company/press‐releases/

panorama‐consulting‐solutions‐releases‐2014‐erp‐report/ (accessed February 26, 2015). 15 For additional examples of IT failures in general and enterprise systems failures in particular, please visit the blog written by Michael Krigsman, http://

blogs.zdnet.com/projectfailures/. 16 T. Wailgum, “Why CEOs and CFOs Hate It: ERP” (April 8, 2009), http://advice.cio.com/thomas_wailgum/why_cfos_and_ceos_hate_it_erp (accessed

February 14, 2012). 17 Panorama Consulting 2014 Report. 18 Ibid.

c05.indd 117 11/26/2015 6:25:56 PM

118 Information Systems and Business Transformation

When the System Drives the Transformation

When is it appropriate to use the enterprise system to drive transformation and business process redesign, and when

is it appropriate to redesign the process fi rst and then implement an enterprise system? Although it may seem like

the process should be redesigned fi rst and then the information system aligned to the new design, there are times

when it is appropriate to let the enterprise system drive business process redesign. First, when an organization is just

starting out and processes do not yet exist, it is appropriate to begin with an enterprise system as a way to structure

operational business processes. After all, most processes embedded in the “plain vanilla” enterprise system from

a top vendor are based on the best practices of corporations that have been in business for years. Second, when an

organization does not rely on its operational business processes as a source of competitive advantage, then using an

enterprise system to redesign these processes is appropriate. Third, it is reasonable when the current systems are in

Social Business Lens: Crowdsourcing Changes Innovation Processes

One business process that has been radically changed by the use of social IT is the way innovation is managed

using crowdsourcing. Enterprises have found ways to use a social IT platform to solicit, discuss, and prioritize new

ideas. Anyone in the community can add an idea, and then the entire community can discuss, comment on, and

rate the idea. Managers then have a wealth of ideas along with community input to use as input into the innova-

tion process.

One of the original examples of this is Dell ’ s Ideastorm. Anyone in the community can access Ideastorm to

view ideas posted by the community, post an idea for Dell products or services, vote on the ideas presented,

and see what Dell managers have decided to do with the ideas presented. Ideas presented by the community

range from suggestions for new features on existing systems to new products and services Dell might offer. By

allowing the community to comment and vote on ideas, managers get a sense of the importance and viability of

implementing the innovation.

Similar social platforms have been implemented by numerous other companies including Starbucks ’ mystar-

bucksidea.com and Best Buy ’ s IdeaX. Companies have also taken this idea inside the corporation to solicit ideas

and innovations about processes, products, and other enterprise issues. Dell ’ s EmployeeStorm and the City of

New York ’ s Simplicity are two social IT examples of soliciting ideas to improve processes and effi ciencies from

employees.

Companies have also embraced the crowd for individual projects; Sam Adams , the beer company, used a

Facebook application for crowdsourcing the next fl avor of beer. The application let fans select the color, clar-

ity, body, malt, hops, and yeast components of a recipe. For each component, the crowdsourcing application

educated fans about the contribution each component made to the resulting beer. The company collected the

crowd ’ s preferences, sharing them along the way for comment and discussion. The results not only gave Sam

Adams managers information about preferences of their fans but also prioritized ideas about the next product to

create with a high probability that it will have a large fan base to get it started.

Sources: https://gigaom.com/2011/01/19/new‐york‐city‐crowdsourcing/ (accessed August 27, 2015) ; http://www.facebook.com/ SamuelAdams?sk=app_299970113373932 (accessed January 19, 2012); http://www.ideastorm.com (accessed on August 30, 2015).

FIGURE 5.9 Advantages and disadvantages of enterprise systems.

Advantages Disadvantages

• Represent “best practices” • Allow modules throughout the organization to

communicate with each other • Enable centralized decision making • Eliminate redundant data entry • Enable standardized procedures in different locations

• Require enormous amount of work • Require redesign of business practices for maximum

benefi t • Have very high cost • Are sold as a suite, not individual modules • Require organizational changes • Have high risk of failure

c05.indd 118 11/26/2015 6:25:56 PM

119Summary

crisis and there is not enough time, resources, or knowledge in the firm to fix them. Even though it is not an optimal

situation, managers must make tough decisions about how to fix the problems. A business must have working oper-

ational processes; therefore, using an enterprise system as the basis for process design may be the only workable

plan. It was precisely this situation that many companies faced with Y2K.

Likewise, it is sometimes inappropriate to let an enterprise system drive business process change. When an

organization derives a strategic advantage through its operational business processes, it is usually not advisable

for it to buy a vendor’s enterprise system. Using a standard, publicly available information system that both the

company and its competitors can buy from a vendor may mean that any system‐related competitive advantage is

lost. For example, consider a major computer manufacturer that relied on its ability to process orders faster than

its competitors to gain strategic advantage. Adopting an enterprise system’s approach would result in a loss of that

advantage. Furthermore, the manufacturer might find that relying on a third party as the provider of such a strategic

system would be a mistake in the long run because any problems with the system due to bugs or changed business

needs would require negotiating with the ERP vendor for the needed changes. With a system designed in house, the

manufacturer was able to ensure complete control over the IS that drives its critical processes.

Another situation in which it would be inappropriate to let an enterprise system drive business process change

is when the features of available packages and the needs of the business do not fit. An organization may use spe-

cialized processes that cannot be accommodated by the available enterprise systems. For example, many ERPs

were developed for discrete part manufacturing and do not support some processes in paper, food, or other process

industries.19

A third situation would result from lack of top management support, company growth, a desire for strategic flex-

ibility, or decentralized decision making that render the enterprise system inappropriate. For example, Dell stopped

the full implementation of SAP R/3 after only the human resources module had been installed because the CIO did

not think that the software would be able to keep pace with Dell’s extraordinary growth. Enterprise systems were

also viewed as culturally inappropriate at the highly decentralized Kraft Foods.

Challenges for Integrating Enterprise Systems Between Companies

With the widespread use of enterprise systems, the issue of linking supplier and customer systems to the business’s

systems brings many challenges. As with integrated supply chains, there are issues of deciding what to share, how

to share it, and what to do with it when the sharing takes place. There are also issues of security and agreement on

encryption or other measures to protect data integrity as well as to ensure that only authorized parties have access.

Some companies have tried to reduce the complexity of this integration by insisting on standards either at the

industry level or at the system level. An example of an industry‐level standard is the bar coding used by all who do

business in the consumer products industry. An example of a system‐level standard is the use of SAP or Oracle to

provide the ERP system used by both supplier and customer. And the increasing use of cloud‐based systems with

standard interfaces makes the integration easier.

S U M M A R Y

• Most business processes today have a significant information systems component to them. Either the process is com- pletely executed through software or an important information component complements the physical execution of the

process. Transforming business, therefore, involves rethinking the information systems that support business processes.

• IS can enable or impede business process change. IS enables change by providing both the tools to implement the change and the tools on which the change is based. IS can impede change, particularly when the process flow is mis-

matched with the capabilities of the IS.

• To understand the role IS plays in business transformation, one must take a business process rather than a functional (silo) perspective. Business processes are well‐defined, ordered sets of tasks characterized by a beginning and an end,

19 Markus and Tanis, “The Enterprise System Experience,” 176–79.

c05.indd 119 11/26/2015 6:25:56 PM

120 Information Systems and Business Transformation

sets of associated metrics, and cross‐functional boundaries. Most businesses operate business processes even if their

organization charts are structured by functions rather than by processes.

• Agile business processes are processes that are designed to be easily reconfigurable. Dynamic processes are designed to automatically update themselves as conditions change. Both types of processes require a high degree of information

systems, which makes the task of changing the process a software activity rather than a physical activity.

• Making changes in business processes typically involves either incremental or radical change. Incremental change with TQM and Six Sigma implies an evolutionary approach. Radical change with a BPR approach, on the other hand, is more sudden.

Either approach can be disruptive to the normal flow of the business; hence, strong project management skills are needed.

• BPM systems are used to help managers design, control, and document business processes and ultimately the workflow in an organization.

• An enterprise system is a large information system that provides the core functionality needed to run a business. These systems are typically implemented to help organizations share data between divisions. However, in some cases,

enterprise systems are used to effect organizational transformation by imposing a set of assumptions on the business

processes they manage.

• An ERP system is a type of enterprise system used to manage resources including financial, human resources, and operations.

• A CRM system is a type of enterprise system used to manage the processes related to customers and the relationships developed with customers.

• An integrated supply chain is often managed using an SCM system, an enterprise system that crosses company bound- aries and connects vendors and suppliers with organizations to synchronize and streamline planning and deliver products

to all members of the supply chain.

• A PLM system is a type of enterprise system support product development from its first idea up through its end.

• Information systems are useful as tools to both enable and manage business transformation. The general manager must take care to ensure that consequences of the tools themselves are well understood and well managed.

D I S C U S S I O N Q U E S T I O N S

1. Why was radical design of business processes embraced so quickly and so deeply by senior managers of so many com- panies? In your opinion, and using hindsight, was its popularity a benefit for businesses? Why or why not?

2. Off‐the‐shelf enterprise IS often forces an organization to redesign its business processes. What are the critical success factors to make sure the implementation of an enterprise system is successful?

3. ERP systems are usually designed around best practices. But whose best practices are the right ones? A Western bias is common; practices found in North America or Europe are often the foundation. When transferred to Asia, however, the

K E Y T E R M S

agile business processes (p. 104)

business process management

(BPM) (p. 107)

business process

perspective (p. 102)

business process reengineering

(BPR) (p. 105)

customer relationship management

(CRM) (p. 113)

cycle time (p. 102)

dynamic business processes (p. 104)

Enterprise Information Systems

(EIS) (p. 110)

enterprise resource planning

(ERP) (p. 110)

enterprise systems (p. 110)

middleware (p. 112)

process (p. 102)

process perspective (p. 102)

product life cycle management

(PLM) (p. 116)

silo perspective (p.103)

Six Sigma (p. 105)

supply chain management

(SCM) (p. 114)

throughput (p. 102)

total quality management

(TQM) (p. 105)

workflow (p. 107)

workflow diagram (p. 107)

c05.indd 120 11/26/2015 6:25:56 PM

121Case Study

Bicycle enthusiasts not only love the ride their bikes provide but also are often willing to pay for newer technology, espe-

cially when it will increase their speed or comfort. Innovating new technologies for bikes is only half the battle for bike

manufacturers. Designing the process to manufacture the bikes is often the more daunting challenge.

Consider the case of Santa Cruz Bicycles . It digitally designs and builds mountain bikes and tests them under the most

extreme conditions to bring the best possible product to its customers. A few years back, the company designed and patented

the Virtual Pivot Point (VPP) suspension system, a means to absorb the shocks that mountain bikers encounter when on the

rough terrain of the off‐road ride. One feature of the new design allowed the rear wheel to bounce 10 inches without hitting

the frame or seat, providing shock absorption without feeling like the rider was sitting on a coiled spring.

The fi rst few prototypes did not work well; in one case, the VPP joint ’ s upper link snapped after a quick jump. The expe-

rience was motivation for a complete overhaul of the design and engineering process to fi nd a way to go from design to

prototype faster. The 25‐person company adopted a similar system used by large, global manufacturers: product life cycle

management (PLM) software.

The research and development team had been using computer‐aided‐design (CAD) software, but it took seven months to

develop a new design, and if the design failed, starting over would be the only solution. This design approach was a drain

not only on the company ’ s time but also on its fi nances. The design team found a PLM system that helped members analyze

and model capabilities in a much more robust manner. The team used simulation capabilities to watch the impact of the

new designs on rough mountain terrain. The software tracks all the variables the designers and engineers need so they can

quickly and easily make adjustments to the design. The new system allows the team to run a simulation in a few minutes,

representing a very large improvement over their previous design software, which took seven hours to run a simulation.

The software was just one component of the new process design. The company also hired a new master frame builder to

build and test prototypes in house and invested in a van‐size machine that can fabricate intricate parts for the prototypes, a

process the company previously outsourced. The result was a signifi cant decrease in its design‐to‐prototype process. What

once averaged about 28 months from start of design to shipping of the new bike now takes 12 to 14 months.

■ CASE STUDY 5‐1 Santa Cruz Bicycles

resulting systems may be problematic. Why do you think this is the case? What might be different in the way different coun-

tries use processes (besides the standard “language” difference)?

4. Have you been involved with a company doing a redesign of its business processes? If so, what were the key things that went right? What went wrong? What could have been done better to minimize the risk of failure?

5. What do you think the former CIO of Dell , Jerry Gregoire, meant when he said, “Don ’ t automate broken business processes”? 20

6. What might an integrated supply chain look like for a financial services company such as an insurance provider or a bank? What are the components of the process? What would the customer relationship management process look like for this

same firm?

7. Tesco , the U.K. retail grocery chain, used its CRM system to generate annual incremental sales of £100 million. Using a fre- quent shopper card, a customer got discounts at the time of purchase, and the company got information about the customer ’ s

purchases, creating a detailed database of customer preferences. Tesco then categorized customers and customized dis-

counts and mailings, generating increased sales and identifying new products to expand the organization ’ s offerings. At the

individual stores, data showed which products must be priced below competitors, which products had fewer price‐sensitive

customers, and which products must have regular low prices to be successful. In some cases, prices were store specific,

based on the customer information. The information system has enabled Tesco to expand beyond groceries to books, DVDs,

consumer electronics, flowers, and wine. The chain also offers services such as loans, credit cards, savings accounts, and

travel planning. What can Tesco management do now that the company has a CRM that it could not do prior to the CRM

implementation? How does this system enable Tesco to increase the value provided to customers?

20 “Technology: How Much? How Fast? How Revolutionary? How Expensive?” Fast Company 56, no. 62, http://www.fastcompany.com/online/56/ fasttalk.html (accessed May 30, 2002).

c05.indd 121 11/26/2015 6:25:56 PM

122 Information Systems and Business Transformation

The fi rst Boeing 787 Dreamliner was delivered to Japan ’ s ANA in the third quarter of 2011, more than three years after the

initial planned delivery date. Its complicated, unique design (including a one‐piece fuselage that eliminated the need for

1,500 aluminum sheets and 50,000 fasteners and reduced the resulting weight of the plane proportionally) promised both

a reduction in out‐of‐service maintenance time and a 20% increase in fuel economy, but problems with early testing of

the new design contributed to the giant project ’ s troubles. Even after those delays, the 787 was grounded in January 2013

because the main battery had problems of overheating and subsequently burning. The problems were fi nally reported solved

in December 2014.

Delivery of Boeing ’ s 787 Dreamliner project was delayed, in part, because of the company ’ s global supply chain net-

work, which was touted to reduce cost and development time. In reality, the network turned out to be a major cause for

problems. Boeing decided to change the rules of the way large passenger aircraft were developed through its Dreamliner

program; rather than simply relying on technological know‐how, it decided to use collaboration as a competitive tool embed-

ded in a new global supply chain process.

With the Dreamliner project, Boeing not only attempted to create a new aircraft through the innovative design and

new material but also radically changed the production process. It built an incredibly complex supply chain involving

over 50 partners scattered in 103 locations all over the world. The goal was to reduce both the fi nancial risks involved in a

$10 billion‐plus project for designing and developing a new aircraft and the new product development cycle time. Boeing

tapped the expertise of various fi rms in different areas such as composite materials , aerodynamics, and IT infrastructure to

create a network in which partners ’ skills complement each other. This changed the basis of competition to skill set rather

than the traditional basis of low cost. In addition, this was the fi rst time Boeing had outsourced the production on the two

most critical parts of the plane—the wings and the fuselage.

