McGraw-Hill/Irwin - Canis Learning · DBMS Report generators Marketing Views program Accounting program Database FIGURE 1.3 Managing Information with a Database and Database Management

Information Systems Management

McGraw−Hill Primis

ISBN: 0−390−55207−0

Text: Business Driven TechnologyHaag−Baltzan−Phillips

Harvard Business Review Management of Information Systems Articles

Harvard Business School Management of Information Systems Cases

Harvard Business School POM Cases

Richard Ivey School of Business — The University of Western Ontario

Course:Health Information SystemsMBAHC−5

California College for Health SciencesMBA Health Care Program

McGraw-Hill/Irwin��


http://www.mhhe.com/primis/online/Copyright ©2005 by The McGraw−Hill Companies, Inc. All rights reserved. Printed in the United States of America. Except as permitted under the United States Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without prior written permission of the publisher. This McGraw−Hill Primis text may include materials submitted to McGraw−Hill for publication by the instructor of this course. The instructor is solely responsible for the editorial content of such materials.

111 INFOGEN ISBN: 0−390−55207−0

This book was printed on recycled paper.


Contents

Haag−Baltzan−Phillips • Business Driven Technology

I. Achieving Business Success through Information Technology 1

1. Business Driven Technology Overview 12. Identifying Competitive Advantages 93. Strategic Initiatives for Implementing Competitive Advantages 164. Measuring the Success of Strategic Initiatives 235. Organizational Structures That Support Strategic Initiatives 30

II. Managing Information for Business Initiatives 37

6. Valuing Organizational Information 37

Technology Plug−ins 44

T2. Networks and Telecommunications 44

Business Plug−ins 64

B1. Information Security 64


PACE MEDICAL CENTRE 77

Case 77

Harvard Business Review Management of Information Systems Articles

Just−in−Time Delivery Comes to Knowledge Management 89

Article 89

iii

Harvard Business School Management of Information Systems Cases

Medtronic Vision 2010 (A): Transforming for the 21st Century 101

Case 101


Mount Auburn Hospital: Physician Order Entry 135

Case 135

iv

Haag−Baltzan−Phillips: Business Driven Technology

I. Achieving Business Success through Information Technology

1. Business Driven Technology Overview

1© The McGraw−Hill Companies, 2005

Chapter One: Business Driven Technology Overview

LEARNING OUTCOMES

1.1. Compare management information systems (MIS)and information technology (IT).

1.2. Describe the relationships among people,information technology, and information.

1.3. Describe why people at different levels of anorganization have different information needs.

his chapter provides an overview of the units in this text and introduces afew of the important business and technology concepts covered in eachunit.

UNIT 1—ACHIEVING BUSINESS SUCCESS THROUGH INFORMATION TECHNOLOGY

Information technology (IT) is any computer-based tool that people use to workwith information and support the information and information-processing needsof an organization. Information technology can be an important enabler of busi-ness success and innovation. This is not to say that IT equals business success andinnovation or that IT represents business success and innovation. Information tech-nology is most useful when it leverages the talents of people. Information technol-ogy in and of itself is not useful unless the right people know how to use and man-age it effectively.

Management information systems is a business function just as marketing, fi-nance, operations, and human resource management are business functions. For-mally defined, management information systems (MIS) is the function that plansfor, develops, implements, and maintains IT hardware, software, and the portfolioof applications that people use to support the goals of an organization. To performthe MIS function effectively, almost all organizations today, particularly large andmedium-sized ones, have an internal IT Department, often called Information Tech-nology (IT), Information Systems (IS), or Management Information Systems (MIS).

The plans and goals of the IT Department must align with the plans and goals ofthe organization. For example, if a primary goal of the organization is to increasesales, as at Levi’s, information technology can facilitate Levi’s relationship with Wal-Mart. Information technology can enable an organization to increase efficiency inmanufacturing, retain key customers, seek out new sources of supply, and intro-duce effective financial management.

It is not always easy for managers to make the right choices when using IT tosupport (and often drive) business initiatives. Most managers understand theirbusiness initiatives well, but are often at a loss when it comes to knowing how touse and manage IT effectively in support of those initiatives. Managers who under-stand what IT is, and what IT can and cannot do, are in the best position to helptheir organization succeed.

Unit 1 Achieving Business Success through Information Technology 7*

T




2 © The McGraw−Hill Companies, 2005

In essence,

■ people use

■ information technology to work with

■ information (see Figure 1.2)

Those three key resources—people, information, and information technology(in that order of priority)—are inextricably linked. If one fails, they all fail. Most im-portant, if one fails, then chances are the business will fail.

Unit 1 introduces several business strategies, such as Porter’s Five Forces, valuechain, supply chain management, and customer relationship management, thatorganizations can use to achieve success. The unit then focuses on how to measurethe success of these strategies and finishes with a discussion on implementing thecorrect organizational structure to support these strategies.

UNIT 2—MANAGING INFORMATION FOR BUSINESS INITIATIVES

Like any resource, an organization must manage information properly. That is, anorganization must:

1. Determine what information it requires.

2. Acquire that information.

3. Organize the information in a meaningful fashion.

4. Assure the information’s quality.

5. Provide software tools so that employees throughout the organization can ac-cess the information they require.

At the very heart of most—if not all—management information systems is adatabase and a database management system (see Figure 1.3). A database main-tains information about various types of objects (inventory), events (transactions),people (employees), and places (warehouses). A database management system(DBMS) is software through which users and application programs interact with adatabase. Think of it this way: A DBMS is to a database as word processing softwareis to a document or as spreadsheet software is to a spreadsheet. One is the informa-tion and the other is the software people use to manipulate the information.

The primary task of a database is to store and organize every piece of informa-tion related to transactions (for instance, the sale of a product) and business events(such as the hiring of a new employee). As such, databases store a tremendousamount of detailed information. The primary task of a DBMS then is to allow usersto create, access, and use information stored in a database.

8 Unit 1 Achieving Business Success through Information Technology*

Info

rmat

ion

Tech

nolo

gy

People

Information

BusinessSuccess

FIGURE 1.2

Business Success =People + Information +Information Technology





As displayed in Figure 1.3, a user can directly interact with a database of in-formation using different types of information technology tools such as views andreport generators. Users can also interact with a database of information by using ap-plication programs such as accounting, marketing, and manufacturing applications.

Unit 2 covers databases and database management systems in detail and high-lights why and how information adds value.

UNIT 3—ENHANCING BUSINESS DECISIONS

The structure of a typical organization is similar to a pyramid. The array of organi-zational activities occur at different levels of the pyramid. People in the organiza-tion have unique information needs and thus require various sets of informationtechnology tools (see Figure 1.4). At the lower levels of the pyramid, people performdaily tasks such as processing transactions. This is online transaction processing(OLTP)—the capturing of transaction and event information using technology to(1) process the information according to defined business rules, (2) store the infor-mation, and (3) update existing information to reflect the new information. At thislevel during OLTP, the organization must capture every detail of transactions andevents. The activities of processing, storing, and updating information occur withinthe context of databases and DBMSs.


DBMS

Manufacturingprogram

Direct userinteraction

Indirectuser

interaction

DBMS

Reportgenerators

ViewsMarketingprogram

Accountingprogram

Database

FIGURE 1.3

Managing Informationwith a Database andDatabase ManagementSystem (DBMS)

FIGURE 1.4

Activities, Information,and InformationTechnology within an Organization

Analytical

Processes

Transactional

Coarse

Granularity

Fine

OnlineAnalytical

Processing

Processing

OnlineTransactionProcessing

Information requirements

Data WarehousesData-Mining ToolsCustom Interfaces

Technologies

Databasesand

DBMSs

Analysts

Organizational Levels

Managers

Executives

Information requirements





Moving up through the organizational pyramid, people (typically managers)deal less with the details (“finer” information) and more with meaningful aggre-gations of information (“coarser” information) that help them make broader deci-sions on behalf of the organization. This is online analytical processing (OLAP)—the manipulation of information to create business intelligence in support ofstrategic decision making. Business intelligence is a broad, general term describinginformation that people use to support their decision-making efforts.

While DBMS tools help managers obtain various aggregations of information ina database, many organizations today employ data warehouses and data-miningtools to support their strategic decision making. A data warehouse is a logical col-lection of information—gathered from many different operational databases—thatsupports business analysis activities and decision-making tasks. The tools that peo-ple use to work with information in a data warehouse are called data-mining tools.Data-mining tools use a variety of techniques to find patterns and relationships inlarge volumes of information and infer rules from them that predict future behav-ior and guide decision making.

Unit 3 introduces the role of information technology in strategic decision mak-ing and covers in detail topics such as data marts, data-mining tools, digital dash-boards, supply chain management, and customer relationship management.

UNIT 4—CREATING COLLABORATIVE PARTNERSHIPS IN BUSINESS

To be successful—and avoid being eliminated by the competition—an organiza-tion will constantly undertake new initiatives, address both minor and major prob-lems, and capitalize on significant opportunities. In support of these activities, anorganization will create and utilize teams, partnerships, and alliances because allthe requisite expertise needed is beyond the scope of a single individual or even theorganization. An organization can form teams, partnerships, and alliances inter-nally among its employees or externally with other organizations (see Figure 1.5).

The increasingly complicated nature of business often requires the expertisefrom many functional areas. IT-based collaboration tools can help organizationsmake efficient and effective use of their resources, namely their people and infor-


FIGURE 1.5

Teams, Partnerships,and Alliances withinand External to anOrganization

Marketing

Collaboration Systems

Information partnerships with other organizations

• Groupware• Document management systems• Knowledge management systems• Project management software

Distribution

Organization #1

Organization #2 Organization #3

Accounting Production





mation, when they use teams. A collaboration system is an IT-based set of toolsthat supports the work of teams by facilitating the sharing and flow of information.Many successful organizations today have utilized some or all of the following col-laboration systems in support of teams:

■ Groupware—software tools that support team interaction and dynamics in-cluding calendaring, scheduling, and videoconferencing.

■ Document management systems (DMS)—support the electronic capturing,storage, distribution, archival, and accessing of documents. Document man-agement systems are ideal for moving standard business documents, such aspurchase orders, among various functions including order processing, inven-tory management, billing, warehousing, and shipping.

■ Knowledge management systems (KMS)—systems that support the capturingand use of an organization’s “know how.”

■ Project management software—specifically supports the long-term and day-to-day management and execution of the steps in a project (such as buildinga new warehouse or designing and implementing a new IT system).

For example, Project Management Advisors, Inc. (PMA), provides its clients withexpertise in project management for real estate design, construction, and occu-pancy processes. PMA required a system for sharing project information such asproject plans, budgets, and progress reports with its project team members whowere typically located in cities across the United States. PMA implemented Synergy,a Web-based collaboration tool that provides the various team members access toproject information. The tool even offers the functionality to control which teammembers can update documents and which team members can only view docu-ments. The system replaced e-mail discussions with Web-based discussion forums,which in turn provide an organized record of project-related discussions amongteam members. The use of Synergy has permitted PMA to undertake larger, morecomplex projects and reduce its administrative costs at the same time.2

In the same way that organizations use internal teams, they are increasinglyforming alliances and partnerships with other organizations. The core competencyof an organization is its key strength, a business function that it does better thanany of its competitors. For example, Apple Computer is highly regarded for itsstrength in product design, while Accenture’s core competency is the design and in-stallation of information systems. A core competency strategy is one in which an or-ganization chooses to focus specifically on what it does best (its core competency)and forms partnerships and alliances with other specialist organizations to handlenonstrategic business processes.

Information technology systems make such business partnerships and allianceseasier to establish and manage. An information partnership occurs when two ormore organizations cooperate by integrating their IT systems, thereby providingcustomers with the best of what each can offer. The advent of the Internet hasgreatly increased the opportunity for IT-enabled business partnerships and al-liances. For example, Amazon.com developed a profitable business segment byproviding e-business outsourcing services to other retailers who use Amazon’s Website software. Some well-known retailers partnering with Amazon.com includeMarshall Fields, Office Depot, and Target.3

Information partnerships are an integral foundation for many business initia-tives, including supply chain management, as with Wal-Mart and Levi’s in the open-ing case study. Levi’s core competency is brand-name differentiation and recogni-tion, while Wal-Mart’s core competency is retail cost leadership. The informationpartnership between those two organizations enables cost-leadership selling of awidely recognized brand name. It is a win-win situation for both organizations.

Unit 4 specifically focuses on IT support for collaborative partnerships, both in-ternally to an organization and externally with its business partners.






UNIT 5—TRANSFORMING ORGANIZATIONS

Some observers of our business environment have anominous vision of the future—digital Darwinism. Digi-tal Darwinism implies that organizations which cannotadapt to the new demands placed on them for survivingin the information age are doomed to extinction.4

Rapid changes in technology coupled with recenttrends toward the globalization of business have raisedthe intensity of the competitive environment in justabout every industry. In the words of one long-time busi-ness consultant, “Nothing’s easy any more.” What thismeans is that managers will need all of the tools at theirdisposal to ensure that their business thrives in the infor-

mation age by continuously transforming itself. Figure 1.6 shows several businesssegments that have changed dramatically because of Internet-based competition.

There are numerous examples of organizations losing revenue because of ad-vances in technology. For example, the airline industry lost revenue from businesstravelers after the invention of videoconferencing technologies because managersno longer have to travel to distant places to meet with their co-workers. The airlineindustry also lost revenue with the invention of networking technologies that giveindividuals the ability to access systems remotely to make updates, changes, andfixes. Technical specialists do not have to physically travel to the location of the sys-tem; they can simply log in from wherever they are located. Thus, managers mustcontinually watch for Internet competition and technology advances that have thepotential to corrode market share.

Unit 5 explores the power of IT to transform an organization. Information tech-nology is a powerful tool that can transform an organization from doing “businessas usual” to becoming what some observers call an agile organization, capable ofanticipating and/or reacting to business opportunities and threats. Unit 5 focuseson how to manage the development of IT systems to support agile organizations inkeeping with the requirements of a 21st century organization.


Automobile dealers

Bookstores

Mortgage bankers

Music retailers

Stockbrokers

Travel agents

U.S. Postal Service

Auctions

Traditional Businesses Internet Competitors

Autobyte, AutoTrader

Amazon, BarnesandNoble

DiTech, HomeLoanAdvisor

Apple i-Tunes, Pressplay

E-Trade, Ameritrade

Expedia, Travelocity

AOL, MSN, Hotmail

eBay, ubid

FIGURE 1.6

Traditional BusinessChanged by Internet-Enabled Competition

1. Explain how Levi’s achieved business success through the use of information, informationtechnology, and people.

2. Describe the types of Levi’s jeans information staff employees at a Wal-Mart store requireand compare it to the types of Levi’s jeans information the executives at Wal-Mart’s corpo-rate headquarters require.

3. Arrange the five units covered in this text and rank them in order of greatest impact to leastimpact on Levi’s competitive strategy.

O P E N I N G C A S E S T U D Y Q U E S T I O N S





Technology, specifically the Internet, is changing the way businesses operate. Internet-basedbusiness such as online retail sales and online advertising generates over $100 billion in rev-enue per year. Organizations must understand the potential value that can be unleashed fromembracing technology and Internet-based business. The following are a few statistics aboutthe Internet that organizations can use to estimate future revenue potential:

■ Forester Research predicted online retail sales would hit $101.1 billion in the UnitedStates by 2002. This prediction came true a year later in 2003 (see Figure 1.7).


Chapter One Case: Technology in Business

FIGURE 1.7

Online Retail Sales

FIGURE 1.8

Households withBroadband

$120 billion

$60 billion

$90 billionForecast

Actual

$30 billion

$0

Online Retail Sales

1999 2000 2001 2002 2003

1-year lag

30 million

10 million

20 million Forecast

Actual

0

Households with Broadband

1999 2000 2001 2002 2003

1-year lag

■ eMarketer estimated that 22.3 million households would have broadband connectionsin the United States by 2000. The actual figure for 2002 was 17.2 million and reached 24million by the end of 2003 (see Figure 1.8).





■ Online advertising revenue was expected to hit $3 billion in 2001 and actually did in 2003(see Figure 1.9).

FIGURE 1.9

Online AdvertisingRevenue

FIGURE 1.10

Internet UsersWorldwide


$12 billion

$6 billion

$9 billion

Forecast

Actual

$3 billion

$0

Online Advertising Revenue

1999 2000 2001 2002 2003

2-year lag

600 million

200 million

400 million

0

Internet Users Worldwide

1999 2000 2001 2002 2003

Forecast

Actual1-year ahead

■ Jupiter Research estimated the world’s online population would hit 498.1 million by2003. According to eMarketer, the global Internet population was over 633 million in2003 (see Figure 1.10).5

Questions1. Review the graphs in Figures 1.7 through 1.10 and explain why it is critical that busi-

nesses understand and embrace the Internet.2. Explain the correlation between the online retail sales graph (Figure 1.7) and the online

advertising revenue graph (Figure 1.9).3. The number of Internet users worldwide is two years ahead of its forecast. What are

the potential impacts that underestimating the number of global Internet users mighthave on a business?

PLUG-IN POINTERS >>

Review the Technology Plug-In Hardware and Software for anoverview of hardware devices, application software, systemsoftware, storage devices, and connecting devices.

Review the Technology Plug-In Networks and Telecommunicationsfor a comprehensive overview of networks including LAN, WAN,MAN, VPN, TCP/IP, network topologies, network operating systems,and guided and unguided media. >

>



2. Identifying Competitive Advantages


LEARNING OUTCOMES

2.1. Explain why competitive advantages are typicallytemporary.

2.2. List and describe each of the five forces in Porter’sFive Forces Model.

2.3. Compare Porter’s three generic strategies.2.4. Describe the relationship between business

processes and value chains.

o survive and thrive, an organization must create a competitive advantage. Acompetitive advantage is a product or service that an organization’s cus-tomers value more highly than similar offerings from a competitor. Unfortu-

nately, competitive advantages are typically temporary because competitors oftenseek ways to duplicate the competitive advantage. In turn, organizations must de-velop a strategy based on a new competitive advantage.

When an organization is the first to market with a competitive advantage, itgains a first-mover advantage. The first-mover advantage occurs when an organi-zation can significantly impact its market share by being first to market with a com-petitive advantage. FedEx created a first-mover advantage several years ago when itdeveloped its customer self-service software allowing people and organizations torequest a package pick-up, print mailing slips, and track packages online. Otherparcel delivery services quickly followed with their own versions of the software.Today, customer self-service on the Internet is a standard for doing business in theparcel delivery industry.

As organizations develop their competitive advantages, they must pay close atten-tion to their competition through environmental scanning. Environmental scan-ning is the acquisition and analysis of events and trends in the environment externalto an organization. Information technology has the opportunity to play an importantrole in environmental scanning. For example, Frito Lay, a premier provider of snackfoods such as Cracker Jacks and Cheetos, does not just send its representatives intogrocery stores to stock shelves—they carry hand-held computers and record theproduct offerings, inventory, and even product locations of competitors. Frito Layuses this information to gain business intelligence on everything from how well com-peting products are selling to the strategic placement of its own products.

There are three common tools used in industry to analyze and develop compet-itive advantages: (1) the Five Forces Model, (2) the three generic strategies, and (3)value chains.

THE FIVE FORCES MODEL—EVALUATING BUSINESS SEGMENTS

Organizations frequently face a decision as to whether to enter a new industry orindustry segment. Michael Porter’s Five Forces Model is a useful tool to aid in thischallenging decision. The Five Forces Model helps determine the relative attrac-tiveness of an industry and includes the following five forces (see Figure 1.11):


Chapter Two: Identifying Competitive Advantages

T





1. Buyer power

2. Supplier power

3. Threat of substitute products or services

4. Threat of new entrants

5. Rivalry among existing competitors

The following introduction to each force provides detailed examples of how infor-mation technology can develop a competitive advantage.

Buyer Power

Buyer power in the Five Forces Model is high when buyers have many choices ofwhom to buy from and low when their choices are few. To reduce buyer power (andcreate a competitive advantage), an organization must make it more attractive forcustomers to buy from them than from their competition. One of the best IT-basedexamples is the loyalty programs that many organizations offer. Loyalty programsreward customers based on the amount of business they do with a particular or-ganization. The travel industry is famous for its loyalty programs such as frequent-flyer programs for airlines and frequent-stayer programs for hotels.

Keeping track of the activities and accounts of many thousands or millions ofcustomers covered by loyalty programs is not practical without large-scale IT sys-tems. Loyalty programs are a good example of using IT to reduce buyer power. Because of the rewards (e.g., free airline tickets, upgrades, or hotel stays) travelersreceive, they are more likely to be loyal to or give most of their business to a singleorganization.

Supplier Power

Supplier power in the Five Forces Model is high when buyers have few choices ofwhom to buy from and low when their choices are many. Supplier power is the con-verse of buyer power: A supplier organization in a market will want buyer power tobe low. A supply chain consists of all parties involved, directly or indirectly, in theprocurement of a product or raw material. In a typical supply chain, an organiza-tion will probably be both a supplier (to customers) and a customer (of other sup-plier organizations) (see Figure 1.12).

As a buyer, the organization can create a competitive advantage by locating al-ternative supply sources. IT-enabled business-to-business (B2B) marketplaces canhelp. A business-to-business (B2B) marketplace is an Internet-based service whichbrings together many buyers and sellers. One important variation of the B2B mar-


FIGURE 1.11

Porter’s Five ForcesModel in the InternetEconomy

Bargaining powerof suppliers

Supplier Power

Threat ofNew Entrants

Rivalry amongExisting Competitors

Buyer PowerBargainingpower ofchannels

Bargainingpower ofend users

Threat of SubstituteProducts or Services





ketplace is a private exchange. A private exchange is a B2B marketplace in which asingle buyer posts its needs and then opens the bidding to any supplier who wouldcare to bid. Bidding is typically carried out through a reverse auction. A reverse auc-tion is an auction format in which increasingly lower bids are solicited from orga-nizations willing to supply the desired product or service at an increasingly lowerprice. As the bids get lower and lower, more and more suppliers drop out of the auc-tion. Ultimately, the organization with the lowest bid wins. Internet-based reverseauctions are an excellent example of the way that information technology can re-duce supplier power for an organization and create a competitive advantage.

Threat of Substitute Products or Services

The threat of substitute products or services in the Five Forces Model is high whenthere are many alternatives to a product or service and low when there are few alternatives from which to choose. Ideally, an organization would like to be in amarket in which there are few substitutes for the products or services it offers. Ofcourse, that is seldom possible in any market today, but an organization can stillcreate a competitive advantage by using switching costs. Switching costs are coststhat can make customers reluctant to switch to another product or service.

A switching cost need not have an associated monetary cost. Amazon.com offersan example. As customers purchase products at Amazon.com over time, it beginsto develop a unique profile of their shopping and purchasing habits. When a cus-tomer visits Amazon.com repeatedly, it can begin to offer products tailored to thatparticular customer based on their profile. If the customer decides to shop else-where, there is an associated switching cost because the new site will not have theprofile of the customer’s past purchases. In this way Amazon.com has reduced thethreat of substitute products or services in a market in which there are many by tai-loring customer offerings and creating a “cost” to the consumer to switch to an-other online retailer.

Threat of New Entrants

The threat of new entrants in the Five Forces Model is high when it is easy for newcompetitors to enter a market and low when there are significant entry barriers toentering a market. An entry barrier is a product or service feature that customershave come to expect from organizations in a particular industry and must be of-fered by an entering organization to compete and survive. For example, a new bankmust offer its customers an array of IT-enabled services, including ATM use, onlinebill paying, and account monitoring. These are significant barriers to entering thebanking market. At one time, the first bank to offer such services gained a valuablefirst-mover advantage, but only temporarily, as other banking competitors devel-oped their own IT systems.

Rivalry among Existing Competitors

Rivalry among existing competitors in the Five Forces Model is high when compe-tition is fierce in a market and low when competition is more complacent. Althoughcompetition is always more intense in some industries than in others, the overalltrend is toward increased competition in just about every industry.


FIGURE 1.12

An Organization withinthe Supply ChainOrganizationSuppliers

Organizations want supplierpower to be low here

Organizations want supplierpower to be high here

Customers





The retail grocery industry is intensively competitive. While Kroger, Safeway, andAlbertson’s in the United States compete in many different ways, essentially they tryto beat or match the competition on price. Most of them have loyalty programs thatgive shoppers special discounts. Customers get lower prices while the store gathersvaluable information on buying habits to craft pricing strategies. In the future, ex-pect to see grocery stores using wireless technologies to track customer movementthroughout the store and match it to products purchased to determine purchasingsequences. Such a system will be IT-based and a huge competitive advantage to thefirst store to implement it.

Since margins are quite low in the grocery retail market, grocers build efficien-cies into their supply chains, connecting with their suppliers in IT-enabled infor-mation partnerships such as the one between Wal-Mart and its suppliers. Commu-nicating with suppliers over telecommunications networks rather than usingpaper-based systems makes the procurement process faster, cheaper, and more ac-curate. That equates to lower prices for customers and increased rivalry among ex-isting competitors.

THE THREE GENERIC STRATEGIES—CREATING A BUSINESS FOCUS

Once the relative attractiveness of an industry is determined and an organizationdecides to enter that market, it must formulate a strategy for entering the new mar-ket. An organization can follow Porter’s three generic strategies when entering a newmarket: (1) broad cost leadership, (2) broad differentiation, or (3) a focused strategy.Broad strategies reach a large market segment, while focused strategies target aniche market. A focused strategy concentrates on either cost leadership or differen-tiation. Trying to be all things to all people, however, is a recipe for disaster, since itis difficult to project a consistent image to the entire marketplace. Porter suggeststhat an organization is wise to adopt only one of the three generic strategies.

To illustrate the use of the three generic strategies, consider Figure 1.13. The ma-trix shown demonstrates the relationships among strategies (cost leadership versusdifferentiation) and market segmentation (broad versus focused).

■ Hyundai is following a broad cost leadership strategy. Hyundai offers low-costvehicles, in each particular model stratification, that appeal to a large audi-ence.


FIGURE 1.13

Three GenericStrategies in the AutoIndustry

Broad markets

Cost Leadership strategy Differentiation strategy

Hyundai Audi

Focused markets

KIA Hummer





■ Audi is pursuing a broad differentiation strategy with its Quattro modelsavailable at several price points. Audi’s differentiation is safety and it prices itsvarious Quattro models (higher than Hyundai) to reach a large, stratified au-dience.

■ KIA has a more focused cost leadership strategy. KIA mainly offers low-costvehicles in the lower levels of model stratification.

■ Hummer offers the most focused differentiation strategy of any in the indus-try (including Mercedes-Benz).

VALUE CHAINS—TARGETING BUSINESS PROCESSES

An organization must understand, accept, and successfully execute its businessstrategy. Every aspect of the organization contributes to the success (or failure) ofthe chosen strategy. The business processes of the organization and the value chainthey create play an integral role in strategy execution.

