Friday, March 23, 11:52 a.m....

"Speechless" was not a word most people could imagine applying to Jim Barton, head of the IVK Loan Operations department. But the news [CEO Carl] Williams had conveyed moments before had left Barton dumbfounded. "We're not asking you to leave. But I had originally proposed a very different role for you than the one you've ended up in." An unusual assignment. I can live with that [thought Barton]. "I'm willing to do whatever will help," he offered. "Having discussed this with the board extensively, we've..." Here Williams drew in a deep breath, "Well, we've decided that you should be our new chief information officer." This was the news that had knocked the air out of Barton. Finally, he managed to babble: "CIO? You want me to be the CIO?" "Davies has been overwhelmed in that role. You've been one of his most outspoken critics." "I know, but...I've got no background in information technology." "And Davies has a lot. That clearly doesn't work, so we've decided to try something else." "Carl," said Barton, "I just don't think I'm the right choice." "Give it time," said Williams, "but not too much time. Let me know what you decide."

Friday, March 23, 2:41 p.m....

All day, employees had been working on a big whiteboard in the back of a storage room to create a chart showing the new management team. Jim Barton remained the biggest puzzle. When inquisitiveness overwhelmed them, people gravitated to the corridor outside Barton's office. Barton was oblivious to their attention, lost in a think fog, oscillating between anger and excitement, as unsure as he had ever been about anything. At 1:35 p.m., he'd swiveled his chair around to the computer screen and had begun searching the Web. He had come across a PowerPoint presentation called "A Short History of the CIO Position." Some of the content was cryptic, but the gist of it was clear. As Barton thought back through the history of IVK, he realized that this [CIO history] fit IVK reasonably well. During the dotcom craze, IVK had been a startup. When the bottom had fallen out of the tech market, it was a very good thing that IVK had never quite gotten on board the Internet express. Throughout much of the crash-and-burn period for Internet startups, IVK had managed to grow.

The Adventures of an IT Leader

Page 1

The part about IT being a potential source of growth for a firm excited Barton. He remembered Davies arguing that superior technical features that could be demonstrated to clients could be a factor in closing deals. That's why he'd wanted in on meetings with customers. The idea of Davies and his weird neckties sitting down with customers had obscured serious consideration of this argument. He shut his browser and stood up. Looking toward the door, he noticed the people outside his office. "What is it?" he asked them, as he emerged with coat on and briefcase in hand. He singled out someone who had worked for him in Loan Operations. "Jackie, what's going on?" "We've been trying to figure out where you fit in the new management team." He looked around, gathered his nerve and tried on a phrase that had never before passed his lips: "I'm the new CIO." Several people in the room gasped. Barton did not wait for further reactions. He headed for the elevator, leaving stunned silence in his wake.

Sunday, March 25, 8:15 a.m....

Barton sat on cold pavement, legs outstretched, prepping for a long run around the park. He'd spent Saturday night watching TV and listening to music, and then he'd gone to bed early. The relatively mindless pursuits had left him with plenty of capacity to think about his first day as CIO on Monday. The obvious first thing to do would be a meeting of his direct reports. In the afternoon, he wanted to spend some time with Gary Geisler, the keeper of information that pertained to IT budgets and expenditures. As Barton began to jog down a path, he had a disturbing thought. Sometimes Davies jogged here. A few minutes later he found himself running almost side-by-side with Davies, who didn't seem to notice at first. When Davies slowed down and stopped to rest and stretch, Barton did also. "Hi, Bill," said Barton. "Hello, Jim," responded Davies. A pause grew uncomfortable. Barton broke it: "I guess you heard..." "I did." Barton waited to give Davies time to say more, but he didn't. Barton opted for brevity to fill the new silence: "Ironic, huh?" "I laughed for about half an hour when I heard." Barton looked closely, trying to discern whether the remark was a friendly joke or a hostile gesture. "Hey, I just want you to knowwe had some disagreements."
The Adventures of an IT Leader

Page 2

"We sure did." Barton continued: "I was out of line at times, and I feel bad about that." Davies began to laugh. "What you don't realize, Jim, is that you'll be gone soon too. That company is a madhouse. Nobody could succeed running IT in that place. You won't last a year."

Barton started to answer, but Davies wasn't finished: "Don't feel bad for me," he added. "I start a new job on Monday. I even got a raise." Without waiting for a response from Barton, Davies sprinted away, making it clear that he didn't want to be followed. Next: Barton learns about I.T. valueand how to sell it. Excerpted from The Adventures of an IT Leader by Robert D. Austin, Richard L. Nolan and Shannon O'Donnell, Harvard Business Press, April 2009. Austin is a professor at Copenhagen Business School and an associate professor (on leave) at Harvard Business School. Nolan is a professor at the Foster School of Business at the University of Washington, Seattle, and a professor emeritus at Harvard Business School. O'Donnell is a PhD fellow at Copenhagen Business School and a former director and dramaturg at People's Light and Theatre in Philadelphia.

