How can you link IT performance metrics with financial metrics?

System availability (read as down time) has a hard cost. N number of users, taken off line @ an average cost of $XX per hour per person is an easy calculation and something the business can understand and manage to. Something like ‘reputation damage’ from a data breach is harder to calculate.

Linking your IT objectives to the organization’s strategy and goals is not a trivial task. From my security perspective, the key points are; 1) availability of key information and systems, 2) time to recover from system outages and time to remediate vulnerabilities that could cause them, and 3) value of the data and services that may be lost if #1 occurs and #2 is excessive. Next you need to understand the key business functions that directly impact profitability and make sure those systems and data are resilient.

At this stage, a good practice is to use OKRs. This way, you'll consistently discuss with your team the objectives of each of your technical deliveries from the perspective of their contribution to the business. It's quite common for IT specialists to focus solely on technical benefits, features, technologies, security, and overlook connecting all these resources with their impact on organizational outcomes. Defining your OKRs will consistently align you with the business's strategic objectives, serving as a supportive practice to ensure that IT remains connected to the strategy

Fundamentally this is where the biggest challenge lies as in most cases IT is simply measured as a cost and nothing else (a cost to be optimised). Uou have the business strategy, you can align your IT strategy to IT but the two are measured as one business case whereas you show the business revenue vs the IT cost and there you have your financials. How do you measue or define that value added which in organisations is not looked upon as value added but simply evaluated as a cost from the get go.

In my experience, choosing metrics connected to organizational outcomes is one of the most important practices to elevate the perceived value your team delivers. I've been involved in digital product projects where we invested a lot of time in defining our key metrics and indicators. Here are some examples we used: how much this product and its features will contribute to reducing customer acquisition time, setting reduction percentages; how it will contribute to lowering the cost of acquiring new customers; and how it will optimize the time of commercial managers. These are just a few examples, but it's essential to define the benefits and impacts that IT deliveries generate for the business.

One of the most important steps in Business Continuity Planning is to perform a Business Impact Analysis. Personally, I have seen this crucial step missed quite often across every industry I worked in. Going through this process provides quantifiable impact to the business in the event of a disruption. If you know how much an outage costs in lost revenue it makes it a lot easier to make smart decisions. Knowing that a 1-hour outage will cost $1M suddenly makes a $500K/year DR environment a no brainer.

Establish Clear Objectives: Determine specific objectives for IT that contribute to financial outcomes. For example, improving website performance to increase online sales. Benchmarking: Compare your IT performance metrics and financial metrics to industry benchmarks and competitors to gain insights into your relative performance. Identify KPIs Define relevant IT performance metrics, such as system uptime, response times, or incident resolution times. Identify financial metrics, such as revenue, cost savings, or profitability, that are affected by IT operations. Cost-Benefit Analysis: Calculate the cost of IT improvements and compare them to the financial benefits they generate. Assess the ROI for IT projects and initiatives.