A business process is a standardized set of activities that accomplish a specifictask, such as processing a customer’s order. To evaluate the effectiveness of its busi-ness processes, an organization can use Michael Porter’s value chain approach. Thevalue chain approach views an organization as a chain, or series, of processes, eachof which adds value to the product or service for each customer. To create a com-petitive advantage, the value chain must enable the organization to provide uniquevalue to its customers.

Organizations can achieve this by offering lower prices or by competing in a dis-tinctive way. Examining the organization as a value chain (actually numerous dis-tinct but inseparable value chains) leads to the identification of the important ac-tivities that add value for customers and then identifying IT systems that supportthose activities. Figure 1.14a provides a graphical depiction of a value chain. Pri-mary value activities, shown at the bottom of the graph, acquire raw materials andmanufactures, delivers, markets, sells, and provides after-sales services. Supportvalue activities, along the top of the graph, such as firm infrastructure, human re-source management, technology development, and procurement, support the pri-mary value activities.

The goal here is to survey the customers and ask them the extent to which theybelieve each activity adds value to the product or service. This generates a quantifi-able metric, displayed in percentages in Figure 1.14, for how each activity adds value(or reduces value). The competitive advantage decision then is to (1) target highvalue-adding activities to further enhance their value, (2) target low value-addingactivities to increase their value, or (3) perform some combination of the two.


FIGURE 1.14a

A Graphical Depictionof a Value Chain

Firm infrastructure (3.1%)

Human resource management (7.1%)

Technology development (and R&D) (4.2%)

Procurement (27%)ValueAdded

Receiveand storerawmaterials(5.2%)

Make theproduct orservice(40.3%)

Deliver theproduct orservice(6.6%)

Market andsell theproduct orservice(4.3%)

Serviceafter thesale (2.2%)

Supp

ort

Valu

eA

ctiv

ities

Prim

ary

Valu

eA

ctiv

ities





Value chain analysis is a highly useful tool in that it provides hard and fast num-bers for evaluating the activities that add value to products and services. An orga-nization can find additional value by analyzing and constructing its value chain interms of Porter’s Five Forces (see Figure 1.14b). For example, if an organizationwants to decrease its buyer’s or customer’s power it can construct its value chain ac-tivity of “service after the sale” by offering high levels of quality customer service.This will increase the switching costs for its customers, thereby decreasing theirpower. Analyzing and constructing its support value activities can help an organi-zation decrease the threat of new entrants. Analyzing and constructing its primaryvalue activities can help an organization decrease the threat of substitute productsor services.


FIGURE 1.14b

The Value Chain andPorter’s Five Forces

Firm infrastructure (3.1%)

Human resource management (7.1%)

Technology development (and R&D) (4.2%)

Procurement (27%)ValueAdded

Receiveand storerawmaterials(5.2%)

Make theproduct orservice(40.3%)

Deliver theproduct orservice(6.6%)

Market andsell theproduct orservice(4.3%)

Serviceafter thesale (2.2%)

SupplierPower

Threat ofSubstitute Products

or Services

Threat ofNew Entrants

BuyerPower

Supply Chain Demand Chain

1. How can Levi’s use environmental scanning to gain business intelligence?

2. Using Porter’s Five Forces Model, analyze Levi’s buyer power and supplier power.

3. Which of the three generic strategies is Levi’s following?






Wireless operators, credit card companies, and retailers are working on a technology that al-lows customers to purchase items by using their cell phones. For example, a customer couldpurchase a can of soda by dialing a telephone number on the dispensing machine and havethe charge for the soda show up on their cell phone bill. Working prototypes are currently inuse in South Korea, Japan, and Europe.

The ability to charge items to a cell phone has significant business potential because, un-like in the United States, credit cards are not nearly as popular in other countries. In Japanand China, for example, people are much more likely to have a cell phone than a credit card.Japanese consumers use credit cards for only 5.6 percent of their personal spending com-pared with 33 percent of U.S. consumer spending.

The payoff for credit card companies and cell phone operators from this technology couldbe enormous. By associating a credit card with a cell phone, banks and credit card compa-nies hope to convince consumers to buy products, such as soda, with their cell phones in-stead of pocket change. Of course, they will reap transaction fees for each transaction. Mo-bile phone operators see the technology as a way to increase traffic on their networks as wellas to position cell phones as an even more useful and, thus, essential device for consumers.Retailers envision easier transactions also leading to more sales.

MasterCard International and Nokia are currently testing a cell phone credit card for theU.S. market. The phones have a special chip programmed with the user’s credit card informa-tion and a radio frequency transmitting circuit. Consumers can simply tap their phone on aspecial device at a checkout counter equipped with a receiving device that costs the retailerabout $80. Betsy Foran-Owens, vice president for Product Services at MasterCard Interna-tional commented that with this technology, “You don’t even have to get off your phone to pay.You can just tap this thing down at the register.” She also noted, “If you’re not going to carrycash around, what are you going to carry? Your mobile phone.”

The only players who might not look favorably on the technology are the traditional tele-phone companies, who must certainly view the technology as just one more threat to their tra-ditional telephone business.6

Questions1. Do you view this technology as a potential threat to traditional telephone companies?

If so, what counterstrategies could traditional telephone companies adopt to preparefor this technology?

2. Using Porter’s Five Forces describe the barriers to entry for this new technology.3. Which of Porter’s three generic strategies is this new technology following?


Chapter Two Case: Say “Charge It” with Your Cell Phone



3. Strategic Initiatives for Implementing Competitive Advantages


Chapter Three: Strategic Initiatives for ImplementingCompetitive Advantages

LEARNING OUTCOMES

3.1. List and describe the four basic components ofsupply chain management.

3.2. Explain customer relationship managementsystems and how they can help organizationsunderstand their customers.

3.3. Summarize the importance of enterprise resourceplanning systems.

rek, a leader in bicycle products and accessories, gained more than 30 per-cent of the worldwide market by streamlining operations through the imple-mentation of several IT systems. According to Jeff Stang, director of IT and

Operational Accounting, the most significant improvement realized from the newsystems was the ability to obtain key management information to drive businessdecisions in line with the company’s strategic goals. Other system results includeda highly successful Web site developed for the 1,400 Trek dealers where they couldenter orders directly, check stock availability, and view accounts receivable andcredit summaries. Tonja Green, Trek channel manager for North America, stated,“We wanted to give our dealers an easier and quicker way to enter their orders andget information. Every week the number of Web orders increases by 25–30 percentdue to the new system.”7

This chapter introduces three high-profile strategic initiatives that an organiza-tion can undertake to help it gain competitive advantages and business efficien-cies—supply chain management, customer relationship management, and enter-prise resource planning.

SUPPLY CHAIN MANAGEMENT

To understand a supply chain, consider a customer purchasing a Trek bike from adealer. On one end, the supply chain has the customer placing an order for the bikewith the dealer. The dealer purchases the bike from the manufacturer, Trek. Trekpurchases raw materials such as packaging material, metal, and accessories frommany different suppliers to make the bike. The supply chain for Trek encompassesevery activity and party involved in the process of fulfilling the order from the cus-tomer for the new bike.

Supply chain management (SCM) involves the management of informationflows between and among stages in a supply chain to maximize total supply chaineffectiveness and profitability. The four basic components of supply chain manage-ment are:

1. Supply chain strategy—the strategy for managing all the resources requiredto meet customer demand for all products and services.


T





2. Supply chain partners—the partners chosen to deliver finished products, rawmaterials, and services including pricing, delivery, and payment processesalong with partner relationship monitoring metrics.

3. Supply chain operation—the schedule for production activities includingtesting, packaging, and preparation for delivery. Measurements for this com-ponent include productivity and quality.

4. Supply chain logistics—the product delivery processes and elements includ-ing orders, warehouses, carriers, defective product returns, and invoicing.

Dozens of steps are required to achieve and carry out each of the above compo-nents. SCM software can enable an organization to generate efficiencies withinthese steps by automating and improving the information flows throughout andamong the different supply chain components.

Wal-Mart and Procter & Gamble (P&G) implemented a tremendously successfulSCM system. The system linked Wal-Mart’s distribution centers directly to P&G’smanufacturing centers. Every time a Wal-Mart customer purchases a P&G product,the system sends a message directly to the factory alerting P&G to restock the prod-uct. The system also sends an automatic alert to P&G whenever a product is run-ning low at one of Wal-Mart’s distribution centers. This real-time information allows P&G to efficiently make and deliver products to Wal-Mart without having tomaintain large inventories in its warehouses. The system also generates invoicesand receives payments automatically. The SCM system saves time, reduces inven-tory, and decreases order-processing costs for P&G. P&G passes on these savings toWal-Mart in the form of discounted prices.8

Figure 1.15 diagrams the stages of the SCM system for a customer purchasing aproduct from Wal-Mart. The diagram demonstrates how the supply chain is dy-namic and involves the constant flow of information between the different parties.For example, the customer generates order information by purchasing a productfrom Wal-Mart. Wal-Mart supplies the order information to its warehouse or dis-tributor. The warehouse or distributor transfers the order information to the man-ufacturer, who provides pricing and availability information to the store and re-plenishes the product to the store. Payment funds among the various partners aretransferred electronically.

Effective and efficient supply chain management systems can enable an organi-zation to:

■ Decrease the power of its buyers.

■ Increase its own supplier power.

■ Increase switching costs to reduce the threat of substitute products or services.


FIGURE 1.15

Supply Chain for aProduct Purchasedfrom Wal-Mart

Procter &Gamble

Wal-MartWarehouse

or distributor

Indicates information flows for products,pricing, scheduling, and availability

Papermanufacturer

Packagingsupplier

Scented oilmanufacturer

Cocoa oilmanufacturer

Wal-Martstore Customer






■ Create entry barriers thereby reducing the threat of new entrants.

■ Increase efficiencies while seeking a competitive advantage through costleadership (see Figure 1.16).

CUSTOMER RELATIONSHIP MANAGEMENT

Today, most competitors are simply a mouse-click away. This intense marketplacehas forced organizations to switch from being sales focused to being customer focused.

Charles Schwab recouped the cost of a multimillion-dollar customer relation-ship management system in less than two years. The system, developed by Siebel,allows the brokerage firm to trace each interaction with a customer or prospectivecustomer and then provide services (retirement planning, for instance) to eachcustomer’s needs and interests. The system gives Schwab a better and more com-plete view of its customers, which it can use to determine which customers are se-rious investors and which ones are not. Automated deposits from paychecks, forexample, are a sign of a serious investor, while stagnant balances signal a nonseri-ous investor. Once Schwab is able to make this determination, the firm allocates itsresources accordingly, saving money by not investing time or resources in subsidiz-ing nonserious investors.9

Customer relationship management (CRM) involves managing all aspects of a customer’s relationship with an organization to increase customer loyalty and retention and an organization’s profitability. CRM allows an organization to gain insights into customers’ shopping and buying behaviors in order to develop andimplement enterprisewide strategies. Kaiser Permanente, for example, undertook aCRM strategy to improve and prolong the lives of diabetics. After compiling CRMinformation on 84,000 of its diabetic patients among its 2.4 million northern Cali-fornia members, Kaiser determined that only 15 to 20 percent of its diabetic patients were getting their eyes checked routinely. (Diabetes is the leading cause of blindness.) As a result, Kaiser is now enforcing more rigorous eye-screening programs for diabetics and creating support groups for obesity and stress (twomore factors that make diabetes even worse). This CRM-based “preventive medi-cine” approach is saving Kaiser considerable sums of money and saving the eye-sight of diabetic patients.10

It is important to realize that CRM is not just technology, but a strategy that anorganization must embrace on an enterprise level. Although there are many tech-nical components of CRM, it is actually a process and business goal simply en-hanced by technology. Implementing a CRM system can help an organizationquickly identify types of customers, design specific marketing campaigns tailoredto each customer type, and thereby increase customer spending. A CRM systemalso allows an organization to treat customers as individuals, gaining important in-sights into their buying preferences and behaviors leading to increased sales,greater profitability, and higher rates of customer loyalty.

Figure 1.17 provides an overview of a typical CRM system. Customers contact anorganization through various means including call centers, Web access, e-mail,faxes, and direct sales. A single customer may access an organization multiple

Decrease

Increase

Organization’sSupply Chain

• Supplier Power

• Buyer Power• Threat of Substitute Products or Services• Threat of New Entrants

FIGURE 1.16

Effective and EfficientSupply ChainManagement’s Effecton Porter’s Five Forces





times through many different channels. The CRM system tracks every communi-cation between the customer and the organization and provides access to CRM information within different systems from accounting to order fulfillment. Under-standing all customer communications allows the organization to communicateeffectively with each customer. It gives the organization a detailed understandingof each customer’s products and services record regardless of the customer’s pre-ferred communication channel. For example, a customer service representativecan easily view detailed account information and history through a CRM systemwhen providing information to a customer such as expected delivery dates, com-plementary product information, and customer payment and billing information.

Eddie Bauer ships 110 million catalogs a year, maintains two Web sites, and hasover 600 retail stores. The company collects information through customer trans-actions and analyzes the information to determine the best way to market to eachindividual customer. One thing Eddie Bauer discovered was that customers whoshop across all three of its distribution channels—catalogs, Web sites, and stores—spend up to five times more than customers who shop through only one channel.

Michael Boyd, director of CRM at Eddie Bauer, stated that “our experience tellsus that CRM is in no way, shape, or form a software application. Fundamentally, itis a business strategy to try to optimize profitability, revenue, and satisfaction at anindividual customer level. Everything in an organization, every single process,every single application, is a tool that can be used to serve the CRM goal.”11


FIGURE 1.17

CRM Overview

Customerservicesystem

Inventorysystem

Orderfulfillment

system

Accountingsystem

Customer Relationship Management System

Customer information flowsare represented by arrows.





FIGURE 1.18

Functional OrganizationOverview


ENTERPRISE RESOURCE PLANNING

Enterprise resource planning (ERP) integrates all departments and functionsthroughout an organization into a single IT system (or integrated set of IT systems)so that employees can make enterprisewide decisions by viewing enterprisewideinformation on all business operations. The key word in ERP is “enterprise” and notnecessarily resource or planning.

Understanding that typical organizations operate by functional areas, which areoften called functional silos if they are not integrated, is the best way to see thevalue of ERP. Figure 1.18 provides a graphical depiction of an organization withfunctional silos. Each functional area undertakes a specific core business function:

■ Sales and Marketing: demand forecasting, sales forecasting, market segmen-tation, advertising, campaigns and promotions, bids and quotes, order pro-cessing, order management, customer relationship management, and cus-tomer support.

■ Operations and Logistics: purchasing, supplying, receiving, transportation,production, shipping, manufacturing and maintenance, production plan-ning, materials management, order entry and order processing, warehousemanagement, transportation management, and customer service manage-ment.

■ Accounting and Finance: financial and cost accounting, planning, budgeting,cash flow, tax compliance, general ledger, accounts payable, treasury manage-ment, and cost control.

■ Human Resources: hiring, training, benefits, and payroll.

Functional areas are anything but independent in an organization. In fact, func-tional areas are interdependent. For example, sales must rely on information fromoperations to understand inventory and be able to place orders, calculate trans-portation costs, and gain insight into product availability based on productionschedules. It is critical to an organization’s success that every department or func-tional area work together sharing common information and not be a “silo.” This re-quires that all IT systems—including hardware, software, information, and peo-ple—be integrated with one another. This is the goal of ERP, but it is no small task.

Logistics

Marketing

Accounting

Sales

Humanresources

Operations

Functional organization—Each functional area has its own systemsand communicates with every other functional area (diagramdisplays Marketing communicating with all other functional areasin the organization).






An IT infrastructure includes the hardware, software, and telecommunicationsequipment that, when combined, provide the underlying foundation to supportthe organization’s goals. The problem with maintaining a consistent IT infrastruc-ture occurs when a single department decides to implement a new system withouttaking into consideration the other departments or overall organizational IT infra-structure. This makes it difficult to integrate IT systems throughout the organiza-tion. Organizations must ensure that the integration of their separate systems oc-curs; otherwise, ERP is not possible.

To integrate the IT infrastructures of separate and distinct systems, organiza-tions need the help of integration tools including:

■ Intranets—an internalized portion of the Internet, protected from outside ac-cess, that allows an organization to provide access to information and appli-cation software to only its employees. Intranets support information and ap-plication software sharing across different IT infrastructures.

■ Enterprise information portals (EIP)—an Internet site owned and operatedby an organization to support its operations. EIPs often operate within an in-tranet and work in a fashion similar to popular Internet search tools such asGoogle.

ERP solutions can provide tremendous value toan organization by offering the flexibility that givesemployees their own unique interface to the system.ERP solutions meet the individual needs of eachemployee in the organization while supporting theenterprise-level needs of the overall organization.

As an alternative to integrating existing systems,many organizations are turning to the acquisitionof enterprisewide ERP solutions, offered by suchvendors as SAP, PeopleSoft, and Oracle. SAP wasone of the first vendors to develop a comprehensiveERP system, and today is one of the dominant mar-ket leaders. SAP’s mySAP Business Suite offers a va-riety of business solutions in areas such as businessintelligence, customer relationship management,enterprise information portals, financials, humanresources, product lifecycle management, supplierrelationship management, and supply chain man-agement. As an organization acquires these varioustools, it can integrate them to develop a completeERP solution.

To summarize—initiatives in customer relationship management, supply chainmanagement, and enterprise resource planning are integral parts of a strategicbusiness tool set that enable organizations to create competitive advantages.

1. Which of Porter’s Five Forces did Levi’s address through the implementation of its updatedsupply chain management system?

2. Evaluate how Levi’s can gain business intelligence through the implementation of a cus-tomer relationship management system.

3. Create an argument against the following statement: “Levi’s should not invest any re-sources to upgrade its current supply chain management system.”


mySAP ERP Web site





Saab Cars USA imports more than 37,000 Saab sedans, convertibles, and wagons annuallyand distributes the cars to 220 U.S. dealerships. Saab competes in the premium automotivemarket and its primary challenge is to compete with rivals who attract customers through ag-gressive marketing campaigns, reduced prices, and inexpensive financing. Saab decided thatthe answer to beating its competition was not to spend capital on additional advertising, butto invest in Siebel Automotive, a customer relationship management system.

Until recently, the company communicated with its customers through three primary chan-nels: (1) dealer network, (2) customer assistance center, (3) lead management center. Tradi-tionally, each channel maintained its own customer database and this splintered approach tomanaging customer information caused numerous problems for the company. For example, aprospective customer might receive a direct mail piece from Saab one week, then an e-mailwith an unrelated offer from a third-party marketing vendor the next week. The local dealermight not know of either activity, and therefore might deliver an ineffective pitch when thecustomer visited the showroom that weekend. Al Fontova, direct marketing manager withSaab Cars USA, stated that he had over 3 million customer records and 55 files at three differ-ent vendors. Analyzing this information in aggregate was complicated, inefficient, and costly.

Saab required a solution that would provide a consolidated customer view from all threetouchpoints. In 2002, Saab implemented the Siebel CRM solution, which provides Saab’s callcenter employees with a 360-degree view of each customer, including prior service-relatedquestions and all the marketing communications they have received. Known internally as“TouchPoint,” the Siebel application provides Saab’s dealers with a powerful Web-based so-lution for coordinating sales and marketing activities. These tracking capabilities enable Saabto measure the sales results of specific leads, recommend more efficient selling techniques,and target its leads more precisely in the future. Using Siebel Automotive, Saab received thefollowing benefits:

■ Direct marketing costs decreased by 5 percent.■ Lead follow-up increased from 38 percent to 50 percent.■ Customer satisfaction increased from 69 percent to 75 percent.■ Saab gained a single view of its customers across multiple channels.12

Questions1. Explain how implementing a CRM system enabled Saab to gain a competitive advan-

tage.2. Estimate the potential impact to Saab’s business if it had not implemented a CRM sys-

tem.3. What additional benefits could Saab receive from implementing a supply chain man-

agement system?


Chapter Three Case: Consolidating Touchpoints for Saab



4. Measuring the Success of Strategic Initiatives


Chapter Four: Measuring the Success of Strategic Initiatives

LEARNING OUTCOMES

4.1. Compare efficiency IT metrics and effectiveness ITmetrics.

4.2. List and describe five common types of efficiencyIT metrics.

4.3. List and describe four types of effectiveness ITmetrics.

4.4. Explain customer metrics and their importance toan organization.

n an effort to offer detailed information to all layers of management, GeneralElectric Co. (GE) invested $1.5 billion in employee time, hardware, software,and other technologies to implement a real-time operations monitoring sys-

tem. GE’s executives use the new system to monitor sales, inventory, and savingsacross its 13 different global business operations every 15 minutes. This allows GEto respond to changes, reduce cycle times, and improve risk management on anhourly basis instead of waiting for month-end or quarter-end reports. GE estimatesthat the $1.5 billion investment will provide a 33 percent return on investment overthe five years of the project.13

Organizations spend enormous sums of money on IT to compete in today’s fast-paced business environment. Some organizations spend up to 50 percent of theirtotal capital expenditures on IT. To justify expenditures on IT, an organization mustmeasure the payoff of these investments, their impact on business performance,and the overall business value gained.

Efficiency and effectiveness metrics are two primary types of IT metrics. Effi-ciency IT metrics measure the performance of the IT system itself includingthroughput, speed, availability, etc. Effectiveness IT metrics measure the impact IThas on business processes and activities including customer satisfaction, conver-sion rates, sell-through increases, etc. Peter Drucker offers a helpful distinction be-tween efficiency and effectiveness. Drucker states that managers “Do things right”and/or “Do the right things.” Doing things right addresses efficiency—getting themost from each resource. Doing the right things addresses effectiveness—settingthe right goals and objectives and ensuring they are accomplished.14

Effectiveness focuses on how well an organization is achieving its goals and ob-jectives, while efficiency focuses on the extent to which an organization is using itsresources in an optimal way. The two—efficiency and effectiveness—are definitelyinterrelated. However, success in one area does not necessarily imply success in theother.

BENCHMARKING—BASELINING METRICS

Regardless of what is measured, how it is measured, and whether it is for the sakeof efficiency or effectiveness, there must be benchmarks, or baseline values the sys-tem seeks to attain. Benchmarking is a process of continuously measuring systemresults, comparing those results to optimal system performance (benchmark val-ues), and identifying steps and procedures to improve system performance.


I





Consider e-government worldwide as an illustra-tion of benchmarking efficiency IT metrics and effec-tiveness IT metrics (see survey results in Figure 1.19).From an effectiveness point of view, Canada ranksnumber one in terms of e-government satisfaction ofits citizens. (The United States ranks third.) The sur-vey, sponsored by Accenture, also included such attri-butes as CRM practices, customer-service vision, ap-proaches to offering e-government services throughmultiple-service delivery channels, and initiatives foridentifying services for individual citizen segments.These are all benchmarks at which Canada’s govern-ment excels.15

In contrast, the United Nations Division for PublicEconomics and Public Administration ranks Canada

sixth in terms of efficiency IT metrics. (It ranked the United States first.) This par-ticular ranking based purely on efficiency IT metrics includes benchmarks such asthe number of computers per 100 citizens, the number of Internet hosts per 10,000citizens, the percentage of the citizen population online, and several other factors.Therefore, while Canada lags behind in IT efficiency, it is the premier e-governmentprovider in terms of effectiveness.16

Governments hoping to increase their e-government presence would bench-mark themselves against these sorts of efficiency and effectiveness metrics. Thereis a high degree of correlation between e-government efficiency and effectiveness,although it is not absolute.

THE INTERRELATIONSHIPS OF EFFICIENCY AND EFFECTIVENESS IT METRICS

Efficiency IT metrics focus on the technology itself. The most common types of efficiency IT metrics include:

■ Throughput—the amount of information that can travel through a system atany point in time.

■ Speed—the amount of time a system takes to perform a transaction.

■ Availability—the number of hours a system is available for use by customersand employees.

■ Accuracy—the extent to which a system generates the correct results whenexecuting the same transaction numerous times.

■ Web traffic—including a host of benchmarks such as the number of page-views, the number of unique visitors, and the average time spent viewing aWeb page.

■ Response time—the time it takes to respond to user interactions such as amouse click.

While these efficiency metrics are important to monitor, they do not alwaysguarantee effectiveness. Effectiveness IT metrics are determined according to anorganization’s goals, strategies, and objectives. Here, it becomes important to con-sider the strategy an organization is using, such as a broad cost leadership strategy(Wal-Mart for example), as well as specific goals and objectives such as increasingnew customers by 10 percent or reducing new product development cycle times tosix months. Broad, general effectiveness metrics include:

■ Usability—the ease with which people perform transactions and/or find in-formation. A popular usability metric on the Internet is degrees of freedom,which measures the number of clicks to get to desired information or process-ing capabilities.


1. United States (3.11)

2. Australia (2.60)

3. New Zealand (2.59)

4. Singapore (2.58)

5. Norway (2.55)

6. Canada (2.52)

7. United Kingdom (2.52)

8. Netherlands (2.51)

9. Denmark (2.47)

10. Germany (2.46)

Efficiency Effectiveness

1. Canada

2. Singapore

3. United States

4. Denmark

5. Australia

6. Finland

7. Hong Kong

8. United Kingdom

9. Germany

10. Ireland

FIGURE 1.19

Comparing IT Efficiencyand EffectivenessMetrics for E-GovernmentInitiatives





■ Customer satisfaction—as measured by such benchmarks as satisfaction sur-veys, percentage of existing customers retained, and increases in revenue dol-lars per customer.

■ Conversion rates—the number of customers an organization “touches” forthe first time and convinces to purchase its products or services. This is a pop-ular metric for evaluating the effectiveness of banner, pop-up, and pop-underads on the Internet.

■ Financial—such as return on investment (the earning power of an organiza-tion’s assets), cost-benefit analysis (the comparison of projected revenues andcosts including development, maintenance, fixed, and variable), and break-even analysis (the point at which constant revenues equal ongoing costs).

In the private sector, eBay is an organization that constantly benchmarks its information technology efficiency and effectiveness. In 2003, eBay posted impres-sive year-end results with revenues increasing 74 percent while earnings grew 135percent. Maintaining constant Web site availability and optimal throughput per-formance is critical to eBay’s success.17

Jupiter Media Metrix ranked eBay as the Website with the highest visitor volume (efficiency) in2003 for the second year in a row, with an 80 per-cent growth from the previous year. eBay averaged4.5 million unique visitors during each week of the holiday season that year with daily peaks ex-ceeding 5 million visitors. To ensure constantavailability and reliability of its systems, eBay im-plemented ProactiveNet, a performance measure-ment and management-tracking tool. The tool al-lows eBay to monitor its environment againstbaseline benchmarks, which helps the eBay teamkeep tight control of its systems. The new systemhas resulted in improved system availability with a150 percent increase in productivity as measuredby system uptime.18

Do not forget to consider the issue of securitywhile determining efficiency and effectiveness ITmetrics. When an organization offers its cus-tomers the ability to purchase products over theInternet it must implement the appropriate secu-rity—such as encryption and Secure Sockets Lay-ers (SSLs; denoted by the lock symbol in the lower right corner of a browser windowand/or the “s” in https). It is actually inefficient for an organization to implementsecurity measures for Internet-based transactions as compared to processing non-secure transactions. However, an organization will probably have a difficult time at-tracting new customers and increasing Web-based revenue if it does not implementthe necessary security measures. Purely from an efficiency IT metric point of view,security generates some inefficiency. From an organization’s business strategypoint of view, however, security should lead to increases in effectiveness metrics.

