According to a recent Harvard Business School study, higher IT capability directly correlates with superior revenue growth.

Nearly all IT managers (at more than 150 large enterprises) surveyed for the study said they plan to increase outsourcing, particularly in the areas of application development and IT infrastructure.

Outsourcing is the practice of turning over responsibility of some to all of an organization’s information systems applications and operations to an outside firm. This practice is widely believed (sometimes erroneously, according to recent research) to lead to cost savings and/or to free company resources for other activities.

Often, outsourcing enables a business to run faster than if it tried to deploy the same technology using in-house staff. So, where time to market and such is crucial and skilled IT labor is scarce, outsourcing has gained in popularity. U.S. IT managers are adapting to outsourcing and gradually implementing it as a comprehensive corporate strategy, rather than as individual contracts for distinct IT tasks.

However, outsourcing isn’t without potential pitfalls. Some firms are less than confident when it comes to giving outsourcers access to their internal operation. What’s more, some question how much responsibility an outsourcer will accept when its service isn’t sufficient and whether it can integrate its offerings fully with a business’s existing infrastructure and legacy applications. Caveat emptor.

With both the findings of the Harvard study and my caveat in mind, this article—the third in a series on capital budgeting—will focus on the use of decision-tree analysis (with real options) to facilitate the buy or make decision of a proposed Voice over Internet Protocol (VoIP) project. (See footnote.) Here, “buy” refers to outsourcing the job of migrating from a traditional analog telephone system to a data-based digital one. The buy or make a particular deliverable decision is crucial in project management in today’s business environment.

Decision-tree analysis is a schematic way of representing alternative sequential decisions and the possible outcomes from these decisions, as illustrated in Figure 1. In a sequential decision problem, in which the actions taken at one stage depend on actions previously taken in earlier stages, the evaluation of investment alternatives can become very complicated. In such cases, the decision tree technique facilitates project evaluation by enabling the firm to write down all the possible future decisions, as well as their monetary outcomes, in a systematic manner.


Figure 1. Model of three- (or possibly four-) stage investment decision process for the build branch of an earlier build-inhouse or outsource decision node (shown later in Figure 4).

Figure 1 shows a decision-tree model based on costs (rectangles—with square or rounded corners), probability of successes and, future cost savings (increased cash flow streams). Because this model treats the investment decisions for a proposed project in a series of stages, the solution is a close proxy for real options theory.

You identify the things that could happen to the project and the main counteractions that you might take. Then, working back from the future to the present, you can consider which action you should take in each case. Note, however, that this figure hides many of the real-world details that must be assigned dollar amounts when constructing your capital budget.

VoIP is a potentially cost-saving technology used to transmit voice conversations over a data network using the Internet Protocol (IP). Such data networks may be the Internet or a corporate Intranet. When, as in the case discussed below, a project involves rolling out a major new data-networking application, along with new hardware and infrastructure to support it, the project should be staged and budgeted throughout its life cycle.

Also included will be a look at related issues such as:

How much unbudgeted downside risk you should manage
Worst-case scenario (given catastrophic losses) vs. regret
The value (and cost) of compliance with regulations (for example, SOX)
To present a real-world discussion of decision-tree analysis, I will also explore some of the assumptions made in the penultimate and antepenultimate articles of this series: for example, probability distributions are symmetric and worst-case scenarios need only be considered statistically.