The fi rst sign of problems showed up just six months into the trial production. Engineers discovered unexpected bubbles

in the skin of the fuselage during baking of the composite material. This delayed the project a month. Boeing offi cials in-

sisted that they could make up the time and all things were under control. But next to fail was the test version of the nose

section. This time, a problem was found in the software programs, which were designed by various manufacturers. They

failed to communicate with each other, leading to a breakdown in the integrated supply chain. Then problems popped up in

the integration of electronics. The Dreamliner program entered the danger zone when Boeing declared that it was having

trouble getting enough permanent titanium fasteners to hold together various parts of the aircraft. The global supply network

did not integrate well for Boeing and left it highly dependent on a few suppliers.

The battery problems involved lithium‐ion batteries that could not recover from a situation involving a rare but serious

internal short circuit that would cause fl ames to spread from one cell to another. Lithium‐ion batteries had not previously

been used in an airplane and had not been tested under an assumption of a short circuit.

This case clearly underscores the hazards in relying on an extensive supply chain, failing to expect the worst case with

critical new parts, and encountering information exchange problems that caused long delays and seriously compromised a

company ’ s ability to carry out business as planned. Creating a radically different process can mean encountering unexpected

problems. In some cases, it would put a company so far behind its competition that it was doomed to fail. However, in this

case, the major competitor to the Dreamliner, the Airbus 380 program, was also using a global supply chain model, and its

program was delayed by a couple of years. The result for Boeing was a much‐anticipated plane with fuel economy and out-

standing design that made the wait worth it. However, because of compromises in design, the Dreamliner holds only up to

250 passengers, compared to the A380, which has a seating capacity between 525 and 853.

■ CASE STUDY 5‐2 Boeing 787 Dreamliner

Discussion Questions

1. Would you consider this transformation to be incremental or radical? Why?

2. What, in your opinion, was the key factor in Santa Cruz Bicycles ’ successful process redesign? Why was that factor

the key?

3. What outside factors had to come together for Santa Cruz Bicycles to be able to make the changes it did?

4. Why is this story more about change management than software implementation?

Source: Adapted from Mel Duvall, “Santa Cruz Bicycles,” www.baselinemag.com (accessed February 24, 2008).

c05.indd 122 11/26/2015 6:25:56 PM

123Case Study

Discussion Questions

1. Why did Boeing adopt the radical change approach for designing and developing the 787 Dreamliner? What were the

risks? In your opinion, was it a good move? Defend your choice.

2. Using the silo perspective versus business process perspective, analyze the Dreamliner program.

3. What are your conclusions about the design of the integrated supply chain? Give some specific ideas about what could

have been done to integrate it better.

4. If you were the program manager, what would you have done differently to avoid the problems faced by the Dreamliner

program?

Sources: Adapted from J. Lynn Lunsford , “ Boeing Scrambles to Repair Problems with New Plane ,” The Wall Street Journal (December 7, 2007 ), A1, 13 ; Stanley Holmes , “ The 787 Encounters Turbulence ,” Businessweek ( June 19 , 2006 ), 38 – 40 ; Zach Honig , “ Boeing 787 Review: ANA ’ s Dreamliner Flies Across Japan, We Join for the Ride ” (December 16, 2011 ), http://www.engadget.com/2011/12/16/boeing‐787‐ review‐anas‐dreamliner‐fl ies‐across‐japan‐we‐join/ (accessed August 27, 2015) ; J. Mouawad , “ Report on Boeing 787 Dreamliner Battery Flaws Finds Lapses at Multiple Points ,” The New York Times (December 1, 2014 ), http://www.nytimes.com/2014/12/02/business/report‐ on‐boeing‐787‐dreamliner‐batteries‐assigns‐some‐blame‐for‐fl aws.html?

c05.indd 123 11/26/2015 6:25:56 PM

124

6 chapter

Mohawk , 1 a paper mill in upstate New York, was established in 1931. Contrary to a common assump-

tion that information technology is not critical to old technology industry players facing a declining

market, the fi rm has not only embraced cloud computing but also has been able to transform its

business because of the cloud in three ways: (1) moving from manufacturing as its primary focus to

providing service, (2) shifting from a self‐suffi cient model to one of collaboration with a network

of partners, and (3) ensuring that the partner network is fl exible and its capabilities are integrated

with those of Mohawk . Mohawk accomplished this fl exibility by using service‐oriented architecture

(SOA) tools, which enable a fi rm to scale technology services (and expenses) up and down instanta-

neously according to its needs. 2 Also, applications under SOA can be added or subtracted as needed.

Mohawk ’ s new envelope manufacturing facility serves as a vivid example to illustrate the ben-

efi ts of fl exibility. Along the way, the company learned of the anticipated bankruptcy of the largest

envelope manufacturing fi rm in the United States and developed a list of six outsourced fi rms to

turn its premium papers into envelopes. After six months of using those suppliers and investing

in building its own in‐house envelope manufacturing capabilities, Mohawk was able to shift to an

insourcing model for 90% of its volume. The cloud services approach avoided the information sys-

tems diffi culties usually inherent in such a transformation.

There are also benefi ts to internal fl exibility as well. As processing volumes increase and decrease,

sometimes on a seasonal basis and sometimes due to new or discontinued lines of business, Mohawk

experiences corresponding increases and decreases in its requirements for space, servers, and

processing. Its cloud approach allows the company to set up or dismantle servers quickly.

This chapter provides managers with an overview of IT architecture and infrastructure issues and designs. It begins by translating a business into IT architecture and then from the architecture into infrastructure. The manager ’ s role is then discussed, and an example of a fi cti- tious company, GiantCo.com, is used to show how strategy leads to infrastructure. The frame- work used to describe the basic components of architecture and infrastructure, introduced in Chapter  1 , is revisited here, providing a language and structure for describing hardware, soft- ware, network, and data considerations. Common architectures are then presented, including centralized, decentralized and Web‐based service‐oriented architecture (SOA). Architectural principles are covered, followed by a discussion of enterprise architecture. Virtualization and cloud computing, two current architectural considerations, are reviewed. The chapter con- cludes with a discussion of managerial considerations that apply to any architecture.

Architecture and Infrastructure

1 Adapted from Paul J. Stamas , Michelle L. Kaarst‐Brown , and Scott A. Bernard , “ The Business Transformation Payoffs of Cloud

Services at Mohawk ,” MIS Quarterly Executive 13 , no. 4 ( 2014 ) . 2 Christopher Hale : “ Liaison Technologies to Deliver SOA‐in‐the‐Cloud Services to Mohawk Papers ,” Business Wire (February 24, 2010 ), http://www.businesswire.com/news/home/20100224006065/en/Liaison‐Technologies‐Deliver‐SOA‐in‐the‐Cloud‐ Services‐

Mohawk‐Papers#.VYFh_0ZZWjs (accessed June 17, 2015) .

c06.indd 124 11/26/2015 7:23:18 PM

125From Vision to Implementation

Mohawk’s experience shows that cloud computing is not just a mechanism to avoid or reduce costs or to gain

operational benefits. The cloud can enable transformation of the business itself. Mohawk’s mission changed from

“making paper” to “making connections,” which involves being able to sell directly to consumers five times the

number of products than in the pre‐2011 period when it mainly sold a few lines of paper to 10–15 large distributors.

Partners now offer many of those products, and the system provides the capabilities to sell from Mohawk’s own

inventory or from the partners in a seamless way directly to many thousands of small businesses and consumers

via its Web site.

Mohawk was able to make the changes it believed were necessary by shifting from an electronic data interchange

(EDI) approach to a simpler, more interchangeable format using XML and other tools. Liaison Technologies, its

integration consulting firm, enabled these changes by first developing what it calls a cloud integration platform and

building upon that platform in several stages to ultimately arrive at an enhanced Web services platform that enabled

other organizations and customers to request information, inquire about freight charges and pricing, place orders,

and pay for their orders through connections with banks. The platform enables designers to “mash up” (combine)

applications as needed on Web sites that can be built rather quickly. Each feature “plugs in” using tools that make

it easy to connect the Web sites to existing databases.

Payoffs to Mohawk included:

• Shaking the precloud annual earnings decreases of 2%–5% per year to tripling its earnings in two years

• Automating its transaction processes, saving $1 million to $2 million annually in staff costs

• Increasing its product variety fivefold

• Increasing its customer base from 10–15 distributors to 100 business partners and many thousands of direct customers

Not all firms can base their entire operations on a cloud platform that permits integration with other organiza-

tions. Mohawk’s experiences can be considered to be “cutting edge,” and integration consulting is a rather new

phenomenon. Further, even if firms use a cloud approach, they will need to estimate the extent of services they

will need to purchase up front. The Mohawk story illustrates how infrastructure can enable the strategic objectives

of a firm. However, building such an infrastructure cannot come first. Firms must begin by determining a strate-

gic vision, determining the IS architecture needed to fulfill that vision, and then making it all tangible by putting

together an IS infrastructure.

This chapter examines the mechanisms by which business strategy is transformed into tangible IS architecture

and infrastructure. The terms architecture and infrastructure are often used interchangeably in the context of IS. This chapter discusses how the two differ and the important role each plays in realizing a business strategy. Then

this chapter examines some common architectural components for IS today.

From Vision to Implementation As shown in Figure  6.1, architecture translates strategy into infrastructure. Building a house is similar: The owner

has a vision of how the final product should look and function. The owner must decide on a strategy about where to

live—in an apartment or in a house. The owner’s strategy also includes deciding how to live in the house in terms of

taking advantage of a beautiful view, having an open floor plan, or planning for special interests by designing such

special areas as a game room, study, music room, or other amenities. The architect develops plans based on this vision.

These plans, or blueprints, provide a guide—unchangeable in some areas but subject to interpretation in others—for

the carpenters, plumbers, and electricians who actually construct the house. Guided by past experience and by industry

standards, these builders select the materials and construction techniques best suited to the plan. The plan helps them

determine where to put the plumbing and wiring, important parts of the home’s infrastructure. When the process works,

the completed house fulfills its owner’s vision, even though he or she did not participate in the actual construction.

An IT architecture provides a blueprint for translating business strategy into a plan for IS. An IT infrastructure is everything that supports the flow and processing of information in an organization, including hardware, software,

data, and network components. It consists of components, chosen and assembled in a manner that best suits the

c06.indd 125 11/26/2015 7:23:18 PM

126 Architecture and Infrastructure

plan and therefore best enables the overarching business strategy.3 Infrastructure in an organization is similar to the

beams, plumbing, and wiring in a house; it’s the actual hardware, software, network, and data used to create the

information system.

The Manager’s Role

Even though he or she is not drawing up plans or pounding nails, the homeowner in this example needs to know

what to reasonably expect from the architect and builders. The homeowner must know enough about architecture,

specifically about styling and layout, to work effectively with the architect who draws up the plans. Similarly, the

homeowner must know enough about construction details such as the benefits of various types of siding, windows,

and insulation to set reasonable expectations for the builders.

Like the homeowner, managers must understand what to expect from IT architecture and infrastructure to be

able to make full and realistic use of them. The manager must effectively communicate his or her business vision

to IT architects and implementers and, if necessary, modify the plans if IT cannot realistically create or support

those plans. Without the involvement of the manager, IT architects could inadvertently make decisions that limit

the manager’s business options in the future.

For example, a sales manager for a large distribution company did not want to partake in discussions about

providing sales force automation systems for his group. He felt that a standard package offered by a well‐known

vendor would work fine. After all, it worked for many other companies, he rationalized, so it would be fine for

his company. No architecture was designed, and no long‐range thought was given to how the application might

support or inhibit the sales group. After implementation, it became clear that the application had limitations and

did not support the type of sales process in use at this company. He approached the IT department for help, and in

the discussions that ensued, he learned that earlier infrastructure decisions now made it prohibitively expensive to

implement the capability he wanted. Involvement with earlier decisions and the ability to convey his vision of what

the sales group wanted to do might have resulted in an IT infrastructure that provided a platform for the changes the

manager now wanted to make. Instead, the infrastructure lacked an architecture that met the business objectives of

the sales and marketing departments.

The Leap from Strategy to Architecture to Infrastructure The huge number of IT choices available coupled with the incredible speed of technology advances makes the

manager’s task of designing an IT infrastructure seem nearly impossible. However, in this chapter, the task is bro-

ken down into two major steps: first, translating strategy into architecture and second, translating architecture into

Owner’s

Vision

Architect’s

Plans

Builder’s

Implementation

Strategy Architecture Infrastructure

Abstract Concrete

Building

Information

Technology

FIGURE 6.1 From the abstract to the concrete—building versus IT.

3 Gordon Hay and Rick Muñoz, “Establishing an IT Architecture Strategy,” Information Systems Management 14, no. 3 (Summer 1997), 67–69.

c06.indd 126 11/26/2015 7:23:18 PM

127The Leap from Strategy to Architecture to Infrastructure

infrastructure. This chapter describes a simple framework to help managers sort through IT issues. This framework

stresses the need to consider business strategy when defining an organization’s IT building blocks. Although this

framework may not cover every possible architectural issue, it does highlight major issues associated with effec-

tively defining IT architecture and infrastructure.

From Strategy to Architecture

The manager must start out with a strategy and then use the strategy to develop more specific goals as shown in

Figure  6.2. Then detailed business requirements are derived from each goal. In the Mohawk case, the business

strategy was to integrate its own product offerings with those from partners and to present the larger product line

directly to a large number of customers as well as an expanded list of wholesalers. The business requirements

were to integrate the disparate functionality into a modular, flexible system. By outlining the overarching business

strategy and then fleshing out the business requirements associated with each goal, the manager can provide the

architect with a clear picture of what IS must accomplish and the governance arrangements needed to ensure their

smooth development, implementation, and use. The governance arrangements specify who in the company retains

control of and responsibility for the IS. Preferably this is somebody in upper management.

Of course, the manager’s job is not finished here. Continuing with Figure 6.2, the manager must work with the

IT architect to translate these business requirements into a more detailed view of the systems requirements, stan-

dards, and processes that shape an IT architecture. This more detailed view, the architectural requirements, includes

consideration of such things as data and process demands as well as security objectives. These are the architectural

requirements. The IT architect takes the architectural requirements and designs the IT architecture.

From Architecture to Infrastructure

Mohawk’s decision to use a service‐oriented architecture led to the design of a number of services and composite

applications. This illustrates the next step, translating the architecture into infrastructure. This task entails add-

ing yet more detail to the architectural plan that emerged in the previous phase. Now the detail comprises actual

hardware, data, networking, and software. Details extend to location of data and access procedures, location of

firewalls, link specifications, interconnection design, and so on. This phase is also illustrated in Figure 6.2 where

the architecture is translated into functional specifications. The functional specifications can be broken down into

hardware specifications, software specifications, storage specifications, interface specifications, network specifica-

tions, and so on. Then decisions are made about how to implement these specifications: what hardware, software,

storage, interface, network, and so forth to use in the infrastructure.

When we speak about infrastructure, we are referring to more than the components. Plumbing, electrical wiring,

walls, and a roof do not make a house. Rather, these components must be assembled according to the blueprint to

create a structure in which people can live. Similarly, hardware, software, data, and networks must be combined

in a coherent pattern to have a viable infrastructure. This infrastructure can be considered at several levels. At the

most global level, the term may be focused on the enterprise and refer to the infrastructure for the entire organi-

zation. The term may also focus on the interorganizational level by laying the foundation for communicating with

customers, suppliers, or other stakeholders across organizational boundaries. Sometimes infrastructure refers to those components needed for an individual application. When considering the structure of a particular application,

it is important to consider databases and program components, as well as the devices and operating environments

on which they run.

Often when referring to an infrastructure, the underlying computer system is called the platform. The term has

been used in a variety of ways: to identify the hardware and operating system of a computer, such as Microsoft Win-

dows, Apple OSX, or Linux, or smartphone and tablet operating systems, such as Android and iOS. Vendors need to

provide an entirely separate version of their software on each chosen platform, and they often have tools that allow

their programs to produce, nearly automatically, versions that run on multiple platforms.