Figure 1.20 provides a graph depicting the interrelationships between efficiencyand effectiveness. Ideally, an organization should operate in the upper right-handcorner of the graph, realizing both significant increases in efficiency and effective-ness. However, operating in the upper left-hand corner (minimal efficiency with in-creased effectiveness) or the lower right-hand corner (significant efficiency withminimal effectiveness) may be in line with an organization’s particular strategies. Ingeneral, operating in the lower left-hand corner (minimal efficiency and minimaleffectiveness) is not ideal for the operation of any organization.


eBay’s Web site





FIGURE 1.20

The Interrelationshipsbetween Efficiency andEffectiveness

DETERMINING IT EFFICIENCY AND EFFECTIVENESS

Stock market analysts tend to have a bias toward financial metrics. Clearly this em-phasis is important—however, focusing only on financial measurements is limitingsince financial metrics are only one factor that an organization can use to deter-mine IT effectiveness. Customer metrics assess the management of customer rela-tionships by the organization. These effectiveness metrics typically focus on a set ofcore measurements including market share, customer acquisition, customer satis-faction, and customer profitability.

Traffic on the Internet retail site for Wal-Mart has grown 66 percent in the lastyear. The site has over 500,000 visitors daily, 2 million Web pages downloaded daily,6.5 million visitors per week, and over 60,000 users logged on simultaneously. Wal-Mart’s primary concern is maintaining optimal performance for online transac-tions. A disruption to the Web site directly affects the company’s bottom line andcustomer loyalty. The company monitors and tracks the hardware, software, andnetwork running the company’s Web site to ensure high quality of service, whichsaved the company $1.1 million dollars in 2003.19

Customers are primarily concerned with the quality of service they receive froman organization. Anyone using the Internet knows that it is far from perfect and often slow. One of the biggest problems facing Internet users is congestion causedby capacity too small to handle large amounts of traffic. Corporations are continu-ally benchmarking and monitoring their systems in order to ensure high quality ofservice. The most common quality of service metrics that are benchmarked andmonitored include throughput, speed, and availability.

A company must continually monitor these behaviors to determine if the systemis operating above or below expectations. If the system begins to operate below ex-pectations, system administrators must take immediate action to bring the systemback up to acceptable operating levels. For example, if a company suddenly begantaking two minutes to deliver a Web page to a customer, the company would needto fix this problem as soon as possible to keep from losing customers and ultimatelyrevenue.

Web Traffic Analysis

Most companies measure the traffic on a Web site as the primary determinant ofthe Web site’s success. However, a lot of Web site traffic does not necessarily indi-cate large sales. Many organizations with lots of Web site traffic have minimal sales.A company can go further and use Web traffic analysis to determine the revenuegenerated by Web traffic, the number of new customers acquired by Web traffic, anyreductions in customer service calls resulting from Web traffic, and so on. The Yan-kee Group reports that 66 percent of companies determine Web site success solelyby measuring the amount of traffic. New customer acquisition ranked second onthe list at 34 percent, and revenue generation ranked third at 23 percent.20


High

Effic

ienc

yLow

Low HighEffectiveness

Optimal areain which to

operate






Analyzing Web site traffic is one way organizations can understand the effective-ness of Web advertising. A cookie is a small file deposited on a hard drive by a Website containing information about customers and their Web activities. Cookies al-low Web sites to record the comings and goings of customers, usually without theirknowledge or consent. A click-through is a count of the number of people who visitone site and click on an advertisement that takes them to the site of the advertiser.A banner ad is a small ad on one Web site that advertises the products and servicesof another business, usually another dot-com business. Advertisers can track howoften customers click on banner ads resulting in a click-through to their Web site.Often the cost of the banner ad depends on the number of customers who click onthe banner ad. Tracking the number of banner ad clicks is a great way to begin tounderstand the effectiveness of the ad on its target audience.

Tracking effectiveness based on click-throughs guarantees exposure to targetads; however, it does not guarantee that the visitor liked the ad, spent any substan-tial time viewing the ad, or was satisfied with the information contained in the ad.In order to help understand advertising effectiveness, interactivity measures aretracked and monitored. Interactivity measures the visitor interactions with the tar-get ad. Such interaction measures include the duration of time the visitor spendsviewing the ad, the number of pages viewed, and even the number of repeat visitsto the target ad. Interactivity measures are a giant step forward for advertisers,since traditional methods of advertising through newspapers, magazines, outdoorsuch as billboards and buses, and radio and television provide no way to track effectiveness metrics. Interactivity metrics measure actual consumer activities,something that was impossible to do in the past and provides advertisers withtremendous amounts of useful information.

The ultimate outcome of any advertisement is a purchase. Knowing how manyvisitors make purchases on a Web site and the dollar amount of the purchases cre-ates critical business information. It is easy to communicate the business value ofa Web site or Web application when an organization can tie revenue amounts andnew customer creation numbers directly back to the Web site, banner ad, or Webapplication.

Behavioral Metrics

Firms can observe through click-stream data the exact pattern of a consumer’s nav-igation through a site. Click-stream data can reveal a number of basic data pointson how consumers interact with Web sites. Metrics based on click-stream data in-clude:

■ The number of page views (i.e., the number of times a particular page hasbeen presented to a visitor)

■ The pattern of Web sites visited, including most frequent exit page and mostfrequent prior Web sites

■ Length of stay on the Web site

■ Dates and times of visits

■ Number of registrations filled out per 100 visitors

■ Number of abandoned registrations

■ Demographics of registered visitors

■ Number of customers with shopping carts

■ Number of abandoned shopping carts

Figure 1.21 provides definitions of common metrics based on click-stream data. Tointerpret such data properly, managers try to benchmark against other companies.For instance, consumers seem to visit their preferred Web sites regularly, evenchecking back to the Web site multiple times during a given session. Consumerstend to become loyal to a small number of Web sites, and they tend to revisit thoseWeb sites a number of times during a particular session.





Evolving technologies are continually changing the speed and form of businessin almost every industry. Organizations spend an enormous amount of money onIT in order to remain competitive. Some organizations spend up to 50 percent oftheir total capital expenditures on IT investments. More than ever, there is a needto understand the payoff of these large IT investments, the impact on business per-formance, and the overall business value gained with the use of technology. One ofthe best ways to demonstrate business value is by analyzing an IT project’s effi-ciency and effectiveness metrics.


FIGURE 1.21

Web Site Metrics

Hits

Qualified hits

When visitors reach a Web site, their computer sends a request to thesite’s computer server to begin displaying pages. Each element of arequested page (including graphics, text, interactive items) is recorded bythe Web site’s server log file as a “hit.”

Exclude less important information recorded in a log file (such as errormessages, etc.).

Visitor Visitor Metrics

Exposure Exposure Metrics

Hit Hit Metrics

A visitor is an individual who visits a Web site. An “unidentified visitor”means that no information about that visitor is available.

A unique visitor is one who can be recognized and counted only oncewithin a given period of time. An accurate count of unique visitors is notpossible without some form of identification, registration, orauthentication.

A session ID is available (e.g., cookie) or inferred by incoming addressplus browser type, which allows a visitor’s responses to be tracked withina given visit to a Web site.

An ID (e.g., cookie) is available which allows a user to be tracked acrossmultiple visits to a Web site. No information, other than a uniqueidentifier, is available for a tracked visitor.

An ID is available (e.g., cookie or voluntary registration), which allows auser to be tracked across multiple visits to a Web site. Other information(name, demographics, possibly supplied voluntarily by the visitor) can belinked to this ID.

Unidentified visitor

Unique visitor

Session visitor

Tracked visitor

Identified visitor

The number of times a particular Web page has been viewed by visitorsin a given time period, without regard to duplication.

The number of visitor sessions at a Web site in a given time period,without regard to visitor duplication.

Page exposures(page-views)

Site exposures

The length of time a visitor spends on a Web site. Can be reported as anaverage in a given time period, without regard to visitor duplication.

The total number of pages a visitor is exposed to during a single visit to aWeb site. Can be reported as an average or distribution in a given timeperiod, without regard to visitor duplication.

The total number of unique pages a visitor is exposed to during a singlevisit to a Web site. Can be reported as an average or distribution in agiven time period, without regard to visitor duplication.

Visit Visit Metrics

Stickiness (visitduration time)

Raw visit depth (totalWeb pages exposureper session)

Visit depth (totalunique Web pagesexposure per session)






Jonathan Abrams is keeping quiet about how he is going to generate revenue from his Website, Friendster, which specializes in social networking. Abrams is a 33-year-old Canadiansoftware developer whose experiences include being laid off by Netscape and then movingfrom one start-up to another. In 2002, Abrams was unemployed, not doing well financially, andcertainly not looking to start another business when he developed the idea for Friendster. Hequickly coded a working prototype and watched in amazement as his Web site took off.

The buzz around social networking start-ups has recently been on the rise. A number ofhigh-end venture capital (VC) firms, including Sequoia and Mayfield, have invested more than$40 million into social networking start-ups such as LinkedIn, Spoke, and Tribe Networks.Friendster received over $13 million in VC capital from Kleiner, Perkins, Caufield, Byers, andBenchmark Capital, which reportedly valued the company at $53 million—a startling figure fora company that had yet to generate even a single dime in revenue.

A year after making its public debut, Friendster is one of the largest social networking Websites, attracting over 5 million users and receiving over 50,000 page-views per day. The ques-tion is how do efficiency metrics, such as Web traffic and page-views, turn into cash flow?Everyone is wondering how Friendster is going to begin generating revenue.

The majority of Abrams’s competitors make their money by extracting fees from their sub-scribers. Friendster is going to continue to let its subscribers meet for free but plans to chargethem for premium services such as the ability to customize their profile page. The companyalso has plans to extend beyond social networking to an array of value-added services suchas friend-based job referrals and classmate searches. Abrams is also looking into using hishigh-traffic Web site to tap into the growing Internet advertising market.

Abrams does not appear concerned about generating revenue or about potential competi-tion. He states, “Match.com has been around eight years, has 12 million users, and has spentmany millions of dollars on advertising to get them. We’re a year old, we’ve spent zero dollarson advertising, and in a year or less, we’ll be bigger than them—it’s a given.”

The future of Friendster is uncertain. Google recently offered to buy Friendster for $30 mil-lion even though there are signs, both statistical and anecdotal, that Friendster’s popularitymay have peaked.21

Questions1. How could you use efficiency IT metrics to help place a value on Friendster?2. How could you use effectiveness IT metrics to help place a value on Friendster?3. Explain how a venture capital company can value Friendster at $53 million when the

company has yet to generate any revenue. 4. Explain why Google would be interested in buying Friendster for $30 million when the

company has yet to generate any revenue.

Chapter Four Case: How Do You Value Friendster?

1. Formulate a strategy for how Levi’s can use efficiency IT metrics to improve its business.

2. Formulate a strategy for how Levi’s can use effectiveness IT metrics to improve its business.




5. Organizational Structures That Support Strategic Initiatives


Chapter Five: Organizational Structures That SupportStrategic Initiatives

LEARNING OUTCOMES

5.1. Compare the responsibilities of a chief informationofficer (CIO), chief technology officer (CTO), chiefprivacy officer (CPO), and chief security officer(CSO).

5.2. Explain the gap between IT people and businesspeople and the primary reason this gap exists.

5.3. Define the relationship between security andethics.

mployees across the organization must work closely together to developstrategic initiatives that create competitive advantages. Understanding thebasic structure of a typical IT department including titles, roles, and respon-

sibilities will help an organization build a cohesive enterprisewide team.

IT ROLES AND RESPONSIBILITIES

Information technology is a relatively new functional area, having only beenaround formally in most organizations for about 40 years or so. Therefore, job titles,roles, and responsibilities often differ dramatically from organization to organiza-tion. Nonetheless, there are some clear trends developing toward elevating some ITpositions within an organization to the strategic level.

Most organizations maintain positions such as chief executive officer (CEO),chief financial officer (CFO), and chief operations officer (COO) at the strategiclevel. Recently there are more IT-related strategic positions such as chief informa-tion officer (CIO), chief technology officer (CTO), chief security officer (CSO), andchief privacy officer (CPO).

The chief information officer (CIO) is a senior executive who (1) oversees all usesof information technology and (2) ensures the strategic alignment of IT with busi-ness goals and objectives. The CIO often reports directly to the CEO. CIOs must pos-sess a solid and detailed understanding of every aspect of an organization coupled

with tremendous insight into the capability of IT. Broadfunctions of a CIO include:


E

94%

92

89

87

83

66

64

45

Percentage CIO’s Concerns

Enhancing customer satisfaction

Security

Technology evaluation

Budgeting

Staffing

ROI analysis

Building new applications

Outsourcing hosting

1. Manager—ensuring the delivery of all IT projects,on time and within budget.

2. Leader—ensuring that the strategic vision of IT is inline with the strategic vision of the organization.

3. Communicator—building and maintaining strongexecutive relationships.

Although CIO is considered a position within IT, CIOsmust be concerned with more than just IT. According to a recent survey (see Figure 1.22), most CIOs ranked “en-hancing customer satisfaction” ahead of their concerns

FIGURE 1.22

What Concerns CIOsthe Most?





for any specific aspect of IT. CIOs with the broad business view that customer satis-faction is more crucial and critical than specific aspects of IT should be applauded.22

The chief technology officer (CTO) is a senior executive responsible for ensuringthe throughput, speed, accuracy, availability, and reliability of an organization’s infor-mation technology. CTOs are similar to CIOs, except that CIOs take on the additionalresponsibility for effectiveness of ensuring that IT is aligned with the organization’sstrategic initiatives. CTOs have direct responsibility for ensuring the efficiency of ITsystems throughout the organization. Most CTOs possess well-rounded knowledgeof all aspects of IT, including hardware, software, and telecommunications.

The chief security officer (CSO) is a senior executive responsible specifically forensuring the security of IT systems and developing strategies and IT safeguardsagainst attacks from hackers and viruses. The role of a CSO has been elevated in re-cent years because of the number of attacks from hackers and viruses. Most CSOspossess detailed knowledge of networks and telecommunications as hackers andviruses usually find their way into IT systems through networked computers.

The chief privacy officer (CPO) is a senior executive responsible for ensuring theethical and legal use of information within an organization. CPOs are the newestsenior executive position in IT. In 2001, 150 of the Fortune 500 companies addedthe CPO position to their list of senior executives. Not surprising, many CPOs arelawyers by training, enabling them to understand the often complex legal issuessurrounding the use of information.

All the above IT positions and responsibilities are critical to an organization’s suc-cess. While many organizations may not have a different individual for each of thesepositions, they must still have leadership in place taking responsibility for all theseareas of concern. Employees must seek the guidance and support of the individualsin these roles who are responsible for enterprisewide IT and IT-related issues.

THE GAP BETWEEN BUSINESS PERSONNEL AND IT PERSONNEL

One of the greatest challenges today is effective communication between businesspersonnel and IT personnel. Business personnel possess expertise in functional ar-eas such as marketing, accounting, sales, and so forth. IT personnel have the tech-nological expertise. Unfortunately, there often exists something of a communica-tions gap between the two. IT personnel have their own vocabularies consisting ofacronyms and technical terms. Business personnel have their own vocabulariesbased on their experience and expertise. Effective communication between busi-ness and IT personnel should be a two-way street with each side making the effortto better understand the other (including written and oral communication).

Business personnel must seek to achieve an increased level of understanding of IT. Although they do not need to know every technical detail, it will be beneficialto business personnel’s careers to understand what they can and cannot accom-plish using IT. There are numerous business-oriented IT magazines including InformationWeek and CIO that business managers and leaders can read to increasetheir IT knowledge.

At the same time, an organization must develop strategies for integrating its ITpersonnel into the various business functions. All too often, IT personnel are leftout of strategy meetings because “they do not understand the business so they willnot add any value.” That is a dangerous position to take. If IT personnel are not go-ing to understand the business, how is the organization going to determine whichtechnologies can benefit (or hurt) the business? On the other hand, with a little ef-fort to communicate, by providing information on the functionality available inCRM systems, IT personnel might greatly enhance a meeting about how to improvecustomer service. Working together, business and IT personnel have the potentialto create customer-service competitive advantages.

It is the responsibility of the CIO to ensure effective communications betweenbusiness and IT personnel. While the CIO assumes the responsibility on an enter-prisewide level, it is each employee’s responsibility to see to it that the business andIT sides of an organization are communicating effectively.






FUNDAMENTAL SUPPORT STRUCTURES—ETHICS AND SECURITY

Ethics and security are two fundamental building blocks that organizations mustbase their businesses on. In recent years, such events as the Enron and MarthaStewart fiascos along with 9/11 have shed new light on the meaning of ethics andsecurity. When the behavior of a few individuals can literally destroy billion dollarorganizations because of a lapse in ethics or security, the value of highly ethical andhighly secure organizations should be evident. It is recommended to review theEthics and Security plug-ins to gain a detailed understanding of these topics. Dueto the importance of these topics, they will be readdressed throughout this text.

Ethics

Ian Clarke, the inventor of a file-swapping service called Freenet, decided to leavethe United States for the United Kingdom, where copyright laws are more lenient.Wayne Rosso, the inventor of a file-sharing service called Grokster, decided to leavethe United States for Spain, again saying goodbye to tough United States copyrightprotections. File sharing encourages a legal network of shared thinking that can improve drug research, software development, and the flow of information. TheUnited States copyright laws, designed decades before the Internet was ever in-vented, make file sharing and many other Internet technologies illegal.23

The ethical issues surrounding copyright infringement and intellectual propertyrights are consuming the e-business world. Advances in technology are making iteasier and easier for people to copy everything from music to pictures. Technologyposes new challenges for our ethics—the principles and standards that guide ourbehavior toward other people. Review Figure 1.23 for an overview of concepts,terms, and ethical issues stemming from advances in technology.

In today’s electronic world, privacy has become a major ethical issue. Privacy isthe right to be left alone when you want to be, to have control over your own per-sonal possessions, and not to be observed without your consent. Some of the mostproblematic decisions organizations face lie in the murky and turbulent waters ofprivacy. The burden comes from the knowledge that each time employees make adecision regarding issues of privacy, the outcome could sink the company some day.

The SEC began inquiries into Enron’s accounting practices on October 22, 2001.David Duncan, the Arthur Andersen partner in charge of Enron, instructed histeam to begin destroying paper and electronic Enron-related records on October23, 2001. Kimberly Latham, a subordinate to Duncan, sent instructions on October24, 2001, to her entire team to follow Duncan’s orders and even compiled a list ofcomputer files to delete. Arthur Andersen blames Duncan for destroying thousandsof Enron-related documents. Duncan blames the Arthur Andersen attorney, NancyTemple, for sending him a memo instructing him to destroy files. Temple blamesArthur Andersen’s document deletion policies.24

Regardless of who is to blame, the bigger issue is that the destruction of files af-ter a federal investigation has begun is both unethical and illegal. A direct corporateorder to destroy information currently under federal investigation can pose a realdilemma for any professional. Comply, and you participate in potentially criminalactivities; refuse, and you might find yourself looking for a new job.

Privacy is one of the biggest ethical issues facing organizations today. Trust between companies, customers, partners, and suppliers is the support structure of


FIGURE 1.23

Ethical IssuesStemming fromTechnology Advances

Intellectual property Intangible creative work that is embodied in physical form.

Copyright The legal protection afforded an expression of an idea, such as a song,video game, and some types of proprietary documents.

Fair use doctrine In certain situations, it is legal to use copyrighted material.

Pirated software The unauthorized use, duplication, distribution, or sale of copyrightedsoftware.

Counterfeit software Software that is manufactured to look like the real thing and sold as such.





the e-business world. One of the main ingredients in trust is privacy. Widespreadfear about privacy continues to be one of the biggest barriers to the growth of e-business. One way or another, people are concerned their privacy will be violatedas a consequence of interactions on the Web. Unless an organization can effectivelyaddress this issue of privacy, its customers, partners, and suppliers may lose trustin the organization, which in effect hurts its business. Figure 1.24 displays the re-sults from a recent CIO survey as to how privacy issues lose trust for e-business.25


FIGURE 1.24

Primary ReasonsPrivacy Issues LoseTrust for E-Business

1. Loss of personal privacy is a top concern for Americans in the 21st century.

2. Among Internet users, 37 percent would be “a lot” more inclined to purchase a product on aWeb site that had a privacy policy.

3. Privacy/security is the #1 factor that would convert Internet researchers into Internet buyers.

Primary Reasons Privacy Issues Lose Trust for E-Business

Security

Organizational information is intellectual capital. Just as organizations protecttheir assets—keeping their money in an insured bank or providing a safe workingenvironment for employees—they must also protect their intellectual capital. Anorganization’s intellectual capital includes everything from its patents to its trans-actional and analytical information. With security breaches on the rise and hackerseverywhere, an organization must put in place strong security measures to survive.

The Health Insurance Portability and Accountability Act (HIPAA) protects theprivacy and security of personal health records and has the potential to impactevery business in the United States. HIPAA affects all companies that use electronicdata interchange (EDI) to communicate personal health records. HIPAA requireshealth care organizations to develop, implement, and maintain appropriate secu-rity measures when sending electronic health information. Most important, theseorganizations must document and keep current records detailing how they are per-forming security measures for all transmissions of health information. On April 21,2005, security rules for HIPAA will become enforceable by law.

According to recent Gartner polls, less than 10 percent of all health care organi-zations have begun to implement the security policies and procedures required byHIPAA. The Health Information Management Society estimates that 70 percent ofall health care providers failed to meet the April 2003 deadline for privacy rule com-pliance. Health care organizations need to start taking HIPAA regulations seriouslysince noncompliance can result in substantial fines and even imprisonment.26

Beyond the health care industry, all businesses must understand the importanceof information security, even if it is not enforceable by law. Information securityis a broad term encompassing the protection of information from accidental or intentional misuse by persons inside or outside an organization. With current advances in technologies and business strategies such as CRM, organizations areable to determine valuable information—such as who are the top 20 percent oftheir customers who produce 80 percent of their revenues. Most organizations viewthis type of information as valuable intellectual capital and they are implementingsecurity measures to prevent the information from walking out the door or fallinginto the wrong hands.

Adding to the complexity of information security is the fact that organizationsmust enable employees, customers, and partners to access all sorts of informationelectronically to be successful. Doing business electronically automatically createstremendous information security risks for organizations. There are many technicalaspects of security, but the biggest information security issue is not technical, but apeople issue. Most information security breaches result from people misusing anorganization’s information either intentionally or inadvertently. For example, manyindividuals freely give up their passwords or leave them on sticky notes next to theircomputers, leaving the door wide open to intruders.





Figure 1.25 displays the typical size of an organization’s information securitybudget relative to the organization’s overall IT budget from the CSI/FBI 2004 Com-puter Crime and Security Survey. Forty-six percent of respondents indicated thattheir organization spent between 1 and 5 percent of the total IT budget on security.Only 16 percent indicated that their organization spent less than 1 percent of the ITbudget on security.

Figure 1.26 displays the spending per employee on computer security brokendown by both public and private industries. The highest average computer securityspending per employee ($608) was found in the transportation industry. The high-est average computer security operating expenditures per employee was found inthe federal government ($261).27

Security is perhaps the most fundamental and critical of all the technologies/disciplines an organization must have squarely in place in order to execute its busi-ness strategy. Without solid security processes and procedures, none of the othertechnologies can develop business advantages.


Unknown%

Less than 1%

Perc

enta

ge o

f IT

Bud

get

1–2%

3–5%

6–7%

8–10%

More than 10%

0% 5% 10% 15%Percentage of Respondents

Percentage of IT Budget Spent on Information Security

20% 30%25%

Medical

0 100 200 300Number of Employees

Average Reported Computer SecurityExpenditure/Investment per Employee

40050 150 250 350 450 500

Retail

Local government

Manufacturing

Educational

Utility

Legal

Other

State government

Financial

Investment/employee

High-tech

Telecommunications

Federal government

Transportation

Operating expense/employee

FIGURE 1.25

OrganizationalSpending onInformation Security

Source: Computer SecurityInstitute

FIGURE 1.26

Computer SecurityExpenditures/Investments





Perceptive CIOs recognize that rewards come from implementing effective solutions for notonly their own organizations but also their customers’ organizations. This concept is knownas CCRM—customer’s customer relationship management. It is a balancing act.

Ticketmaster, one of the world’s largest ticket vendors, has two sets of customers: (1) thepeople who actually buy the tickets, and (2) the stadiums, venues, teams, leagues, bands andacts that sell the tickets. Ticketmaster’s CIO Sean Moriarty often finds himself dealing with thechallenge of meeting the needs of both sets of customers.

Moriarty’s challenge is to convince his customers to give him access to their customers soTicketmaster can serve both. For example, when Ticketmaster sells tickets to a Knicks gameat Madison Square Garden, it would also like to book dinner for that customer at a restaurantclose to the venue. This might be nice for the ticket buyer. The dilemma is that the primary cus-tomer in this example, Madison Square Garden, might not benefit from adding additional valuefor its customers since dinner could cut into lucrative concession sales at the sporting event.On the other hand, the Garden and the Knicks will be better off if the fans have an excellentexperience and come to more games.

Almost all organizations in every industry face this type of channel conflict. With the ad-vancements in technology it is now even easier for channel conflicts (and opportunities) toarise. For example, many brokers will think twice before giving detailed information abouttheir customers to a mutual fund. The mutual fund would benefit greatly from marketing di-rectly to the customers; however, the brokers would not want the competition. In the informa-tion age advantages and opportunities abound—but so do threats—posing challenges andcalling for strategic management.

Today, CIOs must become advocates of collaborative initiatives to be successful. CIOsmust convince their customers to co-invest with them. Ironically, a successful collaborativeinitiative may take some revenue away from a customer in the short run. If customers do not


Chapter Five Case: CCRM—Customer’s CustomerRelationship Management

1. Predict what might have happened to Levi’s if its top executives had not supported invest-ments in IT.

2. David Bergen, Levi’s CIO, put together a cross-functional team of key managers from IT, fi-nance, and sales to transform Levi’s systems to meet Wal-Mart’s requirements. Analyze therelationships between these three business areas and determine why Bergen chose themto be a part of his cross-functional team.

