Dr. Warren Ritchie

Old School CIOs versus COBIT

Avoiding COBIT is avoiding the emerging standards of IT accountability

Consider the old school CIO who rose up through the technology side of the IT business and over the years progressively demonstrated the ability to effectively manage both technology and the technologists. Now consider COBIT (Control Objectives for IT) developed by the IT Governance Institute (www.itgi.org), a generic framework for managing IT that is seemingly growing in popularity, at least as measured by the number of citations in IT periodicals. COBIT seems to be a well-reasoned, integrated framework that can actually be used as a blueprint for managing an IT department. So how should old school CIOs react to a new school phenomenon such as the COBIT framework?

From a knowledge perspective the old school CIO and COBIT represent different domains. The old school CIO manages from experience. Experience derived knowledge is generally full of idiosyncrasies related to the context in which it was learned. The old school CIO's knowledge is rich with the details of how, when, and why IT events occur. Two common properties of experience-based knowledge are that it is generally tacit in nature, meaning it is difficult to transmit to others, and it is generally deeper in some areas than others. On the other hand, the COBIT framework contains well-documented or explicit knowledge developed with the collaboration of many contributors from varying backgrounds. The result is a comprehensive blueprint that links business metrics with IT metrics and a taxonomy of IT processes and IT organizational role alignment. Contrary to the old school CIO's knowledge, the COBIT framework is easily transmitted and understood by others, including business unit leaders. It is very broad, by design, and not particularly deep in any functional area within IT.

These differences set the stage for potential conflict. Old school CIOs may see COBIT as too general, or even theoretical and impractical. COBIT nomenclature is likely to be somewhat unfamiliar and the metrics may seem largely uncollectible within some IT departments. Conversely, advocates of COBIT may view old school CIOs as so deep in the details of their past experience that they do not see the general patterns. To them the old school CIO may seem largely reactive to events rather than proactively managing IT as an integrated process.

There's another related perspective--accountability. In an IT department managed the old school way (dependent on experience) the CIO is analogous to the master craftsman. For business unit leaders the internal IT department is a black box. There are a limited number of metrics, and those that exist are not linked. In short, from the business leaders' perspective, either things in IT are running or they are not.

In the vision of a COBIT-oriented IT department there is a level of transparency into the operation that can be understood by business unit leaders. Metrics can be integrated, and the operation is not just known to be running but rather running with measures of efficiency and effectiveness. The point is not to suggest that an IT environment managed by an old school CIO is necessarily better or worse but rather that there simply will be fewer descriptive statistics about performance. So, the old school CIO often enjoys a degree of autonomy from the scrutiny of business unit leaders simply because there is insufficient internal transparency about how the IT department really works.

So, how should old school CIOs react? Should they compete with COBIT? Maybe first ignore it and then downplay the value by suggesting it's too conceptual and really doesn't apply to their unique IT environment? The question is rhetorical. Avoiding COBIT is avoiding the emerging standards of IT accountability. Not advisable, although some will consider this course. The real issue is to supplement the old school CIO's tacit knowledge with the broad, interconnected framework of COBIT. The first step is framing a non-competitive relationship between the past and COBIT. COBIT is not prescriptive, it is descriptive. It is an enhancement to existing practice, not a substitute. Is it old school CIOs versus COBIT? Alternatively, is it old school CIOs and COBIT? It's a choice but an obvious one.