“There’s so much that our company does in IT that needs to be framed within the context of finance,” says Michael Blake, vice president and CFO of the IT division at Kaiser Permanente, an Oakland, California, provider of health-care services. “IT is one of the few expenses that is almost 100 percent at management’s discretion, and sometimes the best lens on that is finance,” which provides guidance on when the company should boost or throttle back technology spending. Blake says the finance department at Kaiser Permanente works closely with IT management to allocate resources and manage projects.
As a not-for-profit entity, Kaiser Permanente isn’t subject to Sarbox 404 rules, at least not yet. Nevertheless, it’s using the stick of compliance to pursue the carrot of better IT governance. “IT and finance can work together on this, and if we do it right we’ll be Sarbanes-Oxley compliant just by the fact that we govern appropriately under frameworks such as CobiT [Control Objectives for Information and Related Technologies] and others,” Blake says. “With the advent of compliance, all of a sudden governance is starting to take a front seat.”
Indeed, when we asked CFOs about their IT priorities for 2006, the number one answer was “Maintain or improve service levels,” followed closely by “Drive productivity/efficiency initiatives,” reinforcing Gartner’s view that companies will have less funding to investigate new technologies this year. One exception may be software that addresses compliance and IT governance, which Gartner says will become a $9 billion market worldwide by 2008. One priority at some firms will be to see how such expenditures can be leveraged to meet a variety of needs (see “Doing More with Sarbox Software” at the end of this article).
Even amid regulatory requirements, life goes on, and companies such as The Hartford Financial Services Group Inc. are trying to balance the near-term demands of Sarbox with longer-range planning. Libbie Bock, vice president and CFO of The Hartford’s eBusiness & Technology group, says that the company will spend more on IT in 2006 as it tackles “many more significant projects than we have in recent years.” Many of those projects will be focused on a reengineered IT infrastructure that will allow the company to make greater use of emerging industry standards and to deliver IT services to employees and external partners more efficiently.
“We are now one year into a multiyear change effort to transform our IT organization,” she says, “that will aggressively improve our total cost of ownership, enhance our operating model, and improve our talent.”
Part of that effort, inevitably, will be to address compliance issues — for example, the company is establishing policies on how best to classify and save data — but Bock says that while last year The Hartford was largely in a “reactionary” mode, this year it will move forward more thoughtfully as it establishes policies suitable for the long haul. As for where the company might be with its multiyear plan if there were no compliance issues to address, Bock says “the rigor required for Sarbox has better positioned us to move full speed ahead in our transformation. We invested time in 2004 investigating six general IT processes [physical access, logical access, release management, job processing, data transmissions, and data backup]. Now we can effectively leverage that base of consistent processes and policies.”