3. Explain why it would be unethical for Wal-Mart to sell Levi’s jeans sales information to an-other jeans manufacturer.

4. Evaluate the ramifications for Wal-Mart’s business if it failed to secure its partner’s infor-mation and all sales information for all products were accidentally posted to an anonymousWeb site.






see any larger benefits, the collaboration may collapse. If Ticketmaster began selling BigHead Todd albums online as well as concert tickets, chances are the promoter and the recordcompany would be furious with the intermediary for stepping on what they consider their ter-ritory.

The key to successfully implementing strategic initiatives (managing customers’ customerrelationships) is to ensure that the benefits for all parties significantly outweighs the costs.28

Questions1. Describe the dilemma an organization faces when attempting to access its customer’s

customers.2. Compare customer relationship management and customer’s customer relationship

management.3. Explain why directly accessing a customer’s customer is considered unethical.4. Assess the adverse impact to Ticketmaster if it failed to ensure the security of its cus-

tomer information such as credit card numbers.


>>

PLUG-IN POINTERS >>

Review the Business Plug-In Information Security for an overview ofsecurity issues and features including information security policiesand plans, hackers, viruses, public key encryption, digital certificates,digital signatures, firewalls, and authentication, authorization, anddetection and response technologies.

Review the Business Plug-In Ethics for an overview of privacy laws,ethical computer use policy, Internet use policy, information privacypolicy, acceptable use policy, e-mail privacy policy, anti-spam policy,monitoring technologies, and monitoring polices.


II. Managing Information for Business Initiatives

6. Valuing Organizational Information


Chapter Six: Valuing Organizational Information

54 Unit 2 Managing Information for Business Initiatives*

LEARNING OUTCOMES

6.1. Describe the broad levels, formats, andgranularities of information.

6.2. Differentiate between transactional and analyticalinformation.

6.3. List, describe, and provide an example of each ofthe five characteristics of high-quality information.

6.4. Assess the impact of low-quality information on anorganization and the benefits of high-qualityinformation on an organization.

oogle recently reported a 200 percent increase in sales of its new EnterpriseSearch Appliance tool released in 2002. Companies use the tool within anenterprise information portal (EIP) to search corporate information for an-

swers to customer questions and to fulfill sales orders. Hundreds of Google’s cus-tomers are already using the tool—Xerox, Hitachi Data Systems, Nextel Communi-cations, Procter & Gamble, Discovery Communications, Cisco Systems, Boeing.The ability to search, analyze, and comprehend information is vital for any organi-zation’s success. The incredible 200 percent growth in sales of Google’s new SearchAppliance tool is a strong indicator that organizations are coveting technologiesthat help organize and provide access to information.5

Information is everywhere in an organization. When addressing a significantbusiness issue, employees must be able to obtain and analyze all the relevant infor-mation so they can make the best decision possible. Organizational informationcomes at different levels and in different formats and “granularities.” (Granularitymeans fine and detailed or “coarse” and abstract information.) Employees must beable to correlate the different levels, formats, and granularities of information whenmaking decisions. For example, if employees are using a supply chain managementsystem to make decisions, they might find that their suppliers send information indifferent formats granularity at different levels. One supplier might send detailedinformation in a spreadsheet, another supplier might send summary informationin a Word document, and still another might send aggregate information from adatabase. Employees will need to compare these different types of information forwhat they commonly reveal to make strategic SCM decisions. Figure 2.2 displaystypes of information found in organizations.

Successfully collecting, compiling, sorting, and finally analyzing informationfrom multiple levels, in varied formats, exhibiting different granularity can providetremendous insight into how an organization is performing. Taking a hard look atorganizational information can yield exciting and unexpected results such as po-tential new markets, new ways of reaching customers, and even new ways of doingbusiness.

Samsung Electronics took a detailed look at over 10,000 reports from its resellersto identify “lost deals” or orders lost to competitors. The analysis yielded the en-lightening result that 80 percent of lost sales took place in a single business unit, the

G





health care industry. Furthermore, Samsung was able to identify that 40 percent ofits lost sales in the health care industry were going to one particular competitor.Prior to performing the analysis, Samsung was heading into its market blind.Armed with this valuable information, Samsung is changing its selling strategy inthe health care industry to recoup its losses by implementing a new strategy towork more closely with hardware vendors to win back lost sales.6

Not all companies are successful when it comes to managing information. Sta-ples, the office-supplies superstore, opened its first store in 1986 with state-of-the-art technology. The company experienced rapid growth and soon found itselfoverwhelmed with the resulting volumes of information. The state-of-the-art tech-nology quickly became obsolete and the company was unable to obtain any insightinto its massive volumes of information. A simple query such as identifying the cus-tomers who purchased a computer, but not software or peripherals, took hours.Some of the queries required several days to complete and by the time the man-agers received answers to their queries it was too late.7

After understanding the different levels, formats, and granularities of informa-tion, it is important to look at a few additional characteristics that help determinethe value of information. These characteristics include transactional, analytical,timeliness, and quality.

THE VALUE OF TRANSACTIONAL AND ANALYTICAL INFORMATION

Transactional information encompasses all of the information contained within asingle business process or unit of work and its primary purpose is to support theperforming of daily operational tasks. Examples of using transactional informationare withdrawing cash from an ATM, making an airline reservation, or purchasingstocks. Organizations capture and store transactional information in databases,and they use it when performing operational tasks and repetitive decisions such asanalyzing daily sales reports and production schedules to determine how much in-ventory to carry.

Unit 2 Managing Information for Business Initiatives 55*

FIGURE 2.2

Levels, Formats, andGranularities ofOrganizationalInformation

Individual

Department

Enterprise

Document

Presentation

Spreadsheet

Database

Detail (Fine)

Summary

Aggregate (Course)

InformationLevels

InformationTypes Range Examples

Individual knowledge, goals, and strategies

Departmental goals, revenues, expenses, processes,and strategies

Enterprisewide revenues, expenses, processes, andstrategies

Letters, memos, faxes, e-mails, reports, marketingmaterials, and training materials

Product, strategy, process, financial, customer, andcompetitor presentations

Sales, marketing, industry, financial, competitor,customer, and order spreadsheets

Customer, employee, sales, order, supplier, andmanufacturer databases

Reports for each sales person, product, and part

Reports for all sales personnel, all products, and allparts

Reports across departments, organizations, andcompanies

InformationFormats

InformationGranularities





Analytical information encompasses all organizational information and its pri-mary purpose is to support the performing of managerial analysis tasks. Analyticalinformation includes transactional information along with other information suchas market and industry information. Examples of analytical information includetrends, sales, product statistics, and future growth projections. Analytical informa-tion is used when making important ad hoc decisions such as whether the organi-zation should build a new manufacturing plant or hire additional sales personnel.

THE VALUE OF TIMELY INFORMATION

The need for timely information can change for each business decision. Some decisions require weekly or monthly information while other decisions requiredaily information. Timeliness is an aspect of information that depends on the situ-ation. In some industries, information that is a few days or weeks old can be rele-vant while in other industries information that is a few minutes old can be almostworthless. Some organizations, such as 911 centers, stock traders, and banks, re-quire consolidated, up-to-the-second information, 24 hours a day, 7 days a week.Other organizations, such as insurance and construction companies, require onlydaily or even weekly information.

Real-time information means immediate, up-to-date information. Real-timesystems provide real-time information in response to query requests. Many orga-nizations use real-time systems to exploit key corporate transactional information.In a December 2003 survey of 700 IT executives by Evans Data Corp., 48 percent ofrespondents said they were already analyzing information in or near real-time, andanother 25 percent reported plans to add real-time systems.8

Real-time systems provide valuable information for supporting corporate strate-gies such as customer relationship management. Bell Mobility Inc., Canada’slargest wireless carrier, staffs over 550 customer service representatives and usesE.piphany Inc.’s Real-Time tool to make the right customer offers at the right timewithout having to rely on guesswork. Figure 2.3 display’s Bell Mobility’s results fromthe first month after implementation of the Real-Time tool.9

The growing demand for real-time information stems from organizations’ needto make faster and more effective decisions, keep smaller inventories, operate moreefficiently, and track performance more carefully. But timeliness is relative. Organi-zations need fresh, timely information to make good decisions. Information alsoneeds to be timely in the sense that it meets employees’ needs—but no more. If em-ployees can absorb information only on an hourly or daily basis, there is no need togather real-time information in smaller increments. For example, MBIA InsuranceCorp. uses overnight updates to feed its real-time systems. Employees use this in-formation to make daily risk decisions for mortgages, insurance policies, and otherservices. The company found that overnight updates were sufficient, as long asusers could gain immediate access to the information they needed to make busi-ness decisions during the day.10

Most people request real-time information without understanding one of thebiggest pitfalls associated with real-time information—continual change. Imaginethe following scenario: Three managers meet at the end of the day to discuss a busi-ness problem. Each manager has gathered information at different times duringthe day to create a picture of the situation. Each manager’s picture may be differentbecause of this time discrepancy. Their views on the business problem may not


Bell Mobility’s Real-Time Tool ResultsFIGURE 2.3

Results from BellMobility’s Real-TimeTool

■ 18 percent increase in sales per hour

■ 16 percent increase in total inbound marketing revenue

■ 75 percent decrease in total time to create and deploy a new marketing campaign





match since the information they are basing their analysis on is continually chang-ing. This approach may not speed up decision making, and in fact it may slow itdown.

The timeliness of the information required must be evaluated for each businessdecision. Organizations do not want to find themselves in the position of usingreal-time information to make a bad decision faster.

THE VALUE OF QUALITY INFORMATION

Westpac Financial Services (WFS), one of the four major banks in Australia, servesmillions of customers from its many core systems, each with its own database. Thedatabases maintain information and provide users with easy access to the storedinformation. Unfortunately, the company failed to develop information capturingstandards, which led to inconsistent organizational information. For example, onesystem had a field to capture e-mail addresses while another system did not. Dupli-cate customer information among the different systems was another major issueand the company continually found itself sending conflicting or competing mes-sages to customers from different operations of the bank. A customer could alsohave multiple accounts within the company, one representing a life insurance pol-icy and one representing a credit card. WFS had no way to identify that the two dif-ferent customer accounts were for the same customer.

WFS had to solve its information quality problems immediately if it was to re-main competitive. The company purchased NADIS (Name & Address Data IntegritySoftware), a software solution that filters customer information, highlighting miss-ing, inaccurate, and redundant information. Customer service ratings are on therise for WFS now that the company can operate its business with a single and com-prehensive view of each one of its customers.11

Business decisions are only as good as the quality of the information used tomake the decisions. Review Figure 2.4 for an overview of five characteristics com-mon to high-quality information: accuracy, completeness, consistency, unique-ness, and timeliness. Figure 2.5 highlights several issues with low-quality informa-tion including:

■ The first issue is missing information. The customer’s first name is missing.(See #1 in Figure 2.5.)

■ The second issue is incomplete information since the street address containsonly a number and not a street name.

■ The third issue is a probable duplication of information since the only slightdifference between the two customers is the spelling of the last name. Streetaddresses and phone numbers being the same make this likely.


FIGURE 2.4

The Five CommonCharacteristics of High-Quality Information

Characteristics of High-Quality Information

Accuracy Are all the values correct? For example, is the name spelled correctly? Is thedollar amount recorded properly?

Completeness Are any of the values missing? For example, is the address complete includingstreet, city, state, and zip code?

Consistency Is aggregate or summary information in agreement with detailed information?For example, do all total fields equal the true total of the individual fields?

Uniqueness Is each transaction, entity, and event represented only once in the information?For example, are there any duplicate customers?

Timeliness Is the information current with respect to the business requirements? Forexample, is information updated weekly, daily, or hourly?





■ The fourth issue is potential wrong information because the customer’sphone and fax numbers are the same. Some customers might have the samenumber for phone and fax line, but the fact that the customer also has thisnumber in the e-mail address field is suspicious.

■ The fifth issue is definitely an example of inaccurate information since aphone number is located in the e-mail address field.

■ The sixth issue is incomplete information since there is not a valid area codefor the phone and fax numbers.

Recognizing how low-quality information issues occur will allow organizationsto begin to correct them. The four primary sources of low-quality information are:

1. Online customers intentionally enter inaccurate information to protect theirprivacy.

2. Information from different systems that have different information entrystandards and formats.

3. Call center operators enter abbreviated or erroneous information by accidentor to save time.

4. Third party and external information contains inconsistencies, inaccuracies,and errors.12

Addressing the above sources of information inaccuracies will significantly im-prove the quality of organizational information and the value that can be extractedfrom the information.

Understanding the Costs of Low-Quality Information

Using the wrong information can lead to making the wrong decision. Making thewrong decision can cost time, money, and even reputations. Every business deci-sion is only as good as the information used to make the decision. Bad informationcan cause serious business ramifications such as:

■ Inability to accurately track customers, which directly affects strategic initia-tives such as CRM and SCM.

■ Difficulty identifying the organization’s most valuable customers.

■ Inability to identify selling opportunities and wasted revenue from marketingto nonexisting customers and nondeliverable mail.

■ Difficulty tracking revenue because of inaccurate invoices.

■ Inability to build strong relationships with customers—which increases theirbuyer power.

FIGURE 2.5

Low-QualityInformation Example


113114115116

SmithJonesRobertsRobert

FirstName City

JeffJennyJenny

1. Missing information (no first name)

3. Probable duplicate information (similar names, same address, phone number)

4. Potential wrong information (are the phone and fax numbers the same or is this an error?)

5. Inaccurate information (invalid e-mail)

6. Incomplete information (missing area codes)

Street

123 S. Main12A1244 Colfax1244 Colfax

DenverDenverDenverDenver

State

COCO COCO

Zip

80210802248523185231

Phone

(303) 777-1258(303) 666-6868759-5654759-5654

Fax

(303) 777-5544(303) 666-6868853-6584853-6584

E-mail

[email protected](303) [email protected]@msn.com

IDLast

Name

2. Incomplete information (no street)





The Alaska Department of Fish and Game requires high-quality information to manage thestate’s natural resources, specifically to increase fishing yields, while ensuring the future ofmany species. Using fish counts the department makes daily decisions as to which districtswill be open or closed to commercial fishing. If the department receives low-quality informa-tion from fish counts then either too many fish escape or too many are caught. Allowing toomany salmon to swim upstream could deprive fishermen their livelihoods. Allowing too manyto be caught before they swim upstream to spawn could diminish fish populations—yieldingdevastating effects for years to come.

Because of the incredible size of Alaskan fisheries, the Commercial Fisheries Division’s de-cisions have global impact. Its information is relied upon by individual fishermen who want to


Chapter Six Case: Fishing for Quality

Understanding the Benefits of High-Quality Information

High-quality information can significantly improve the chances of making a gooddecision and directly increase an organization’s bottom line. Lillian Vernon Corp., acatalog company, used Web analytics to discover that men preferred to shop at Lil-lian Vernon’s Web site instead of looking through its paper catalog. Based on this in-formation, the company began placing male products more prominently on itsWeb site and soon realized a 15 percent growth in sales to men.13

Another company discovered that Phoenix, Arizona, is not a good place to sellgolf clubs, even with its high number of golf courses. An analysis revealed that typ-ical golfers in Phoenix are either tourists or conventioneers. These golfers usuallybring their clubs with them while visiting Phoenix. The analysis further revealedthat two of the best places to sell golf clubs in the United States are Rochester, NewYork, and Detroit, Michigan.14

There are numerous examples of companies that have used their high-quality information to make solid strategic business decisions. High-quality information ofcourse does not automatically guarantee that every decision made is going to be agood one, since people ultimately make decisions. But high-quality information ensures that the basis of the decisions is accurate. The success of the organization depends on appreciating and leveraging the true value of timely and high-quality information.

1. Determine if Google’s search results are examples of transactional information or analyti-cal information.

2. Describe the ramifications on Google’s business if the search information it presented toits customers was of low quality.

3. Review the five common characteristics of high-quality information and rank them in orderof importance to Google’s business.

4. Explain how the Web site RateMyProfessors.com solved its problem of low-quality infor-mation.






know the best places to fish, by corporations around the world that need information on whichto base business strategies for seafood processing and marketing, by researchers, and bylegislators. With so much at stake, the Division of Commercial Fisheries set out to improve thequality of its information by implementing a system that can gather the information from re-mote parts of the state and analyze it quickly to determine the daily outcomes.

Originally, the department captured information in spreadsheets that were e-mailed fromstation to station before being entered into the system. There was no central information setto work from, and more often than not, the information was low quality. Decisions were basedon inaccurate and, because of delays in posting, untimely information.

With the implementation of an Oracle database, the department significantly improved thequality and timeliness of its information. Each time a commercial fishing boat within Alaska’sjurisdiction unloads at a processing plant, the catch is weighed and details of the catch, suchas species caught, weight, and quantity, are recorded on a fish ticket. This information is en-tered into the new system. To gather fish escapement information from remote areas, fieldworkers positioned in towers scan rivers to visibly count fish. This information is radioed in thenext morning.

Information from fish processed the previous day is keyed in by 10:00 A.M., and one hourlater, the managers and fisheries across the state have all the information they require tomake accurate decisions. They then announce on the radio and on their Web site, which re-ceives more that 3,000 hits on an average day, whether or not fishermen can fish that day.

Fisheries are now managed with timely, centralized, and accurate information. Web pagessummarize daily catches for certain areas, like Bristol Bay, whose annual Sockeye Salmonseason, which lasts only a few weeks, is closely monitored by fish processors worldwide.With the enormous quantities of fish caught, salmon fisheries worldwide adjust their produc-tion levels based on the results of the annual Bristol Bay Sockeye Salmon season. This is justone reason why producing fast, high-quality information is critical to managing Alaska’s nat-ural resources.15

Questions1. Describe the difference between transactional and analytical information and deter-

mine which type the Alaska Department of Fish and Game is using to make decisions.2. Explain the importance of high-quality information for the Alaska Department of Fish

and Game.3. Review the five common characteristics of high-quality information and rank them in

order of importance for the Alaska Department of Fish and Game.



Technology Plug−ins T2. Networks and Telecommunications


384 Plug-In T2 Networks and Telecommunications*

P L U G - I N

T2 Networks andTelecommunications

1. Summarize the individual components of a computer network.2. Describe the three main network topologies.3. Explain the difference between the three main forms of network access methods.4. Summarize the difference between guided media and unguided media.5. Explain how a network operating system works.6. List the transmitting and receiving devices used in a computer network. 7. Describe the function of TCP/IP.8. Summarize the use of a virtual private network (VPN).

IntroductionA computer network (or just network) is a group of two or more computer systemslinked together using wires or radio waves over a geographical area. Computer net-works that do not use physical wires are called wireless—one of the fastest growingareas in IT and business.

In the business world, a computer network is more than a collection of intercon-nected devices. For many businesses, the computer network is the resource thatenables them to gather, analyze, organize, and disseminate information that is es-sential to their profitability. The rise of intranets and extranets—business networksbased on Internet technology—is an indication of the critical importance of com-puter networking to businesses.

Networks now take a whole variety of forms—they can exist within an entirebuilding, a city, a country, or the world. There are networks that access each otherat will or at the whim of individual users who can connect to them any time overtelephone lines or a wireless satellite link.

This plug-in takes a detailed look at the key concepts that are integrating com-puter networks and data communications into the business world.

LEARNING OUTCOMES




The Need for NetworkingOn the most fundamental level, a computer network interconnects a collection ofdevices that enables the storage, retrieval, and sharing of information. Commonlyconnected devices include personal computers, printers, pagers, and various data-storage devices. Recently, other types of devices have become network con-nectable, including interactive televisions, videophones, hand-held devices, andnavigational environmental control systems.

A network provides two principle benefits: the ability to communicate and theability to share. A network supports communication among users in ways thatother media cannot. E-mail, the most popular form of network communication,provides low-cost, printable correspondence with the capability for forwarding, acknowledgment, storage, retrieval, and attachment. Sharing involves not only information (database records, e-mail, graphics, etc.), but also resources (applica-tions, printers, modems, disk space, scanners, etc.).

Through its ability to share, a network promotes collaboration. This is the mainattraction of software called groupware that is designed to allow multiple users tohold electronic meetings and work concurrently on projects. Groupware is soft-ware that supports team interaction and dynamics including calendaring, schedul-ing, and videoconferencing.

THE BENEFITS OF COMPUTER NETWORKING

The most obvious benefit of computer networking is that it can store virtually anykind of information at, and retrieve it from, a central location on the network aswell as access it from any connected computer. Anyone can store, retrieve, andmodify textual information such as letters and contracts, audio information such asvoice messages, and visual images such as facsimiles, photographs, medical X rays,and even video segments.

A network also combines the power and capabilities of diverse equipment pro-viding a collaborative medium to combine the skills of different people, regardlessof physical location. Networking enables people to share information and ideaseasily, so they can work more efficiently and productively. Networks also improvecommercial activities such as purchasing, selling, and customer service (B2B andB2C activities). Networks are making traditional business processes more efficient,more manageable, and less expensive.

NETWORKING BASICS

Information travels over the cables (unless the network is wireless), allowing net-work users to exchange documents and data with each other, print to the sameprinters, and generally share hardware or software that is connected to the net-work. Each computer, printer, or other peripheral device that is connected to thenetwork is called a node. Networks can have tens, thousands, or even millions ofnodes.

Networks are assembled according to certain rules. Cabling, for example, has tobe a certain length; each cabling strand can support only a certain amount of net-work traffic. Topology refers to the actual physical organization of the computers(and other network devices) including connections. Bandwidth indicates howmuch information can be carried in a given time period (usually a second) over awired or wireless communications link. Speed is expressed as megabits per second(or mbps), where one “bit” (short for binary digit) is the smallest unit of data in acomputer. A bit has a single binary value, either 0 or 1.

For historical reasons, the network industry refers to nearly every type of net-work as an “area network.” The most commonly discussed categories of computernetworks include the following:

Plug-In T2 Networks and Telecommunications 385*

*




■ Local Area Network (LAN)

■ Wide Area Network (WAN)

■ Metropolitan Area Network (MAN)

A local area network (LAN) connects network devices over a relatively short dis-tance, such as a building or a campus, whereas a wide area network (WAN) is a geographically dispersed telecommunications network, such as the Internet. LANSand WANS (see Figure T2.1) are the most often referred to of the network designs.The concept of “area” makes good sense because a key distinction between a LANand a WAN involves the physical distance that the network spans. A third category,equally popular, is the metropolitan area network (MAN) that interconnects userswith computer resources in a geographic area or region larger than that covered byeven a large local area network, but smaller than the area covered by a wide areanetwork. In terms of geographic breadth, MANs are larger than LANs, but smallerthan WANs.

Local Area Network (LAN) Basics

A LAN connects network devices over a relatively short distance. A networked officebuilding, school, or home usually contains a single LAN, although sometimes onebuilding will contain a few small LANs, and occasionally a LAN will span a group ofnearby buildings.

FIGURE T2.1

Wide Area Network,Local Area Network,and Metropolitan AreaNetwork Diagram


Network

BOSTON

Network

LOS ANGELESNetwork

DENVER

WAN

LAN

LOCAL LIBRARY

LAN

Network

LOCAL LIBRARY

Network

LOCAL RESEARCHFACILITY

Network

LOCALCORPORATE

OFFICE

MAN




Wide Area Network (WAN) Basics

As the term implies, a wide area network spans a large physical distance. The Inter-net is a WAN that spans most of the world. A wide area network is a geographicallydispersed telecommunications network. The term distinguishes a broader tele-communications structure from a local area network. A wide area network may beprivately owned or rented, but the term usually implies the inclusion of public(shared user) networks.

Metropolitan Area Network (MAN) Basics

A MAN interconnects users in a geographical area larger than a LAN, but smallerthan a WAN, such as a city, with dedicated or high-performance hardware. For in-stance, a university or college may have a MAN that joins together many of its localarea networks situated around its campus. Then from its MAN it could have severalwide area network links to other universities or the Internet.

Networks—The Big PictureThere are a number of networks in the computing world, ranging from tiny two-computer local area networks to the biggest network of all, the Internet. Networksvary a great deal, but they all share one simple idea—they allow people to extendthe reach of their computers beyond the devices and shared information that aresitting on their desktop. Networks give computer users the power to use the re-sources—such as hard disks, printers, and CD-ROM drives—of other computerswithout forcing anyone to physically move to those other computers to use them.Before the development of network technology, individual computers were isolatedfrom each other and limited in their range of applications. By linking these individ-ual computers over networks, the computers’ usefulness and productivity havebeen increased enormously.

A network is made up of many physical elements in addition to the computers,printers, and other devices that are the main components of the network. Usingnetwork hardware, the computers and other devices in a specific area are literallyhooked up to each other. After the connections are made, special networking soft-ware is enabled on the networked computers so the computers can communicatewith each other. The manner in which all these items are connected is often re-ferred to as the network topology. Because of the specific nature of computer net-work technology, networks must be arranged in a particular way in order to workproperly. These arrangements are based on the network hardware’s capabilities andthe characteristics of the various modes of data transfer. Network topologies arefurther subdivided into two categories:

■ Physical topologies

■ Logical topologies

PHYSICAL TOPOLOGIES

The physical topology refers to the actual physical organization of the computerson the network and its connections. Physical topologies vary depending on costand functionality. There are five principal topologies used in LANs:

1. Bus topology—all devices are connected to a central cable, called the bus orbackbone. Bus networks are relatively inexpensive and easy to install for smallnetworks (see Figure T2.2).

2. Star topology—all devices are connected to a central device, called a hub. Starnetworks are relatively easy to install and manage, but bottlenecks can occurbecause all data must pass through the hub (see Figure T2.2).





FIGURE T2.2

Bus, Star, and RingTopology


3. Ring topology—all devices are connected to one another in the shape of aclosed loop, so that each device is connected directly to two other devices, oneon either side of it. Ring topologies are relatively expensive and difficult to in-stall, but they offer high bandwidth and can span large distances (see FigureT2.2).

4. Tree topology—combines the characteristics of the bus and star topologies. Itconsists of groups of star-configured workstations connected to a linear busbackbone cable (see Figure T2.3).

5. Wireless topology—devices are connected by a receiver/transmitter to a spe-cial network interface card that transmits signals between a computer and aserver, all within an acceptable transmission range (see Figure T2.3).

NETWORK ACCESS METHODS (PROTOCOLS)

A protocol is the predefined way that someone (who wants to use a service) talkswith or utilizes that service. The “someone” could be a person, but more often it isa computer program like a Web browser. Simply put, for one computer (or com-puter program) to talk to another computer (or computer program) they must bothbe talking the same language, and this language is called a protocol.

