Tackling Risk Analysis and Asset Portfolio Optimization

Technology portfolios don't come in "one-size-fits-all" packages, so here are some guidelines to follow when deciding how best to invest your company's money

Technology portfolios don't come in "one-size-fits-all" packages, so here are some guidelines to follow when deciding how best to invest your company's money

Technology spending is an important factor in an organization's cost structure, and an enabler of revenues. Technology cost and capabilities are ever-changing as new technologies arrive and existing technologies mature. In this turbulent environment, managers must establish a consistent and complete framework for establishing which technology portfolio best fits the organization's desire for return, tolerance for risk and business goals.

Maintaining an optimal balance of risk, return and strategic direction in the acquisition and management of a technology portfolio requires that organizations obey a consistent and complete process for assessing individual components and the portfolio. Business cases for each component are the foundation of this process; they provide a forecast of possible financial returns. The organization's internal risk factors are then identified and applied to derive a range of probable outcomes and to identify certain influential variables in those outcomes. Next, the portfolio is reviewed as a whole to rank the components by return, risk and strategic alignment. This ranked list is then laid against resource constraints to identify a range of possible portfolios. Finally, these portfolios are plotted by risk and return to find the optimum portfolio for a given level of risk or rate of return. When diligently applied, this process gives managers a consistent measure for disparate technologies and a firm foundation for the application of their strategic direction.

Valuing Individual Projects

Building a business case for a technology component requires the thorough investigation of each of the component's benefits at a technological, operational and economic level to derive an expected return for that benefit. To reflect the uncertainty in this forecast, benchmark data is applied to produce a range of returns (worst case, most likely case, best case). This range is narrowed conservatively to allow for degree of causation. Finally, these benefit returns are aggregated to produce a forecast of economic effect for the component. It is very important that this foundation-level work be done diligently and thoroughly, as the value of the final analysis is entirely dependent on the quality of this initial work.

Assessing benefits requires a careful investigation of the technical, operational and economic effect of the benefit. In reviewing these effects, it is useful to sort benefits into four categories: cost reductions, reduction in headcount or materials; revenue increases, increased sales or price points; cost avoidance, a reduction in the growth of budget item; and revenue protection, retained market share in the face of new competition or new marketplaces. The resulting four-by-three matrix provides a sound framework for this task. As a simple example:

* Technical benefits — new word-processing software enables printer sharing, reducing the number of printers required for a given number of users. However, the new software might also be incompatible with existing printing resources, requiring the purchase of new printers.

* Operational benefits — the printer sharing cited above might reduce the number of printers required, but might also slow document preparation as users would now have to walk further to retrieve their print jobs. However, the newly shared printers may have more functions (as a reduced printer cost would allow the pooling of advanced functions on fewer, but more expensive machines), and thereby reduce the need to go farther afield when advanced functions are needed.

* Economic benefits — efficiencies gained through the new word-processing tools may allow the organization to expand its markets and increase revenues. If, however, the new software is incompatible with some existing clients' technology, revenues may decrease.

This forecast must be adjusted to reflect uncertainty. This "uncertainty factor" is derived through a sensitivity analysis that applies historical or benchmark data. The application of the results of this analysis to each predicted benefit provides an expected range of results, generally represented by the use of the best case, most likely case, and worst case results. The outcome is a range representing an objective quantification of the economic impact of the benefit.

In the same manner, analysts should provide for causation. For instance, there is a more direct correlation between the printer sharing and the number of printers required than there is between printer sharing and the revenue resulting from entry into new markets. Moreover, external factors, such as the economy, competitor actions (e.g. a new and much better product), or changes in fashion, can have a significant, negative (or positive) impact on the forecast. As this gap between cause and effect widens, so does the potential for inaccuracy in the benefit's forecasted effect. It is prudent, then, to make a final, conservative adjustment to allow for this risk.

When complete, these analyses of individual benefits are rolled up to produce a forecast of the economic effect of the component. This forecast also shows the financial risk of not making an investment in the component.

Taxonomy of Risk

Components of technology portfolios face risks internal to the organization. These can be organized into four categories: people, process, technology and project:

* People — a reflection of the competency of the personnel in the application and platform in which the initiative will be developed; their ability to effectively manage the deployment, manage the technology itself and use the technology to effect technical or operational improvements. Highly competent personnel who have taken on similar projects in the past lower the risk.

* Process — refers to the number of business process that are involved and the extent to which they are being changed. Is the change transparent to users or will they have to be retrained? If an initiative changes a business process(es), then there are additional risk factors such as resistance to change, transition from one process to the other, etc. Also, the creation of a new business process brings with it unique issues.

* Technology — if the application is new to the organization, it has higher risk than if it is a replacement for an existing application. If the application is new to the world, then the risk is even higher. Similarly, an increasing level of risk occurs if the platform on which the application is to be implemented is either new to the organization or to the world.

* Project — a measure of the internal support for the initiative. For example, decide how well the initiative is staffed and budgeted, the magnitude of the undertaking relative to projects that have been successfully implemented within the organization, and the visibility or priority of the project. Projects that do not have an executive sponsor frequently fail.

Risk factors from these four categories, after being weighted and assembled as a whole, form a "taxonomy of risk," which is a companion analysis to the business case and used in conjunction with the business case in the portfolio comparison.

Monte Carlo Simulation

The business case identifies a range of possible outcomes; the Monte Carlo simulation applies the taxonomy of risk to assign probabilities to the values lying between the best- and worst-case forecasts (e.g. how probable is it that the worst case will occur versus the best case versus all the values in between).