CIO The story so far: Jim Barton, the head of loan operations for financial services company IVK, has been tapped as the CIO by the company's new CEO, Carl Williams. The previous CIO, named Davies, has been fired. When Barton runs into Davies on a local running path a few days later, he finds out that Davies already has a new joband thinks Barton is doomed. Barton must restore Williams's confidence in IT while he learns on the job.Read the first installment

Friday, April 6, 4:20 p.m....

Barton's musings about IT value finally sent him down the hall to consult with Bernie Ruben, director of the IT department's Technical Services Group. Barton gave him an overview. "Carl is going to want to hear our ideas about how to measure IT value." Ruben nodded. "You can distinguish, not just in IT but in other areas too, between investments that are merely "qualifiers" that keep you in business and investments that help you compete. It'd be interesting to know how much of the IT budget we spend to qualify versus how much we spend to compete." "And we could try to affect the distribution of expenditures across those categories over time," said Barton. "If we can reduce costs for running qualifiers, then even if their numbers increase, we might be able to reduce our total spend on them. I like the idea of taking a run through our portfolio with

The Adventures of an IT Leader

Page 3

these categories in mind. Any chance you'd be willing to take the lead on this? I'll get Gary Geisler to help." Geisler was the IT department's financial guru. "I'll do that and get with Geisler to prepare for the value discussion. First thing Monday morning." Barton returned to his office, encouraged by Bernie's [ideas], but still feeling unsettled. Maybe from a different vantage-point he could see a way forward. If IVK is the forest, thought Barton, perhaps I should start with the value of IVK? Then at least I can establish an upper bound of the value of IT. Although he knew it to be a controversial measure, one estimate of a company's value is the price at which investors are willing to buy its common stock. How much did IT contribute to this value? The flip side of this question was also important: How much did IT diminish this market value? Barton remembered celebrating when IVK's stock price passed $75, giving IVK a market value of almost $4.8 billion. Just one-and-a-half years later, after a disappointing financial result, IVK had lost more than half of its market value. What role did IT play in that loss?

Wednesday, May 2, 1:30 p.m....

The most recent leadership team meeting had included a discussion of the company's approach to allocating resources. Each department would assess its approach to resource allocation and propose improvements to increase return on investment. In IT, this meant improving processes for figuring out which projects deserved investment. But Barton had just come from lunch with Paul Fenton, whose infrastructure and operations domain included IT security. Fenton had mentioned a concern that John Cho, the department's top security expert, had expressed. "We can close those security holes Cho is most worried about with an upgrade project," Fenton had said. "We've tried to get it funded twice now. Davies never could make much headway." "Why not?" Fenton looked uncomfortable. "I'm not sure," he said. "Geisler probably has the most complete picture." Barton thought he was leaving something unsaid. "I'm meeting with him after lunch. I'll take it up with him." Later, in a meeting with Geisler, Barton started with Fenton's security issue. "I'd like to get this project done." Now Geisler looked uncomfortable. "We have a few slush funds. For when we can't get important projects approved."

The Adventures of an IT Leader

Page 4

"Why can't we get our projects through the same decision processes we use for business unit projects?" "We have trouble getting some projects approved. Especially the deeply technical ones." "So somebody thought this was not as important as the things that we did fund?" asked Barton. "That's one interpretation," said Geisler. "John thinks there's a security hole. But it's more a professional opinion than a specific threat. So the project aimed at plugging this hole keeps losing out." "That's nonsense," said Barton. "Did Davies present it? I might have been at the meeting." Barton thought Geisler grew paler: "It was technical and didn't go over well." "Who argued against this project?" Geisler said nothing. Barton waited. "Well," Geisler said, indignation slipping into his voice, "as I remember it...you were the biggest critic." Barton had no memory of the meeting, but he had often complained aboutthe way IT presented its project proposals. "What did I say?" Barton asked. "You said they should come back when they could speak English." Barton remembered. Davies had flushed bright red. Now Geisler's recounting of the events on that day made Barton's own face warm. "Well," said Barton, recovering weakly, "that was unfair of me." "Cho thought so. He almost left the company." Barton would need to follow up on this. The company needed John Cho. Yet another reason why this upgrade project would have to be approved this time around.

"Maybe we need to get better at presenting our cases to justify IT projects." "Maybe," admitted Geisler. "Two objectives," said Barton, resolutely. "First, I want to find a way to fund thisan aboveboard way. Second, I want us to review the process we use to decide how to allocate IT budget dollars, how we decide what priorities to fund. And, as this situation demonstrates, we need to improve the process."