A protocol is based on an agreed-upon and established standard, and this wayall manufacturers of hardware and software that are utilizing the protocol do so ina similar fashion to allow for interoperability. The Institute of Electrical and Elec-tronics Engineers (IEEE) is the governing body that determines the standards.Through extensive testing, collaboration, and industry feedback, standards are solidified into working blueprints for communicating. The most popular networkprotocols used are:

RING Topology

STAR Topology

BUS Topology




■ Token Ring

■ Ethernet

■ Fiber Distributed Data Interface (FDDI)

Token Ring

A token ring network is a LAN in which all computers are connected in a ring or startopology (as suggested by Figure T2.4), and a token-passing scheme is used in order to prevent the collision of data between two computers that want to sendmessages at the same time. The token ring protocol is the second most widely usedprotocol on local area networks after Ethernet. IBM originally developed the tokenring network in the 1970s that is still IBM’s primary local area network (LAN) tech-nology. The token ring technology provides for data transfer rates of either 4 or 16megabits per second, comparatively slower than the Ethernet technology.

Ethernet

Ethernet is a physical and data layer technology for LAN networking. Ethernet isthe most widely installed LAN access method originally developed by Xerox andthen developed further by Xerox, Digital Equipment Corporation, and Intel. Whenit first began to be widely deployed in the 1980s, Ethernet supported a maximumtheoretical data transfer rate of 10 megabits per second (Mbps). More recently, FastEthernet has extended traditional Ethernet technology to 100 Mbps peak, and Gigabit Ethernet technology extends performance up to 1000 Mbps.

Ethernet has survived as the major LAN technology (it is currently used for ap-proximately 85 percent of the world’s LAN-connected PCs and workstations) be-cause its protocol has the following characteristics:

FIGURE T2.3

Tree and WirelessTopology


TREE Topology

Wireless Topology

ACCESSPOINT

ACCESSPOINT

WIRELESS LAN/WAN/MAN




FIGURE T2.4

Ethernet and TokenRing Protocol

FIGURE T2.5

Fiber Distributed DataInterface (FDDI)


■ Easy to understand, implement, manage, and maintain.

■ Allows low-cost network implementations.

■ Provides extensive flexibility for network installation.

■ Guarantees successful interconnection and operation of standards-compliantproducts, regardless of manufacturer.

Fiber Distributed Data Interface (FDDI)

Fiber Distributed Data Interface (FDDI) is a set of protocols for sending digitaldata over fiber optic cable. FDDI networks are token-passing networks that supportdata rates of up to 100 megabits per second. FDDI networks are typically used asbackbones for wide area networks (see Figure T2.5).

Ethernet

Ethernet

Ethernet

Token-ring

Token-ring

WANFDDI

Primary

Secondary




Networking HardwareThe hardware used to transport the data from one computer to another can gener-ally be divided into network transmission media and transmitting and receivingdevices. Network transmission media refers to the various types of media used tocarry the signal between computers. Transmitting and receiving devices are the de-vices placed at either end of the network transmission media to either send or re-ceive the information.

When information is sent across the network, it is converted into electrical signals. These signals are generated as electromagnetic waves (analog signaling) oras a sequence of voltage pulses (digital signaling). To be sent from one location toanother, a signal must travel along a physical path. The physical path that is usedto carry a signal between a signal transmitter and a signal receiver is called thetransmission media. There are two types of transmission media:

■ Guided

■ Unguided

GUIDED MEDIA

Guided media are transmission material manufactured so that signals will be con-fined to a narrow path and will behave predictably. The three most commonly usedtypes of guided media are (see Figure T2.6):

■ Twisted-pair wiring

■ Coaxial cable

■ Fiber optic cable

Twisted-Pair Wiring

Twisted-pair wiring refers to a type of cable composed of four (or more) copperwires twisted around each other within a plastic sheath. The wires are twisted to re-duce outside electrical interference. There are “shielded” and “unshielded” vari-eties of twisted-pair cables. Shielded cables have a metal shield encasing the wiresthat acts as a ground for electromagnetic interference. Unshielded twisted-pair(UTP) is the most popular and is generally the best option for LAN networks. Thequality of UTP may vary from telephone-grade wire to high-speed cable. The cablehas four pairs of wires inside the jacket. Each pair is twisted with a different num-ber of twists per inch to help eliminate interference from adjacent pairs and otherelectrical devices. The RJ-45 connectors on twisted-pair cables resemble large tele-phone connectors.

FIGURE T2.6

Twisted-Pair, CoaxialCable, and Fiber OpticCable


Twisted-Pair Cabling(10Base-T)

Coaxial Cable

Fiber-Optic Cable

Protective outside cover

Jacket

Cladding

Glass fiber core

Protective outside cover

Copper/Aluminum mesh

Insulater

Copper center conductorInner, single-wire cover

Copper wire




Coaxial Cable

Coaxial cable is cable that can carry a wide range of frequencies with low signalloss. It consists of a metallic shield with a single wire placed along the center of ashield and isolated from the shield by an insulator. This type of cable is referred toas “coaxial” because it contains one copper wire (or physical data channel) that carries the signal and is surrounded by another concentric physical channel con-sisting of a wire mesh. The outer channel serves as a ground for electrical interfer-ence. Because of this grounding feature, several coaxial cables can be placed withina single conduit or sheath without significant loss of data integrity. Coaxial cable isdivided into two different types: (1) thinnet and (2) thicknet.

1. Thinnet coaxial cable is similar to the cable used by cable television compa-nies. Thinnet is not as flexible as twisted-pair, but it is still used in LAN envi-ronments. The connectors on coaxial cable are called BNC twist-on connec-tors and resemble those found on television cables.

2. Thicknet coaxial cable is similar to thinnet except that it is larger in diameter.The increase in size translates into an increase in maximum effective dis-tance. The drawback to the increase in size, however, is a loss of flexibility.Since thicknet is much more rigid than thinnet, the deployment possibilitiesare much more limited and the connectors are much more complex. Thicknetis used primarily as a network backbone with thinnet “branches” to the indi-vidual network components.

Fiber Optic Cable

Fiber optic (or optical fiber) refers to the technology associated with the trans-mission of information as light impulses along a glass wire or fiber. 10Base-FL and100Base-FX optical fiber cable are the same types of cable used by most telephonecompanies for long distance service. Optical fiber cable can transmit data over longdistances with little loss in data integrity. In addition, because data is transferred asa pulse of light, optical fiber is not subject to interference. The light pulses travelthrough a glass wire or fiber encased in an insulating sheath.

As with thicknet, optical fiber’s increased maximum effective distance comes ata price. Optical fiber is more fragile than wire, difficult to split, and labor intensiveto install. For these reasons, optical fiber is used primarily to transmit data over ex-tended distances where the hardware required to relay the data signal on less ex-pensive media would exceed the cost of optical fiber installation. It is also usedwhere large amounts of data need to be transmitted on a regular basis.

Figure T2.7 summarizes the cable specifications, cable types, and maximumlengths. Figure T2.8 summarizes the common relationships between the physicaltopology, cabling, and protocol.

FIGURE T2.7

Cable Summary


Specification Cable Type Maximum Length

Unshielded Twisted-Pair

Thin Coaxial

Thick Coaxial

Faber Optic



100 meters

185 meters

500 meters

2000 meters

100 meters

220 meters

10BaseT

10Base2

10Base5

10BaseF

100BaseT

100BaseTX




UNGUIDED MEDIA

Unguided media are natural parts of the Earth’s environment that can be used asphysical paths to carry electrical signals. The atmosphere and outer space are ex-amples of unguided media that are commonly used to carry signals. These mediacan carry such electromagnetic signals as microwave, infrared light waves, and ra-dio waves.

Network signals are transmitted through all media as a type of waveform. Whentransmitted through wire and cable, the signal is an electrical waveform. Whentransmitted through fiber optic cable, the signal is a light wave: either visible or infrared light. When transmitted through the Earth’s atmosphere, the signal cantake the form of waves in the radio spectrum, including microwaves, infrared, orvisible light.

Recent advances in radio hardware technology have produced significant ad-vancements in wireless networking devices: the cellular telephone, wirelessmodems, and wireless LANs. These devices use technology that in some cases hasbeen around for decades but until recently was too impractical or expensive forwidespread use.

TRANSMITTING AND RECEIVING DEVICES

Once a transmission media has been selected, devices that can propagate signalsacross the media and devices that can receive the signals when they reach the otherend of the media are needed. Such devices are designed to propagate a specific typeof signal across a particular type of transmission medium. Transmitting and receiv-ing devices used in computer networks include the following:

■ Network adapters

■ Modems

■ Repeaters

■ Concentrators, hubs, and switches

■ Bridges, routers, and gateways

■ Microwave transmitters

■ Infrared and laser transmitters

■ Cellular transmitters

■ Wireless LAN transmitters

Network Adapters

A network adapter is the hardware installed in computers that enables them tocommunicate on a network. Network adapters are manufactured in a variety offorms. The most common form is designed to be installed directly into a standardexpansion slot inside a PC. Many manufacturers of desktop workstation mother-boards include network adapters as part of the motherboard. Other networkadapters are designed for mobile computing: they are small and lightweight andcan be connected to portable computers so that the computer and network adaptercan be easily transported from network to network.

FIGURE T2.8

Physical Topology,Cable, and ProtocolRelationship


Physical Topology Common Cable Common Protocol

Twisted-Pair Coaxial Fiber

Twisted-Pair Fiber

Twisted-Pair

Twisted-Pair Coaxial Fiber

Ethernet LocalTalk

Ethernet LocalTalk

Token Ring

Ethernet

Bus

Star

Ring

Tree





Network adapters are manufactured for connection to virtually any type ofguided medium, including twisted-pair wire, coaxial cable, and fiber optic cable.They are also manufactured for connection to devices that transmit and receive vis-ible light, infrared light, and radio microwaves.

Modems

Modems provide the means to transmit computer data (digital) over analog trans-mission media, such as ordinary telephone lines. The transmitting modem con-verts the encoded data signal to an audible signal and transmits it. A modem con-nected at the other end of the line receives the audible signal and converts it backinto a digital signal for the receiving computer. Modems are commonly used for in-expensive, intermittent communications between a network and geographicallyisolated computers.

While dial-up Internet connections such as the 56K modem are still the mostpervasive in the United States, cable modems are quickly catching up in popularityto the traditional form of connectivity. With each passing day, the number of cableTV systems that provide this high-speed connection service is increasing.

Repeaters

Repeaters are used to increase the distance over which a network signal can bepropagated. As a signal travels through a transmission medium, it encounters resistance and gradually becomes weak and distorted. The technical term for thissignal weakening is “attenuation.” All signals attenuate, and at some point, they become too weak and distorted to be received reliably. Repeaters are used to over-come this problem. A simple, dedicated repeater is a device that receives the net-work signal and retransmits it at the original transmission strength. Repeaters areplaced between transmitting and receiving devices on the transmission medium ata point at which the signal is still strong enough to be retransmitted. Dedicated re-peaters are seldom used within current networks since they are considered “dumb”devices, meaning that they do not have the capability to analyze what they are repeating. They therefore will repeat all signals, including those that should not berepeated, which increases network traffic. Repeating capabilities are now built intoother, more complex networking devices that can analyze and filter signals. For example, virtually all modern network adapters, hubs, and switches incorporate repeating capabilities.

Concentrators, Hubs, and Switches

Concentrators, hubs, and switches provide a common physical connection pointfor computing devices. Most hubs and all wiring concentrators and switches havebuilt-in signal repeating capability to perform signal repair and retransmission(these devices also perform other functions). In most cases, hubs, wiring concentra-tors, and switches are proprietary, standalone hardware. Occasionally, hub technol-ogy consists of hub cards and software that work together in a standard computer.

Bridges, Routers, and Gateways

The devices used to interconnect network segments are divided into three classifi-cations: bridges, routers, and gateways. Bridges and routers are generally used toconnect networks that use similar protocols (e.g., TCP/IP), while gateways are usedto connect networks that use dissimilar protocols (TCP/IP and IPX). Bridges androuters are usually separate hardware components that are connected directly tothe transmission media at the intersection point of the two separate networks.There are also bridges and routers that are software-based and function as part ofa server’s network operating system (discussed in detail later on in this plug-in) orrun in conjunction with the network operating system. Software-based bridges androuters can also be installed on standard computers to create dedicated, stand-alone devices.




FIGURE T2.9

Satellite MicrowaveLink


New York

LondonParis

TokyoSan Francisco

Gateways, on the other hand, are usually a combination of both hardware andsoftware, and they perform much more advanced functions than either bridges orrouters.

Microwave Transmitters

Microwave transmitters and receivers, especially satellite systems, are commonlyused to transmit network signals over great distances. A microwave transmitteruses the atmosphere (or outer space) as the transmission medium to send the sig-nal to a microwave receiver. The microwave receiver then either relays the signal toanother microwave transmitter or translates the signal to some other form, such asdigital impulses, and relays it on another suitable medium to its destination as il-lustrated in Figure T2.9. Originally, this technology was used almost exclusively forsatellite and long-range communication. Recently, however, there have been devel-opments in cellular technology that allow complete wireless access to networks, in-tranets, and the Internet via microwave transmission.

Infrared and Laser Transmitters

Infrared and laser transmitters are similar to microwave systems: they use the at-mosphere and outer space as transmission media. However, because they transmitlight waves rather than radio waves, they require a line-of-sight transmission path.Infrared and laser transmissions are useful for signaling across short distanceswhere it is impractical to lay cable. However, infrared and laser signals are in thelight spectrum—rain, fog, and other environmental factors can cause transmissionproblems.

Cellular Transmitters

Cellular transmitters are radio transmissions that have the advantage of being able to penetrate solid objects. The cellular base station at the center of each cellconsists of low-power transmitters, receivers, antennas, and computer controlequipment. The cell tower usually has a triangular array of antennas on top. Unlikeconventional radio and television transmitters, whose primary purpose is to coverthe largest area possible, cellular transmitters emit signals that do not carry muchfarther than a few cells. Cellular devices are configured to operate at low power toavoid interfering with other cellular devices in the area.




FIGURE T2.10

Overview of WirelessMedia


Wireless LAN Transmitters

Wireless LAN transmitters or access points function like hubs and switches in awired environment, only they propagate signals through radio waves or infraredlight instead of wires. An access point consists of a transceiver, usually positionedin a high place such as a tower or near a ceiling in a building that physically con-nects to the hard wiring of the LAN. An access point that is connected to the LANvia radio waves is called an extension point. Wireless networking operates underthe same principal as cellular phones: each access point or extension point coversa cell and then users are handed off from one cell to the next. Therefore, a user witha hand-held device can connect to the network in one room, walk to another partof the building or campus, and still maintain connectivity.

Other kinds of wireless transmitters reside in wireless devices and interface di-rectly with similar devices, creating an ad hoc, peer-to-peer network when they arenear one another. These transmitters also operate at low power to avoid unwantedinterference. Figure T2.10 summarizes the wireless media discussed in this plug-in.

The Network Operating SystemIn order for a network to communicate successfully, all the separate functions ofthe individual components discussed in this plug-in must be coordinated. This taskis performed by the network operating system (NOS), an operating system that includes special functions for connecting computers and devices into a local areanetwork. The NOS is the “brain” of the entire network, acting as the command cen-ter and enabling the network hardware and software to function as one cohesivesystem. Network operating systems are divided into two categories: client-serverand peer-to-peer. Networks based on client-server NOSs are composed of clientworkstations that access network resources made available through the server. Onthe other hand, networks based on peer-to-peer NOSs involve computers that areequal, all with the same networking abilities.

CLIENT-SERVER NETWORKS

A client-server network is a versatile, message-based, and modular infrastructurethat is intended to improve usability, flexibility, interoperability, and scalability ascompared to centralized, mainframe computing. A client is defined as a requesterof services and a server is defined as the provider of services. A single machine canbe both a client and a server depending on the software configuration. The client-server model has become one of the central ideas of network computing. Mostbusiness applications being written today use the client-server model.

Type ofWirelessMedia

Cellular

Infrared

Microwave

WirelessLAN

Use

Telephone

Short distancedata transfer

Long haul, buildingto building

Local areanetworks

Transfer Rate

19.2kbps

16Mbps

100Mbps

2Mbps–54Mbps

Range

Each cell has .5–50mile radius,nationwide coverage

1.5 miles

20–30 miles

<100 meters

Advantage

Widespread,inexpensive

Fast, inexpensive

Reliable, highspeed, highvolume

Ease of use,inexpensive

Disadvantage

Noise

Short distances, lineof sight required

Expensive, potentialinterference

Too many standards




In the usual client-server network model, a server is activated and awaits clientrequests. Typically, multiple client programs share the services of a common serverprogram. A Web browser is a client program that requests services (the sending ofWeb pages or files) from a Web server on the Internet.

In a client-server network, the NOS runs on a computer called the networkserver. A client-server NOS is responsible for coordinating the use of all resourcesand services available from the server on which it is running. The client part of aclient-server network is any other network device or process that makes requests touse server resources and services, as illustrated in Figure T2.11. For example, net-work computer users request the use of services and resources though client soft-ware, which runs on the computer and communicates with the NOS on the serverby means of a common protocol, such as TCP/IC.

The NOS provides many services or tasks performed by a server, such as coordi-nating file access and file sharing, managing data security, scheduling tasks for processing, coordinating printer access, and managing Internet communications.Among the most important functions performed by a client-server NOS are ensur-ing the reliability of data stored on the server and managing server security.

THIN CLIENT-SERVER NETWORKS

A variation on the client-server network is the server-based network or thin client-server network. This kind of network also consists of servers and clients, but the re-lationship between client and server is different. Thin clients are similar to termi-nals connected to mainframes; the server performs the bulk of the processing, andthe client presents the interface. Unlike mainframe terminals, however, thin clientsare connected to a network, not directly to the server.

The term “thin client” usually refers to a specialized PC that possesses little com-puting power and is optimized for network connections. Thin clients are usuallydevoid of floppy drives, expansion slots, and hard disks; consequently, the “box” orcentral processing unit is much smaller than that of a conventional PC.

The “thin” in thin client refers both to the client’s reduced processing capabilitiesand to the amount of traffic generated between client and server. In a typical thin-client environment, only the keystrokes, mouse movements, and screen updatestravel across the connection. The term “thin” is also used generically to describeany computing process or component that uses minimal resources.

FIGURE T2.11

Client-Server Network


LAN

Client SERVER Client

ClientClient

LAN

Client SERVER Client

ClientClient

LAN/WAN/MAN




FIGURE T2.12

Peer-to-Peer Networks


Internet

PEER-TO-PEER NETWORKS

Peer-to-peer networks enable networked computers to function as both serversand workstations. In a wired peer-to-peer network the NOS is installed on everynetworked computer so that any networked computer can provide resources andservices to all other networked computers, as illustrated in Figure T2.12. For exam-ple, each networked computer can allow other computers to access its files and useconnected printers while it is in use as a workstation without the aid of a server. Ina wireless peer-to-peer network, each networked device contains a short-rangetransceiver that interfaces with the transceivers of nearby devices or with accesspoints. Like their wired counterparts, wireless peer-to-peer networks offer file andresource sharing.

Peer-to-peer networks provide fewer services than client-server networks. In ad-dition, the services they provide are less robust than those provided by client-servernetworks. Moreover, the performance of peer-to-peer networks decreases signifi-cantly both with heavy use and as the network grows. Maintenance is also oftenmore difficult. Since there is no method of centralized management, there can bemany servers (or peer computers) to manage (rather than one centralized server orpeer), and many people may have the rights to change the configuration of differ-ent computers. In the case of wireless peer-to-peer networks, however, an accesspoint may be one node in the network, allowing users both to share files directlyfrom their hard drives and to access resources from the servers on the LAN.

Internet TechnologyThe Internet’s history can be traced to 1957, when the Department of Defense(DoD) formed the Advanced Research Projects Agency (ARPA) in response to Rus-sia’s launch of Sputnik, the first artificial earth satellite. ARPA (later renamedDARPA) sponsored a number of studies to research how to make a few universitysupercomputers available to many research scientists across the country. In 1969,the first computer network was created. Called ARPANET, it interconnected UCLA,Stanford Research Institute, and UC Santa Barbara in California with the Universityof Utah. As time passed, more and more organizations joined this growing com-puter network.

Now the Internet is the world’s largest computer network, linking thousands ofnetworks and millions of individual computers around the world. The interlinkednetworks and individual computers belong to a myriad of private individuals, gov-ernment agencies, universities, hospitals, private businesses of all kinds, and otherorganizations in almost every country in the world.




On a daily basis, millions of users send and receive e-mail, download and uploadfiles, perform research, and conduct business on the Internet. E-business alone isexpected to account for billions of dollars in sales over the next few years.

Given that the Internet is so popular and widely used, many of its technologieshave spilled over into the private computer networking market. Two of the most in-fluential technologies are the Transmission Control Protocol/Internet Protocol(TCP/IP) suite and the World Wide Web (WWW). These technologies, and the ad-dressing scheme that supports them, have become integral to computer network-ing that is shaping the future of the network industry.

TRANSMISSION CONTROL PROTOCOL/INTERNET PROTOCOL(TCP/IP)

Transmission Control Protocol/Internet Protocol (TCP/IP) was originally devel-oped by the Department of Defense to connect a system of computer networks thatbecame known as the Internet. Transmission Control Protocol/Internet Protocol(TCP/IP) is a group, or suite, of networking protocols used to connect computers onthe Internet. TCP and IP are the two main protocols in the suite. TCP providestransport functions, ensuring, among other things, that the amount of data re-ceived is the same as the amount transmitted. The IP part of TCP/IP provides theaddressing and routing mechanism, that acts as a postmaster.

TCP/IP uses a special transmission method that maximizes data transfer and au-tomatically adjusts to slower devices and other delays encountered on a network.The TCP/IP suite of applications include (see Figure T2.13):

1. File Transfer Protocol (FTP) allows files containing text, programs, graphics,numerical data, and so on to be downloaded off or uploaded onto a network.

2. Simple Mail Transfer Protocol (SMTP) is TCP/IP’s own messaging system fore-mail.

3. Telnet protocol provides terminal emulation that allows a personal computeror workstation to act as a terminal, or access device, for a server.

4. Hypertext Transfer Protocol (HTTP) allows Web browsers and servers to sendand receive Web pages.

5. Simple Network Management Protocol (SNMP) allows the management ofnetworked nodes to be managed from a single point.

WORLD WIDE WEB (WWW)

The World Wide Web has become the dominant Internet service, taking only a fewshort years to catch on after it was introduced to Internet users in 1991 by TimBerners-Lee and CERN (a European consortium for nuclear research).

The World Wide Web is a client-server environment where information is man-aged through Web sites on computers called Web servers. Accessing Web sites isdone through the use of client software (i.e., a browser) and the Internet’s HTTP.

FIGURE T2.13

The TCP/IP ProtocolSuite


FTP, SMTP, Telnet, HTTP, SNTP

TCP

IP

Ethernet, Token Ring, FDDI

Applications

Transport

Address

Network Interface





The computers and Web sites on the Internet are linked through documentscalled Web pages. The basic format of a Web page is a text document written inHTML, which is made up of codes that tell how the page will be displayed on thebrowser. The HTML document also includes the text that will be displayed as wellas the addresses, or Uniform Resource Locators (URLs), of other Web pages thathave links in the document. These links appear as underlined or highlighted textthat includes hidden cross-references, or hyperlinks, to additional information.Clicking on this highlighted text allows users to jump to the Web page referenced bythe link. Web pages may also display icons and images as links to other pages.

In order for these links to work, however, the addressing scheme must be specificand the links must reference an appropriate URL. The URL is then used to deter-mine the location of the site referenced by the link.

Intranet

An intranet is an internalized portion of the Internet, protected from outside ac-cess, that allows an organization to provide access to information and applicationsoftware to only its employees. The term intranet appeared when companies dis-covered that they could use Internet technologies to make internal informationavailable to all employees, no matter where the employees were located or whatkind of hardware they were using. They could still secure the information from un-wanted access by outsiders and make the information available at the lowest pos-sible cost.

The main reason for a company to implement an intranet is that it enables thecollection, management, and dissemination of information more quickly and eas-ily. Intranet publishing is the ultimate in electronic publishing because it is basedon the Internet technologies that were developed specifically for allowing informa-tion sharing among dissimilar computing systems.

Extranet

An extranet is a private network that uses the Internet protocol and the publictelecommunications system to securely share part of a business’s information oroperations with suppliers, vendors, partners, customers, or other businesses. On anextranet, each connected company usually makes some selected part of its intranetaccessible to the employees of one or more other companies. For example, severalcompanies might create an extranet to consolidate data gathering and to sharedata, to jointly develop and share training programs, or to coordinate project man-agement for a common work project. On an extranet, each company uses the secu-rity inherent in its own intranet to keep employees of other companies from access-ing information they do not need to see.

Virtual Private Network (VPN)

A virtual private network (VPN) is a way to use the public telecommunications in-frastructure (e.g., Internet) to provide secure access to an organization’s network.By contrast, traditional WAN connections are made by means of dedicated commu-nications equipment and dedicated leased lines. Although VPNs may not providethe same data-transfer performance as a dedicated-line WAN, there are some ad-vantages that a VPN has over a dedicated-line WAN that have made VPNs increas-ingly popular. The most obvious advantage is the cost of implementation. SinceVPNs use the Internet as the backbone, there is no need to lay cable or lease dedi-cated lines between the remote sites needing to connect. This eliminates an incredible amount of overhead. With a conventional dedicated-line network, anadditional Internet connection would be required. Using a VPN, businesses cannetwork remote offices into one large WAN and provide access to the Internet.




The TCP/IP suite and the World Wide Web have drastically changed the future ofcomputer networking. Businesses and individuals who have become familiar withthe Internet and its workings have recognized the advantages of this technologyand applied it to their business networks in the form of intranets, extranets, and vir-tual private networks (VPNs) (refer to Figure T2.14).


FIGURE T2.14

Intranet, Extranet, andVPN Technologies

MainOffice

VPN

VPN

VPN Internet

Intranet

ExtranetRemoteOffice

BusinessPartner




etworks come in all sizes from two computers connected to share a printer, to the In-ternet, which is the largest network of all, joining millions of computers of all types all

over the world. In between are business networks, which vary in size from a dozen or fewercomputers to many thousands.

Each computer on a network must have a network card that provides the communicationdoorway for information traffic to and from other computers. A network usually has at leastone connecting device (like a hub or a router) that ties the computers on the network togetherand acts as a switchboard for passing information. There must be communications mediasuch as cables or radio waves connecting network hardware devices. The communicationsmedia transport information around the network between computers and the connecting de-vice(s). Each computer must have software that supports the movement of information in andout of the computer. This could be modem software and/or a network operating system.