Real Options: The Value of Midcourse Corrections to Projects
One of the fundamental insights of modern financial theory is that options have value. The phrase “We are out of options” is surely a sign of trouble. However, because corporations (and other organizations) make decisions in a dynamic environment, they usually have midcourse options that should be considered in project valuations:

The Option to Abandon a project: Has value if return (or savings) turns out to be lower than expected
The Option to Expand a project: Has value if return (or savings) turns out to be higher than expected
The Option to Delay a project: Has value if the underlying variables are changing with a favorable trend
The Option to Outsource a project: Has value if internal resources don’t have required experience and expertise
In the previous two articles of this series, the widely-practiced Net Present Value (NPV) analysis was used as the basis for selecting or rejecting a project. However, NPV analysis ignores the adjustments that an organization can make after a project is accepted. These adjustments are called real options. In this respect, NPV—the present value of its expected future cash flows, discounted at a rate that reflects the riskiness of the expected future cash flows—can underestimate the true value of a project. This outcome can be exacerbated further when the data from which NPV is calculated stems from an asymmetric probability distribution, as explained in Appendix 1. (Figure 1 shows the full life cycle of a project in which real options are considered.)

When you use discounted expected future cash flows—the basis for the NPV calculation—to value a project, you implicitly assume that the organization will hold the asset passively. But, managers are not paid to be passive. After they have invested in a new project, they do not simply sit back and watch the future unfold. If things go well, the project may be expanded; if they go badly, the project may be cut back or abandoned altogether. Managers get to manage projects—not simply accept or reject them.

In practice, companies sometimes have other choices. They can delay the decision until later, when more information is available. Or, they can call in outside help, even after having deciding not to do so at the outset. Such investment timing options can dramatically affect a project’s estimated mean NPV and risk. Projects that can easily be modified in these ways are more valuable than those that do not provide such flexibility. The more uncertain the outlook, the more valuable this flexibility becomes.

Consider a proposed project where there is uncertainty about the state of the economy. Suppose it can be either good or bad and it’s as likely to be one as the other. If it is good, your investment project returns $5. If it is bad, you lose $6. The cost of doing nothing now and waiting to see what the economy looks like at a future date is $1 (you might, for example, have to pay the salaries of software developers or others who become under-utilized as you wait).

An NPV calculation, where you invest now or never, values the project at 50%x$5 – 50%x$6 = -$0.50. If you sink $1 and wait and see, the real option value of the project is 50%x$5 – 50%x$0 – $1 = $1.50 as you don’t have to invest if the economic climate is bad. So flexibility can be profitable!

The final decision as to whether to build in house or outsource is determined by which of the two choices has the lower discounted cash flow (NPV) after probabilities are used to weight the expected cash flows. Remember, the entire model in Figure 1 represents only the make branch of the make-buy decision. Both branches are shown in Figure 4.

When are real option values most significant?
Uncertainty: There must be high uncertainty about the future. In fact, the option value increases with increasing uncertainty. This is in contrast to most traditional thinking; instead of fearing the uncertainty (risk), option thinking is actively taking advantage of uncertainty.
New information: It must be very likely that you will receive new information (decreased uncertainty) over time.
Managerial flexibility: If there is high uncertainty and new information decreases this uncertainty, there is no option value unless management is able to respond appropriately to this new information.
Obviously, for some projects flexibility is of great value while to others flexibility is of minor interest. Which factors are important to increase the Real Option value?

The Decision Tree shown in Figure 1 is a simplification created to satisfy the needs of this article. Figure 2 indicates that, although decision trees alone can be helpful when a project is characterized by high flexibility but low uncertainty, decision trees with the addition of real options is the methodology of choice when the project is characterized by both high flexibility and high uncertainty.

However, it is generally felt that real option analysis does not provide much value in investment decisions on projects with very high NPVs, because the projects are already attractive for investment and the additional value that may be provided would not change the decision. Similarly, on projects with very low NPVs, the additional value provided by real options would most likely be so negligible that the investment decision would still be a “no go.” That is, real options offer the greatest value on projects with an NPV close to zero (either positive or negative) and positioned in the upper-right quadrant of Figure 2.


Figure 2. Real options have value when both uncertainty and flexibility characterize a project.

The bottom line: Breaking up the inflexible investment bet represented by the upper path(s) in Figure 1 into two smaller investment bets represented by the lower path(s) enables the project manager (or Project Management Office) to use options to improve his or her allocation of resources to the project as new information becomes available. Appendix 3 contains a discussion on the place of real options in the real world.