Next: The Wrath of the CEO

The Adventures of an IT Leader

Page 5

Excerpted from The Adventures of an IT Leader by Robert D. Austin, Richard L. Nolan and Shannon O'Donnell, Harvard Business Press, April 2009. Austin is a professor at Copenhagen Business School and an associate professor (on leave) at Harvard Business School. Nolan is a professor at the Foster School of Business at the University of Washington, Seattle, and a professor emeritus at Harvard Business School. O'Donnell is a PhD fellow at Copenhagen Business School and a former director and dramaturg at People's Light and Theatre in Philadelphia.

The story so far: Jim Barton, the head of loan operations for financial services company IVK, has been tapped as the CIO by the company's new CEO, Carl Williams. The previous CIO has been fired, and Barton must restore Williams's confidence in IT while he learns on the job. In his previous role, Barton had argued against a security upgrade. Now an apparent data breach may have compromised customer information, and Barton's job as CIO is on the line. Read the first and second installment.

Friday, June 29, 9:12 a.m....

Barton and his direct reports had convened at 7:15 a.m., and they'd begun talking through a list of issues. First, they needed to identify the security measures they wanted to implement to reduce the risk of future attacks. The upgrade project that had been rejected earlier would be accelerated, but Barton wanted them to figure out what else they could do. Second, they needed to decide what should be done to make the company secure against additional mischief from the attack that had just happened. They had no smoking gun to tell them that there had been intruders, but neither could anyone think of a way a database index file could be renamed without someone meaning to do it. Third, they needed to figure out what to recommend to Williams about what, if anything, they needed to disclose outside the company. This was the issue most likely to get people fired, the issue most likely to spell an ugly end for IVK.

Friday, June 29, 3:47 p.m....

Options were shaping up. The team would work on "future event avoidance" on a less urgent time frame, but the other two issues, recovery from the attack and what to disclose, had to be dealt with now. There were three possible courses of action: 1. Do nothing. Assume that the past mischief was the worst that the bad guys had intendedif in fact there had been bad guys. 2. Shut down the company except for operations that could run manually and rebuild critical systems from development files. This was the "playing it as safe as possible" option, but the shutdown would be noticeable enough from outside IVK that it would need to be explained.
The Adventures of an IT Leader

Page 6

3. Build a mirror site from development files and rebuild production systems after the mirror site was up and running. It would cost money and take a couple of weeks to assemble the necessary facilities and equipment. Barton's team had a preference for playing it safe; they liked option two. The disclosure issue was, as expected, more complicated. Some argued for coming totally clean. The most popular position called for contacting customers whose records had been accessed and warning them that their information might have been compromised. A few argued for no disclosure at all. After much tired and occasionally heated discussion, the group settled on the immediate rebuild optionexplaining it as maintenanceand disclosure to customers only. Barton called Williams to say that he was ready to discuss options. Williams informed him that the senior management team would convene at 8 a.m. to decide what to do.

Saturday, June 30, 8:56 a.m....

"So, this is a recommendation," said Williams. They were assembled in the boardroom. Williams stood, as usual. Leadership team members sat around the table. Williams turned to Graham Wells, the company's chief lawyer. "I like the idea of playing it safe," said Wells. "Other thoughts?" Williams looked around the room. The others stirred, nodding and murmuring agreement with Barton and Wells. "What if," Williams asked, "a reporter or analyst puts together the maintenance outage and the warnings we're sending to customers, then wants to know about the attack?" "How would a reporter or analyst know about the attack?' asked Niels Hansen, Barton's successor as head of loan operations. "I don't know," said Williams. "Our employees know about it. Think none of them has mentioned it to a friend?" Williams continued: "Let me see handswho thinks we should adopt the plan that Jim Barton has recommended?" Haltingly, exchanging uncertain glances, the executives raised their hands, in the end indicating unanimous agreement. Williams surveyed the room, then moved to the window. For a long time he stood, looking out. Such a flair for drama, mused Barton. All the long pauses and stalking around. Williams turned back: "I don't agree," he said quietly. "I WAS HIRED," he said, now shouting, "to turn this company around. We will NOT shut the company down. And we will NOT say to anyone that we think, maybe, possibly we might haveperhaps, perchance, conceivablylost customer data."
The Adventures of an IT Leader

Page 7

He paused to inhale again, then focused his attention on Barton. "This is it," Barton thought, "I'm history." Miraculously, Graham Wells chose that moment to speak up: "I can't go along with you on this, Carl. This is a very dangerous course you're proposing. "I agree," said Hansen. "Anybody else?" Williams asked. No one said anything. "Very well," Williams said quietly, "the two of you are fired."

Williams returned to the window. Wells and Hansen looked at each other, then stood and left the room. No one moved or made a sound. Suddenly, Williams turned and pointed at Barton. "YOU will need to take over loan operations again until I figure out who to turn it over to. Do NOTand I mean DO NOTlet loan operations distract you from your duties in IT. And DO NOT let this ever happen again. " "Yes, Carl," Barton whispered. "This meeting is adjourned," said Williams. CAN BARTON RECOVER? Read the final installment.