A platform can also refer to a firm’s collection of cloud‐based, modular tools as the example from Mohawk

illustrated. Such platforms use open standards for easy “plugging‐in” of components, enabling “mashing‐up” of a

c06.indd 127 11/26/2015 7:23:18 PM

128

c06.indd 128 11/26/2015 7:23:19 PM

Functional

Spec

Functional

Spec

Architectural

Requirement

Architectural

Requirement

Business

Requirement

Business

Requirement

Goal

Interface

Spec Infrastructure

Data

Protocol

SWb

Spec

HWa

Spec

Architecture Strategy Goal

Goal

a Hardware. b Software.

FIGURE 6.2 From strategy to architecture to infrastructure.

129The Leap from Strategy to Architecture to Infrastructure

variety of resources at once. Google Maps is an excellent example of a standardized resource that can be accessed

by any platform that provides the proper requests.

Framework for the Infrastructure and Architecture Analysis

When developing a framework for transforming business strategy into architecture and then into infrastructure,

these basic components should be considered:

• Hardware: The physical components that handle computation, storage, or transmission of data (e.g., personal computers, servers, mainframes, hard drives, RAM, fiber‐optic cabling, modems, and telephone lines).

• Software: The programs that run on the hardware to enable work to be performed (e.g., operating systems, databases, accounting packages, word processors, sales force automation, and enterprise resource planning

systems). Software is usually divided into two groups: system software, such as Microsoft Windows, Apple OSX, and Linux, and applications, such as word processors, spreadsheets, and digital photo editors. Sys- tem software is often referred to as a platform because application software runs upon it, sometimes only on a particular version.

• Network: Software and hardware components for local or long‐distance networking. Local networking com- ponents include switches, hubs, and routers; long‐distance networking components include cable, fiber, and

microwave paths for communication and data sharing. All work according to a common protocol, most often

Internet protocol (IP). Some networks are private, requiring credentials to connect. Others, like the Internet,

are public.

• Data: The electronic representation of the numbers and text. Here, the main concern is the quantity and format of data and how often it must be transferred from one piece of hardware to another or translated from

one format to another.

The framework that guides the analysis of these components was introduced in the first chapter in Figure 1.6

This framework is simplified to make the point that initially understanding an organization’s infrastructure is not

difficult. Understanding the technology behind each component of the infrastructure and the technical requirements

of the architecture is a much more complex task. The main point is that the general manager must begin with an

overview that is complete and that delivers a big picture.

This framework asks three types of questions that must be answered for each infrastructure component: what,

who, and where. The “what” questions are those most commonly asked and that identify the specific type of tech-

nology. The “who” questions seek to understand what individuals, groups, and departments are involved. In most

cases, the individual user is not the owner of the system or even the person who maintains it. In many cases, the

systems are leased, not owned, by the company, making the owner a party completely outside the organization. In

understanding the infrastructure, it is important to get a picture of the people involved. The third set of questions

addresses “where” issues. With the proliferation of networks, many IS are designed and built with components in

multiple locations, often even crossing oceans. Learning about infrastructure means understanding where every-

thing is located.

We can expand the use of this framework to also understand architecture. To illustrate the connections between

strategy and systems, the table in Figure 6.3 has been populated with questions that typify those asked in addressing

architecture and infrastructure issues associated with each component.

The questions shown in Figure 6.3 are only representative of many that would need to be addressed; the specific

questions depend on the business strategy the organizations are following. However, this framework can help IT

staff ask managers to provide further information as they seek to translate business strategy into architecture and ul-

timately into infrastructure in their organizations. The answers derived with IT architects and implementers should

provide a robust picture of the IT environment. That means that the IT architecture includes plans for the data and

information, the technology (the standards to be followed and the infrastructure that provides the foundation), and

the applications to be accessed via the company’s IT system.

c06.indd 129 11/26/2015 7:23:19 PM

130 Architecture and Infrastructure

FIGURE 6.3 Infrastructure and architecture analysis framework with sample questions.

Component What Who Where

Architecture Infrastructure Architecture Infrastructure Architecture Infrastructure

Hardware What type of personal device will our users use?

What size hard drives do we equip our laptops with?

Who knows the most about servers in our organization?

Who will operate the server?

Does our architecture require centralized or distributed servers?

What specific computers will we put in our Tokyo data center?

Software Does fulfillment of our strategy require ERP software?

Shall we go with SAP or Oracle applications?

Who is affected by a move to SAP?

Who will need SAP training?

Does our geographical organization require multiple database instances?

Can we use a cloud instance of Oracle for our database?

Network How should the network be structured to fulfill our strategy?

Will a particular Cisco switch be fast enough for what we need?

Who needs a connection to the network?

Who provides our wireless network?

Will we let each user’s phone be a hotspot?

Shall we lease a cable or use satellite?

Data What data do we need for our sales management system?

What format will we store our data in?

Who needs access to sensitive data?

How will authorized users identify themselves?

Will backups be stored on‐site or off‐site?

Will data be in the cloud or in our data center?

Traditionally, there are three common configurations of IT architecture as shown in Figure  6.4. Enterprises

sometimes like the idea of a centralized architecture with everything purchased, supported, and managed cen- trally, usually in a data center, to eliminate the difficulties that come with managing a distributed infrastructure. In addition, almost every sizable enterprise has a large data center with servers and/or large mainframe computers that support many simultaneous users. Because of that history, there are a significant number of legacy mainframe

environments still in operation today. However, one large computer at the center of the IT architecture is not used

as regularly today as it was in the past. Instead, many smaller computers are linked together to form a centralized

IT core that operates very much like the mainframe, providing the bulk of IT services necessary for the business.

A more common configuration is a decentralized architecture. The hardware, software, networking, and data are arranged in a way that distributes the processing and functionality between multiple small computers, servers,

and devices, and they rely heavily on a network to connect them together. Typically, a decentralized architecture

uses numerous servers, often located in different physical locations, at the backbone of the infrastructure, called a

server‐based architecture. A third increasingly common configuration is service‐oriented architecture (SOA), the architecture that

Mohawk, in this chapter’s opening case, decided to use. An example of a service is an online employment form that,

when completed, generates a file with the data for use in another service. Another example is a ticket‐processing

service that identifies available concert seats and allocates them. These relatively small chunks of functionality are

available for many applications through reuse. The type of software used in an SOA architecture is often referred to as software‐as‐a‐service, or SaaS. Another term for these applications when delivered over the Internet is Web services.

A cutting‐edge type of configuration is one that can allocate or remove resources by itself, referred to as a

software‐defined architecture.4 Two illustrations can provide an idea of this trend. The first is a true story of a

4 See K. Pearlson, “Software Defined Future: Instant Provisioning of IT Services,” Connect-Converge (Fall 2014), http://connect‐converge.com/ issues/2014_fall/A1767E8395A03D54262BE6F0B892F986/Converge%20C2‐2014‐Fall.pdf (accessed August 27, 2015).

c06.indd 130 11/26/2015 7:23:20 PM

131The Leap from Strategy to Architecture to Infrastructure

FIGURE 6.4 Common architectures.

Architecture Description Other Terms When to Use?

Centralized Architecture

• A large central computer system runs all applications and stores all data.

• Typically, the computer is housed in a data center and managed directly by the IT department.

• Networking allows users to access remotely.

Mainframe architecture

• To make it easier to manage— all functionality is located in one place

• When the business is highly centralized

Decentralized Architecture

• Computing power is spread out among a number of devices in different locations.

• Servers in different locations, personal computers, laptops, smartphones, and tablets are also included.

• The “client” devices can perform many of the services needed with only occasional requests to central servers for data and services.

Server‐based architecture

• To modularize and address concerns about scalability

• When the business is primarily decentralized

Service‐Oriented Architecture (SOA)

• Software is broken down into services “orchestrated” and connected to each other.

• Together those services form an application for an entire business process.

• The services are often offered from multiple vendors on the Internet and are combined to form applications.

Cloud‐based architecture

• To be agile—reusability and componentization can create new apps

• When the business is new and rapid app design is important

Software‐Defined Architecture

• Infrastructure reconfigures based on load or time of day.

• Infrastructure can be reconfigured autonomously based on rules.

Software‐defined network, network virtualization

• When resources need to be flexible and reconfigured often

• When usage varies dramatically depending on time of day

company selling 10 bird baths per month. It had a Web site for its small family business. For a while, the site was

adequate for its needs. However, when Oprah Winfrey featured the company’s high‐quality designs on her show, the

number of monthly orders jumped to 80,000. Fortunately, the firm’s IT consultants were able to create a software‐

defined network that adapted to the increase in orders. It was able to sense a change in the volume of orders and

allocate additional resources such as storage and processing power to keep the Web site working. A typical hosting

provider would have treated a monthly 8,000‐fold volume increase as an attack and would shut down the site to

protect it. Also, a typical provider would not have enough storage allocated for the orders. The software‐defined

network saved thousands of sales (and hundreds of thousands of dollars) from being lost.

Sometimes software‐defined networks can even change the architecture on the fly. For example, many fast‐food

restaurants and coffee shops offer free WiFi to customers. This capability requires more than one connection to the

Internet in very busy locations, and the shop itself needs its own secure, dedicated connection to record sales trans-

actions and inventory updates from individual restaurant and shop operations. If that operation connection fails, a

software‐defined network could automatically reconfigure to switch one of the customer connections to become

a substitute operations connection. Customers might find their WiFi connections to be a little slower until the

situation returns to normal, but the automatic reconfiguration prevents the restaurant or shop from having to close

c06.indd 131 11/26/2015 7:23:20 PM

132 Architecture and Infrastructure

or revert to a very clumsy manual system. Even without a catastrophe, customer traffic on the WiFi system and the

need for operations capacity can fluctuate as well. After closing, the WiFi system for customers is not needed, but

during busy times, it might be saturated. When software updates are performed or large volumes of transactions are

transmitted, the operations connection might be overwhelmed. Shifting resources automatically from one separate

architectural component to another is a powerful way to reduce costs.

A manager must be aware of the trade‐offs when considering architectural decisions. For example, decentralized

architectures are more modular than centralized architectures, allowing other servers to be added with relative ease

and provide increased flexibility for adding clients with specific functionality for specific users. Decentralized orga-

nizational governance, such as that associated with the networked organization structure (discussed in Chapter 3), is

consistent with decentralized architectures. In contrast, a centralized architecture is easier to manage in some ways

because all functionality is centralized in the main computer instead of distributed throughout all the devices and

servers. A centralized architecture tends to be a better match in companies with highly centralized governance, for

example, those with hierarchical organization structures. SOA is increasingly popular because the design enables

large units of functionality to be built almost entirely from existing software service components. SOA is useful

for building applications quickly because it offers managers a modular and componentized design and, therefore, a

more easily modifiable approach to building applications. Software‐defined architectures are even easier to man- age because they self‐manage many of their features. However, each self‐managing feature must be imagined and

defined; the systems are not autonomous beyond those features.

An example of an organization making these trade‐offs is the Veterans Health Administration (VHA), a part of

the Department of Veterans Affairs of the U.S. federal government.5 The organization included 14 different business

units that served various administrative and organizational needs. The primary objective of the organization was to

provide health care for veterans and their families. In addition, the VHA was a major contributor to medical research,

allowing medical students to train at VHA hospitals. The medical centers operated independently and sometimes

competed against each other. When the U.S. Congress passed an act that enabled the VHA to restructure itself from

a system of hospitals to a single health care system, the IT architecture was reconfigured from a very centralized

design, which enabled the Office of Data Management and Telecommunications to retain control, to a decentral-

ized hospital‐based architecture that gave local physicians and administrators the opportunity to deploy applications

addressing local needs while ensuring that standards were developed across the different locations. The VA then

introduced the “One‐VA” architecture to unify the decentralized systems and “to provide an accessible source of con-

sistent, reliable, accurate, useful, and secure information and knowledge to veterans and their families. . . .”6 Efforts

were made to encrypt, secure, and account for every piece of computer hardware in the system, and a national and

regional data warehouse initiative was launched to standardize business data storage and management.

Technological advances such as peer‐to‐peer architecture and wireless or mobile infrastructure make possible

a wide variety of options. These designs can either augment a firm’s existing way of operating or become its main

focus. For example, a peer‐to‐peer architecture allows networked computers to share resources without needing a central server to play a dominant role. ThePirateBay.org, the Web site for sharing music, movies, games, and more,

and Skype, a site for teleconferencing, texting, and telephoning, are examples of businesses that use a peer‐to‐peer

architecture. Wireless (mobile) infrastructures allow communication from remote locations using a variety of wireless technologies (e.g., fixed microwave links; wireless LANs; data over cellular networks; wireless WANs;

satellite links; digital dispatch networks; one‐way and two‐way paging networks; diffuse infrared, laser‐based com-

munications; keyless car entry; and global positioning systems).

Web‐based and cloud architectures locate significant hardware, software, and possibly even data elements on the Internet. Web‐based architectures offers greater flexibility when used as a source for capacity‐on‐demand, or the availability of additional processing capability for a fee. IT managers like the concept of capacity on demand to

help manage peak processing periods when additional capacity is needed. It allows them to use the Web‐available

capacity as needed, rather than purchasing additional computers to handle the larger loads.

5 Adapted from V. Venkatesh, H. Bala, S. Venkatraman, and J. Bates, “Enterprise Architecture Maturity: The Story of the Veterans Health Administration,”

MIS Quarterly Executive 6, no. 2 (June 2007),79–90; and J. Walters, “IBM Transformation Series, 2009,” http://www.businessofgovernment.org/report/ transforming‐information‐technology‐department‐veterans‐affairs (accessed August 27, 2015). 6 Venkatesh, Venkatraman, and Bates, “Enterprise Architecture Maturity,” p. 86.

c06.indd 132 11/26/2015 7:23:20 PM

133From Strategy to Architecture to Infrastructure: An Example

With the proliferation of smartphones and tablets, enterprises increasingly have employees who want to bring

their own devices and connect to enterprise systems. Some call this Bring Your Own Device (BYOD), and it raises some important managerial considerations. When employees connect their own devices to the corporate

network, issues such as capacity, security, and compatibility arise. For example, many corporate applications are

not designed to function on the small screen of a smartphone. Redesigning them for personal devices may require

significant investment to accommodate the smartphone platform. And not all smartphone platforms are the same.

Designing for an iPhone is different than for an Android phone. Even if a system were redesigned for these two

platforms, the resources required to maintain the system increase because each platform evolves at a different rate

and the applications need to appear similar on each device. In some circles, the drive to port applications to personal

devices and the ensuing issues to make them work is referred to as the consumerization of IT. Consumerization of IT is a growing phenomenon. Not only do employees want to use their own devices to

access corporate systems but also customers increasingly expect to access company systems from their mobile

devices. Making applications robust yet simple enough for customers to use from virtually any mobile device over

the Web is a challenge for many information systems departments. Companies such as Good Technology have been

created to provide services that allow enterprise employees to connect, communicate, and collaborate using their

own devices, supplementing the IT organization’s ability to meet this new demand. Websites are designed with the

philosophy of “responsive design,” permitting them to adapt to screens of any size.

From Strategy to Architecture to Infrastructure: An Example This section7 considers a simple example to illustrate the process of converting strategy to architecture to infra-

structure: We introduce GiantCo.com, a fictitious competitor of Amazon and Wal‐Mart, which sells a wide variety

of products online.