Before continuing, as I have been, with issues from the perspective of the CIO or PMO head, you should take a look at some of the issues that the CTO will be concerned with while evaluating the buy-make decision for this proposed project. Understanding one helps understand the other.

Voice over IP (VoIP)
The feature of Voice over IP (VOIP) that has attracted the most attention is its cost-saving potential. By moving away from the public switched telephone networks (PSTN), long distance phone calls become very inexpensive. Instead of being processed across conventional commercial telecommunications line configurations, voice traffic travels on the Internet or over private data network lines. PSTN is the international telephone system based on copper wires carrying analog voice data.

Furthermore, VoIP, being digital, offers features and applications not possible with its analog predecessor.

Most legacy telephony devices are dumb endpoints with no memory or processors built into them; all of the intelligence was located within the proprietary PBX processor software. In contrast, with VoIP PBX solutions, all endpoints have processors and memory, thus creating superior intelligence out at the network edge.

And, many VoIP installations use SIP, a signaling protocol for the establishment of communication sessions between these smart endpoints. It is commonly used to initiate voice, video, and IM sessions and also can be used to convey presence, location, and other information. SIP has emerged as a key protocol with strong industry support for the deployment of IP-based telephony. In addition to the rich media session and information that it can convey, SIP offers other additional benefits.

For example, SIP provides a user with a logical identity regardless of the device type he or she is currently using or the device’s physical location. This allows road warriors to roam and to switch between devices (such as from a handheld to a computer SIP phone), while remaining reachable through a single address: callers do not need to try multiple phone numbers.

VOIP also is cost effective because all of an organization’s electronic traffic (phone and data) can be migrated onto one physical network, bypassing the need for separate private branch exchange (PBX) tie lines. Although there is a significant initial startup cost to such an enterprise, significant net savings can result from managing only one network and not needing to sustain a legacy telephony system in an increasingly digital/data-centered world. Also, the network administrator’s burden may be lessened because they can now focus on a single network. There is no longer a need for several teams to manage a data network and another to mange a voice network. The simplicity of VOIP systems is attractive, one organization/one network.

But, the whole world hasn’t migrated to VoIP telephony yet. Therefore, your VoIP networks need a portal to the rest of the world (that is, PSTN). So, initially, you will typically employ VoIP gateways to interface between a VoIP network and a private branch exchange (PBX) or the PSTN.


Figure 3. Basic hybrid VoIP/PSTN network.

The transition from a traditional PBX-based telephony system to a Voice over IP (VoIP) system usually is not an overnight process. Instead, you typically take “baby steps.” A first step might be to replace the trunk line that interconnects PBXs at remote sites with an IP wide area network (WAN) connection. A next step could be to connect existing analog phones, fax machines, and speaker phones to voice-enabled routers (in other words, a gateway). The end result of these steps is a telephony network, without a PBX, where voice traffic is transmitted over an IP network. There are, of course, many other migration scenarios, some of which will be mentioned later.

Planning
It should come as no surprise that there are any number of costs that may be difficult to estimate à priori; that is, during the budgeting process. But, these costs can be crucial to the outcome of the project, so you (or the contractor you hire) can’t gloss over them when planning for the introduction of a new VoIP system.

The simplified decision tree shown in Figure 4 (to be discussed below) consists of two branches: one—to create a VoIP system with in-house staff (in other words, make)—and another—to outsource (buy). The buy branch may sometimes contain little more than the net of the purchase price of your contract with an outsourcing firm and the discounted future cash flow savings resulting from the use of the resulting VoIP system. In either case, you should know as much as possible about the process of migrating a traditional telephone system to one that is either all VoIP or a hybrid consisting of both traditional and VoIP services. One possible hybrid is shown in Figure 3.