P L U G - I N S U M M A R Y*

K E Y T E R M S*

M A K I N G B U S I N E S S D E C I S I O N S*


Bandwidth, 385Bridge, 394Bus topology, 387Cellular transmitter, 395Client-server network, 396Coaxial cable, 392Computer network (network), 384Concentrator, hub, and

switch, 394Ethernet, 389Extranet, 400Fiber distributed data interface

(FDDI), 390Fiber optic (optical fiber), 392File transfer protocol (FTP), 399Gateway, 394Groupware, 385Guided media, 391Hypertext transfer protocol

(HTTP), 399Infrared transmitter, 395Intranet, 400

Laser transmitter, 395Local area network (LAN), 386Metropolitan area network

(MAN), 386Microwave transmitter, 395Modem, 394Network adapter, 393Network operating system

(NOS), 396Network transmission

media, 391Peer-to-peer network, 398Physical topology, 387Protocol, 388Repeater, 394Ring topology, 388Router, 394Simple mail transfer protocol

(SMTP), 399Simple network management

protocol (SNMP), 399

Star topology, 387Telnet, 399Thicknet coaxial cable, 392Thin client, 397Thinnet coaxial cable, 392Token ring, 389Topology, 385Transmission Central

Protocol/Internet Protocol(TCP/IP), 399

Tree topology, 388Twisted-pair, 391Unguided media, 393Virtual private network

(VPN), 400Wide area network (WAN), 386Wireless, 384Wireless LAN transmitter, 396Wireless topology, 388

1. Secure AccessOrganizations that have traditionally maintained private, closed systems have begun to look atthe potential of the Internet as a ready-made network resource. The Internet is inexpensive andglobally pervasive: every phone jack on earth is a potential connection. However, what the In-ternet has lacked as a network is security. What obstacles must organizations overcome to al-low secure connections? What type of network infrastructure must they develop?

N




2. LAN GrowthThe introduction of Ethernet technology as well as the availability of powerful, affordablepersonal computers has driven the growth of local area networks. As a result, applicationsthat once were possible only on mainframe computers are now running on LANs. Networkspeed and availability are critical requirements for these applications. Existing applicationsand a new generation of multimedia, groupware, imaging, and database products can eas-ily overwhelm a network running at Ethernet’s traditional speed of 10 megabits per second(Mbps). With more applications requiring faster LAN speeds for acceptable performance,network managers face several choices for implementing high-speed LAN technology.Make a detailed list of the alternatives to using traditional Ethernet, listing advantages anddisadvantages for each.

3. Why Is the Network Slow?When network managers hear a user complain, “Why is the network slow?” they typicallydo not have an immediate answer because they do not have a complete picture of whatthe network is doing. Having a completely instrumented network would show them theflows of data through their network at different times of the day and provide an immediatepicture of who is transmitting and receiving information through interfaces on the network.Explain why it is almost impossible for network managers to have a complete picture oftheir networks.

4. Rolling Out with NetworksAs organizations begin to realize the benefits of adding a wireless component to their net-work, they must understand how to leverage this emerging technology. Wireless solutionshave come to the forefront of many organizations with the rollout of more standard, cost-effective, and secure wireless protocols. With wireless networks, increased businessagility may be realized by continuous data access and synchronization. However, with theincreased flexibility come many challenges. Develop a list outlining the challenges that awireless network presents along with recommendations for any solutions.



Business Plug−ins B1. Information Security64 © The McGraw−Hill Companies, 2005

220 Plug-In B1 Information Security*

P L U G - I N

B1 Information Security

1. Describe the relationship between information security policies and an informationsecurity plan.

2. Summarize the five steps to creating an information security plan.3. Provide an example of each of the three primary security areas: (1) authentication and

authorization, (2) prevention and resistance, and (3) detection and response.4. Describe the relationships and differences between hackers and viruses.

IntroductionThe core units introduced information security, which is a broad term encompass-ing the protection of information from accidental or intentional misuse by personsinside or outside an organization. With current advances in technologies and busi-ness strategies such as CRM, organizations are able to determine valuable informa-tion such as who are the top 20 percent of the customers that produce 80 percentof all revenues. Most organizations view this type of information as valuable intel-lectual capital and they are implementing security measures to prevent the infor-mation from walking out the door or falling into the wrong hands. This plug-in dis-cusses how an organization can implement information security lines of defensethrough people first and through technology second.

The First Line of Defense—PeopleAdding to the complexity of information security is the fact that organizations mustenable employees, customers, and partners to access information electronically tobe successful in this electronic world. Doing business electronically thus automat-ically creates tremendous information security risks for organizations. Surprisingly,the biggest issue surrounding information security is not a technical issue, but apeople issue.

The 2003 CSI/FBI Computer Crime and Security Survey reported that 33 percentof respondents indicated security incidents originated within the enterprise. Insid-ers are legitimate users who purposely or accidentally misuse their access to the

LEARNING OUTCOMES


Business Plug−ins B1. Information Security 65© The McGraw−Hill Companies, 2005

environment and cause some kind of business-affecting incident. Most informa-tion security breaches result from people misusing an organization’s informationeither advertently or inadvertently. For example, many individuals freely give uptheir passwords or write them on sticky notes next to their computers, leaving thedoor wide open to intruders.1

Information security policies identify the rules required to maintain informa-tion security. An information security plan details how an organization will imple-ment the information security policies. Figure B1.1 is an example of the Universityof Denver’s Information Security Plan.

FIGURE B1.1

Sample InformationSecurity Plan(continued on the nextpage)

Plug-In B1 Information Security 221*

*

INTERIM INFORMATION SECURITY PLAN

This Information Security Plan (“Plan”) describes the University of Denver’s safeguards to protect information and data incompliance (“Protected Information”) with the Financial Services Modernization Act of 1999, also known as the Gramm LeachBliley Act, 15 U.S.C. Section 6801. These safeguards are provided to:

■ Ensure the security and confidentiality of Protected Information;

■ Protect against anticipated threats or hazards to the security or integrity of such information; and

■ Protect against unauthorized access to or use of Protected Information that could result in substantial harm or inconvenienceto any customer.

This Information Security Plan also provides for mechanisms to:

■ Identify and assess the risks that may threaten Protected Information maintained by the University of Denver;

■ Develop written policies and procedures to manage and control these risks;

■ Implement and review the plan; and

■ Adjust the plan to reflect changes in technology, the sensitivity of covered data and information and internal or externalthreats to information security.

Identification and Assessment of Risks to Customer Information

The University of Denver recognizes that it has both internal and external risks. These risks include, but are not limited to:

■ Unauthorized access of Protected Information by someone other than the owner of the covered data and information

■ Compromised system security as a result of system access by an unauthorized person

■ Interception of data during transmission

■ Loss of data integrity

■ Physical loss of data in a disaster

■ Errors introduced into the system

■ Corruption of data or systems

■ Unauthorized access of covered data and information by employees

■ Unauthorized requests for covered data and information

■ Unauthorized access through hardcopy files or reports

■ Unauthorized transfer of covered data and information through third parties

The University of Denver recognizes that this may not be a complete list of the risks associated with the protection of ProtectedInformation. Since technology growth is not static, new risks are created regularly. Accordingly, the Information TechnologyDepartment and the Office of Student Affairs will actively participate with and seek advice from an advisory committee made upof university representatives for identification of new risks. The University of Denver believes current safeguards used by theInformation Technology Department are reasonable and, in light of current risk assessments are sufficient to provide securityand confidentiality to Protected Information maintained by the University.

Information Security Plan Coordinators

The University CIO and the Vice President for Student Affairs, in consultation with an advisory committee, have been appointedas the coordinators of this Plan. They are responsible for assessing the risks associated with unauthorized transfers of covereddata and information and implementing procedures to minimize those risks to the University of Denver.

Design and Implementation of Safeguards Program

Employee Management and Training

During employee orientation, each new employee in departments that handle Protected Information will receive proper trainingon the importance of confidentiality of Protected Information.



The first line of defense an organization should follow is to create an informationsecurity plan detailing the various information security policies. A detailed infor-mation security plan can alleviate people-based information security issues. Thefollowing are the five steps for creating an information security plan:

1. Develop the information security policies—Identify who is responsible andaccountable for designing and implementing the organization’s informationsecurity policies. Simple, yet highly effective types of information securitypolicies include requiring users to log off of their systems before leaving forlunches or meetings, never sharing passwords with anyone, and changingpersonal passwords every 60 days. The chief security officer (CSO) will typi-cally be responsible for designing these information security policies.

2. Communicate the information security policies—Train all employees on thepolicies and establish clear expectations for following the policies. For exam-ple, let all employees know that they will receive a formal reprimand for leav-ing a computer unsecured.

3. Identify critical information assets and risks—Require the use of user IDs,passwords, and antivirus software on all systems. Ensure any systems thatcontain links to external networks have the appropriate technical protec-tions such as firewalls or intrusion detection software. A firewall is hardwareand/or software that guards a private network by analyzing the informationleaving and entering the network. Intrusion detection software (IDS) searchesout patterns in information and network traffic to indicate attacks and quicklyrespond to prevent any harm.

4. Test and reevaluate risks—Continually perform security reviews, audits,background checks, and security assessments.

5. Obtain stakeholder support—Gain the approval and support of the informa-tion security polices by the Board of Directors and all stakeholders.

The director of information security at a large health care company discoveredhow easy it was to create an information security breach when she hired outsideauditors to test her company’s security awareness. In one instance, auditors found


FIGURE B1.1

Sample InformationSecurity Plan(concluded)

Physical Security

The University of Denver has addressed the physical security of Protected Information by limiting access to only thoseemployees who have a business reason to know such information.

Information Systems

The University of Denver has policies governing the use of electronic resources and firewall and wireless policies. The Universityof Denver will take reasonable and appropriate steps consistent with current technological developments to make sure that allProtected Information is secure and to safeguard the integrity of records in storage and transmission. The University of Denverwill develop a plan to ensure that all electronic Protected Information is encrypted in transit.

Selection of Appropriate Service Providers

Due to the specialized expertise needed to design, implement, and service new technologies, vendors may be needed to provideresources that the University of Denver determines not to provide on its own. In the process of choosing a service provider thatwill maintain or regularly access Protected Information, the evaluation process shall include the ability of the service provider tosafeguard Protected Information. Contracts with service providers may include the following provisions:

■ A stipulation that the Protected Information will be held in strict confidence and accessed only for the explicit businesspurpose of the contract;

■ An assurance from the contract partner that the partner will protect the Protected Information it receives.

Continuing Evaluation and Adjustment

This Information Security Plan will be subject to periodic review and adjustment, especially when due to the constantly changingtechnology and evolving risks. The Coordinators, in consultation with the Office of General Counsel, will review the standards setforth in this policy and recommend updates and revisions as necessary. It may be necessary to adjust the plan to reflect changesin technology, the sensitivity of student/customer data and internal or external threats to information security.

INTERIM INFORMATION SECURITY PLAN (continued)



that staff members testing a new system had accidentally exposed the network tooutside hackers. In another instance, auditors were able to obtain the passwords of16 employees when the auditors posed as support staff; hackers frequently usesuch “social engineering” to obtain passwords. Social engineering is using one’s social skills to trick people into revealing access credentials or other informationvaluable to the attacker. Dumpster diving, or looking through people’s trash, is an-other way social engineering hackers obtain information.

Figure B1.2 provides the top 10 questions from Ernst & Young that managersshould ask to ensure their information is secure.2

The Second Line of Defense—TechnologyArkansas State University (ASU) recently completed a major network upgrade thatbrought gigabit-speed network capacity to every dorm room and office on its cam-pus. The university was concerned that the new network would be a tempting play-ground for hackers. To reduce its fear the university decided to install intrusion de-tection software (IDS) from Cisco Systems to stay on top of security and potentialnetwork abuses. Whenever the IDS spots a potential security threat, such as a virusor a hacker, it alerts the central management system. The system automaticallypages the IT staff, who deal with the attack by shutting off access to the system,identifying the hacker’s location, and calling campus security.3

Once an organization has protected its intellectual capital by arming its peoplewith a detailed information security plan, it can begin to focus its efforts on deploy-ing the right types of information security technologies such as the IDS installed atASU.

International Data Corp. estimates that worldwide spending on IT security soft-ware, hardware, and services will top $35 billion in 2004. There are numerous tech-nologies available that organizations can deploy to prevent information securitybreaches. When determining which types of technologies to invest in, it helps tounderstand the three primary information security areas:


Top 10 Questions Managers Should Ask Regarding Information Security

1. Does our Board of Directors recognize information security is a board level issue that cannotbe left to the IT department alone?

2. Is there clear accountability for information security in our organization?

3. Do our Board members articulate an agreed-upon set of threats and critical assets? How oftendo we review and update these?

4. How much is spent on information security and what is it being spent on?

5. What is the impact on the organization of a serious security incident?

6. Does our organization view information security as an enabler? (For example, by implementingeffective security, could we enable our organization to increase business over the Internet?)

7. What is the risk to our business of getting a reputation for low information security?

8. What steps have we taken to ensure that third parties will not compromise the security of ourorganization?

9. How do we obtain independent assurance that information security is managed effectively inour organization?

10. How do we measure the effectiveness of our information security activities?

FIGURE B1.2

Top 10 QuestionsManagers Should AskRegarding InformationSecurity



1. Authentication and authorization

2. Prevention and resistance

3. Detection and response4

AUTHENTICATION AND AUTHORIZATION

Authentication is a method for confirming users’ identities. Authentication tech-niques are broken down into three categories, and the most secure type of authen-tication involves a combination of all three:

1. Something the user knows such as a user ID and password

2. Something the user has such as a smart card or token

3. Something that is part of the user such as a fingerprint or voice signature

Something the User Knows such as a User ID and Password

The first type of authentication, using something the user knows, is the most com-mon way to identify individual users and typically consists of a unique user ID andpassword. But this is actually one of the most ineffective ways for determining au-

thentication because passwords are not secure. All ittypically takes to crack a password is enough time. Over50 percent of help-desk calls are password related,which can cost an organization significant money, andpasswords are vulnerable to being coaxed out of some-body by a “social engineer.” Figure B1.3 displays theamount of money lost to identity thefts based onstolen passwords, among other things. The worldwidetotal for identity theft is expected to hit between $2 and$5 trillion by 2005.5

Something the User Has such as a SmartCard or Token

The second type of authentication, using somethingthat the user has, offers a much more effective way to identify individuals than a user ID and password.Tokens and smart cards are two of the primary forms ofthis type of authentication. Tokens are small electronicdevices that change user passwords automatically. Theuser enters his/her user ID and token displayed pass-word to gain access to the network. A smart card is adevice that is around the same size as a credit card,containing embedded technologies that can store in-formation and small amounts of software to performsome limited processing. Smart cards can act as iden-tification instruments, a form of digital cash, or a datastorage device with the ability to store an entire med-ical record.

Something That Is Part of the User such as a Fingerprint or Voice Signature

The third kind of authentication, using something that is part of the user, is by farthe best and most effective way to manage authentication. Biometrics (narrowlydefined) is the identification of a user based on a physical characteristic, such as afingerprint, iris, face, voice, or handwriting. Unfortunately, biometric authentica-tion can be costly and intrusive. For example, iris scans are expensive and consid-ered intrusive by most people. Fingerprint authentication is less intrusive and inex-pensive but is also not 100 percent accurate.


$5,000

Identity thefts are expected to increase anywherefrom 900% to 2,250% over the next two years;dollar figures are billions.

$4,500

$2,500

$3,000

$3,500

$4,000

$2,000

$1,500

$500

$1,000

20022003

2005

US Losses WorldwideLosses

FIGURE B1.3

Identity Theft Losses by2005 (billions of dollars)



PREVENTION AND RESISTANCE

Prevention and resistance technologies stop intruders from accessing intellectualcapital. A division of Sony Inc., Sony Pictures Entertainment (SPE), defends itselffrom attacks by using an intrusion detection system to detect new attacks as theyoccur. SPE develops and distributes a wide variety of products including movies,television, videos, and DVDs. A compromise to SPE security could result in costingthe company valuable intellectual capital as well as millions of dollars and monthsof time. The company needed an advanced threat management solution thatwould take fewer resources to maintain and require limited resources to track andrespond to suspicious network activity. The company installed an advanced intru-sion detection system allowing it to monitor all of its network activity including anypotential security breaches.6

The cost of downtime or network operation failures can be devastating to anybusiness. For example, eBay experienced a 22-hour outage in June 2000 that causedthe company’s market cap to plunge an incredible $5.7 billion. Downtime costs forbusinesses can vary from $100 to $1 million per hour. An organization must pre-pare for and anticipate these types of outages resulting most commonly from hack-ers and viruses. Technologies available to help prevent and build resistance to at-tacks include:

1. Content filtering

2. Encryption

3. Firewalls7

Content Filtering

Content filtering occurs when organizations use software that filters content toprevent the transmission of unauthorized information. Organizations can use con-tent filtering technologies to filter e-mail and prevent e-mails containing sensitiveinformation from transmitting, whether the transmission was malicious or acci-dental. It can also filter e-mails and prevent any suspicious files from transmittingsuch as potential virus-infected files. E-mail content filtering can also filter forspam, a form of unsolicited e-mail. Organizational losses from spam are estimatedto be $190 billion in 2004.8

Encryption

Encryption scrambles information into an alternative form that requires a key orpassword to decrypt the information. If there is an information security breach andthe information was encrypted, the person stealing the information will be unableto read it. Encryption can switch the order of characters, replace characters withother characters, insert or remove characters, or use a mathematical formula toconvert the information into some sort of code. Companies that transmit sensitivecustomer information over the Internet, such as credit card numbers, frequentlyuse encryption.

Firewalls

One of the most common defenses for preventing a security breach is a firewall. Afirewall is hardware and/or software that guards a private network by analyzing theinformation leaving and entering the network. Firewalls examine each messagethat wants entrance to the network. Unless the message has the correct markings,the firewall prevents it from entering the network. Firewalls can even detect com-puters communicating with the Internet without approval. As Figure B1.4 illus-trates, organizations typically place a firewall between a server and the Internet.





FIGURE B1.4

Sample FirewallArchitectureConnecting SystemsLocated in Chicago,New York, and Boston

DETECTION AND RESPONSE

The final area where organizations can allocate resources is in detection and re-sponse technologies. If prevention and resistance strategies fail and there is a secu-rity breach, an organization can use detection and response technologies to miti-gate the damage. The most common type of defense within detection and responsetechnologies is antivirus software.

A single worm can cause massive damage. In August 2003, the “Blaster worm” in-fected computers worldwide and was one of the worst outbreaks of the year. JeffreyLee Parson, 18, was arrested by U.S. cyber investigators for unleashing the damag-ing worm on the Internet. The worm replicated itself repeatedly, eating up com-puter capacity, but did not damage information or programs. The worm generatedso much traffic that it brought entire networks down.

The FBI used the latest technologies and code analysis to find the source of theworm. Prosecutors of the case said that Microsoft suffered financial losses that “sig-nificantly” exceeded $5,000, the statutory threshold in most hacker cases. Parson,charged with intentionally causing or attempting to cause damage to a computer,faces up to 10 years in prison and a $250,000 fine. “With this arrest, we want to de-liver a message to cyber-hackers here and around the world,” said U.S. AttorneyJohn McKay in Seattle. “Let there be no mistake about it, cyber-hacking is a crime.We will investigate, arrest, and prosecute cyber-hackers.”9

Typically, people equate viruses (the malicious software) with hackers (the peo-ple). While not all types of hackers create viruses, many do. Figure B1.5 provides anoverview of the most common types of hackers and viruses.

Some of the most damaging forms of security threats to e-business sites includemalicious code, hoaxes, spoofing, and sniffers. Malicious code includes a variety ofthreats such as viruses, worms, and Trojan horses. Hoaxes attack computer systemsby transmitting a virus hoax, with a real virus attached. By masking the attack in aseemingly legitimate message, unsuspecting users more readily distribute the mes-sage and send the attack on to their co-workers and friends, infecting many usersalong the way. Spoofing is the forging of the return address on an e-mail so that thee-mail message appears to come from someone other than the actual sender. Thisis not a virus but rather a way by which virus authors conceal their identities as theysend out viruses. A sniffer is a program or device that can monitor data travelingover a network. Sniffers can show all the data being transmitted over a network, in-cluding passwords and sensitive information. Sniffers tend to be a favorite weaponin the hacker’s arsenal.

Server Firewall

Chicago

InternetDatabase

Firewall Server

New York

Firewall Server

Boston

Database

Database



FIGURE B1.5

Hackers and Viruses


Hackers—people very knowledgeable about computers who use their knowledge to invade otherpeople’s computers.

■ White-hat hackers—work at the request of the system owners to find system vulnerabilitiesand plug the holes.

■ Black-hat hackers—break into other people’s computer systems and may just look around ormay steal and destroy information.

■ Hactivists—have philosophical and political reasons for breaking into systems and will oftendeface the Web site as a protest.

■ Script kiddies or script bunnies—find hacking code on the Internet and click-and-point theirway into systems to cause damage or spread viruses.

■ Cracker—a hacker with criminal intent.

■ Cyberterrorists—seek to cause harm to people or to destroy critical systems or information anduse the Internet as a weapon of mass destruction.

Viruses—software written with malicious intent to cause annoyance or damage.

■ Worm—a type of virus that spreads itself, not only from file to file, but also from computer tocomputer. The primary difference between a virus and a worm is that a virus must attach tosomething, such as an executable file, in order to spread. Worms do not need to attach toanything to spread and can tunnel themselves into computers.

■ Denial-of-service attack (DoS)—floods a Web site with so many requests for service that itslows down or crashes the site.

■ Distributed denial-of-service attack (DDoS)—attacks from multiple computers that flood a Web site with so many requests for service that it slows down or crashes. A common type isthe Ping of Death, in which thousands of computers try to access a Web site at the same time,overloading it and shutting it down.

■ Trojan-horse virus—hides inside other software, usually as an attachment or a downloadablefile.

■ Backdoor programs—viruses that open a way into the network for future attacks.

■ Polymorphic viruses and worms—change their form as they propagate.



mplementing information security lines of defense through people first and through tech-nology second is the best way for an organization to protect its vital intellectual capital.

The first line of defense is securing intellectual capital by creating an information securityplan detailing the various information security policies. The second line of defense is invest-ing in technology to help secure information through authentication and authorization, pre-vention and resistance, and detection and response.

P L U G - I N S U M M A R Y*

K E Y T E R M S*


Authentication, 224 Backdoor program, 227 Biometrics, 224 Black-hat hacker, 227Content filtering, 225 Cracker, 227 Cyberterrorist, 227Denial-of-service attack

(DoS), 227Distributed denial-of-service

attack (DDoS), 227Encryption, 225Firewall, 222, 225

Thinking Like the Enemy

David and Barry Kaufman, the founders of the six-year-old Intense School, recently addedseveral security courses, including the five-day “Professional Hacking Boot Camp” and “So-cial Engineering in Two Days.”

Information Technology departments must know how to protect organizational information.Therefore, organizations must teach their IT personnel how to protect their systems, espe-cially in light of the many new government regulations, such as HIPPA, that demand securesystems. The concept of sending IT professionals to a hacking school seems counterintuitive;it is somewhat similar to sending accountants to an Embezzling 101 course. The IntenseSchool does not strive to breed the next generation of hackers, however, but to teach its stu-dents how to be “ethical” hackers: to use their skills to build better locks, and to understandthe minds of those who would attempt to crack them.

The main philosophy of the security courses at the Intense School is simply “To know thyenemy.” In fact, one of the teachers at the Intense School is none other than Kevin Mitnick,the famous hacker who was imprisoned from 1995 to 2000. Teaching security from the hacker’sperspective, as Mitnick does, is more difficult than teaching hacking itself: A hacker justneeds to know one way into a system, David Kaufman notes, but a security professional needsto know all of the system’s vulnerabilities. The two courses analyze those vulnerabilities fromdifferent perspectives.

Hacker, 227Hactivist, 227Hoaxes, 226Information security, 220Information security plan, 221 Information security policy, 221 Insider, 220Intrusion detection software

(IDS), 222 Malicious code, 226 Polymorphic virus and

worm, 227

Script kiddies or script bunnies, 227

Smart card, 224 Sniffer, 226Social engineering, 223Spam, 225Spoofing, 226 Token, 224Trojan-horse virus, 227Virus, 227White-hat hacker, 227 Worm, 227

C L O S I N G C A S E O N E*

I



The hacking course, which costs $3,500, teaches ways to protect against the mischief typ-ically associated with hackers: worming through computer systems through vulnerabilitiesthat are susceptible to technical, or computer-based, attacks. Mitnick’s $1,950 social engi-neering course, by contrast, teaches the more frightening art of worming through the vulner-abilities of the people using and maintaining systems—getting passwords and accessthrough duplicity, not technology. People that take this class, or read Mitnick’s book, The Artof Deception, never again think of passwords or the trash bin the same way.

So how does the Intense School teach hacking? With sessions on dumpster diving (the un-savory practice of looking for passwords and other bits of information on discarded papers),with field trips to case target systems, and with practice runs at the company’s in-house “tar-get range,” a network of computers set up to thwart and educate students.

One feature of the Intense School that raises a few questions is that the school does notcheck on morals at the door: Anyone paying the tuition can attend the school. Given the po-tential danger that an unchecked graduate of a hacking school could represent, it is surpris-ing that the FBI does not collect the names of the graduates. But perhaps it gets them any-how—several governmental agencies have sent students to the school.10

Questions1. Describe how an organization can benefit from attending one of the courses offered at

the Intense School. 2. Explain the two primary lines of security defense and how organizational employees

can use the information taught by the Intense School when drafting an information se-curity plan.

3. Determine the differences between the two primary courses offered at the IntenseSchool, “Professional Hacking Boot Camp” and “Social Engineering in Two Days.” Ex-plain which course is more important for organizational employees to attend.


Homeland Security

“Our first priority must always be the security of our nation. . . . America is no longer protectedby vast oceans. We are protected from attack only by vigorous action abroad, and increasedvigilance at home.”—President George W. Bush, State of the Union Address, January 29, 2002

Homeland Security Facts

■ There are more than 1 million firefighters in the United States, of which approximately750,000 are volunteers.

■ Local police departments have an estimated 556,000 full-time employees includingabout 436,000 sworn law enforcement personnel. Sheriff’s offices reported about291,000 full-time employees, including about 186,000 sworn officers.

■ There are more than 155,000 registered emergency medical technicians.■ The United States has a 7,500-mile land and air border shared with Canada and Mex-

ico and an exclusive economic zone encompassing 3.4 million square miles.■ Each year, more than 500 million people are admitted into the United States, of which

330 million are noncitizens.■ On land, 11.2 million trucks and 2.2 million rail cars cross into the United States while

7,500 foreign-flag ships make 51,000 calls in U.S. ports annually.

C L O S I N G C A S E T W O*



The issue of homeland security is more paramount today than ever before, for all nationsand around the world. Businesses and government agencies are experiencing new chal-lenges in protecting their nation’s interests, and they are continually searching for new andbetter ways to support security efforts.