Define the Strategic Goals

The managers at GiantCo.com recognize that they have a large amount of competition, so they have decided to try

to provide outstanding customer service. In fact, their strategy is to become highly customer focused. Among their

immediate strategic goals are the following:

• To increase the period of a money‐back guarantee from one week to a month

• To provide cross‐selling opportunities by temporarily discounting accessories or items that complement those purchased within the previous year

• To provide a return shipping label with every purchase

• To decrease out‐of‐stock occurrences by 20%

• To answer emails within 24 hours

Translate Strategic Goals to Business Requirements

To keep things simple, consider more closely only the first two of GiantCo.com’s strategic goals: to increase the

period of a money‐back guarantee from one week to a month and to suggest goods that complement all those sold

to a customer in the past year. How can GiantCo.com’s architecture enable this goal? Its goal must be translated into

business requirements. A few of the business requirements that address these two goals are to track

• At least a year’s worth of sales for all customers

• All refunds provided to customers

7 Only a few questions raised from the framework are provided; a comprehensive, detailed treatment of this situation would require more information

than provided in this simple example.

c06.indd 133 11/26/2015 7:23:20 PM

134 Architecture and Infrastructure

• Return patterns by customer to detect excesses

• Sales of complementary goods to provide advice for future potential purchasers

Translate Business Requirements into Architecture

To support the business requirements, architectural requirements are specified that dictate the architecture to be

established. One major component of the architecture deals with how to obtain, store, and use data to support the

business requirements.

The database needs to store the sales data for all customers for more than an entire year. The data can be used for

many purposes, including summarizing for an annual report and identifying whether customers who wish to return

goods are within the 30‐day period. It also provides the foundation for suggesting complementary goods when cou-

pled with data pinpointing goods that are related. As customers use the Web site, the sales data can be very useful

for their own decision making.

Translate Architecture to Infrastructure

With the architecture goals in hand, the framework presented in Figure 6.2 outlines how to build the infrastructure.

The architecture outlines the functions needed by the infrastructure, enabling a functional specification to be cre-

ated. Those specs are then translated into hardware, software, data protocols, interface designs, and other compo-

nents that will make up the infrastructure. For GiantCo.com’s database, the functional specification would include

details such as how big it should be, how fast data access should be, what the format of the data will be, and more.

These functional specifications then help narrow the technical specifications, which answer these questions. For

example, after considering the current customer base and forecasts for growth, GiantCo.com’s database might need

the following:

• Sample functional specifications for a year’s worth of activity

• Space to fit transaction data for 22,500 customers who purchase 25 items a year on average with 30 facts (date, price, quantity, item number, customer number, address shipped, credit card billed, and so on)

recorded for each. On average, each fact occupies 10 characters of storage.

• Ability to insert 1,070 records per minute. One server can handle one update per second, or 60 per min- ute, suggesting the need for 18 servers to handle online sales. Accounting information will be placed on

its own server. That totals 168,750,000,000 characters of storage for the year, indicating that 200 giga-

bytes will be needed for this information alone. An analysis of vendors’ products and pricing indicates

that one terabyte is considered more than adequate for each server given that 18 will be purchased.

• Software to do the required tracking for suggesting complementary goods because the current system does not have that functionality.

• Hardware specifications

• One terabyte RAID (redundant array) level 3 hard drive space.

• Nineteen 3‐gigahertz Core 2 duo servers.

• Software specifications

• Apache operating system.

• My SQL database.

c06.indd 134 11/26/2015 7:23:20 PM

135Architectural Principles

Additional technical specifications would be created until the entire infrastructure is designed. Then GiantCo.

com’s IT department is ready to pick specific hardware, software, network, data, etc., to put into its infrastructure.

Figure 6.5 lists possible infrastructure components needed by GiantCo.com.

Architectural Principles Any good architecture is based on a set of principles, or fundamental beliefs about how the architecture should

function. Architectural principles must be consistent with both the values of the enterprise as well as with the

technology used in the infrastructure. The principles are designed by considering the key objectives of the orga-

nization and then translated into principles to apply to the design of the IT architecture. The number of principles

vary widely, and there is no set list of what must be included in a set of architectural principles. However, a guide-

line for developing architectural principles is to make sure they are directly related to the operating model of the

enterprise and IS organization. Principles should define the desirable behaviors of the IT systems and the role of the

organization(s) that support it. A sample of architectural principles is shown in Figure 6.6.

FIGURE 6.5 GiantCo.com’s infrastructure components.

Hardware Software Network Data

19 servers:

• 18 for sales • 1 for accounting

LaCie 10‐GB Thunderbolt RAID hard drive storage system

ERP system with modules for

• Sales • Accounting • Inventory

Enterprise application integration (EAI) software

Apache operating system

MySQL database software

• Cable modem to ISP • Dial‐up lines for backup • Cicso routers, hubs, and

switches • Firewalls from CheckPoint

Database

• Sales • Inventory • Accounting • Complementary items

FIGURE 6.6 Sample architectural principles. Source: Adapted from examples of IT architecture from IBM, The Open Group Architecture Framework, the U.S. Government, and the State of Wisconsin.

Principle Description of What the Architecture Should Promote

Ease of use Ease of use in building and supporting the architecture and solutions based on the architecture

Single point of view A consistent, integrated view of the business regardless of how it is accessed

Buy rather than build Purchase of applications, components, and enabling frameworks unless there is a competitive reason to develop them internally

Speed and quality Acceleration of time to market for solutions while still maintaining required quality levels

Flexibility and agility Flexibility to support changing business needs while enabling evolution of the architecture and the solutions built on it

Innovation Incorporation of new technologies, facilitating innovation

Data security Data protection from unauthorized use and disclosure

Common data vocabulary Consistent definitions of data throughout the enterprise, which are understandable and available to all users

Data quality Accountability of each data element through a trustee responsible for data quality

Data asset Management of data like other valuable assets

c06.indd 135 11/26/2015 7:23:20 PM

136 Architecture and Infrastructure

Enterprise Architecture Many companies apply even more complex and comprehensive frameworks than those described earlier for devel-

oping an IT architecture and infrastructure than those described earlier. They employ an enterprise architecture (EA), or the “blueprint” for all IS and their interrelationships in the firm. EA is the term used for the organizing logic for the entire organization. It often specifies how information technologies support business processes. EA

differs from an IT architecture in its level of analysis, although it shares some design principles of the lower‐level

architectures. It identifies the core processes of the company and how they will work together, how the IT sys-

tems will support the processes, the standard technical capabilities and activities for all parts of the enterprise, and

guidelines for making choices. As experts Jeanne Ross, Peter Weill, and David Robertson describe in their book,

Enterprise Architecture as Strategy,

Top‐performing companies define how they will do business (an operating model) and design the processes and infra-

structure critical to their current and future operations (enterprise architecture). . . . Then these smart companies exploit

their foundation, embedding new initiatives and using it as a competitive weapon to seize new business opportunities.8

The components of an enterprise architecture typically include four key elements:

• Core business processes: The key enterprise processes that create the capabilities the company uses to exe- cute its operating model and create market opportunities

• Shared data: The data that drive the core processes

• Linking and automation technologies: The software, hardware, and networking technologies that provide the links between applications (applications themselves are part of the IT architecture, but the way applica-

tions link together is part of the bigger picture of the enterprise architecture)

• Customer groups: Key customers to be served by the architecture9

One example of an enterprise architecture framework is the TOGAF (The Open Group Architecture Frame- work).10 TOGAF includes a methodology and set of resources for developing an enterprise architecture. It is based

on the idea of an open architecture, one whose specifications are public (as compared to a proprietary architecture

whose specifications are not made public). It is based on the U.S. Department of Defense frameworks and has

been developing and continuously evolving since the mid‐1990s. It provides a practical, standardized methodology

(called Architecture Development Methodology) to successfully implement an enterprise architecture for an organi- zation. Although there is no well‐accepted standard for enterprise architecture, architects who understand and use

TOGAF speak a common language and use the same basic framework and processes to build their company’s IS

architecture. TOGAF is designed to translate strategy into architecture and then into a detailed infrastructure; how-

ever, it supports a much higher level of architecture that includes more components of the enterprise.11

Another example of enterprise architecture frameworks is the Zachman framework, which determines archi- tectural requirements by providing a broad view that helps guide the analysis of the detailed view. This framework’s

perspectives range from the company’s scope, to its critical models and, finally, to very detailed representations of

the data, programs, networks, security, and so on. The models it uses are the conceptual business model, the logical

system model, and the physical technical model.12

Enterprise architectures mature as firms invest resources in technologies that support their strategy. Jeanne

Ross13 theorized that enterprise architecture moves from compartmentalized “silos” to standardized technologies to

enterprisewide software to business modularity. A recent study14 shows a dramatic increase in perceived IT effec-

tiveness as the architecture matures through those four stages.

8 Jeanne W. Ross, Peter Weill, and David C. Robertson, Enterprise Architecture as Strategy (Boston, MA: Harvard Business School Press, 2006), viii–ix. 9 Ibid., 50–52. 10 The Open Group, http://www.opengroup.org. 11 For more information on the TOGAF framework, visit the Open Group’s Web site at www.opengroup.org/togaf/. 12 For more information on the Zachman framework, visit Zachman International’s Web site at www.zachman.com. 13 J. W. Ross, “Creating a Strategic IT Architecture Competency: Learning in Stages,” MIS Quarterly Executive 2, no. 1 (2003), 31–43. 14 Randy V.Bradley, Renée M. E. Pratt, Terry Anthony Byrd, and Lakisha L. Simmons, “The Role of Enterprise Architecture in the Quest for IT Value,”

MIS Quarterly Executive 10, no. 2 (2011), 19–27.

c06.indd 136 11/26/2015 7:23:20 PM

137Virtualization and Cloud Computing

Because enterprise architecture is more about how the company operates than how the technology is designed,

building an EA is a joint exercise to be done with business leaders and IT leaders. IT leaders cannot and should

not do this alone. Because virtually all business processes today involve some component of IT, the idea of trying

to align IT with business processes would merely automate or update processes already in place. Instead, business

processes are designed concurrently with IT systems. The Mohawk case at the beginning of this chapter illustrates

this very well; if Mohawk had simply continued its existing business processes or had made them faster with newer

technology, its profitability would have merely continued to decline. They company was able to reverse this trend

only by redesigning or redirecting its business processes, an effort that was enabled by IT.

As Mohawk found, building an enterprise architecture is more than just linking the business processes to IT.

It starts with organizational clarity of vision and strategy and places a high value on consistency in approach as a

means of optimal effectiveness. The consistency manifests itself as some level of standardization—standardization

of processes, deliverables, roles, and/or data. Every EA has elements of all these types of standardization; however,

the degree and proportion of each vary with organizational needs, making it dynamic. A good enterprise architect

understands this and looks for the right blend for each activity the business undertakes. That means that because

organizational groups and individuals are resources for business processes, the organizational design decisions

should be part of the enterprise architecture. However, this is a sophisticated approach, and new enterprise archi-

tects often seek to put more rigid standards in place and do not attempt to tackle the more complex organizational

design issues.

Barclay’s Bank,15 which services more than 48 million customers worldwide, had an IT architecture that

included more than 2,000 applications and spent in excess of £1 billion annually on IT. The resulting complexity

was managed with an EA that specified frameworks, tools, and processes that created a common language and for-

mat. The EA governance model dictated that both business and technology executives sign off on projects to ensure

accountability and ownership. Roadmaps helped clarify the enterprise architecture design and direction, which

informed planning and portfolio management and created a common vision and a repeatable mechanism for future

investments. The EA ensured appropriate linkages between IT investment and business needs.

Virtualization and Cloud Computing Physical corporate data centers are rapidly being replaced by virtual infrastructure called virtualization. Virtual infrastructure originally meant one in which software replaced hardware in a way that a “virtual machine” or a “virtual desktop system” was accessible to provide computing power. Typically, computing capabilities, storage,

and networking are provided by a third party or group of vendors, usually over the Internet or through a private

network. In most virtual architectures, the five core components available virtually are servers, storage, backup,

network, and disaster recovery. Virtualizing the desktop is a common virtualization application. In a virtual-

ized desktop, the user’s device locally accesses desktop software on a remote server, essentially separating the

operating system from the applications. Virtualization is a useful way to design architecture because it enables

resources to be shared and allocated as needed by the user and makes maintenance easier because resources are

centralized.

Cloud computing is another term used to describe an architecture based on services provided over the Internet. It is based on the concept of a virtual infrastructure. Entire computing infrastructures are available “in the cloud.”

Using the cloud to provide infrastructure means that the cloud is essentially a large cluster of virtual servers or

storage devices. This is called infrastructure as a service (IaaS). In addition to IaaS, software as a service (Saas) and platform as a service (PaaS) are typical services found in

cloud computing. These are described more fully in Chapter 10. Using the cloud for a platform means that the man-

ager will use an environment with the basic software available, such as Web software, applications, database, and

collaboration tools. Using the cloud for an entire application generally means that the software is custom designed

or custom configured for the business but resides in the cloud.

15 Adapted from Phil LeClare and Eric Knorr, “The 2010 Enterprise Architecture Awards” (September 10, 2010), http://www.infoworld.com/d/

architecture/the‐2010‐enterprise‐architecture‐awards‐823 (accessed August 27, 2015).

c06.indd 137 11/26/2015 7:23:20 PM

138 Architecture and Infrastructure

Consumers of cloud computing purchase capacity on demand and are not generally concerned with the under-

lying technologies. It’s the next step in utility computing, or purchasing any part of the consumers’ storage or processing infrastructure they need when they need it. Much like the distribution of electricity, the vision of utility

computing is that computing infrastructure would be available when needed in as much quantity as needed. When

the lights and appliances are turned off in a home, the electricity is not consumed. Ultimately, the customer is

billed only for what is used. In utility computing, a company uses a third‐party infrastructure to do their processing

or transactions and pay only for what they use. And as in the case of the electrical utility, the economies of scale

enjoyed by the computing utility enable very attractive financial models for their customers. As the cost of connec-

tivity falls, models of cloud computing emerge.

Salesforce.com, Facebook, Gmail, Windows Azure, Apple iTunes, and LinkedIn are examples of applications

in the cloud. Users access LinkedIn through the Web and build networks of business professionals on the site. But

LinkedIn provides additional services, such as linking a user’s blog to her or his profile, sharing and storing doc-

uments among group’s members, and accessing applications such as GoodReads to see what network peers are

reading and Tripit to learn about their travel plans.

Benefits of virtualization and cloud computing are many. Businesses that embrace a virtual infrastructure can

consolidate physical servers and possibly eliminate many of them, greatly reducing the physical costs of the data

center. Fees can be based on transaction volumes rather than large up‐front investments. There is no separate cost

for upgrade, maintenance, and electricity. Nor is there a need to devote physical space or to guess how many storage

servers are required. Typically, the network is much simpler, too, because the virtual infrastructure mainly requires

Internet connections for all applications and devices.

But the biggest benefit of virtualization and cloud computing is the speed at which additional capacity, or pro-

visioning, can be done. In a traditional data center, additional capacity is often a matter of purchasing additional

hardware, waiting for its delivery, physically installing it, and ensuring its compatibility with the existing systems.

It can take weeks. In a virtual infrastructure, the nature of the architecture is dynamic by design, making adding

capacity relatively easy and quick.

For example, The New York Times decided to make all public domain articles from 1851 to 1922 available on the Internet. To do that, the company decided to create PDF files of all the articles from the original papers in its

archives. This required scanning each column of the story, creating a series of graphic pictures of the scanned

image, and then cobbling them together to create the single PDF for each story. This was a lot of work and required

significant computing power. Once this batch of articles was converted and added to the company’s existing library,

the 11 million New York Times stories from 1851 to 1989 were accessible on the Internet. The manager of this project had an idea to use the cloud. He selected a service offered by Amazon.com, Amazon

EC2, wrote some code to do the project he envisioned, and tested it on the Amazon servers. He used his credit card

to charge the $240 it cost him to do this conversion. He calculated it would have taken him at least a month to do

the conversion if he used only the few servers available to him in The New York Times network. However, using the Amazon cloud services, he was able to use a virtual server cluster of 100 servers, and it took just under 24 hours to

process the entire 11 million articles.16

But managers considering virtualization and cloud computing must also understand the risks. First is the

dependence on the third‐party supplier. Building applications that work in the cloud may mean retooling exist-

ing applications for the cloud’s infrastructure. The dominant vendor, as of the writing of this text, is VMware, a

company that offers software for workstations, virtual desktop infrastructures, and servers. However, because there

are no standards for virtual infrastructure, applications running on one vendor’s infrastructure may not port easily

to another vendor’s environment.