As already stated, VoIP can result in cost savings, especially where users have existing under-utilized network capacity they can use for VoIP at no additional cost. However, extra voice over IP traffic may cause a need for increased bandwidth. The cost for this extra capacity will have to be subtracted from the savings achieved from reduced traditional telephone usage. Nonetheless, the cost justifications for a VoIP integrated network are usually large enough to warrant an upgrade in equipment costs if needed.

Consider interoffice calls. Nowadays, large corporations typically find themselves with offices or supply chains spread out over many geographical locations, in countries all over the world. What is the cost of telephone communications with these offices and suppliers? Depending on the configuration of your network and the locations of the calls you need to make, your long-distance tolls could plummet after implementing VoIP. After all, there is no distinction to be made on a data network between an international link and a regional link.

Bypassing the PSTN and making telephone calls on an IP network is referred to as toll bypass. Toll bypass occurs when a PBX or an IP PBX is connected to a VoIP gateway, which is then connected to an IP network. The call traffic goes from the PBX to the VoIP gateway instead of from the PBX to a PSTN switch, thus avoiding the toll, or cost of using the PSTN. As a result of the PSTN toll rate structure, companies with a large number of international sites are likely to see more cost savings from toll bypass than companies that make most of their calls within the United States.

Savings may not be immediate or automatic, however. Many organizations should not convert to VoIP completely, or all at once. The PSTN lines may still be needed for some time during the migration phase, and some companies may want to keep the PSTN as a fallback network. But, in most cases, the long-distance costs associated with PSTN usage should decrease after a VoIP implementation.

Calculations of parameters such as peak bandwidth are hard to estimate at the outset and midcourse and/or post-launch corrections are more the rule than the exception. This reality holds true whether you decide to rollout a VoIP system with in-house staff or outsource the job.

The perception of many in business today is that VoIP isn’t reliable enough to support the telecommunication demands of a corporate environment. After all, corporate PBX systems are considered highly reliable, but how many times in a month do you hear users say, “My email isn’t working,” “The Internet is down,” or “I can’t print to the network printer.” Because of such past frustrations with data network applications, this perception of unreliability has unfortunately carried forward to any new application running on the data network, such as VoIP.

VoIP networks can be designed to be more available. One approach is to have fault tolerance built into the network components. By so doing, you actually can design VoIP networks that are just as reliable as legacy PBX systems. But, there’s a cost to doing so and this is another cost that needs to be included in your capital budget, if it’s to be realistic.

Managing unbudgeted downside risk
Tools such as Palisades Precision Tree (shown in Figure 4) can “automate” the buy or make decision process.


Figure 4. A commercial decision tree tool (Palisade Precision Tree).

The objective is to arrive at the decision node (indicated by a green square) with quantitative values for make and buy so that the project manager can pick the alternative that promises to have the better outcome for the project. Precision Tree takes care of this step for you by labeling with “TRUE” the path that yields the optimum choice. The details of how to use this tool in decision tree analysis—there are many ways—are beyond the scope of this article. But, countless references are available.

Inputs to the decision-making process are both quantitative and qualitative or judgmental. You estimate costs and cash benefits for both the make and buy choices. You make judgments about the performance expectations of your in-house technical staff and about the performance of an alternative vendor. Sometimes, there is a project history you can access of former similar-to projects that provide the data for the judgments.

As illustrated in Figures 1 and 4, the budget for expected value is based on probabilities for both favorable and unfavorable outcomes. But, you should never rule out the worst-case scenario. That is, you should replace—if only for a moment—the comforting presumption that disaster could happen (with a given probability) with the harsh reality that it will happen (for certain). The two equations below calculate the worst case scenarios by yielding the cost of the two alternatives when the probability of an x-day delay is 100%.

Downside risk (buy) ≤ $(budget for expected value) .
$(acquisition + cost of x-day delay)

Downside risk (make) ≤ $(budget for expected value) .
$(acquisition + cost of x-day delay)
You, or your project sponsor, must also decide whether this unbudgeted risk is affordable if all risk mitigation fails and the x-day delay does, in fact, occur.

