Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Projects That Defy ROI: Page 3 of 5

The goal was customer satisfaction; buyers had complained the old labels weren't descriptive enough. But if someone asks IT manager Larry Miller to show a hard-dollar return on the investment, "I tell them it's not measurable," he says. "How do we know we wouldn't have gotten that phone call anyway?"

Security is different from other technology categories in that companies tend to overspend out of fear, says Tari Schreider, the security practice manager at consultancy Extreme Logic. Schreider prescribes an annualized loss-expectancy model for security and disaster-recovery investments to ensure that a client's spending is commensurate with the real risk to its IT assets.

The model, which he calls reduced-risk return on investment, or RRROI, factors in which portion of your systems are vulnerable, as well as the likelihood that an outage will occur. If an IT asset is valued at $1 million and an outage would knock out 20 percent of it, your vulnerability is $200,000. If a devastating tornado tends to occur once every two years, your risk is $100,000.

"So you need to spend commensurate with $100,000 of risk rather than $1 million," Schreider says. "No asset is 100 percent at risk 100 percent of the time."

The lesson? If you want to gain credibility with the MBA crowd, you won't score points by employing Chicken Little tactics. "IT has made a living out of scaring the hell out of the business side of the house," says TMG's Neimo. "They're like the life insurance guys who break you down by saying, 'Do you know what the statistics say about the likelihood you will get hit by a car?' "