Architectures are increasingly providing cloud computing and virtualization as alternatives to in‐house infra-

structures. As coordination costs drop and new platforms in the cloud are introduced, cloud computing utilization

will increase.

16 Galen Gruman, “Early Experiments in Cloud Computing,” InfoWorld (April 7, 2008), http://www.infoworld.com/article/2649759/operating‐systems/ early‐experiments‐in‐cloud‐computing.html (accessed July 28, 2015); Derek Gottfrid, “Self‐Service, Prorated Supercomputing Fun!” (November 1,

2007), http://open.blogs.nytimes.com/2007/11/01/self‐service‐prorated‐super‐computing‐fun/ (accessed July 28, 2015).

c06.indd 138 11/26/2015 7:23:20 PM

139Other Managerial Considerations

Other Managerial Considerations The infrastructure and architecture framework shown in Figure  6.3 guides the manager toward the design and

implementation of an appropriate infrastructure. Defining an IT architecture that fulfills an organization’s needs

today is relatively simple; the problem is that by the time it is installed, those needs can change. The primary rea-

son to base an architecture on an organization’s strategic goals is to allow for inevitable future changes—changes

in the business environment, organization, IT requirements, and technology itself. Considering future impacts

should include analyzing the existing architecture, the strategic time frame, technological advances, and financial

constraints.

Understanding Existing Architecture

At the beginning of any project, the first step is to assess the current situation. Understanding existing IT architecture

allows the manager to evaluate the IT requirements of an evolving business strategy against current IT capacity. The

architecture, rather than the infrastructure, is the basis for this evaluation because the specific technologies used to

build the infrastructure are chosen based on the overall plan, or architecture. As previously discussed, these archi-

tectural plans support the business strategy. Assuming that some overlap is found, the manager can then evaluate

the associated infrastructure and the degree to which it can be utilized going forward.

Relevant questions for managers to ask include the following:

• What IT architecture is already in place?

• Is the company developing the IT architecture from scratch?

• Is the company replacing an existing architecture?

• Does the company need to work within the confines of an existing architecture?

• Is the company expanding an existing architecture?

Starting from scratch allows the most flexibility in determining how architecture can enable a new business strat-

egy, and a clean architectural slate generally translates into a clean infrastructure slate. However, planning effec-

tively even when starting from scratch can be a challenge. For example, in a resource‐starved start‐up environment,

it is far too easy to let effective IT planning fall by the wayside. Sometimes the problem is less a shortcoming in IT

management and more one of poorly devised business strategy. A strong business strategy is a prerequisite for IT

architecture design, which is in turn a prerequisite for infrastructure design.

Of course, managers seldom enjoy the relative luxury of starting with a clean IT slate. More often, they must

deal in some way with an existing architecture, infrastructure, and legacy systems already in place. In this case,

they encounter both opportunity—to leverage the existing architecture and infrastructure and their attendant human

resource experience pool—and the challenge of overcoming or working within the old system’s shortcomings. By

implementing the following steps, managers can derive the most value and suffer the least pain when working with

legacy architectures and infrastructures.

1. Objectively analyze the existing architecture and infrastructure: Remember that architecture and infrastruc- ture are separate entities; managers must assess the capability, capacity, reliability, and expandability of

each.

2. Objectively analyze the strategy served by the existing architecture: What were the strategic goals it was designed to attain? To what extent do those goals align with current strategic goals?

3. Objectively analyze the ability of the existing architecture and infrastructure to further the current strategic goals: In what areas is alignment present? What parts of the existing architecture or infrastructure must be modified? Replaced?

c06.indd 139 11/26/2015 7:23:20 PM

140 Architecture and Infrastructure

Whether managers are facing a fresh start or an existing architecture, they must ensure that the architecture will

satisfy their strategic requirements and that the associated infrastructure is modern and efficient. The following

sections describe evaluation criteria including strategic time frame, technical issues (adaptability, scalability, stan-

dardization, maintainability), and financial issues.

Assessing Strategic Timeframe

Understanding the life span of an IT infrastructure and architecture is critical. How far into the future does the strat-

egy extend? How long can the architecture and its associated infrastructure fulfill strategic goals? What issues could

arise and change these assumptions?

Answers to these questions vary widely from industry to industry. Strategic time frames depend on indus-

try‐wide factors such as level of commitment to fixed resources, maturity of the industry, cyclicality, and barriers

to entry. The competitive environment has increased the pace of change to the point that requires any strategic

decision be viewed as temporary.

Architectural longevity depends not only on the strategic planning horizon, but also on the nature of a man-

ager’s reliance on IT and on the specific rate of advances affecting the information technologies on which he or

she depends. Today’s architectures must be designed with maximum flexibility and scalability to ensure they can

handle imminent business changes. Imagine the planning horizon for a dot‐com company in an industry in which

Internet technologies and applications are changing daily, if not more often. You might remember the importance

of flexibility and agility to Mohawk’s new business strategy and that the firm’s IT architecture was created to

support it.

Assessing Technical Issues: Adaptability

With the rapid pace of business, it is no longer possible to build a static information system to support businesses.

Instead, adaptability is a core design principle of every IT architecture and one reason why cloud computing and

virtualization are increasingly popular. A manager may think of technological advances as primarily affecting IT

infrastructure, but the architecture must be able to support any such advance. Can the architecture adapt to emerg-

ing technologies? Can a manager delay the implementation of certain components until he or she can evaluate the

potential of new technologies?

At a minimum, the architecture should be able to handle expected technological advances, such as innovations in

storage capacity and computing power. An exceptional architecture also has the capacity to absorb unexpected tech-

nological leaps. Both hardware and software should be considered when promoting adaptability. For example, new

Web‐based applications that may benefit the corporation emerge daily. The architecture must be able to integrate

these new technologies without violating the architecture principles or significantly disrupting business operations.

The following are guidelines for planning adaptable IT architecture and infrastructure. At this point, these two

terms are used together because in most IT planning, they are discussed together. These guidelines are derived from

work by Meta Group.17

• Plan for applications and systems that are independent and loosely coupled rather than monolithic: This approach allows managers to modify or replace only those applications affected by a change in the state of

technology.

• Set clear boundaries between infrastructure components: If one component changes, others are minimally affected, or if effects are unavoidable, the impact is easily identifiable and quantifiable.

• When designing a network architecture, provide access to all users when it makes sense to do so (i.e., when security concerns allow it): A robust and consistent network architecture simplifies training and knowledge

17 Larry R. DeBoever and Richard D. Buchanan, “Three Architectural Sins,” CIO (May 1, 1997), 124, 126.

c06.indd 140 11/26/2015 7:23:20 PM

141Other Managerial Considerations

sharing and provides some resource redundancy. An example is an architecture that allows employees to use

a different server or printer if their local one goes down.

Note that requirements concerning reliability may conflict with the need for technological adaptability under

certain circumstances. If the architecture requires high reliability, a manager seldom is tempted by bleeding‐edge

technologies. The competitive advantage offered by bleeding‐edge technologies is often eroded by downtime and

problems resulting from pioneering efforts with the technology.

Assessing Technical Issues: Scalability

A large number of other technical issues should also be considered when selecting an architecture or infrastructure.

A frequently used criterion is scalability. To be scalable refers to how well an infrastructure component can adapt to increased, or in some cases decreased, demands. A scalable network system, for instance, could start with just a

few nodes but could easily be expanded to include thousands of nodes. Scalability is an important technical feature

because it means that an investment can be made in an infrastructure or architecture with confidence that the firm

will not outgrow it.

What is the company’s projected growth? What must the architecture do to support it? How will it respond if the

company greatly exceeds its growth goals? What if the projected growth never materializes? These questions help

define scalability needs.

Consider a case in which capacity requirements were poorly anticipated. In early 2007, an ice storm on the

East Coast of the United States forced JetBlue Airlines to scramble to take care of stranded customers, grounded

planes, checked luggage, and canceled flights. In the aftermath, executives told investors that the computers didn’t

fail. Indeed, they did not fail, but the system failed to scale as needed. The system was set up to accommodate

650 agents and was able to be increased to 950 but no more.18 It is unlikely that JetBlue or its software provider

would have had to do any serious systems redesign to respond to the increase in demand; it simply needed to

increase its infrastructure capacity. Ultimately, recovery from this planning failure cost JetBlue millions and even

more in defending its image, which suffered severe negative word of mouth from the poor service that resulted.

The company subsequently contracted with Verizon to manage its infrastructure as a way of responding to the scal-

ability issue. JetBlue’s plight underscores the importance of analyzing the impact of strategic business decisions

on IT architecture and infrastructure and at least ensuring that a contingency plan exists for potential unexpected

effects of a strategy change.

Assessing Technical Issues: Standardization

Another important feature deals with commonly used standards. Hardware and software that use a common stan- dard as opposed to a proprietary approach are easier to plug into an existing or future infrastructure or architecture

because interfaces often accompany the standard. For example, many companies use Microsoft Office software,

making it an almost de facto standard. Therefore, a number of additional packages come with translators to the sys-

tems in the Office suite to make it easy to move data between systems.

Assessing Technical Issues: Maintainability

How easy is the infrastructure to maintain? Are replacement parts available? Is service available? Maintainability

is a key technical consideration because the complexity of these systems increases the number of things that can go

wrong, need fixing, or simply need replacing. In addition to availability of parts and service people, maintenance

considerations include issues such as the length of time the system might be out of commission for maintenance,

18 Mel Duvall, “What Really Happened to JetBlue,” http://www.cioinsight.com/c/a/Past‐News/What‐Really‐Happened‐At‐JetBlue www.cioinsight.com

(April 5, 2007) (accessed August 27, 2015).

c06.indd 141 11/26/2015 7:23:20 PM

142 Architecture and Infrastructure

how expensive and how local the parts are, and obsolescence. Should a technology become obsolete, costs for parts

and expertise skyrocket. Architectures have different inherent security profiles.

Assessing Technical Issues: Security

Securing assets in a highly centralized, mainframe architecture means building protection around the centralized

core. Because data and software are stored and executed on the mainframe computer, methods of protecting these

assets revolve around protecting the mainframe itself. Decentralized, server‐based architecture is more difficult to

secure due to the dispersion of servers. Security is a matter of protecting every server instead of one centralized

system. A Web‐based SOA architecture that utilizes SaaS and capacity on demand raises a whole new set of secu-

rity issues. The data and applications not only reside on servers in the various vendor systems around the Web, but

also the linking mechanism, the network that ties the Web together, introduces another level of security concerns.

Security is discussed in more detail in Chapter 7.

Assessing Financial and Managerial Issues

Like any business investment, IT infrastructure components should be evaluated based on their expected finan-

cial value. Unfortunately, payback from IT investments is often difficult to quantify; it can come in the form of

increased productivity, increased interoperability with business partners, improved service for customers, or yet

more abstract improvements. This suggests focusing on how IT investments enable business objectives rather than

on their quantitative returns.

Still, some effort can and should be made to quantify the return on infrastructure investments. This effort can be

simplified if a manager works through the following steps with the IT staff.

1. Quantify costs: The easy part is costing out the proposed infrastructure components and estimating the total investment necessary. Work with the IT staff to identify cost trends in the equipment the company proposes

to acquire. Don’t forget to include installation and training costs in the total.

2. Determine the anticipated life cycles of system components: Experienced IT staff or consultants can help establish life cycle trends for both a company and an industry to estimate the useful life of various

systems.

3. Quantify benefits: The hard part is getting input from all affected user groups as well as the IT group, which presumably knows most about the equipment’s capabilities. If possible, form a team with representatives

from each of these groups and work together to identify all potential areas in which the new IT system may

bring value.

4. Quantify risks: Assess any risk that might be attributable to delaying acquisition as opposed to paying more to get the latest technology now.

5. Consider ongoing dollar costs and benefits: Examine how the new equipment affects maintenance and upgrade costs associated with the current infrastructure.

Once this analysis is complete, the manager can calculate the company’s preferred discounted cash flow (i.e., net

present value or internal rate of return computation) and the payback period. Approaches to evaluating IT invest-

ments are discussed in greater detail in Chapter 8.

Applying these considerations to the fictitious GiantCo.com company, the last task is to weigh the managerial

considerations against the architectural goals that were used to determine infrastructure requirements. Figure 6.7

shows how these considerations could apply to GiantCo.com’s situation.

Again, note that the criteria evaluated in Figure 6.7 do not address every possible issue for GiantCo.com, but this

example shows a broad sample of the issues that will arise.

c06.indd 142 11/26/2015 7:23:20 PM

143Other Managerial Considerations

FIGURE 6.7 GiantCo.com ’ s managerial considerations.

Criteria Architecture Infrastructure

Strategic time frame Indefi nite: GiantCo.com ’ s strategic goal is to be able to respond to customer needs.

NA

Technology advances Database technology is fairly stable, but transaction capacity needs to be assessed and links with smaller suppliers and customers verifi ed.

NA

Financial Issues

NPV of investment NA GiantCo.com will analyze NPV of various hardware and software solutions and ongoing costs before investing.

Payback analysis GiantCo.com expects the new architecture to pay for itself within three years.

Specifi c options will be evaluated using conservative sales growth projections to see how they match the three‐year goal.

Incidental investments The new architecture represents a moderate shift in the way GiantCo.com does business and will require some training and workforce adjustment.

Training costs for each option will be analyzed. Redeployment costs for employees displaced by any outsourcing must also be considered.

Growth requirements/ scalability

Outsourcing could provide more scalability than GiantCo.com ’ s current model, which is constrained by IT capacity. New innovations will be identifi ed to provide scalability of volume.

The scalability required of various new hardware and software components is not signifi cant, but options will be evaluated based on their ability to meet scalability requirements.

Standardization NA GiantCo.com will adopt the MySQL standard and make it a requirement of all developers for consistency.

Maintainability The new architecture raises some maintenance issues, and new product introductions will mandate constant updates to the rules of complementary goods.

Various options will be evaluated for their maintenance and repair costs.

Staff experience The new model will require new skills and expertise.

Current staff is not familiar with MySQL. Training and workforce adjustment will be needed. Some new staff will be hired.

Security GiantCo.com will lock down resources for traveling personnel.

GiantCo.com will adopt a Pulse Secure VPN for securely connecting traveling personnel with network resources.

Social Business Lens: Building Social Mobile Applications

As companies adopt social IT, they are fi nding that it is closely intertwined with mobile platforms. Employees want,

and in some cases expect, to be able to access their social IT from their smartphones, tablets, and more. As com-

panies look globally, in some countries the mobile screen is the only screen used.

In 2011, more than one‐third of the U.S. population used the mobile Internet. In 2014, that number grew to such

an extent that 52% of device owners consider smartphones and tablets the most important devices for Internet

access, while only 46% consider desktops and laptops the most important devices. Tablets have surpassed all

other devices in importance.

Social business requires that companies extend their architecture to include mobile functions, called social

mobile . Social mobile functions began to take off with the widespread adoption of smartphones. The fi rst devices

combined features of a personal digital assistant with a mobile phone, giving developers the opportunity to link

applications to the Web instantly. RIM ’ s BlackBerry was one of the fi rst to give users mobile access to communication

c06.indd 143 11/26/2015 7:23:20 PM

144 Architecture and Infrastructure

tools such as their e‐mail. More recent devices, such as Apple’s iOS, Google’s Android, Microsoft’s Windows Phone,

Nokia’s Symbian, and RIM’s BlackBerry OS, use a mobile operating system.

Initial social mobile apps were social networks either ported to the mobile platform, like LinkedIn and

Facebook, or designed just for the mobile platform, like Foursquare and Gowalla, social network sites linking

community members who “check in” at physical locations and sometimes earn virtual rewards for doing so.