Rational behavior
The dollar amounts shown in red to the right of the red circles and in green to the right of the green square in Figure 4 are only weighted averages of the possible payoffs. As such, they can be interpreted in one of two ways.

First, imagine the project occurring many times, not just once. That’s the case if you are the outside contractor who builds VoIP systems for many customers. If you use a particular decision each time, then “on average,” you will experience the gain or losses shown. You’re “playing the averages.”

Of course, this decision is not guaranteed to produce a good outcome for a given company.

Unfortunately, in problems with uncertainty, you virtually can never guarantee that the probabilities-based decision will produce the best results. All you can guarantee is that a NPV-maximizing or cost-minimizing decision is the most rational decision, given what you know when you must make the decision.

But, what if the current situation is a “one-shot deal” that will not occur many times in the future? That’s the case if you build the VoIP system just once, for internal use, using in-house staff. Then, financial theorists tell us that this is a “sensible” criterion for making decisions under uncertainty, as long as the monetary values are not too large.

For situations where the monetary values are extremely large, rational decision makers are sometimes willing to violate the maximization (minimization) criteria imposed by the usual rules of capital investment. These decision makers are willing to sacrifice NPV (or other measures of return) to reduce risk. To do so, a few (a very few) firms turn to utility functions for help. They maximize (minimize) expected utility—that is, they choose the alternative with the largest expected utility. Utility is a concept that was introduced by Daniel Bernoulli in the eighteenth century. He believed that for the usual person, utility increases with wealth but at a decreasing rate.

A discussion of utility theory and utility functions (mathematical functions that transform monetary values—payoffs and costs—into utility values) is beyond the scope of this article. However, before leaving this subject altogether, I’d like to mention that much of this methodology’s complexity can be handled for you by tools such as Precision Tree, as shown in Figure 5.


Figure 5. A utility function is selected on a tree-specific basis.

In Figure 5, the Optimum Path option specifies the criterion this tool will use for selecting the optimum path at each node in the tree and whether decisions are forced to a specific branch.

Two options are available for selecting the optimum path at each decision node in a tree. If Maximum is selected, Precision Tree will follow the path that has the highest expected value or expected utility at a decision node. If Minimum is selected, Precision Tree will follow the path that has the lowest expected value for a decision node.

Privacy and Legal Issues with VOIP
Although legal issues regarding VOIP also are beyond the scope of this article, you should be aware that laws and rulings governing interception or monitoring of VOIP lines may be different from those for conventional telephone systems. Privacy issues, including the security of call detail records (CDR) are addressed primarily by the Privacy Act of 1974.

A CDR is a record containing information about recent system usage, such as the identities of sources (points of origin), the identities of destinations (endpoints), the duration of each call, the amount billed for each call, the total usage time in the billing period, the total free time remaining in the billing period, and the running total charged during the billing period. The format of the CDR varies among telecom providers and call-logging software. Some software allows you to configure the CDR format.

You should review any questions regarding privacy and statutory concerns with your legal advisors.

VOIP Security Issues
With the introduction of VOIP, the need for security is compounded because now we must protect two invaluable assets, our data and our voice. In a conventional office telephone system, security is a more valid assumption. Intercepting conversations requires physical access to telephone lines or compromise of the office private branch exchange (PBX). Only particularly security-sensitive organizations bother to encrypt voice traffic over traditional telephone lines. The same cannot be said for Internet-based connections. For example, when ordering merchandise over the phone, most people will read their credit card number to the person on the other end. The numbers are transmitted without encryption to the seller. In contrast, the risk of sending unencrypted data across the Internet is more significant. Packets sent from a user’s home computer to an online retailer may pass through 15-20 systems that are not under the control of the user’s ISP or the retailer.