One such effort includes exploring new ways to manage, mine, and share huge volumes ofvital information. One terabyte of information is equal to one trillion bytes of information andcan contain more than 300 feature length films. To implement strong homeland security, busi-nesses and governments must share thousands of terabytes of information. Governmentagencies and corporations today are making tremendous strides in working together to de-ploy systems to help build strong homeland security. Here are a few examples of the newhomeland security efforts taking place across the United States:

Oregon’s Firehouse Responds Three Times Faster with New EmergencyResponse System

Gresham, Oregon, is the largest suburb of Portland and the fourth largest city in the state. Bal-ancing rapid growth with a tight economy is difficult and the city is using technology to stretchits resources while providing the best possible services. One obstacle the city had to over-come was replacing its old systems, which could not even handle multiple users or providesimple information analysis. Gresham decided to implement a new system that helps fire, po-lice, and emergency personnel better prepare for and respond to emergencies.

Firehouse, the Fire & Emergency Services System, allows fire personnel to enter informa-tion upon returning from an incident involving emergency medical care, fires, rescues, and/orhazardous material problems. The system records information on the location of the incident,the time of the emergency call, the time the crew arrived on the scene, the nature of the inci-dent, treatments given, and so on. Firehouse then analyzes the information to ensure the firepersonnel are providing the most effective and efficient means of delivering its services.

One example of how Gresham has used Firehouse’s analysis capability was crunchingthrough recent traffic accident information determining that most accidents occurred around10:30 P.M. in a certain part of the city. Gresham officials then deployed extra emergency med-ical units in that location at that particular time. Being able to analyze information quickly andfrom many different angles supports planning accuracy based on hard information rather thanguesswork. It helps Gresham allocate resources more intelligently and spend taxpayers’money more wisely.

California’s Emergency Response Operations Center

Orange County, California, Emergency Operations Center (EOC) serves as a nerve center forcountywide disaster-response operations for a population of nearly 3 million. The EOC must beup and running in 30 minutes in the event of a catastrophe and house many public safety offi-cials and county department heads, allowing them to deliver a unified response to majoremergencies. The center has a cart plugged in and ready to go with 20 preprogrammed wire-less laptops loaded with all the software needed to handle information flows for emergencymanagement. The technology allows the officials to network within the building as well aswith state and local agencies and other EOCs to obtain the most current disaster information.

California’s Enabled Motorcycle Officers

Laptop computers provide law enforcement personnel with access to vital database informa-tion including the department’s records management system, warrants, restraining orders,driving records, and criminal histories. Laptops are relatively common in police patrol carsand for the first time ever the Newport Beach Police Department is going to deploy laptopcomputers to its motorcycle officers. The police department is mounting notebook computerson the back of its motorcycle officers’ bikes. The system provides access to vital information




and even provides court-calendar information, computer-aided dispatch information, andlinks to Newport Beach’s vehicle location system. Dispatchers now have the ability to trackofficers’ locations and quickly route them to emergency calls. The Newport Beach Police De-partment realizes that motorcycle officers have the same responsibilities, vulnerabilities, andneed for information as the patrol officers. The new technology is enabling the police depart-ment to get as much information as possible into the field—to the people who really need it.

Texas Health Network

The public health officials in Texas use the Health Alert Network (HAN) to respond to healthcare crises and terrorist attacks. HAN is an advanced Web-based solution that integrateshealth departments across the state. HAN equips state and local health care agencies withthe technology to react more effectively to disease outbreaks and terrorist attacks. It will alsoarm them to counter bioterrorism attacks, an important consideration in an era of heightenedsecurity. In the event of a bioterrorism attack, the system can share information among hos-pitals, clinics, and local health departments simultaneously, allowing the facilities to quicklyrealize that they have a health emergency and begin working on a solution.

The system currently supports 64 local health departments 24 hours a day, seven days aweek. The system will need to eventually support several thousand health officials through-out the Texas public health care system.

Homeland security is crucial to our nation’s future and by using technology in new and in-novative ways, we will be able to ensure its integrity and vitality.11

Questions1. Determine a few of the information security policies that might be implemented along

with Gresham’s new Firehouse system.2. Identify how an information security plan can help the Newport Beach Police Depart-

ment’s vehicle location system be more successful. 3. How can the Texas Health Network use prevention and resistance technologies to as-

sist in preventing a crisis? 4. Explain how Orange County California’s Emergency Operations Center (EOC) might use

authentication and authorization technologies to ensure the center’s information secu-rity.

5. Research and identify an area of homeland security, not discussed in this case, thatuses detection and response technologies to assist in protecting intellectual capital.


1. Firewall DecisionsYou are the CEO of Inverness Investments, a medium-sized venture capital firm that special-izes in investing in high-tech companies. The company receives over 30,000 e-mail mes-sages per year. On average, there are two viruses and three successful hackings againstthe company each year, which result in losses to the company of about $250,000. Currently,the company has antivirus software installed but does not have any firewalls installed.

Your CIO is suggesting implementing 10 firewalls for a total cost of $80,000. The esti-mated life of each firewall is about 3 years. The chances of hackers breaking into the sys-tem with the firewalls installed are about 3 percent. Annual maintenance costs on the fire-walls is estimated around $15,000. Create an argument for or against supporting your CIO’srecommendation to purchase the firewalls.

M A K I N G B U S I N E S S D E C I S I O N S*



2. Drafting an Information Security PlanMaking The Grade is a nonprofit organization that helps students learn how to achieve bet-ter grades in school. The organization has 40 offices in 25 states and over 2,000 employees.The company is currently building a Web site to offer its services online. You have recentlybeen hired by the CIO as the Director of Information Security. Your first assignment is to de-velop a document discussing the importance of creating information security polices andan information security plan. Be sure to include the following:

■ The importance of educating employees on information security.■ A few samples of employee information security policies.■ Other major areas the information security plan should address. ■ Signs the company should look for to determine if the new site is being hacked.■ The major types of attacks the company should expect to experience.

3. Preventing Identity TheftThe FBI states that identity theft is one of the fastest-growing crimes. If you are a victim ofidentity theft, your financial reputation can be ruined, making it impossible for you to casha check or receive a bank loan. Learning how to avoid identity theft can be a valuable ac-tivity. Research the following Web sites and draft a document stating the best ways to pre-vent identity theft. ■ The Federal Trade Commission Consumer Information on ID theft at www.consumer.

gov/idtheft■ The Office of the Comptroller of the Currency at www.occ.treas.gov/chcktfd.idassume.

htm■ The Office of the Inspector General at www.ssa.gov/oig/when.htm■ U.S. Department of Justice at www.usdoj.gov/criminal/fraud/idtheft.html

4. Discussing the Three Areas of SecurityGreat Granola Inc. is a small business operating out of northern California. The companyspecializes in selling unique homemade granola and its primary sales vehicle is through itsWeb site. The company is growing exponentially and expects its revenues to triple this yearto $12 million. The company also expects to hire 60 additional employees to support its grow-ing number of customers. Joan Martin, the CEO, is aware that if her competitors discoverthe recipe for her granola, or who her primary customers are, it could easily ruin her busi-ness. Joan has hired you to draft a document discussing the different areas of informationsecurity, along with your recommendations for providing a secure e-business environment.



PACE MEDICAL CENTRE Case 77© The McGraw−Hill Companies, 2002

��

�

��

��

��

�� !�� "�� #� #�� "�� $�� !�� !�� %�� & �� '�� ( �� )� �� ( ��#� ��*�� +�� ,��#��-�� !�� .�� * ��

��

�� !��"�� !�� #�� "�� "�� !�� $��%� �� !�� #��"�� "��#�� &��'��


PACE MEDICAL CENTRE Case78 © The McGraw−Hill Companies, 2002

��

��

��

�� #�� (�� )�� )�� *�� #�� #��'��*�� #�� )�� +�� (�� '�� (� �� ,�� -�,� �-��,�� *�-��*�� -�� -�,� �� #�� "��-�,� �� #��"��*��*�� -�,� �� )�� )�� #� �� )��

�� #�� (�� *�� -�� (�� $��%� ��



��

��

��#�� &�� .�� "�� #�� '�� "�� "�� *��.�� '�� #�� !�� !��.�� #�� )��"�� #�� #�� *�� *��

�� &�� -�,'��*� �� .�� #�� #��



��

��

�� *�� #�� *�� &�� "�� )�� )�� !�� &��

��&��*�� "�� "�� /��#�� #�� '� �� "�� &�� &�� &�� $��%��"�� '�� #�� "��/�� 0��,��



��

��

��

�� !��!�� !�� !��"�� (��(�� "�� "�� "�� !�� &��)��/��0��,�� !�� "�� !�� !��#�� "��+�� '�� &�� '��"�� !��/��+�� *�� *�� !�� $��%�� *��!�� !��.�� *�� #�� /��#�� #�� 1��



��

��

��

�"�� '�� *�� #�� )�� !�� &��

�"�� "�� !�� !�'��$��%� !�� "�� "�� "�� "��#�� &�� '�� "��

�� '� ��



��

��

��

��

��

�� '�� '� �� '��!��

��

��*�� #��

��

�� *�� $��%� �� /�� #�� #��

��

�� "��

�� (� ��

��

"��



��

��

��

��

�� .��

�� #��

�"��(��(�� !�� *�� (��)�� /��0��,�� /�� ,�� $��%� �� #�� *�� /��#�� )��



��

��

��

�� +�� 2�� 3��4�� $5�� *�� *��%� �� &��

��0��6�� 3��4�� $��

��%�*�� -�� 0�� 3��4�� $�� !��

��&��%� �� 7�� 0��/��6��

�� *�� 3��4�� $�� "�� *�� "��

-�� #�� %� *�� *��!�� /�� 6��

��



��

��

��

��

��

�

�� !"��

��

��

��

��

��#�!$�$�

��

��

� ��

��

��

��%� �!"��&�'�(��



��

��

��

��

��

��,��0��

��

��

7�� "��/��+��-��!��*��

7��!�� !�� /��!��-��"�� "��"�!��,��!��-��"��*��*��!��

7��!��/��/��8��!��2��!�� !�� !��-��*��#�7��!��

7��2��!��!��

��



��

��

��

��)��

��

�!��#�� .��

89Harvard Business Review Management of Information Systems Articles

Just−in−Time Delivery Comes to Knowledge Management

Article © The McGraw−Hill Companies, 2004

Just-in-Time DeliveryComes to Knowledge Management

by Thomas H. Davenport and John Glaser

Reprint r0207h

90 Harvard Business Review Management of Information Systems Articles






HBR Case Study r0207aThe Best of IntentionsJohn Humphreys

Big Picture r0207bLet’s Put Consumers in Charge of Health CareRegina E. Herzlinger

Different Voice r0207cManagement by Fire: A Conversation with Chef Anthony Bourdain

When Paranoia Makes Sense r0207dRoderick M. Kramer

The Growth Crisis – and How to Escape It r0207eAdrian J. Slywotzky and Richard Wise

The Mismanagement of Customer Loyalty r0207fWerner Reinartz and V. Kumar

Campaigning for Change r0207gLarry Hirschhorn

Best Practice r0207hJust-in-Time Delivery Comesto Knowledge ManagementThomas H. Davenport and John Glaser

Tool Kit r0207jMake Your Values Mean SomethingPatrick M. Lencioni

July 2002







Copyright © 2002 by Harvard Business School Publishing Corporation. All rights reserved. 5

r. Bob Goldszer is the associ-ate chief medical officer and head of the Special Services

Department at Brigham and Women’sin Boston, one of the nation’s leadinghospitals. A professor at the HarvardMedical School, Goldszer has both anMD and an MBA.He’s a high-end knowl-edge worker at the top of the medicalprofession.

Yet Dr. Goldszer has a big problem –one common to all physicians. There isso much knowledge available about hiswork that he cannot possibly absorb itall. He needs to know something aboutalmost 10,000 different diseases andsyndromes, 3,000 medications, 1,100 lab-oratory tests, and many of the 400,000articles added each year to the biomed-ical literature. Even if he were to consultonly those articles written by his col-leagues at Partners HealthCare (theBoston-based umbrella organizationthat includes Brigham and Women’s,Massachusetts General, and severalother hospitals and physicians’ groups),he would need to choose among 202 on

Knowledge-sharing

programs often fail

because they make it

harder, not easier, for

people to do their jobs.

But the novel approach

taken by Partners

HealthCare offers hope.

by Thomas H. Davenport

and John Glaser

B e st P r a c t i c e

D

Just-in-Time DeliveryComes to Knowledge Management

hypertension, 139 on asthma, and 313on diabetes. As a primary care physi-cian, he must know something like amillion facts, and those facts are con-stantly changing. Clearly, it is difficultfor Goldszer to stay on top of even afraction of all the new knowledge beinggenerated in his field and still do his job.

This is not a trivial problem. It is, quiteliterally, a matter of life and death. Overthe past decade, researchers have donea series of studies on medical errors. Theresults are sobering. The Institute ofMedicine’s 1999 report To Err Is Humansuggests that more than a million in-juries and as many as 98,000 deathseach year are attributable to medical er-rors. Partners’own research in 1995 sug-gested that more than 5% of patientshad adverse reactions to drugs whileunder medical care; 43% of those inpa-tient reactions were serious, life threat-ening, or fatal. Of the reactions thatwere preventable, more than half werecaused by inappropriate drug prescrip-tions. About a third of the marginallyabnormal pap smears and mammograms




Even the successful ones require motiva-tional schemes and some arm-twistingfrom senior executives.

But there is a better approach to in-formation sharing and retrieval. The keyto success, we’ve found, is to bake spe-cialized knowledge into the jobs ofhighly skilled workers – to make theknowledge so readily accessible that itcan’t be avoided. This is the main ap-proach Partners HealthCare has takento address Dr. Goldszer’s problem. Part-ners has made his job easier by helpinghim avoid mistakes, learn from otheremployees’ experiences, and access im-portant information when he needs tomake decisions. While there are severalways to bake knowledge into knowl-edge work, the most promising ap-proach is to embed it into the technol-ogy that knowledge workers use to dotheir jobs. That approach ensures thatknowledge management is no longer a separate activity requiring additionaltime and motivation.

We believe that this method couldrevolutionize knowledge managementin the same way that just-in-time sys-tems revolutionized inventory man-agement – and by following much thesame philosophy. In this article, we’lldiscuss how just-in-time knowledge hasbeen embedded into Dr. Goldszer’swork and other physicians’ work at afew Partners hospitals. We’ll also con-sider the circumstances that make itpossible–or impossible–to bake knowl-edge into the work processes of otherhigh-end professionals.

Partners’ Ambitious Project

Embedding knowledge into everydaywork processes is time-consuming andexpensive. It’s not an undertaking thatanyone in his right mind would tacklewithout a very good reason.A decade ago,Partners had that reason: Researchersat the Harvard School of Public Healthand Harvard Medical School found thatthere were surprisingly high numbersof medical errors and adverse drug re-actions at Partners hospitals. That theseinstitutions could be unconsciously act-ing in direct opposition to their healingmission was deeply troubling.

Under the direction of H. RichardNesson, CEO of Brigham and Women’sat the time, Partners undertook an am-bitious and risky project to link massiveamounts of constantly updated clinicalknowledge to the IT systems that sup-ported doctors’work processes.The proj-ect was ambitious because it had the po-tential to substantially improve the

quality of physicians’ decision making–and hence improve the quality of pa-tient care. But it was also risky becauseknowledge-based systems had a veryspotty record of success in their first in-carnation two decades ago and becausePartners didn’t really know if it wouldbe able to codify the millions of factsand data points that doctors use to makecomplex decisions about treatment.

So the project was defined relativelynarrowly at first. Partners professionalstargeted an essential work process –physician order entry – and a problemthat was well documented – errors indrug prescriptions and lab-test order-ing. Drug interactions are relativelystraightforward and easy to program;this fact, too, improved the project’schances for success.

The decision to focus on the order-entry system was important because thesystem is central to physicians deliver-ing good medical care. When doctorsorder tests, medications, or other formsof treatment, they’re translating theirjudgments into actions. This is the mo-ment when outside knowledge is mostvaluable. Without the system, doctorswould have no easy way to access oth-ers’ knowledge in real time. Automated

6 harvard business review

B E ST P R A C T I C E • Just - in-Time Knowledge Management

Thomas H. Davenport is the director ofAccenture’s Institute for Strategic Changein Cambridge, Massachusetts, and a man-agement professor at Babson College inWellesley, Massachusetts. John Glaser isthe vice president and CIO of PartnersHealthCare System in Boston.

The key to success is

to bake specialized

knowledge into the jobs

of highly skilled workers –

to make the knowledge so

readily accessible that it

can’t be avoided.

received no documented follow-up. Astudy of the six most common labora-tory tests ordered by physicians in Brig-ham and Women’s surgical intensivecare unit found that almost half of thetests ordered were clinically unneces-sary. Another study at the Brighamfound that more than half of the pre-scriptions for a particular heart medi-cine were inappropriate.

Some of these mistakes result fromcarelessness, but far more of them, webelieve,occur because the clinicians musttrack such massive amounts of complexinformation. The problem of stayingon top of all the knowledge availablein a given profession is not restricted tomedicine, of course. Knowledge work-ers in many other fields have problems similar to Dr. Goldszer’s, though gener-ally theirs are less life threatening. Nomatter what the industry, knowledgeworkers often can’t keep up with theknowledge being generated. And al-though failure to keep up with currentinformation may not result in deaths, itcan lead to less successful projects andproducts, wasted resources, and brokenbusinesses.

Knowledge management, which wasall the rage in the mid- to late 1990s, isstill a good idea, but it needs a new ap-proach. In the early years of knowledgemanagement, companies establishedemployee networks and communitiesof practice, built knowledge reposito-ries, and tried to encourage informationsharing. Knowledge workers were ex-pected to participate in these activitiesin addition to doing their regular jobs.That meant staying a little later eachnight to share what they’d learned inthe course of doing their jobs and com-ing in a little earlier each morning tolearn from others. As a result, the pro-grams, many of which continue today,have been only marginally successful.




order entry addresses this need in sev-eral ways: It increases efficiency andsafeguards against errors due to poorlywritten orders. Even more important, itallows physicians easy access to massiveamounts of up-to-date medical knowl-edge while they go about their dailywork. Indeed, the order-entry systemforces physicians to engage with queriesor recommendations (although, as weshall see, they can always override thesystem’s recommendations).

Order entry is a key work process inthis system, but it’s not the only one.Partners’ approach is built on a set ofintegrated information systems – in-cluding on-line referral and medical-records systems–that physicians can useto manage patient care. These all drawfrom a single database of clinical infor-mation and use a common logic enginethat runs physicians’ orders through aseries of checks and decision rules.

Here’s how it works. Let’s say Dr.Goldszer has a patient, Mrs. Johnson,and she has a serious infection. He de-cides to treat the infection with ampi-cillin. As he logs on to the computer to order the drug, the system automati-cally checks her medical records for al-lergic reactions to any medications.She’s never taken that particular med-ication, but she once had an allergic re-action to penicillin, a drug chemicallysimilar to ampicillin. The computerbrings that reaction to Goldszer’s atten-tion and asks if he wants to continuewith the order. He asks the system whatthe allergic reaction was. It could havebeen something relatively minor, like a rash, or major, like going into shock.Mrs. Johnson’s reaction was a rash. Gold-szer decides to override the computer’srecommendation and prescribe the orig-inal medication, judging that the posi-tive benefit from the prescription out-weighs the negative effects of a relativelyminor and treatable rash. The systemlets him do that, but it requires him togive a reason for overriding its recom-mendation.

The fact that the order-entry systemis linked not just with the clinical data-base but also with the patient’s recordsincreases its usefulness by an order of

through a pager and can then visit thepatient directly or call in a new treat-ment. Minor variations are routed to thenurses’station, and the nurse can decidewhether to call in the physician.

The power of knowledge-based order-entry, referral, computerized medical-record, and event-detection systems isthat they operate in real time. Knowl-edge is brought to bear immediatelywithout the physician having to seek itout. In some situations, physicians canconsult with other experts in real time,via teleconferencing and other tech-nologies. Such practices are still in theirearly stages, but they show great prom-ise. For example, if a patient on Nan-tucket island experiences what his doc-tor suspects is a stroke, he needs to bediagnosed and treated within an houror his chances for full recovery dropprecipitously. By the time he is flown toCape Cod Hospital, it might be too late.If a specialist in Boston, or for that mat-ter in Tel Aviv, can interview the patientover a videoconference screen, observehow he speaks and moves, and reviewscan results, the likelihood of effectivetreatment will go way up.

Partners has also assembled manyother knowledge resources that are notaccessible in real time but are valuablenonetheless. These sources are moreextensive than what’s in the clinical-information database. However, they’relike traditional knowledge-managementsystems in that users need to seek themout. The organization’s on-line sources(collectively called The Handbook) in-clude on-line journals and databases,care protocols or guidelines for partic-ular diseases, interpretive digests pre-pared by Partners physicians, formu-laries of approved drugs and details ontheir use, and even on-line textbooks.All of these resources are accessiblethrough an integrated intranet portal.It’s an unusually good set of resources,but they’re not different in kind fromthose that practitioners at other hospi-tals can consult. The Handbook is ac-cessed, across all Partners institutions,about 3,000 times a day. Contrast thiswith the 13,000 orders submitted a dayat Brigham and Women’s alone; even

july 2002 7

Just - in-Time Knowledge Management • B E ST P R A C T I C E

magnitude. The system may informGoldszer that a drug being prescribed isnot economical or effective, but it canalso tell him that the patient is takinganother drug that interacts badly withthe new medication or one that mightexacerbate a condition other than theone being treated. When it comes to or-dering tests for a patient, the systemmay note that a particular test is gener-ally not useful in addressing the symp-toms identified or that it has been per-formed on the patient enough timesthat a retest would not be useful.

That’s a relatively simple explana-tion of what the integrated system does,but, in fact, the logic engine and theknowledge base can serve as very so-phisticated screens for the physicians’decisions. For instance, imagine that apatient with a history of sleep apnea isprescribed a narcotic to mitigate painafter surgery. Narcotics can cause peo-ple with sleep apnea to go into respira-tory arrest, but, as long as the history of sleep apnea is noted in the patient’smedical records, the system will alertthe physician to that potential problem.It also takes into account the patient’sage, likely metabolism, probability ofrenal failure, maximum allowable life-time amounts of a chemotherapy agent,and hundreds of other factors.

The logic engine and knowledge baseat Partners are used more during orderentry than at any other time. But theyare used increasingly during normal re-view of patient medical records as well.For example, the system alerts the physi-cian, as he or she reviews Mrs. Smith’srecord, to follow up on her marginallyabnormal mammogram or to recheckher cholesterol levels. In addition, it mayremind a physician that a particular pa-tient should receive a call or schedule a follow-up appointment.

There are, of course, times when aphysician isn’t treating a patient directlyyet still needs to know that somethinghas happened. For these times, Partnersdeveloped an event-detection systemthat alerts a physician when a hospi-talized patient’s monitored health indi-cators depart significantly from whatis expected. The physician is notified




practice figures changed. However, Part-ners, which insures itself for malprac-tice, has some early data suggesting thatmalpractice reserves can be smaller be-cause of fewer drug-related claims.

Keys to Success

Developing a system like Partners’ isn’teasy – from either a technical or a man-agerial standpoint. Few off-the-shelfsoftware packages used for knowledge-intensive business processes allow in-dividuals and organizations to embedtheir own knowledge into systems. Part-ners had to develop most of its systemsfrom scratch, creating a complex infor-mation and technology infrastructurethat pulled together the knowledge baseand logic modules with an integratedpatient-record system, a clinical-decisionsupport system, an event-managementsystem, an intranet portal, and severalother system capabilities. Other hospi-tals have some or all of these capabili-ties, but Partners’ real-time knowledgeapproaches are undoubtedly at the cut-ting edge.

The technical underpinnings of anembedded-knowledge system are key,but just as important are the nontech-nical, managerial aspects required tokeep the system running smoothly.Several of these aspects–each of whichwould be relevant to any organizationseeking to bake knowledge into itswork – are described below.

Support from the Best and Brightest.

Building a system like Partners’ is a chal-lenging IT project, to be sure. But thencomes an even harder task: Convincingknowledge workers, no matter what en-vironment or field they’re in, to supportthe system and the new way of working.The growing concern over medical er-rors provided that motivation at Part-ners; absent a similar sense of pressingneed, it probably wouldn’t have gottenoff the ground.

An Expert and Up-to-Date Knowledge

Base. If Partners’ clinical database in-cluded idiosyncratic, untested, or obso-lete knowledge, it would put patients –and Partners itself – at high risk. Thus,only clinicians at the top of their gamecan create and maintain the knowledge

repository. Partners has addressed thisissue by forming several committees,and empowering existing ones, to iden-tify, refine, and update the knowledgeused in each domain. For instance, themedication recommendations in the system come from drug therapy com-mittees. Teams of specialists design careprotocols for particular diseases. Andradiology utilization committees havedeveloped logic to guide radiology testordering. Participation in these groupsis viewed as a prestigious activity, sobusy physicians are willing to devoteextra time to codifying the knowledgewithin their fields.

Prioritized Processes and Knowledge

Domains. Since these initiatives are dif-ficult and expensive, they should onlybe undertaken for truly critical knowl-edge work processes. At Partners, it wasrelatively easy to identify which med-ical care processes were the most cru-cial, but important decisions still neededto be made about which disease do-mains and medical subprocesses to ad-dress – for example, ordering medica-tions versus referring a patient to aspecialist–and in what order. Fields withmany disease variations and multipletreatment protocols, such as oncology,are more difficult to include in the knowl-edge systems. In general, it’s preferableto develop systems in fields with low lev-els of ambiguity, a well-established ex-ternal knowledge base, and a relativelylow number of possible choices facingthe decision makers.

Final Decisions by the Experts. Withhigh-end knowledge workers like physi-cians, it would be a mistake to removethem from the decision-making process;they might end up resenting or rejectingthe system if it challenged their role –and with good reason. Because over-reliance on computerized knowledgecan easily lead to mistakes, Partners’sys-tem presents physicians with recom-mendations, not commands. The hope isthat the physicians will combine theirown knowledge with the system’s. Outof the 13,000 orders entered on an av-erage day by physicians at Brigham andWomen’s, 386 are changed as a resultof a computer suggestion. When med-

8 harvard business review

B E ST P R A C T I C E • Just - in-Time Knowledge Management

though it’s invisible to the clinicians, theinformation embedded in the order-entry system is used far more inten-sively than The Handbook is.