Social mobile applications have extended to many other types of applications as software designers realize the

large market available to them if their applications run on mobile platforms and as device users demand increas-

ing functionality for their mobile devices.

Source: Amy Gahran, “Survey: U.S. Mobile Web Access Growing Fast” (July 8, 2010), http://articles.cnn.com/2010‐07‐08/tech/ mobile.internet.access.pew_1_cell‐phone‐users‐feature‐phones‐mobile‐internet (accessed August 27, 2015); Danyl Bosomworth, “Mobile Marketing Statistics 2015,” Smart Insights (July 22, 2015), http://www.smartinsights.com/mobile‐marketing/mobile‐ marketing‐analytics/mobile‐marketing‐statistics/ (accessed August 27, 2015).

S U M M A R Y

• Strategy drives architecture, which drives infrastructure. Strategic business goals dictate IT architecture requirements. These requirements provide an extensible blueprint suggesting which infrastructure components will best facilitate the

realization of the strategic goals.

• Enterprise architecture is the broad design that includes both the information systems architecture and the interrelation- ships in the enterprise. Often this plan specifies the logic for the entire organization. It identifies core processes, how they

work together, how IT systems will support them, and the capabilities necessary to create, execute, and manage them.

• Four configurations for IT architecture are centralized, decentralized, SOA (or Web‐based), and software‐defined archi- tectures. Applications are increasingly being offered as services, reducing the cost and maintenance requirements for

clients. Virtualization and cloud computing provide architectures for Web‐based delivery of services.

• The manager’s role is to understand how to plan IT to realize business goals. With this knowledge, he or she can facilitate the process of translating business goals to IT architecture and then modify the selection of infrastructure components as necessary.

• Frameworks guide the translation from business strategy to IS design. This translation can be simplified by categorizing components into broad classes (hardware, software, network, data), which make up both IT architecture and infrastructure.

• Enterprise leaders increasingly have requests for new devices that employees want to connect to the corporate network. The consumerization of IT describes the trend to redesign corporate systems for smartphones, tablets, and other consumer‐

oriented devices.

• While translating strategy into architecture and then infrastructure, it is important to know the state of any existing architecture and infrastructure, to weigh current against future architectural requirements and strategic time frame, and

to analyze the financial consequences of the various systems options under consideration. Systems performance should

be monitored on an ongoing basis.

K E Y T E R M S

applications (p. 129)

architecture (p. 125)

bring‐your‐own‐device

(BYOD) (p. 133)

capacity‐on‐demand (p. 132)

centralized architecture (p. 130)

cloud architecture (p. 132)

cloud computing (p. 137)

consumerization of IT (p. 133)

data center (p. 130)

decentralized architecture (p. 130)

enterprise architecture (p. 136)

infrastructure (p. 125)

mainframe (p. 130)

peer‐to‐peer (p. 132)

platform (p. 129)

reuse (p. 130)

scalable (p. 141)

server‐based architecture (p. 130)

service‐oriented architecture

(SOA) (p. 130)

software‐as‐a‐service (p. 130)

software‐defined architecture (p. 130)

standards (p. 141)

system software (p. 129)

TOGAF (p. 136)

utility computing (p. 138)

virtualization (p. 137)

Web‐based architectures (p. 132)

Web services (p. 130)

wireless (mobile)

infrastructures (p. 132)

infrastructures (p. 125)

Zachman framework (p. 136)

c06.indd 144 11/26/2015 7:23:21 PM

145Case Study

Enterprise architecture (EA) at American Express was the framework the organization used to align IT and the business. EA

provided a common language for leaders to use to collaborate and transform the business. At American Express , enterprise

architects were the change agents who streamlined processes and designed ways to more effectively do business using IT

resources. In 2011, American Express was named an InfoWorld/Forrester Enterprise Architecture Award recipient for its EA

practices. As American Express leaders considered new payment methods using mobile devices, the EA guided their progress.

Mobile payments were forcing the payments industry to review their practices and signifi cantly transform the way

business was done. The new business environment introduced additional complexity with the addition of new delivery chan-

nels and the need for shorter time‐to‐market of payment products and services. American Express ’ s business strategy for its

payments products focused on delivering a “consistent, global, integrated customer experience based on services running

on a common application platform.”

To achieve this goal, the EA team created reference architectures and road maps for standardized applications across the

fi rm. This team then worked with multiple business solution delivery teams to create and manage the common application

architecture and create strategies that facilitated each business ’ s objectives. Each strategy included a road map of initiatives

that included a set of actions, the metrics to evaluate the success of these actions, and the commitments IT and the businesses

made to make it happen. The road map was American Express ’ s way to standardize language, tools, life cycle management

of the applications, and architecture and governance processes. The elements of the road map included technology, reference

architecture, and capabilities for the business.

The next steps for American Express were to extend the road maps to cover the maturing of SOA and to develop new

reference architectures and a new taxonomy to increasingly align IT with the needs of the business. As new technologies

emerged and new ways of doing business over social tools created opportunities for new payment products and services,

American Express expected to continually evolve its EA.

Discussion Questions

1. What are the key components of the architecture American Express has created?

2. Why was it important to standardize so much of the architecture? What are the advantages and disadvantages of a stan-

dard EA for American Express ?

■ CASE STUDY 6‐1 Enterprise Architecture at American Express

D I S C U S S I O N Q U E S T I O N S

1. Think about a company you know well. What would be an example of IT architecture at that company? An example of the IT infrastructure?

2. What, in your opinion, is the difference between a decentralized architecture and a centralized architecture? What is an example of a business decision that would be affected by the choice of the architecture?

3. From your personal experience, what is an example of software as a service? Of BYOD?

4. Each of the following companies would benefit from either software‐defined architecture or conventional, owned hardware and software. State which you would advise each of the following fictitious firms (plus the IRS) to adopt and explain why.

a. StableCo is a firm that sells industrial paper shredders. Its business has remained steady for two decades and it has a strong and diverse customer base.

b. DynamicCo is a fast‐growing six‐year old firm that has relied on three to five key wholesale customers for its entire existence. However, the list of key customers changes every year, and during two of the years, sales declined sharply.

c. Plastics3000 is an old, stable plastics manufacturing firm that has kept its sales steady in the face of competitors as the result of an active research and development team that uses advanced software to analyze large amounts of data to

develop new compounds. Once or twice a week, office personnel complain of the network becoming very slow.

d. A downtown Las Vegas casino monitors each slot machine continuously for early detection of malfunctions such as win- nings or losses trending beyond their threshold limits.

e. CallPerfect provides call center services to pharmacies. Phone calls are routed to the company after hours and messages are delivered to the pharmacy manager the next morning.

f. At the IRS, tax forms are available online for citizens to complete and file with the IRS electronically by April 15. A call center routes calls to agents who answer taxpayers ’ questions.

g. At LittlePeople, Inc., a day care center, parents are called using software on the administrator ’ s computer when there is a weather emergency. The school has averaged 120 families for many years.

c06.indd 145 11/26/2015 7:23:21 PM

146 Architecture and Infrastructure

3. Describe how the new architecture supports the goals and strategy of American Express.

4. What types of future payment products and services should be anticipated and prepared for by the EA group? What is

your vision of how payments might work? If you were advising the CIO of American Express , what would you suggest

his group prepare for?

Source: Adapted from Phil LeClare and Eric Knorr , “ The 2011 Enterprise Architecture Awards ” (September 19, 2011 ), http://www. infoworld.com/d/enterprise‐architecture/the‐2011‐enterprise‐architecture‐awards‐173372 (accessed August 27, 2015) .

Scientists doing research often need serious computing capability to run simulations and crunch data. Often that meant

working for a large company that could provide the signifi cant investment in information systems infrastructure. But cloud

computing changed all that. Consider the case of biologist Dr. Eric Schadt, a researcher who claims that approaches to

studying the complexity of living systems have failed. Studying one gene at a time doesn ’ t explain what causes diseases,

making it impossible to fi nd the cures sought by the scientifi c and pharmacology communities. Dr. Schadt ’ s vision is to

manage this area of research, and the large amount of data generated, which appears to be too much for any one individual

or company to manage, by creating a human social network. He believes that this organization refl ects the complexity of the

living systems he studies and therefore it ’ s necessary to understand it.

Dr. Schadt cofounded a nonprofi t organization dedicated to biological research using an open‐source sharing of data,

Sage Bionetworks . He deeply believes that sharing is the key to fi nding cures and creating drugs that will combat diseases.

And his company has millions of dollars worth of data from some of the major pharmaceutical companies to use to begin the

research. But by day, he ’ s the Chief Scientifi c Offi cer of a start‐up, Pacifi c Biosciences (PacBio), whose technology helps

biologists look at individual molecules of DNA in real time. His job is to work on how to use this technology for PacBio and

to collaborate with others who want to use it for their research. So he travels a lot. But to do his research, he needs access to

the capacity of a supercomputer because the amount of data he needs to use for his research is very large.

With the use of the Web, Dr. Schadt is able to do his work anyplace. Planes are especially favored because he has

signifi cant uninterrupted time. According to one article about him,

He has the same access to supercomputers that every other American with an Internet connection and a credit card has. He

waits till the plane climbs to a cruising altitude, then when allowed to use electronic devices, he uses the plane ’ s WiFi to

get on Amazon .

Dr. Schadt is able to initiate a complex analysis of his data using Amazon ’ s services, which crunch the data while he fl ies

across the country. When he lands, the analysis is done and he has the results. This would be equivalent to the computing

power of a scientist working on his company ’ s multimillion‐dollar supercomputer, but in this case, the cost is just a few

hundred dollars.

Companies like Amazon .com have become vendors of extreme computing power. Some have compared the amount of

computing power Dr. Schadt uses while fl ying on an airplane to the amount of computing power available to a scientist at

major pharmaceutical companies that have multimillion‐dollar supercomputers. With services like the computing power

available in the cloud, Dr. Schadt may even have more power available to him than that scientist.

Discussion Questions

1. How would you describe the architecture Dr. Schadt uses to do his research?

2. What are the risks Dr. Schadt faces by using Amazon for his supercomputing? What are the benefits?

3. If you were advising a company trying to make a decision about using cloud computing for key business applications,

what would you advise and why?

Source: Adapted from Tom Junod , “ Adventures in Extreme Science ” (March 22, 2011 ), http://www.esquire.com/features/eric‐schadt‐ profi le‐0411‐4 (accessed August 27, 2015) .

■ CASE STUDY 6‐2 The Case of Extreme Scientists

c06.indd 146 11/26/2015 7:23:21 PM

147

7 chapter

I nformation technology (IT) security is one of the top issues of concern to businesses— hacked systems or stolen data can put a company out of business. General managers must understand the basics to ensure continuance of operations. This chapter explores managing security in fi ve areas: strategy, infrastructure, policies, training, and investments. Lessons from some of the largest and most well‐known breaches are covered as well as how they occurred according to security experts. The chapter also discusses common tools that aim to secure access, data storage, and data transmission to prevent these breaches and their advantages and disadvantages. Policies general managers can implement to decrease risk of security issues and economic damage are presented followed by a discussion of edu- cation, training, and awareness issues.

Security

During lunchtime on June 6, 2015, a white van pulled in front of the U.S. Offi ce of Personnel

Management in Washington, D.C. A team of three expert hackers entered the front door, displaying

the credentials of three janitors who were bound and gagged back at their offi ce. As the hackers

stood at a supply room door next to a highly secure server room, the target of their attack, one

feigned having to crouch to tie his shoe, the other two stood in the way of the security cameras,

and the crouching bandit used a lock‐picking tool to gain access to the supply room. They fi gured

they had only a few minutes to clip a monitoring device to the network wires that led to the servers

containing security clearance information for millions of employees and past employees. The device

monitored electrical activity right through the insulation and transmitted it to the van.

The hackers closed and relocked the supply room door, exited the building, and re‐entered the

van just as the clock struck 1 p.m . The tallest of the three declared “right on schedule!” and set a

timer for 10 minutes. He tuned his laptop into the monitoring device and the other two did the same.

They watched communications to and from the server, waiting for an employee, any employee,

returning from lunch to log‐in. Monitoring was risky due to random sweeps for rogue wireless con-

nections, so after 10 minutes they would abort the mission.

The three typed frantically at their keyboards but nothing seemed to work for several agonizing

minutes. Ten seconds before their time was up, one of the perpetrators hastily wrote some computer

code and then smiled. He was just in time to reveal a log‐in conversation complete with password.

The hackers set the timer for another 10 minutes, which they had budgeted for the next phase.

The hackers searched frantically for large fi les that might contain the security clearance

information they were hired to obtain. One of them found a large fi le called “SecurClearRecs,” and

the three cursed when they saw that the fi le was larger than anticipated. They immediately typed

commands to upload the fi le through the Internet to a server in Shanghai, China. They kept one

eye on the building and the other eye on the red “progress bar” that indicated “5% complete” for

20 full seconds before it changed to “10% complete.” The time required for each 5% seemed to vary

widely; moving from 15% to 20% took almost an entire minute. They realized it would take the

entire 10 minutes they had allocated or more. They could almost hear their own pulses pounding as

c07.indd 147 11/26/2015 7:31:38 PM

148 Security

they anticipated the million dollar reward that awaited them if they were successful but also dreaded the fact that

their overall budgeted 20 minutes might not be quite enough. Maybe they could chance it and go just a little longer.

A few terror‐filled minutes past the budgeted 20 minutes, at 90% complete, they saw a guard step outside of the

building and point at the van. Another officer joined him, and the pair started walking cautiously toward the van,

trying to talk into his radio. The hackers had wisely jammed police channel communications and flattened the patrol

cars’ tires, but they wanted to avoid physical contact as much as possible. Trouble was certain to loom ahead; one

of the officers turned to run back to the building. The tallest hacker jumped into the driver’s seat and started the van.

The hackers looked down at the progress bar, which said “99% complete,” just as an alarm sounded. The remaining

guard began running to the van. Four flat tires would mean a 10‐minute delay waiting for another officer from the

security firm’s headquarters. The hackers waited 5 more seconds for “100% complete” and then screeched away to

a secluded clearing a one‐half mile away in the woods where a blue turbocharged Hyundai Sonata awaited them.

They pushed a red “self‐destruct” button in the van to start a timer, jumped in the Hyundai, and sped down back

roads as distant sirens blared and the van exploded. Two weeks later, on June 20, 2015, an article in Computerworld stated that “The U.S. government still isn’t saying how much data it fears was stolen.”1

This story is notable for two reasons: (1) It is exactly the type of story that we would all imagine when hearing

about data breaches, largely thanks to big‐budget Hollywood movies. However, (2) the story is almost completely

false; the only true parts are that a large number of private security clearance files were indeed stolen from the

Office of Personnel Management, and the June 20 article in Computerworld did display the preceding quote. If managers expect only such “urgent and frantic” physical attacks, they will focus their attention on the wrong

threats. It is important to learn the true story of this very real breach.

Governmental officials learned in May 2015 that at least 4 million records likely had been stolen several months

earlier. Subsequent estimates placed the number at 14 million records.2 The records contained much more than

names, addresses, and social security numbers of current and former employees, possibly as far back as the 1980s.