Because digits are transmitted using a standard for transmitting digits out of band as special messages, anyone with access to these systems could install software that scans packets for credit card information. For this reason, online retailers use encryption software to protect a user’s information and credit card number. So, it stands to reason that if you are to transmit voice over the Internet Protocol, and specifically across the Internet, similar security measures must be applied. The current Internet architecture does not provide the same physical wire security as the phone lines. The key to securing VOIP is to use the security mechanisms like those deployed in data networks (firewalls, encryption, and so forth) to emulate the security level currently experienced by PSTN network users.

Sarbanes-Oxley Act of 2002 Compliance
The Sarbanes-Oxley Act (also known as the Public Company Accounting Reform and Investor Protection Act of 2002 and commonly called SOX) is a United States federal law passed in response to a number of major corporate and accounting scandals involving prominent companies in the United States. These scandals resulted in a decline of public trust in accounting and reporting practices.

The first and most important part of the Act establishes a new quasi-public agency, the Public Company Accounting Oversight Board, which is charged with overseeing, regulating, inspecting, and disciplining accounting firms in their roles as auditors of public companies.

There is considerable debate over the specific requirements of the Sarbanes-Oxley act, as written. The problem with compliance is that, as usual, the federal act is not specific to IT and is vague in its language. See References 13 and 14.

For companies, a key concern is the cost of updating information systems to comply with the control and reporting requirements. Systems that provide document management, access to financial data, or long-term storage of information now must provide auditing capabilities. In most cases, this requires significant changes, or even complete replacement, of existing systems that were designed without the needed level of auditing details.

Examples of the internal controls that are required for compliance include firewalls, access measures, authentication mechanisms, continuous vulnerability assessments, and so forth. A possible situation could occur when an organization uses Active Directory for single sign-on for IT applications and telephony access. Another possibility is using IP phones to access financial information through a wired or wireless VoIP connection.

The cost of implementing and maintaining a VoIP (or any other IT) system must consider that the telecom or security staff has to perform a security audit. This is a systematic evaluation of the organization’s information systems. The audit measures how well the systems conform to a set of established security criteria. An audit will include user practices, software, information-handling processes, and the physical environment and configuration. Vulnerability assessment is the study of the system’s potential security weaknesses.

Besides security audits and vulnerability assessment, the IP Telephony system will have to undergo penetration testing on a regular basis in order to determine whether the system can withstand hackers and other malicious behavior.

Contracts
Contracts between suppliers and the project team are commonly employed to change the risk profile. Contracts transfer risk among the parties, but they do not eliminate risk. All parties have a risk even after the contract is signed.

Some buy decisions lead to granting a fixed-cost turnkey contract to the lowest bidder. This can be a risky proposition, especially when yours is a large organization with a complex IT infrastructure! At the very least, these contracts should include provisions for costly mid-course and post-priori adjustments. A recent survey by DiamondCluster International (http://www.diamondcluster.com) found dissatisfaction among customers who chose the lowest-priced bidder and found that early contract terminations were way up. Once again, caveat emptor.

Conclusion
Software tools, despite their analytical power, are just tools. They do not replace the analyst in any way.

Fifty percent of the challenge in decision making is simply thinking about the problem, with 25 percent being the actual modeling and analytics, and the remaining 25 percent being able to convince and explain the results to senior management, clients, colleagues, and yourself.

Appendix 1. The Assumption of Symmetry
Throughout much of the two previous articles in this series on capital budgeting (see Reference 1 and 2), the assumption of symmetry in probability distributions was made. However, as shown below, there can be weighty consequences to not looking beyond this assumption.

The three most commonly used measures of the location of central tendency are the mode, the median, and the mean. In brief, the mode is the point or region within a distribution where the largest number of individual measures congregate, the median is the midpoint of all the individual measures, and the mean is the arithmetic average of all the individual measures.