Once these probabilities are determined, a number of simulations can be run:

* Business Case Simulation, in which the distribution of possible outcomes is found by allowing each and every benefit and cost in the business case to take on a randomly selected value between its worst-case and best-case values. The distribution of these random values is determined by the probability assigned to each of the variables used to quantify the benefits and costs.

* Benefit Simulation, in which the impact of one benefit is determined by allowing variables for that benefit to take on random values while all the other variables remain at their most likely values.

* Assumptions Sensitivity, which accounts for a single variable being used to forecast any number of benefits and costs. The impact of these individual assumptions is found by randomly setting values for one assumption while all others remain at their most likely value.

The result of each simulation is both an absolute and a normalized risk index. The unit for the absolute index is currency and is simply the standard deviation of the possible economic outcomes of the business case. The normalized risk index is the ratio of the standard deviation and the expected, or average, economic outcome.

Another important result from these simulations is the exposure of the critical variables in the project's performance. Many organizations do not track ongoing project performance, and only some do passively track results. Knowing which variables have the largest or most pertinent effect on a project's economic performance allows "active tracking," in which critical variables are tracked over time and compared to predicted values. In this way, a project manager can see when some facet of the project has gone awry and, critically, take the proper action in response.

Two examples clarify this proposition:

* An aircraft pilot follows a given glide path for his approach to a landing strip. The instruments alert the pilot when the aircraft leaves the glide path and the pilot makes active corrections to bring the aircraft back on the proper course.

* A manager heading the development of a new product finds that of three variables — delivery date, manufacture cost and project budget — two have the largest impact on the eventual profitability of his product — delivery date and manufactured cost. Knowing this, the product manager is willing to expand the project budget by adding additional resources to meet a delivery date, knowing that this one-time cost would not significantly degrade the eventual profitability of the program.

Portfolio Analysis

Once the benefits and risks for each potential component have been identified and quantified, they can be aggregated for an analysis of the proposed portfolio as a whole. The first step in this process is the ranking of the components by the indicators of financial return, risk, strategic alignment and others unique or important to the organization's business or technical environment (e.g. interoperation with existing computing platforms). These variables must be weighted to reflect their relative importance to the organization.

The organization's strategic alignment guides the weighting of the variables. For instance, if the firm's goal is to grow by merger and acquisition, then greater weight might be given to platform interoperability to ensure smooth and fast integration of new corporate elements, to lower acquisition costs and to ensure that the new assets produces profits as soon as possible. If the firm is the technology leader, then management might place emphasis on ground-breaking technologies that will attract innovator and early adopter customers willing to pay a premium for access to the latest technology. This weighting should take place external to the technology purchase process to avoid bias in favor of one project or another.

Organizations may also want to introduce a range of allowable values for each indicator. Indicators whose value falls outside this range would be considered "deal breakers" that automatically eliminate the project from consideration. For instance, there may be an upper limit to the amount of risk an organization may be willing to bear; this risk limit would be represented by a maximum allowable value for the risk variable. Similarly, an organization planning to merge with another within two years may prohibit projects that do not show a positive return in that time or add significant permanent headcount in that time.

Once the indicators are chosen and weighted, each component's score is simply an average of their weighted variables. These scores are ranked from highest to lowest. In reviewing this list, managers should be aware that it is only a ranked list, not an optimized portfolio. There is one final step needed to ensure the optimum mix of components.

The "Efficient Frontier"

Choosing the optimum set of components might seem to be a simple task of beginning at the top of the ranked list and selecting projects until a budget, personnel or capital constraint is met. However, a highly-ranked component may consume an inordinate amount of one resource or another and thereby prohibit the inclusion of another highly-ranked component. Choosing the best possible mix of components within these constraints is a matter of plotting the value of each portfolio (each portfolio's aggregate score) against that portfolio's combined risk.

Given this knowledge, the organization can then find its acceptable level of risk and choose the portfolio that provides the best return at that level.

These frontiers can be read in two ways. First, a manager can determine the best return for a given level of risk and, second, the manager can find the lowest risk for a given level of return.

State of the Industry

Corporations use various methods of assessing technology portfolios and risk; the depth of their investigations varies widely:

* Sensitivity analyses include most likely, worst-case and best-case scenarios for any or all of the assumptions, benefits, costs and return on investment measures.

* The Total Risk of Ownership (TRO) Model provides an estimate of the potential economic impact of not doing the investment.

* The Monte Carlo simulation determines the overall economic impact of uncertainty on the bottom-line of the business case. Often, corporations perform an accompanying sensitivity analysis to determine the individual economic impact of each assumption, benefit and cost.

* Business Cases are about "risk mitigation" — reducing risk by assessing it prior to an investment decision, and comparing the risk of different alternatives in scope and implementation strategies. The comparison of multiple Business Cases (or multiple scenarios of the same Business Case) helps in selecting the Business Case that has the best value and lowest risk.

* Balanced scorecards are a good way to successfully manage projects. The scorecard approach tracks key performance indicators (KPIs) during and after project implementation, allowing the project team to take prompt actions if necessary, and minimizing the chances of project failure.


This analysis provides managers with a means of determining the most efficient and effective portfolio of technology for their organization. The basis is the business case, as a careful and thorough investigation of the individual technologies and their application forms a solid foundation for the remainder of the analysis. A review of this procedure will show several instances where tactical or even strategic goals, are quantified through weighting to ensure that the analysis fits the organization's particular environment. This should indicate to the reader that these analyses support effective executive action and planning; but are certainly no substitute for it.

About the Authors: Ruben Melendez is the president and CEO of Glomark Corp. and Matt Montague is Glomark's Media Relations Manager. Glomark Corp. provides methodology, training and software tools to technology vendors, and creates an economic model for the evaluation of initiatives. The authors may be contacted by e-mail at [email protected], or [email protected].