The 127‐page dossier for each person also included information on alcohol and drug use, financial, psychological,

employment, and criminal history as well as sensitive personal information about contacts and relatives. There

were even comments from acquaintances, which could include neighbors, enemies, and potential enemies of each

person.3 In short, according to the International Business Times, the stolen information was “invasive enough to ruin potentially millions of American lives.”4 As a consequence, the Chairman of the U.S. House Oversight

Committee asked for the resignation of the person in charge, the Director of the Office of Personnel Management.5

In reality, the following important issues are true for this case as well as many others:

1. The hackers were far away and did not need any physical contact or any escape plan.

2. They were able to spend an extended period of time—possibly over a year—to carry out their attack.6

3. It took the victim organization months to discover the breach, which enabled the hackers to cover their tracks. In fact, a 2015 report from consulting firm Mandiant revealed that the median time that it took in

2014 for firms to detect a threat group’s presence was 205 days, and the maximum was a whopping 2,982

days (11 years).7

4. The hackers exploited a stolen password, likely obtained by various means described later in this chapter.

1 O’Connor, Fred, “Hackers Had Access to Security Clearance Data for a Year,” Computerworld (June 20, 2015), http://www.computerworld.com/ article/2938654/cybercrime‐hacking/hackers‐had‐access‐to‐security‐clearance‐data‐for‐a‐year.html (last accessed June 22, 2015). 2 Kim Zetter and Andy Greenberg, “Why the OPM Breach Is Such a Security and Privacy Debacle,” Wired (June 11, 2015), http://www.wired. com/2015/06/opm‐breach‐security‐privacy‐debacle/ (accessed June 22, 2015). 3 Ibid. 4 Jeff Stone “Hacked US Security Clearances Are Giving Beijing Insanely Personal Information about American Citizens” (June 12, 2015), http://www.

ibtimes.com/hacked‐us‐security‐clearances‐are‐giving‐beijing‐insanely‐personal‐information‐about‐1964882 (last accessed August 25, 2015). 5 Erin Kelly, “House Oversight to OPM Chief: ‘Time for You to Go,’” In Brief (June 26, 2015), 2A. 6 “Blackmail Looms after Government Cyber Breaches,” WND.com (June 13, 2015). http://www.wnd.com/2015/06/blackmail‐looms‐after‐government‐

cyber‐breaches/ (accessed June 22, 2015). 7 “M‐Trends: A View from the Front Lines,” Fireeye.com, https://www2.fireeye.com/rs/fireye/images/rpt‐m‐trends‐2015.pdf (last accessed June 24, 2015).

c07.indd 148 11/26/2015 7:31:39 PM

149IT Security Decision Framework

Many other firms have been victimized, and hundreds of millions of records filled with personal information

have been stolen just over the last two years. Security consulting firm FireEye estimates that 97% of all firms have

been breached.8 Managers must understand how large breaches occur to clarify the picture of what is going on out

in the wild frontier and to protect their own company from similar fates. Only when threats are more fully under-

stood can management begin to formulate and implement effective security plans.

IT Security Decision Framework The first step on the road to an effective security plan is for management to adopt a broad view of security. This

can be done by establishing an information security strategy and then putting the infrastructure (tools) and policies

(tactics) in place that can help the organization realize its strategy. To round out the picture, users need to become

familiar with security, and investments need to be made. The whole security picture can be reflected in five key

information security decisions. Understanding these decisions and who is responsible for them (that is, who has

the decision rights for them) is presented in Figure 7.1. We introduced decision rights in Chapter 3, and we use

the concept to illustrate appropriate roles of business and IT managers in making a company’s security decisions.

FIGURE 7.1 Key information security decisions. Sources: Adapted from Yu Wu, “What Color is Your Archetype? Governance Patterns for Information Security,” (Ph.D. Dissertation, University of Central Florida, 2007); Yu Wu and Carol Saunders, “Governing Information Security: Governance Domains and Decision Rights Allocation Patterns,” Information Resources Management Journal 24, no. 1 (January–March 2011), 28–45.

Information Security Decision

Who Is Responsible

Rationale Major Symptoms of Improper Decision Rights Allocation

Security Strategy Business leaders Business leaders have the knowledge of the company’s strategies on which security strategy should be based. No detailed technical knowledge is required.

Security is an afterthought and patched on to processes and products.

Infrastructure IT leaders (CISO) In‐depth technical knowledge and expertise are needed.

There is a misspecification of security and network typologies or a misconfiguration of infrastructure. Technical security control is ineffective.

Security Policy Shared: IT and business leaders

Technical and security implications of behaviors and processes need to be analyzed, and trade‐offs between security and productivity need to be made. The particulars of a company’s IT infrastructure need to be known.

Security policies are written based on theory and generic templates. They are unenforceable due to a misfit with the company’s specific IT and users.

Security Education, Training, and Awareness

Shared: IT and business leaders

Business buy in and understanding are needed to design programs. Technical expertise and knowledge of critical security issues are needed to build them.

Users are insufficiently trained, bypass security measures, or do not know how to react properly when security breaches occur.

Investments Shared: IT and business leaders

They require financial (quantitative) and qualitative evaluation of business impacts of security investments. A business case has to be presented for rivaling projects. Infrastructure impacts of funding decisions need to be evaluated.

Under‐ or overinvestment in information security occurs. The human or technical security resources are insufficient or wasted.

8 Bill Whitaker, “What Happens When You Swipe Your Card?” 60 Minutes (November 30, 2014), transcript, http://www.cbsnews.com/news/swiping‐ your‐credit‐card‐and‐hacking‐and‐cybercrime/ (accessed June 24, 2015).

c07.indd 149 11/26/2015 7:31:39 PM

150 Security

1. Information security strategy: A company’s information security strategy is based on such IT principles as protecting the confidentiality of customer information, strict compliance with regulations, and maintain-

ing a security baseline that is above the industry benchmark. Security strategy is not a technical decision.

Rather, it should reflect the company’s mission, overall strategy, business model, and business environment.

Deciding on the security strategy requires decision makers who are knowledgeable about the company’s

strategy and management systems. An organization’s information systems (IS) likely need to provide the

required technical input for supporting the decision.

2. Information security infrastructure: Information security infrastructure decisions involve selecting and configuring the right tools. Common objectives are to achieve consistency in protection, economies of

scale, and synergy among the components. Top business executives typically lack the experience or exper-

tise to make these decisions. For these reasons, corporate IT typically is responsible for managing the

dedicated security mechanisms and general IT infrastructure, such as enterprise network devices. Thus,

corporate IT should take the lead and make sure that the technology tools in the infrastructure are correctly

specified and configured.

3. Information security policy: Security policies encourage standardization and integration. Following best practices, they broadly define the scope of and overall expectations for the company’s information security

program. From these security policies, lower‐level tactics are developed to control specific security areas

(e.g., Internet use, access control) and/or individual applications (e.g., payroll systems, telecom systems).

Policies must reflect the delicate balance between the enhanced information security gained from follow-

ing them versus productivity losses and user inconvenience. As security attacks become more sophisti-

cated, obeying security measures to deflect those attacks places cognitive demands on users. For example,

they may need a different password for every account, and these passwords must often be long and hard to

remember because they must have special characters. Productivity of users is often sacrificed when they

have to come up with new passwords every month or when they have to spend time judging the legitimacy

of dozens of e‐mails each day. Not surprisingly, both IT and business perspectives are important in setting

policies. Business users must be able to say what they want from the information security program and

how they expect the security function to support their business activities. On the other hand, IT leaders

should be consulted for two reasons: (1) their judgment prevents unrealistic goals for standardization and

integration and (2) policy decisions require the ability to analyze the technical and security implications of

user behaviors and business processes. If either users or IT leaders are not consulted, unenforceable pol-

icies will probably result.

4. Information security education, training, and awareness (SETA): It is very important to make business users aware of security policies and practices and to provide information security education, training, and awareness (SETA). Training and awareness programs build a security‐conscious culture. To promote effectiveness and post‐training retention, training and awareness programs must be linked to the unique

requirements of individual business processes. Business user participation in planning and implementing

training and awareness programs helps gain acceptance of security initiatives. However, IT security person-

nel are in the best position to know critical issues. Thus, both IT security managers and business users must

be actively involved in planning SETA activities.

5. Information security investments: The fear, uncertainty, and doubt (“FUD”) factor once was all that was needed to get top management to invest in information security. As information security becomes a routine

concern in daily operations, security managers increasingly must justify their budget requests financially.

But it is difficult to show how important security is until there has been a breach—and even then it is hard to

put a dollar amount on the value of security. As when determining business needs, different units within the

company may have rival or conflicting “wish lists” for information security‐related purchases that benefit

their unique needs. The IS organization also should have a significant say in these decisions because it is in

the best position to assess whether and how the investments may fit with the company’s current IT infra-

structure and application portfolio. Thus, both IT and business leaders should participate in investment and

prioritization decisions. One way to ensure this joint participation is to use executive committees/councils

c07.indd 150 11/26/2015 7:31:39 PM

151Breaches and How They Occurred

composed of business and IT executives, such as the IT steering committee and budget committee, with the

CIO having overlapping memberships in both. These committees are where IT and business leaders make

business cases for their proposed investments and debate the merit and priorities of the investments. These

decisions about the appropriate level of investment are made with the company’s best interests in mind.

Breaches and How They Occurred In 2013 and 2014, before the Office of Personnel Management’s attack, the most famous breaches infiltrated the

systems at EBay (twice), Target, Home Depot, and Anthem Blue Cross. See Figure 7.2 for the magnitude and cause

of each breach.

Password Breaches

It is important to emphasize the damage that can be done by password breaches. As the following descriptions

indicate, trusting and trustworthy users might have no idea they are opening a security hole by clicking on an

attachment, using public WiFi, or following a link to an authentic‐looking site. Executives should not believe that

employees who use their personal laptops away from the office are harmless to the firm. When employees whose

systems are infected log onto work e‐mail systems or intranets, a hacker can gain access to the firm.

60 Minutes reported in 2015 that 80% of breaches are conducted by stealing a password.9 There are many ways to steal a person’s password. One common method is to conduct a successful phishing attack,10 which sends a person a counterfeit e‐mail that purports to be from a known entity. The e‐mail includes either a virus‐laden

FIGURE 7.2 Well‐known breaches, what was stolen, and how.

Date Detected Company What Was Stolen How

November 2013 Target 40 million debit and credit card account numbersa

Contractor’s opening of an e-mail attachment containing a virus, revealing a passwordb

May 2014 EBay #1 145 million user names, e‐mails, physical addresses, phone numbers, birth dates, encrypted passwordsc

Obtaining an employee’s passwordd

September 2014 EBay #2 Small but unknown Cross‐site scripting

September 2014 Home Depot 56 million credit card numbers

53 million e-mail addresses

Obtaining a vendor’s password and exploiting an operating system’s vulnerabilitye

January 2015 Anthem Blue Cross 80 million names, birthdays, e‐mails, social security numbers, addresses, and employment data (including income)f

Obtaining passwords of at least five high‐level employeesg

a Brian Krebs, “Target Hackers Broke in Via HVAC Company,” Krebs on Security (February 14, 2014), http://krebsonsecurity.com/2014/02/target‐hackers‐broke‐in‐ via‐hvac‐company/ (accessed June 22, 2015). b Brian Krebs, “Home Depot: Hackers Stole 53M Email Addresses,” Krebs on Security (November 14, 2014), http://krebsonsecurity.com/2014/11/home‐depot‐ hackers‐stole‐53m‐email‐addreses/ (accessed June 28, 2015). c Andy Greenberg, “EBay Demonstrates How Not to Respond to a Huge Data Breach, Wired (May 23, 2014), http://www.wired.com/2014/05/ebay‐demonstrates‐ how‐not‐to‐respond‐to‐a‐huge‐data‐breach/(accessed June 22, 2015). d Bill Whitaker, “What Happens When You Swipe Your Card?” 60 Minutes (November 30, 2014), transcript, http://www.cbsnews.com/news/swiping‐your‐credit‐ card‐and‐hacking‐and‐cybercrime/ (accessed June 24, 2015). e Ashley Carman, “Windows Vulnerability Identified as Root Cause in Home Depot breach,” SC Magazine (November 10, 2014), http://www.scmagazine.com/ home‐depot‐breach‐caused‐by‐windows‐vulnerability/article/382450/ (accessed June 28, 2015). f Michael Hiltzik, “Anthem Is Warning Consumers about Its Huge Data Breach. Here’s a Translation,” LA Times (March 6, 2015), http://www.latimes.com/business/ hiltzik/la‐fi‐mh‐anthem‐is‐warning‐consumers‐20150306‐column.html#page=1 (accessed June 28, 2015). g Ibid.

9 Ibid. 10 Brian Honan, “Reactions to the EBay Breach,” http://www.net‐security.org/secworld.php?id=16905 (accessed June 22, 2015).

c07.indd 151 11/26/2015 7:31:39 PM

152 Security

attachment or a link that invites the user to click and visit a page to either solve a problem or accomplish a task (as

described in detail at the end of this chapter).

The only limit is the phisher’s imagination to create a scenario that would motivate a user to click on a link. The

attachment or link in a phishing message often initiates a key logger, or software that traps keystrokes and stores them for hackers to inspect later. A key logger can even be hidden on a thumb drive plugged into a public computer

in a hotel’s business center. A key logger might also be triggered by visiting an unfamiliar Web site. Just by click-

ing on a search result, a user might inadvertently download and install the key logging software. Asking the user to

log‐in will reveal his or her user name and password, opening a world of opportunity for the hacker.

Another way to obtain a password is simply to guess it. Experts warn that large breaches can be caused by using

a weak password, such as “123456,” which, incredibly, won again as the most common password of all in 2014.11 Passwords can be troublesome. Creating a strong password that cannot be guessed results in a hard‐to‐remember

string of nonsense characters. The name of a hometown, a team, an employer, or a family member would be among

the first guesses of a hacker. Also, even if it is difficult to guess, many people use the same password for multiple

purposes, and if one account is breached, all of their other accounts are then wide open. It is challenging to keep

track of difficult passwords that are different for every account. Tools such as LastPass, Dashlane, and Sticky

Password allow access with one password to a set of highly complex and impossible‐to‐remember passwords

synchronized across Windows and Mac computers as well as Android and iOS smartphones.12

Yet another way to open a firm to a large breach is for employees to use an unsecured network at a coffee shop,

hotel, or airport.13 Many users do not realize that, even if the network’s name matches the coffee shop’s name,

someone in the shop might have set up a so‐called evil twin connection WiFi connection and that all incoming and outgoing Internet traffic becomes routed through the perpetrator’s system. Without the proper tools or training,

most users can’t validate a public WiFi connection. Once connected, the unwitting users’ keystrokes, including

their user names and passwords, are captured as they shop online, do Internet banking, or log into their company’s

intranet site.14 The only solution might be for companies to establish policies forbidding their employees to use

public WiFi and use their smartphones as their PC’s sole Internet connection even when tempted by free WiFi in

public places.

Other Attack Approaches

Cross‐Site Scripting

As shown in Figure 7.2, a second EBay breach is another important attack for management to understand. It was

discovered in September 2014 by an astute user who nagged EBay to fix the problem for over a year.15 He even

created a surprising YouTube video to show how it worked.16 The damage is unclear, affecting only the users who

clicked on one particular search result that was eventually removed. However, the cause is clear in this case:17

cross‐site scripting (XSS), which involves booby traps that appear to lead users to their goal, but in reality, they lead to a fraudulent site that requires a log‐in. EBay permits users to install some computer code in their listings to

make their items in EBay search results grab shoppers’ attention. It is intended to allow animation in listings, but

malicious code was inserted instead, designed for a nefarious purpose: to alter the listing’s address to point to a

bogus log‐in screen. Users assumed they needed to log‐in once again for security purposes, but in reality everyone

who “logged‐in” that second time provided the crooks with user names and passwords.