As a rule, the only time you will find the mode and median to be precisely coincident with the mean is when the distribution is unimodal and perfectly symmetrical. In skewed distributions, the mean, median, and mode will tend to be separated from one another, with the mean falling toward the tail of the skew, the mode falling away from the tail, at the peak, and the median falling somewhere in between. Thus, in a positively skewed distribution the mean will be to the right, the mode to the left, and the median in between, whereas in a negatively skewed distribution the mean will be to the left, the mode to the right, and the median in between. These relationships among the three measures of central tendency are shown below in Figure 6.


Figure 6. Relationships of the mean, median, and mode in symmetrical and skewed distributions.

If skew is not considered, then looking only at expected returns (for example, mean or median) and risk (standard deviation), a positively skewed project might be incorrectly chosen! Then, if the horizontal axis represents the net revenues of a project, clearly a left or negatively skewed distribution might be preferred because there is a higher probability of greater returns as compared to a higher probability for lower-level returns.

Failure to account for a project’s distributional skewness may mean that the incorrect project may be chosen (for example, two projects may have identical mean and standard deviation—that is, they both have identical returns and risk profiles—but the distributional skews may be very different).

Finally, the introduction of probability distributions in the form of Monte Carlo simulation into decision tree analysis is beyond the scope of this article. But, at the very least, you should ask questions about the underlying statistical nature of the data presented to you in the decision tree.

Appendix 2. Worst-Case Scenario (Given Catastrophic Losses) vs. Regret

Figure 7. Probability distribution function with kurtosis (dashed line) higher than that of normal curve (solid line).

The area under the lower probability distribution function in Figure 7 is thicker at the tails with less area in the central body. This condition has major impacts on risk analysis. Although the returns and risks are identical with a normal distribution with the same mean and standard deviation, the probabilities of extreme and catastrophic events (potential large losses or large gains) occurring are higher for a high kurtosis distribution. (See Reference 12.)

Kurtosis is a measurement of the peakedness (broad or narrow) of a frequency distribution. Higher kurtosis means more of the variance is due to infrequent extreme deviations, as opposed to frequent modestly sized deviations.

When you calculate the value of the worst-case scenario given catastrophic losses, you also should think about regret. That is, if a decision is made to pursue a particular project, but if the project becomes unprofitable and suffers a loss, the level of regret is simply the difference between the actual losses compared to doing nothing at all.

Appendix 3. A Palimpsest on Real Options
Real options is now taught in most if not all MBA programs, and what’s more, it’s an interdisciplinary subject, found not just in finance but also in strategy and information-systems courses.

The classical application of real options, and the point of much research, is to show that a given investment with a negative NPV may in fact have substantial value, thanks to its embedded options. But, in today’s capital-rationed environment, all IT investments are presumed to have a positive NPV, and a substantial one at that. Therefore, some calculate the real-options value of positive-NPV projects, to arrive at an “expanded” NPV for each—and an optimal ranking of IT investments.

The trouble is, although there is widespread interest in taking a portfolio approach to managing IT investments, few companies—24 percent—actually optimize such portfolios, according to a recent survey of 130 senior IT executives conducted by the Kellogg School, DiamondCluster International, and the Society for Information Management. None of the executives surveyed used real options.

Real options discounts management realities. Is the strength of real options also its Achilles’ heel? Critics say that because real options don’t expire according to contract as financial options do, managers can’t be counted on to pull the plug on a project (exercise an “abandonment option”) when they should. Also, projects assume lives of their own, and may not be easy to kill.

On the other hand, companies often yank NPV-sanctioned projects, while real options provides a detailed map for making such decisions, with far greater precision. Arguably, adopting a real-options approach would promote greater discipline in project management. But, the approach won’t take if an organization doesn’t embrace change, or if compensation systems aren’t aligned accordingly. A manager can’t be expected to exercise a growth option, for example, if she’s being compensated for keeping costs down. Until these sorts of organizational process and governance issues are tackled, the lone analyst can’t really do much more. I don’t see companies at all interested in changing business processes right now. Everybody’s glad they have jobs.