The story so far: Jim Barton, the head of loan operations for financial services company IVK, has been tapped as the CIO by the company's new CEO, Carl Williams. The previous CIO has been fired, and Barton must restore Williams's confidence in IT while he learns on the job. In his previous role, Barton had argued against a security upgrade. After an apparent data breach that may have compromised customer information, Barton has narrowly escaped being fired. And his IT department is under extra scrutiny by the company's leadership team. Read the first, second and thirdinstallment.

Wednesday, August 8, 9:38 a.m....

Jim Barton slammed his office door and slapped a notepad hard onto the desk. "Why," he asked of no one in particular, "does every interaction with those guys have to be like a trip to the dentist?" The leadership team meeting had just broken up. Much of it had to do with IT. Most of that had amounted to listening to people complain. Since the security event in June, people seemed less willing to assume that Barton and the IT group were doing things for good reasons.

The Adventures of an IT Leader

Page 8

He needed to turn his attention to the final item that had come up in the meeting: Web 2.0. Bernie Ruben, director of the IT department's Technical Services Group, had forwarded him an e-mail on the subject a couple of days before. Barton located Ruben's e-mail and clicked on the attachment. He found his way to the bottom of the report, which listed some of the people within IVK who were participating in the so-called "Web 2.0 revolution." Some items in the list were links to blogs. Barton clicked on one and found himself reading about one guy's experiences working in the customer support center at IVK. To his dismay, there was a description of a day when the systems at IVK went down. The author even speculated, jokingly, about the cause of the outage; his lighthearted list included viruses and hackers. "You've got to be kidding!" Barton cried out before he stood and went storming down the hall in search of answers.

Tuesday, August 14, 11:35 a.m....

"Three questions," said Ruben. "One: What should we do about this blog entry?" "Nothing," said Raj Juvvani, director of customer support and collection systems. Ruben nodded and continued: "Two: What should be our policy about blogging on inside information from within the company?"

"Tons of implications here: legal, protecting proprietary info and more," said Tyra Gordon, director of loan operations and new application development. Ruben, still nodding, continued: "Three: What should be our process for spotting emerging technologies and seeing how they might be relevant to us?" Barton spoke: "My first inclination would be to put in place a rather restrictive policy on blogging. That's what Williams would say. "Have you discussed it with Williams?" braved Gordon. I can barely get him to meet with me, thought Barton. He said: "If he learned that there was a description on the Web of the outage we experienced, he'd probably fire all of us." Paul Fenton director of infrastructure and operations, spoke up: "A lot of this Web 2.0 stuff can come to companies whether they like it or not. AskNintendo. When the wrist strap on the company's gaming remote turned out to be underengineered, movies of TVs obliterated by flying remotes started showing up all over the Web." "Can you write up a few of those examples?" said Barton. "I'll use them as a basis for raising this issue with Williams."
The Adventures of an IT Leader

Page 9

Juvvani interjected: "When you take these issues to Williams, I want us to be sure that Web 2.0 technologies don't come out looking like the enemy. There's serious business potential in this area."

Wednesday, February 20, 11:10 a.m....

Barton sat back in the blue chair at CEO Carl Williams's office table. The relationship between the two had been better since the first of the year, for reasons Barton didn't completely understand. The time had come to decide what to spend on some major upgrades. All involved cost-versus-risk trade-offs. Only the CEO could decide how much risk was reasonable to bear, but Barton had been unsure he'd get the help from Williams that he needed. About ten minutes into the meeting, as Barton explained that things could still go wrong no matter how skillfully they deployed prevention measures, Williams started talking about poker. "Sure, I get it," he said. "Even when you've got a strong hand, things can go against you. The flip side is also true. Sometimes you make a questionable decision and things turn out okay. Like they did for us after the hacker attack. Occasionally you win by counting on luck." "But not too often, I guess," Barton said, surprising himself. Williams laughed. "Exactly right!" Then, to Barton's delight, the poker game analogy grew into a larger frame for the conversation about risk. "So, Carl, that is a great context for the decisions we need to make. Our highest priorities are risks that are likely and can generate big costs. We can decide not to do the things that generate those risks or we can decide to take the risk and invest in mitigating it.

Barton handed Williams a thin binder and they dived into discussion of specific project proposals. At one point Williams hit Barton with a stunnera remark made in passing without further elaboration: "You know, it wouldn't surprise me a bit if you turned out to be the next CEO of this company. I won't be here forever, you know." Barton had no idea how much stock to place in this remark. All Barton could do was his job, trying to make the IT department, and IVK, as ready as possible for whatever might happen. END OF SERIES

The Adventures of an IT Leader

Page 10