11 Jamie Condliff, “The 25 Most Popular Passwords of 2014: We’re All Doomed,” Gizmodo (January 20, 2015), http://gizmodo.com/the‐25‐most‐ popular‐passwords‐of‐2014‐were‐all‐doomed‐1680596951 (accessed June 22, 2015). 12 Neil J. Rubenking. “The Best Password Managers for 2015,” PC Magazine (June 2, 2015), http://www.pcmag.com/article2/0,2817,2407168,00.asp (accessed June 25, 2015). 13 Sergio Galindo. “Reactions to the EBay breach,” http://www.net‐security.org/secworld.php?id=16905 (accessed June 22, 2015). 14 Andrew Smith, “Strange Wi‐Fi Spots May Harbor Hackers: ID Thieves May Lurk Behind a Hot Spot with a Friendly Name,” Dallas Morning News (May 9, 2007), http://cloud‐computing.tmcnet.com/news/2007/05/09/2597106.htm (accessed August 25, 2015). 15 Chris Brook, “A Year Later, XSS Vulnerability Still Exists in EBay,” Threatpost (April 29, 2015), https://threatpost.com/a‐year‐later‐xss‐vulnerability‐ still‐exists‐in‐ebay/112493 (accessed August 27, 2015). 16 Paul Kerr, “Ebay Hacked Proof!” (September 16, 2014), https://www.youtube.com/watch?v=WT5TG_LvZz4&feature=youtu.be (accessed June 22, 2015). 17 Phil Muncaster, “EBay Under Fire After Cross‐Site Scripting Attack,” Infosecurity (undated), http://www.infosecurity‐magazine.com/news/ebay‐ under‐fire‐after‐cross‐site/ (accessed June 22, 2015).

c07.indd 152 11/26/2015 7:31:39 PM

153Breaches and How They Occurred

Third Parties

Several breaches have involved third parties. The Target attackers broke into the network using credentials stolen

from a heating, ventilation, and air conditioning (HVAC) contractor and installed malware on the retail sales

system. The malware captured and copied the magnetic stripe card data right from the computer’s memory before

the system could encrypt and store it. Why would an HVAC contractor have access? Security expert and blog-

ger Brian Krebs reports that it is common for large retailers to install on their systems temperature and energy‐

monitoring software provided by contractors. HVAC companies need to update and maintain their software, and

are given access to their main systems so they don’t have to endure delays in those updates. Access to the retailing

system enabled the malware to spread to a majority of Target’s cash registers, collecting information from debit and

credit cards and sending it to various drop points in Miami and Brazil to be picked up later by hackers in Eastern

Europe and Russia.18

Home Depot’s story echoed that of Target from a year earlier. Logon credentials were stolen from a vendor

that had access to Home Depot’s system, and the same malware was unleashed to cash registers. Target’s story

motivated Home Depot to update its system but the attack occurred before the company could complete all of the

improvements.19

The attack at Anthem Blue Cross demonstrates that stealing high‐level user names and passwords can pro-

vide quick access to large and important files. Target and Home Depot hackers had to wait until transactions were

recorded to gain valuable information, which takes several days. But at Anthem, being able to download important

employment and identity information from 80 million people at one pass was easy with the high‐level passwords.

Log‐in credentials of lower‐level employees would involve transaction‐by‐transaction data collection. Therefore,

log‐in accounts of executives need special attention, and their activities should be monitored regularly.

System Logs and Alerts

Early news reports of Target’s hack outraged customers when it was revealed that the newly installed, state‐of‐the‐

art $1.6 million security system detected what was going on. It sent several warnings to the IT department, even

before the first files were transferred, but those alerts were unheeded.20 However, some security experts explain that

there are perhaps hundreds of generic alerts each day, and it is difficult to follow up on every one. One expert was

quoted aptly: “it is completely understandable how this happened.”21

The Cost of Breaches

A Ponemon study places the cost of a data breach in 2015 to be at an all‐time high, between $145 and $154 per each

lost or stolen record containing sensitive information.22 If a breach exposes 100 million records, the costs could

escalate to about $15 billion. Many firms facing such costs would be put in serious jeopardy. The Target breach cost

$61 million in just two months,23 $162 million a year later,24 and potentially billions of dollars in damage control

over the long run.25 The CIO resigned, fourth quarter profit fell 46%, and revenue declined 5.3%.26 The Home Depot

18 Brian Krebs, “Target Hackers Broke in Via HVAC Company,” Krebs on Security (February 14, 2014), http://krebsonsecurity.com/2014/02/target‐

hackers‐broke‐in‐via‐hvac‐company/ (accessed June 22, 2015). 19 Shelly Banjo, “Home Depot Hackers Exposed 53 Million Email Addresses,” The Wall Street Journal (November 6, 2014), http://www.wsj.com/ articles/home‐depot‐hackers‐used‐password‐stolen‐from‐vendor‐1415309282 (accessed June 22, 2015). 20 Michael Riley, Ben Elgin, Dune Lawrence, and Carol Matlack, “Missed Alarms and 40 Million Stolen Credit Card Numbers: How Target Blew

It,” Bloomberg Business (March 13, 2014), http://www.bloomberg.com/bw/articles/2014‐03‐13/target‐missed‐alarms‐in‐epic‐hack‐of‐credit‐card‐data (accessed August 25, 2015). 21 Joel Christie, “Target Ignored High‐Tech Security Sirens Warning Them of a Data Hack Operation BEFORE Cyber‐Criminals in Russia Made Off

with 40 Million Stolen Credit Cards,” http://www.dailymail.co.uk/news/article‐2581314/Target‐ignored‐high‐tech‐security‐sirens‐warning‐data‐hack‐

operation‐BEFORE‐cyber‐criminals‐Russia‐40‐million‐stolen‐credit‐cards.html (last accessed June 24, 2015). 22 Ponemon Institute, “2015 Cost of Data Breach Study,” IBM, http://www‐03.ibm.com/security/data‐breach/ (accessed June 23, 2015). 23 Riley, Elgin, Lawrence, and Matlack, “Missed Alarms and 40 Million Stolen Credit Card Numbers.” 24 PYMNTS@pymnts, “How Much Did the Target, Home Depot Breaches Really Cost?” PYMNTS.com (February 26, 2015), http://www.pymnts.com/

news/2015/target‐home‐depot‐reveal‐full‐breach‐costs/#.VYr_6EZZV34 (accessed June 24, 2015). 25 Christie, “Target Ignored High‐Tech Security Sirens.” 26 Associated Press. “Target’s Tech Boss Resigns as Retailer Overhauls Security in Wake of Massive Payment Card Breach,” Financial Post (March 5, 2014), http://business.financialpost.com/fp‐tech‐desk/cio/target‐cio‐resigns?__lsa=011c‐8001 (accessed August 27, 2015).

c07.indd 153 11/26/2015 7:31:39 PM

154 Security

breach cost $33 million (after insurance proceeds of $30 million reduced the initial outlays of $63 million),27 and

the company’s stock price fell 2.1% the day after the breach was announced.28 Sales were not affected, however,

which might indicate that customers have become numb to these announcements.29

The Impossibility of 100% Security To obtain 100% security for an organization, a first step would be to list all of the potential threats, and the second

step would be to obtain tools that would guard against them. However, as in our personal lives, the challenge would

be overwhelming and the solution untenable. To keep ourselves completely safe and injury free, we would need

thick steel walls and air bags around us not only when we drive but also when we run, walk, and even just sit at

home. We would avoid germs by spraying disinfectants on all surfaces, including our own skin before touching

anything. But paradoxes exist that make it impossible to be completely safe: We would want to be high on a hill to

avoid floods but low in a valley to avoid lightning strikes—an impossible paradox. We learn quickly that it is per-

haps impossible to be 100% safe, 24/7.

Likewise, data stored in a firm would be easier to protect if they would just “stay still” as well and not be

connected to the Internet. Although some paradoxes exist in locating the data, the security closest to 100% would

be to place them in a remote area, removed from Internet access, and under several locks without any keys at all. In

short, the closest we can get to perfect safety is to make data inaccessible. But this is not feasible.

Just as we accept some degree of risk to our safety even when we move from the living room to the kitchen,

management must accept some level of risk as well when it makes any part of its treasure trove of data accessible

to even a single person inside or outside an organization. Wider data accessibility entails great risk.

Back in 1995, the late L. Dain Gary, former manager of the U.S. Computer Emergency Response Team (CERT)

in Pittsburgh appeared on an episode of 60 Minutes and let the public in on a unpleasant fact with a sobering state- ment: “You cannot make a computer secure. You can reduce the risk, but you can’t guarantee security.”30 Because of

the futility of seeking 100% security, many companies take out insurance policies to mitigate the financial impacts

of a breach. It is important to also consider the so‐called “Poulsen’s law” that states that information is secure when

it costs more to get it than it’s worth.31 This is a good rule to remember, and the role of management is to work with

the IT function to make it harder to break in than it is worth.

And stolen information is worth a lot. A security expert reported that in 2014, stolen credit cards sold for bet-

ween $1 and $50 each, depending on the type of card (e.g., platinum, silver, suggesting its credit limit) and expira-

tion date. Of the 40 million Target credit card numbers stolen, about 2 million (5%) were sold at an average price

of $20, yielding $4 million to the hackers. A member of a street gang who bought one of those credit cards for $20

was likely to yield $400 in purchases of gift cards and electronics.32

Further, a complete identity‐theft “kit” containing not only a card but social security number and medical

information is worth far more—between $100 and $1,000 each on the black market.33 The value is high because

identity‐theft information can be used to open new credit cards again and again, generating quite a bit of revenue.

The hackers do not keep stolen credit cards or identity theft information for their own use, given the stagger-

ing volume they acquire. They quickly sell them online to others all over the world who use them before they are

27 PYMNTS@pymnts, “How Much Did the Target, Home Depot Breaches Really Cost?” 28 Hiroko Tabuchi, “Home Depot Posts a Strong 3rd Quarter Despite a Data Breach Disclosure,” The New York Times (November 18, 2014), http://www. nytimes.com/2014/11/19/business/home‐depot‐reports‐strong‐third‐quarter‐growth‐despite‐data‐breach‐disclosure.html (accessed June 23, 2015). 29 Anne D’Innocenzio, “4 Reasons Shoppers Will Shrug Off Home Depot Hack,” USA Today (September 11, 2014), http://www.usatoday.com/story/ money/business/2014/09/11/4‐reasons‐shoppers‐will‐shrug‐off‐home‐depot‐hack/15460461/ (accessed June 23, 2015). 30 60 Minutes, “E‐Systems” (February 26, 1995). 31 “Anything Made by a Man Can Be Hacked,” DSL Reports (March 6, 2006), http://www.dslreports.com/forum/remark,15623829 (accessed September 15, 2015). 32 Whitaker, “What Happens When You Swipe Your Card?” 33 Tim Greene, “Anthem Hack: Personal Data Stolen Sells for 10x Price of Stolen Credit Card Numbers,” Networkworld (February 6, 2015), http://www. networkworld.com/article/2880366/security0/anthem‐hack‐personal‐data‐stolen‐sells‐for‐10x‐price‐of‐stolen‐credit‐card‐numbers.html (accessed June

24, 2015).

c07.indd 154 11/26/2015 7:31:39 PM

155What Should Management Do?

reported as stolen. Those cards even come with a return policy in case they are declined, because the black market

shops need to maintain their reputations. However, the guarantees come with a warning that they run out after only

a few hours.34

One final discouraging word is important. A study by the Software Engineering Institute in 2002 revealed that

over time, the knowledge needed by an intruder for an attack reached an all‐time low whereas the potential impact

of the intruders’ attack reached an all‐time high.35 The intruders’ tools have not only become more sophisticated

but also have actually become user friendly. Automated tools can be purchased on the Deep Web, which is a part of the Internet that is reputed to be 400 times larger than the public Web. The Deep Web includes unindexed Web

sites that are accessible only by a browser named “Tor,” which guarantees anonymity and provides access to sites

offering both legal and illegal items. Examples of illegal items offered are passports, citizenship, and even murders

for hire.36 Also for sale are tools that can scan for vulnerable systems, exploit the weaknesses found, and even gen-

erate viruses. Payment could reach hundreds of thousands of dollars, usually made through Bitcoin, an electronic currency that is difficult to track.

The outlook is certainly grim, but some of the clues in the stories told here can provide some prescriptions for

management.

What Should Management Do? Five critical elements to build security described earlier include security strategy, infrastructure, policies, training,

and investments. Security strategy needs to come first, and top management must determine the general strategy as

well as investments that are needed. Infrastructure, policy, and training decisions have to be made in more detail,

and these three areas will now be discussed. Fortunately, general managers can easily understand key issues for

each of these elements and participate fully in design and implementation of the resulting security plans.

Infrastructure

Hackers have significant tools to breach security barriers as previously described. In this rapidly escalating cyber

war, management must use its own set of technologies and specialists to reduce risk and increase security. Many

firms employ a chief information security officer (CISO), described in Chapter 8, to keep abreast of new threats that

emerge and manage the policies and education necessary to reduce risk. In other firms, this responsibility falls to

the CIO or simply the facilities security staff. Even with specialists, managers need to have a broad understanding

of these tools to communicate effectively with them.

Tools can be divided into two categories: those that provide protection from access by undesired intruders and

those that provide protection for storage and transmission. See Figure 7.3 for a list of common system tools to pre-

vent access and their advantages and disadvantages and Figure 7.4 for a list of common storage and transmission

tools and their advantages and disadvantages.

Passwords are by far the most popular security tool even though they have proven to be the cause of most

breaches. Some security specialists claim that passwords are obsolete and should be discontinued.37 Also, all access

protection tools have the disadvantage of requiring an additional access method if it fails. For instance, because

users often forget a password, firms need to make additional investments to create an automated resetting mecha-

nism through an alternate method, such as an e‐mail to a known address or a text message to a mobile phone.

34 Aaron Sankin, “Inside the Black Markets for Your Stolen Credit Cards,” The Kernel (September 28, 2014), http://kernelmag.dailydot.com/issue‐ sections/features‐issue‐sections/10362/inside‐the‐black‐markets‐for‐your‐stolen‐credit‐cards/ (accessed August 27, 2015). 35 Howard F. Lipson, “Tracking and Tracing Cyber‐Attacks: Technical Challenges and Global Policy Issues,” Special Report CMU/SEI‐2002‐SR‐009,

http://www.sei.cmu.edu/reports/02sr009.pdf (accessed August 27, 2015). 36 Nyshka Chandran, “From Drugs to Killers: Exploring the Deep Web,” CNBC Technology (June, 2015), http://www.cnbc.com/id/102782903 (accessed

June 25, 2015). 37 Justin Balthrop, “Passwords Are Obsolete,” Medium.com (April 12, 2014), https://medium.com/@ninjudd/passwords‐are‐obsolete‐9ed56d483eb

(accessed June 24, 2015).

c07.indd 155 11/26/2015 7:31:39 PM

156 Security

FIGURE 7.3 Common system access security tools and their advantages and disadvantages.

Access Tool Concept Ubiquity Notable Advantages Notable Disadvantages

Physical locks Physically protect computing resources

Very high • They are excellent as long as the lock is highly secure and guarded

• Few criminals can access physical devices

• Many popular locks can be picked with tools sold online

• Most information resources do not require physical access

• Users often lose keys or combinations

Passwords Invent a set of characters known only by the user

Very high • They have very high acceptance and familiarity

• They are easy to use unless forgotten

• Mature best practices replace forgotten passwords (no longer a need to call the help line to reset)

• They prove to be poor by themselves

• They are sometimes forgotten • They are sometimes derived

from key loggers or social engineering

• They can be guessed by “brute force” software

Biometrics Scan a body characteristic, such as fingerprint, voice, iris, head, or hand geometry

Medium overall; popularized by iPhone

• It is somewhat better than passwords

• It can be very reliable (e.g., iris scanning)

• It cannot be forgotten • It cannot be derived from

key loggers or social engineering

• It can be quite inexpensive (e.g., voice, fingerprint)

• It can present false positives and false negatives (e.g., voice; facial recognition)

• It can be relatively expensive and intrusive techniques (e.g., iris scanning)

• It is possible to change characteristics over time, such as voice

• It can result in lost limbs • It can create “loopholes” such

as using a photo of a face or fingerprint on paper

Challenge questions

Prompt with a follow‐up question such as “model of first car?”

Medium overall; very high in banking

• The answers are usually not forgotten

• Shuffling through several different questions can enhance security

• Some answers can be derived from social network sites