Bob Lewis
Columnist

How’s our software acquisition policy?

analysis
Apr 20, 20053 mins

Dear Bob ... Here at my company we have a policy against unapproved software. If a business case is made for something new then and only then will we develop the needed security and installation policy. Why should the IT department go out and work on being able to use something that has no known benefit to our organization? Once its shown it does benefit our compnay or at least might benefit our company then it

Dear Bob …

Here at my company we have a policy against unapproved software. If a business case is made for something new then and only then will we develop the needed security and installation policy. Why should the IT department go out and work on being able to use something that has no known benefit to our organization? Once its shown it does benefit our compnay or at least might benefit our company then it is worth doing what is necessary to allow others to use it. OK, we probably won’t be the first to use a new technology, but we certainly won’t be the last. And we might be the first to use it safely.

What do you think?

– Protected by policy

Dear Protected …

As always, it depends. In this case, it depends on:

* How onerous the process of making the business case is. If we’re talking about an eighty buck piece of software that entails little risk of causing any damage, and a business case-making process that requires three weeks of flaming-hoop-jumping, then IT is the problem, not an enabler of solutions. If we’re talking about a simple process that’s in balance with the software’s cost and risk, then I’m all in favor of it.

* Whether your description is really as circular as it sounds. There’s a lot of software whose potential isn’t easily described until after you have it and employees have had a chance to use it. Those of us who are old enough will recall that this was the challenge of the early PCs: If you used one you understood the value and if you didn’t there was no way to explain it.

* Who does one make the business case to? If it’s to IT, then I hate it. IT shouldn’t be the business value police, because we have a conflict of interest – every new piece of technology is another headache for us. If, on the other hand, we’re talking about a business-led governance process then I’m all in favor of it.

As with so many questions, the devil is in the details, not the broad concept. So my answer to you is to look in the details to see if they make sense. And if you can’t figure it out from there, talk to a bunch of business managers and users, and ask their opinion.

They’re living with the policy, so they can give you a solid answer.

– Bob

——–