Managing IT Risk at Delta

Computerworld - Managers at Delta Technology Inc. once endlessly debated whether they should spend money to upgrade or replace their IT assets, from laptops and mainframes to networks. Although the IT capital budget is prepared annually, these debates "seemed to occur daily," says Brian Leinbach, senior vice president for development at the subsidiary of Atlanta-based Delta Air Lines Inc.

But the debating and wrangling has now largely stopped, he says, thanks to a simple but relatively rigorous framework for analyzing the costs and risks of IT infrastructure renewal. "It's fairly intuitive," Leinbach says. "Simple ideas are often best."

The framework is based on a curve that weighs the risk of failure against the cost of investments. At one end, risks are low but the investments required are too high. For example, it might cost x to reduce the risk of failure to one in a million, but to reduce it further might cost 100x, which is considered too high for the expected payoff. At the other end, investments are modest but risks are too high.

Leinbach says Delta strives to stay near the middle of the curve in a "manageable" area between unacceptable risk and unaffordable investment. The company's annual capital budget of $200 million supports mainframes, Unix and Windows NT servers, desktops, and voice and data networks.

Delta Technology has developed a weighted score for each combination of business area and IT asset, based on five factors: technology age, business value at risk, platform supportability, platform complexity and risk of failure. Each is then assigned a green, yellow or red flag, depending on whether the IT asset in that business area is deemed to present low, medium or high risk to the airline.

The results are combined and might show, for example, that the server infrastructure presents a medium risk for Business Area 1, a low risk for Business Area 2 and a high risk for Business Area 3.

The method works for all parts of the business, Leinbach says. "Even if you are just in finance and responsible for the books, that's not required to keep an airplane in the air, but you can't run the company very long if you can't file your paperwork."

The final step in preparation for budget writing is to develop multiple spending scenarios that show the impact on risk (again by color) in each of the business areas that would result from different levels of spending on IT infrastructure renewal.

The scorecards help focus managers' attention on risks. "It makes everyone take stock of their systems," Leinbach says. "A big red stoplight is a great communications tool." The risk analysis framework has made it easier to understand capital expenditure priorities and to communicate them to all levels of management, he adds.