While Partners’embedded-knowledgeprogram has been under developmentfor more than a decade, it’s still not com-plete. The on-line order-entry systemand related knowledge are only accessi-ble within the organization’s two flag-ship hospitals, Mass General and Brig-ham and Women’s. Medical knowledgehas not yet been codified for all the dis-eases that Partners physicians treat. Butthe approach is clearly beneficial. A con-trolled study of the system’s impact onmedication errors found that serious er-rors were reduced by 55%. When Part-ners experts established that a new drugwas particularly beneficial for heartproblems, orders for that drug increased

from 12% to 81%. When the system beganrecommending that a cancer drug begiven fewer times per day, the percent oforders entered for the lower frequencychanged from 6% to 75%. When the sys-tem began to remind physicians that pa-tients requiring bed rest also needed theblood thinner heparin, the frequency ofprescriptions for that drug increasedfrom 24% to 54%.

These improvements not only savelives, they also save money. For starters,the system now recommends cheaperas well as more effective drugs. Evenmore important, it helps prevent longerhospital stays and repeat tests that resultfrom adverse drug events (ADE). Thatcan save a facility large sums of money,since a 700-bed hospital will normallyincur about $1 million per year in pre-ventable ADE costs.Order entry with em-bedded knowledge is still rare enoughthat U.S. insurers have not yet seen theircosts go down, nor have national mal-

Embedded-knowledge

initiatives should only be

undertaken for truly critical

knowledge work processes.




ication allergies or conflict warningsare generated, a third to a half of the or-ders are canceled. The hospital’s event-detection system generates more than3,000 alerts per year; as a result of thesealerts, treatments are changed 72% ofthe time–a sign that the hybrid human-computer knowledge system at Partnersis working as it should.

A Culture of Measurement. In orderto justify the time and money spent onan embedded-knowledge system, andto assess how well it’s working, an orga-nization needs to have a measurement-oriented culture. Partners has alwayshad a strong measurement culture be-cause it is an academic medical centerand because most of its senior clini-cians are also researchers. Its knowledgemanagement approach has only fur-thered the emphasis on measurement.The tracking mechanisms within theorder-entry system can detect whetherthe physicians use the knowledge andchange their treatment decisions, whichis the only way to know that the sys-tem is working. The measures are usedas justifications and progress reportingtools for efforts to reengineer and con-tinuously improve care processes.

The Right Information and IT People.

Whenever knowledge technologies areapplied to business problems, it’s tempt-ing to attribute any success to the tech-nology. But in the case of Partners’ sys-tem, and in many others we’ve seen,success is based mostly on the people

behind the technology. An IT organiza-tion that knows the business and canwork closely with key executives andknowledge-rich professionals is impor-tant. A “back room” IT group couldnever successfully build a system of thistype. Also important is a staff that isskilled in information management. Inhealth care, this discipline is called med-ical informatics, and Partners has re-cruited leaders in this field. It has severalmedical informatics departments, in-cluding Clinical and Quality Analysis,Medical Imaging, Telemedicine, andClinical Information Systems R&D. Theleaders of each of these departmentsare doctors, but they also have advanceddegrees in fields such as computer sci-ence, statistics, and medical informatics.

• • •In general, it’s easier to embed knowl-edge into the work of less-skilled work-ers; the higher you go, the harder it gets.But organizations are gradually learninghow to make the concept work at alllevels. Customer service representativeswithout a great deal of technical skillnow have highly scripted jobs. Manyhighly skilled reps at high-tech firms likeHewlett-Packard, Dell, and Xerox workwith computer systems that rapidly sup-ply knowledge to help them resolve cus-tomers’ problems. Midlevel knowledgeworkers – programmers, engineers, de-signers–depend increasingly on knowl-edge repositories built into the tech-nology they use to do their jobs. GM’s

july 2002 9

Just - in-Time Knowledge Management • B E ST P R A C T I C E

Vehicle Engineering Centers, for exam-ple, program information about thedesirable dimensions of new vehiclesand the parameters of existing compo-nents into the company’s computer-aided design systems so that car andtruck designers can’t help but employthe knowledge.

Baking knowledge into the work pro-cesses of high-end professionals likephysicians is relatively new. Such pro-fessionals are different from other know-ledge workers: They’re generally paidmore and receive more intensive train-ing; they make decisions based largelyon intuition and years of experience;they’ve historically enjoyed high levelsof autonomy; they’re sufficiently power-ful that the organizations they work forare reluctant to tinker with their workprocesses; and, perhaps most important,they do most of their work away from acomputer screen. All those factors makeit harder to embed knowledge into theirwork processes. But the Partners exam-ple illustrates that it is indeed possibleto inject knowledge directly and effec-tively into the work these professionalsdo, dramatically improving their per-formance. And for people like Dr. Gold-szer and his patients, such improve-ments can make all the difference.

Reprint r0207hTo place an order, call 1-800-988-0886.










101Harvard Business School Management of Information Systems Cases

Medtronic Vision 2010 (A): Transforming for the 21st Century

Case © The McGraw−Hill Companies, 2004

Harvard Business School 9-800-357March 29, 2000

High Tech Fellow, Sheila Marcelo (JD/MBA) and Professor Lynda M. Applegate prepared this case as the basis for class discussion ratherthan to illustrate either effective or ineffective handling of an administrative situation.

Copyright © 2000 by the President and Fellows of Harvard College. To order copies or request permission to reproducematerials, call 1-800-545-7685, write Harvard Business School Publishing, Boston, MA 02163, or go tohttp://www.hbsp.harvard.edu. No part of this publication may be reproduced, stored in a retrieval system, used in aspreadsheet, or transmitted in any form or by any means—electronic, mechanical, photocopying, recording, or otherwise—without the permission of Harvard Business School.

1

Vision 2010 (A): Transforming For The 21st Century

“Some people see things as they are and ask why.We dream things that never were and ask why not.”

George Bernard Shaw

These words echoed through Bill George’s mind long after the applause for his opening speech toMedtronic employees at the annual Global Strategic Direction Meeting, held in January 2000, had faded in theauditorium. As CEO and Chairman, George had led the company in its successful quest to become the undisputedworld leader in delivering medical technologies and services that enabled people with chronic cardiovascular andneurological disease to lead fuller, more productive lives. But, even as they celebrated their success, Georgerecognized that the challenges of the 21st century would demand that the company leverage their considerableassets to transform their company and the health care industry. Throughout 1999, the company had celebratedtheir 50th anniversary. Employees throughout the company had also spent the year defining a new vision andstrategic direction for Medtronic and the industry. This important project was entitled Medtronic.Vision.2010.George’s opening remarks at the annual Global Strategic Direction Meeting described the outcome of the year-longeffort. “Welcome to 2000!,” he said.

All of us have the privilege of, not only witnessing the passing of the century, but also apassing of the millenium. This milestone gives all people a unique opportunity to reflect onhistory and our lives to date, as well as the opportunity to look forward and set new goals andpriorities. Today, we are pleased to announce Medtronic’s bold new vision. 1

Medtronic is the world’s leading medical technology company, providing lifelongsolutions for people with chronic disease.

As you think about this new vision for the company it is important to recognize whathasn’t changed—our commitment to be the world’s leading medical technology company. What isnew, however, are five things: (1) More comprehensive involvement in managing disease—lifelong; (2) Commitment to provide, not just products and therapies, but also—lifelong solutions; (3)Commitment to put patients and their interests first—providing lifelong solutions for people; (4) Ourfocus—on chronic disease; and (5) Our business promise—providing lifelong solutions for people withchronic disease.

1 Prior to Medtronic Vision.2010, the company’s mission, defined in 1995 was: “Medtronic is the world’s leading medicaltechnology company, specializing in implantable and interventional therapies.”

102 Harvard Business School Management of Information Systems Cases



800-357 Medtronic Vision 2010 (A)

2

Our new vision will set the course for a whole new “reinvention” of our company and itsbroader role in health care. It will enable Medtronic to provide more complete products andservices, create new ongoing revenue streams, and contribute to improved quality of life and anoverall reduction in health care costs. It is now the responsibility of leaders throughout Medtronicto make Medtronic Vision.2010 a reality.

Company and Industry Background

Medtronic was founded in 1949 by Earl Bakken, a graduate student in electrical engineering at theUniversity of Minnesota, and his brother-in-law, Palmer Hermundslie. The company began as a medicalequipment repair company, operating out of the brother’s garage in Minneapolis, Minnesota. By the end of the1980s, Medtronic had become a global, diversified medical technology company with sales approaching $800million. William (Bill) W. George, joined Medtronic in 1989 and was appointed CEO in 1991. By the end of itsfiscal year in April 1999, sales approached $5 billion, earnings (prior to pre-tax non-recurring charges) exceeded $1billion and Medtronic claimed leadership positions in each of its major product lines: Cardiac RhythmManagement, Vascular, Cardiac Surgery, Neurological and Spinal Therapy, and ENT. (See Exhibit 1 for a summaryof financial information.)

Cardiac Rhythm Management Since its origin, Medtronic maintained a leadership position in cardiac pacing fortreatment of bradycardia (hearts that beat irregularly or too slow), and more recently tachycardia (hearts that beattoo fast or quiver uncontrollably). In 1999, the company introduced several major cardiac rhythm managementproducts that included adaptive therapies, ablation, and diagnostic systems to treat and monitor atrial fibrillation(rapid, uncontrolled heartbeats in upper chamber) and heart failure (the inability of the heart to maintain itsworkload of pumping blood to the body). In addition, Medtronic merged with Physio-Control, a leading providerof external defribrillators, making Medtronic the only company in the world offering a full-range of defribrillatorsfrom automated to implantable devices.

Vascular Therapy Medtronic provided coronary vascular products which includes several types of cathetersused to unblock coronary arteries, stents that support the walls of an artery and prevent additional blockage, andproducts used in minimally invasive vascular procedures for coronary artery disease. In early 1999, Medtronicacquired Arterial Vascular Engineering (AVE)—a global leader in the coronary stent market, to expand its marketshare in the $4 billion vascular market. This allowed the company to further expand its product line to includecatheters, guide wires and stent grafts.

Cardiac Surgery To support cardiac surgeons, Medtronic offered products such as tissue heart valves, andcardiac cannulae used to connect a patient’s circulatory system to external perfusion systems, such as those used insurgeries. In 1999, the Company acquired Avecor to expand the depth of the company's product line in perfusionsystems designed to sustain patients during open-heart surgery. In addition, the Company began development ofinnovative products, such as the Octopus2, which would allow a surgeon to repair blocked blood vessels while theheart is still beating.

Neurological and Spinal Therapy Medtronic also offered advanced, innovative products for neurologicalstimulation, drug delivery therapies and neurosurgery. These products helped relieve some of the delibitatingeffects of cerebral palsy, Parkinson’s disease, chronic back pain, incontinence and other disorders. To enhance itsleadership position in this area, in 1999, Medtronic merged with Sofamor Danek, a technology leader in "internalfixation devices" for delicate spinal surgeries. In addition, Medtronic’s product line was expanded by Midas Rex, amanufacturer of high-speed drills used in neurological surgery.

Not only had Medtronic’s business evolved dramatically in the 1990s, but the medical device industry hadalso been transformed. During the 1990s, consolidation had greatly influenced both the suppliers and thepurchasers of medical devices. The imperative to sustain strong growth, as well as offer a broad product line toeconomic buyers had driven Medtronic and its competitors to expand aggressively through acquisition. As a




Medtronic Vision 2010 (A) 800-357

3

result, by January 2000, Medtronic faced larger and more aggressive competitors than at any time in its history.(See Exhibit 2.)

The consolidation of medical device players also enhanced the considerable barriers to entry in theindustry. As of 1999, R&D spending had become much more concentrated in a few hands, physician relationshipswere deeper with a smaller group of companies, and most importantly, key intellectual property was shared onlybetween a few strong players in a given product line. While these barriers made it unlikely for a significant newcompetitor to emerge and threaten the leading companies in the industry, they also created much fiercer rivalryamong those that were already well-established.

To meet the challenges of the 21st century, in April 1999, Glen Nelson, M.D. and ViceChairman, and ArtCollins, President and Chief Operating Officer, joined Bill George, in launching the Medtronic.Vision.2010 project.Three guiding principles were articulated at the start.

Medtronic is not just a medical technology company.We are in the business of helping patients and families manage chronic disease.

Bill George

When it comes to our current business segments, there are few, if any, companies that have anywhere nearMedtronic’s knowledge of what it takes to treat patients suffering from chronic disease. How can we use thatknowledge to be a more significant contributor in the management of the patient during the course of a chronicdisease? Although great progress has been made over the last 50 years in the treatment of cardiovascular disease, itis still going to be our number one killer. But people are living a lot longer with the disease. I think we can enablethem to live full, active lives by applying our technology. The same is true of many other chronic diseases in theneurological area, in the spinal area, and areas like cancer. If we can put together all of our technology and ourresources, it is possible to dramatically change the parameters of how chronic disease is managed. And in sodoing, I think we can create a better world for the patients and also for health care.

Medtronic is not just a medical technology company.We must also become an information technology and information services company.

Glen Nelson

It is interesting that Medtronic has traditionally thought of itself as a technology company that producedmedical technology products. Today there are important things happening in terms of information technology andthe transfer of information. That said, we must not just be a medical technology products leader, but must alsobecome an information technology leader and an information company. In the simplest sense, we have aresponsibility to be sure that the people who use our products, use them optimally. It will require that we add toour current capabilities if we wish to also help people manage the increasingly complex health problems facing usas we enter the 21st century. It is going to require a really thoughtful effort to leverage the current technologies andthose that are coming in the future at an increasingly faster rate. We may need to cannibalize some of our ownproducts and make dramatic, and sometimes painful, changes. At the same time, we will have to be good stewardsof our resources and those of our partners and customers. Some of the technology that we’ll ultimately use may betoo far in the future for us to develop at this point in time. Drawing a fine line between what we do and don't do,and paying careful attention to how rapidly we adopt new technologies and business models, will, to a largedegree, determine our success.





4

After all the analysis and debate, what should Medtronic do?Art Collins

Undoubtedly we will debate major trends that are underway in our environment and in our industry, andwe will do our best to estimate what will change. . It’s not only important to understand directionally where thesechanges will take us, but also to spend time really understanding how quickly they will become significant in ourfuture. But, after we get done with all that, after we’ve done all our analysis, and we've been as clairvoyant aspossible concerning the future, I would ask all of us to consider … “So what." What are we going to do differently?What has all this analysis and all this future thinking done to change the way we act—today and tomorrow? Willwe allocate our resources differently? Will we focus our organization differently? What, in fact, will we dodifferently? Because, if we don’t change because of the opportunities that the future holds, then it’s been all for not.

Three additional guiding principles were also articulated.

Commitment to Mission and Core Values

While the goal of Medtronic.Vision.2010 was innovation and transformation, management at Medtronicfelt that, in the midst of radical change, it would be essential to keep Medtronic's mission and core values in mind.In the early years of the company, as it struggled to establish itself, founder Earl Bakken first clarified Medtronic’smission. “From the start,” Bakken stated, “we have had one fundamental purpose: to make devices and provideservices that are going to help restore people to full, active, productive, better lives.”

Executives believed that this mission, which had sustained the company for the past 50 years, wouldcontinue to be at the core of the company's values for the next 100 years. In fact, they believed thatMedtronic.Vision.2010 would enable employees throughout the company to renew their commitment to EarlBakken’s early mission, and that it would serve as a core principle in how they made decisions and took actions inthe future. Glen Nelson explained: “My vision for Medtronic in 2010 hinges around the continual accomplishmentof our mission. If we accomplish the mission, the financial targets and the other expectations for the company willbe fulfilled.”

Commitment to People

Art Collins stressed the importance of not losing sight of the fact that people are Medtronic's mostimportant asset—a belief that permeated the company's mission statement.

My vision for the future is focused, not only on what changes will take place in theenvironment and what our strategies will be to maximize our performance, but also on how wedefine the resources that need to be directed toward achieving our goals. On this point, I’d like tobe very clear: the number one resource that we have in this corporation today, as it’s been in thepast and as it will be in the future, is the collective capability of our organization and our people. Itis something that is difficult to quantify. It's not easy to find it in the P&L, the balance sheet, or thecash flow statement. It's not the buildings that we have or the technology per se that makes useffective. It’s our people that will make us successful going forward; they are our single mostprecious resource for the future. If we develop a vision that looks into the next decade, it betteremphasize our human resource.

Catalyzed by Leadership and Empowerment

All agreed that leadership would be necessary for Medtronic to realize its vision—not just leadership fromthe top, but instead, leadership throughout the organization. Building on comments by Art Collins and Glen





5

Nelson, Bill George emphasized that the Medtronic.Vision.2010 process was also important as a mechanism forunleashing the insight, creativity and leadership potential in the company's 22,000 employees around the world.As they executed on the strategies that would flow from Medtronic.Vision.2010, and as employees reached out tophysicians, patients and business partners, the empowerment process would continue. Bill George believed thatpatients, their families and society would be the ultimate beneficiaries.

I’d like every employee in our company to be a leader. People who take leadership roles inour organization—whether it be on the production line or in the boardroom—need to be peoplewho reflect the concern for health and healing that's at the heart of our mission. They need to leadtheir lives in such a way that they become a role model for the rest of the organization and for thepeople with whom we interact. What does this mean? The first thing employees need to do is tobe healthy themselves. My father used to say, “You can’t do anything unless you’re healthy.”They also need to be open-minded and receptive to drawing ideas from others. They need torecognize that hierarchy is not what counts, and status is not what counts. What does count is afocus on restoring people to full life and health. If each individual only does that for one otherperson, we've made a great contribution.

George emphasized that empowering others was at the core of the company's approach.

If we take a servant approach to leadership, we don't need to have all the answers. We'veseen many examples of successful innovation—what it takes to change a life or come up with anew therapy; to work with a doctor who has a great idea that can change the whole course ofhuman disease. That’s the kind of leadership we need. Our vision needs to reflect that kind ofleadership and those values; to create an organization filled with those kind of people. If we dothat well, then I think Medtronic’s future will be extraordinary and that’s the only way we’re goingto realize our vision.

Leadership and Learning: Creating Medtronic.Vision.2010

The Medtronic.Vision.2010 project was launched in April 1999. Chris O'Connell, VP of Corporate Strategy,defined four vision teams that each addressed targeted issues. Employees from all levels and all parts of thebusiness were grouped into four teams to examine various aspects of the company's business in 1999, and topredict how it might change by 2010. Each team was led by an executive sponsor from the business unit and amember of the corporate strategy team. A Central Vision Team, led by O’Connell, and reported directly to theExecutive Committee. Bill George served as the executive sponsor and head of the entire project. In total, 75employees were directly involved in the project.

The teams were encouraged to reach outside the company and to incorporate new thinking and new ideas.While the charge to the teams was clear, the teams were given significant latitude to define the process they woulduse to accomplish their goals. O’Connell commented:

The initial instructions to the teams were quite loose. While I gave some initial directionconcerning the subject matters we would like them to cover, the teams really had the opportunityto define their own direction and their own deliverables. People struggled with the seeming lackof direction but, in the end, we believe the results were much more creative, and the ideas werestronger and deeper than we would have had otherwise.

In early June, each team met for the first time. Although the diverse composition of the teams allowedthem to gather creative ideas throughout the organization, the size of each team posed a challenge. As a result, theteams broke out into subgroups with separate assignments to research topics. The teams met again in July to hearsub-team reports. Between meetings the subgroups researched their topics by examining literature and publishedmarket research on each topic. They conducted meetings with customers and consulted with internal and outside





6

experts. Some examples of outside experts included professors from Harvard Business School and consultingfirms, such as Boston Consulting Group and the Wilkerson Group.

A Central Vision Team was formed early in the process to serve as a funnel for ideas and insights.Functioning in the role of "boundary spanners" the executive members of the team brought new ideas to encouragecross fertilization of ideas and shared insights among the four vision teams. As the process developed, this groupbegan to play a key role in integrating the findings and defining strategic recommendations. The Central VisionTeam met throughout the summer in parallel with the four project teams to identify overriding ideas, to providefeedback to the teams, and to integrate ideas as they came forward.

Recognizing the importance of mobilizing the creativity, insight and leadership potential of all employees,the Vision 2010 process was designed to engage individuals from all business units and all levels. Steve Mahle,president Cardiac Rhythm Management, believed that the initiative was essential for enabling their increasinglydiverse company to achieve a common understanding of Medtronic's future direction.

To me, the value of Medtronic.Vision.2010 is that it links our mission to an idea, a vision, adirection, that can be used to align employees across the organization in a common vision of thestrategic direction for the future. We have that kind of alignment with our mission, we now needalignment with our strategy. Doing this will add a great deal of power to our execution. Whilevision and strategy are absolutely necessary, they are not sufficient for success. Success demandsflawless execution. The power of our 2010 vision is to provide directional focus as we developstrategies and then execute them. An analogy is in mountain climbing, it’s always helpful to beable to look up periodically and see the summit. But, seeing the summit is not enough, to get thereI have to figure out how to get over this boulder or up this ledge. My willingness to do all this andnot get discouraged is reinforced by my ability to look up and say, “Okay. I see the goal, I knowwhere I'm going and how I'm going there.”

I think this is an essential role and responsibility of the leaders in this company. To setdirection for the cardiac rhythm business, I must understand the broader context of Medtronic'sbusiness. We start with the mission, then we create the vision and strategy and then weimplement. The meeting in October is a tremendous opportunity for us. It's the first time we'vebrought all of the parts of Medtronic together. It’s one thing for those of us that have been hereforever to understand the broader context of Medtronic's business. But, it's different when you arein AVE, Physio-Contol or Sofamor Danek or any of the other large businesses that we haverecently acquired. That's the real advantage of the Medtronic.Vision.2010 process and the SeniorManagement Meeting in October. It provides an opportunity to link all of our businesses to abroader understanding of Medtronic’s future. Then each of us will need to go back and figure outwhat we need to do in our respective businesses to make that vision a reality.

Scott Solano, President of Vascular, believed that the biggest challenge in the process was convincingmanagers in Medtronic’s decentralized organizational structure to buy into an integrated vision and the need forchange.

This is not something you can do in a few days. That is the problem… Among these 125managers are people that have been operating for 15 or 20 years under a common set ofassumptions. We’re not going to change that in a few days.

By definition, decentralized means that you have different operating units that think verydifferently. And, the realities of the time frame under which we all operate are going to be verydifferent for the different operating units. There are going to be some specialties where thedynamics of the industry won’t change that dramatically. So to convince people that they have todo something dramatically different today is going to be very difficult.





7

What really matters is the leadership of people working in each organization. They mustbe able to take some general concepts and then drive them into their organization. They must beable to figure out how to make the vision actionable for their own group or specialty. That’s reallygoing to be a challenge. I certainly see it as a challenge for me and my organization. Everybusiness unit must figure out what the vision means to our division and what it means to ourcustomers.

Jodi Harpstead, vice president Cardiac Rhythm Management Global Marketing and U.S. Sales, believedthat choosing and prioritizing a strategic action among the vast array of opportunities over the next ten years wasthe key challenge facing Medtronic.

There’s so much opportunity ahead of us that our biggest challenge will be to decide howto sort through them and determine where to place our bets. The challenge will be to not onlyunderstand the trends and where we might be able to apply technology to help treat thesediseases, but also to determine where money will be made, and where there is an opportunity forour company to uniquely address that opportunity in a way that’s profitable to us. These are muchharder issues to confront than simply defining the trends. We need to do our homework, but thenwe need to take some leaps of faith and decide where to place our bets. We must go forwardcourageously and press forward hoping that we got it right.

Our competition will also be making choices and placing bets. Medtronic, because of oursize, has the opportunity to pursue more opportunities than our competition. This is a majoradvantage for us. At the same time, it makes life a little tougher; we’re going to have moreopportunities among which to decide. While it will take a lot of hard work to make thosedecisions, it’s as much about guts as it is homework. This is a much bigger challenge than sorting itout intellectually.

Medtronic.Vision.2010: Team Findings

Disease Platforms Team

As part of Medtronic’s commitment to its mission to continually improve human welfare, the companyassembled the Disease Platforms Team, which was given the task to find new opportunities in areas whereMedtronic could make unique and worthy contributions. The team focused on two key issues:

1. What chronic diseases are most attractive for Medtronic to serve?

2. What opportunities do we have to build our business around the treatment of chronic disease?

In assessing opportunities for Medtronic to make a difference, the team examined demographic trends andanalyzed the global prevalence of chronic diseases. As of 1996, an estimated 90 million Americans suffered fromchronic conditions, such as cancer, diabetes, AIDS, heart disease, arthritis and emphysema.2 In fact, the number ofpatients with chronic conditions was growing as the global population aged. The team gathered data, whichpredicted that from 1998 to 2025, the median age worldwide would rise from 26 to 32; the trend toward an olderpopulation was even more significant in developed countries, where the median age would rise from 37 in 1998 to43 in 2025.

2 Hoffman, C., Rice, D., Sung, H.Y., “Persons with Chronic Conditions. Their Prevalence and Costs.” JAMA, 1996, 276, 1473-1479.





8

The growing prevalence of chronic diseases continually challenged health care systems in many countries.Chronic disorders accounted for a significant portion of health care expenditures. For example, the costs of healthservices and supplies for non-hospitalized patients with chronic conditions amounted to over $270 billion, makingup 76 percent of direct medical care in the United States.3

In their demographic analysis, the team found that over the next ten years, the world’s population wouldgrow from 6.1 billion to approximately 6.9 billion. During this time period, less developed countries would growfaster than developed countries (0.9% compared to 0.04%) and would comprise approximately 70% of the world’spopulation in 2010. However, in 2010, the geographic areas with the highest GNP per capita would not changesignificantly.

Other less developed countries, like China and India, would continue to have a relatively low overall GNPper capita, but there existed an attractive population in these countries that had the economic means to pay formedical technology. For example, in 1999, China, India and Brazil had a total population of approximately 2.5billion, of which approximately 5% to 10% (or 125 to 150 million people) would have the means to access medicaltechnology. (See Exhibit 3.) This had potentially significant implications for Medtronic’s geographic expansionstrategies moving forward.

To assess the relative attractiveness of individual diseases and disease categories, the team developedMarket Opportunity Maps and Attractiveness Rating Charts for chronic disease categories. A composite map wasthen prepared to show the relative attractiveness of specific diseases across all categories. In each MarketOpportunity Map, the team plotted diseases into a four-quadrant map, where the x-axis represented the intractablepatient population in 2010 and the y-axis represented unmet medical need (measured as the degree of human andeconomic cost of the disease given current treatment modalities). Disease states characterized by a high degree ofunmet medical need and large patient populations in the year 2010 aggregated in the upper right quadrant. Thecomposite Market Opportunity Map for all disease categories (shown below) indicated that Cancer, Circulatory,Neurological and Musculoskeletal diseases represented the best opportunities for Medtronic to make a differencein the quality of life during the coming decade.

The Team developed a Disease Category Rating Chart and ranked each disease in terms of itsattractiveness to Medtronic. For each disease, the team rated the following criteria on a 1-5 scale:

3 Hoffman, C., op cit.

��

Level ofUnmetClinicalNeed

Patient Population

Low

Low High

High

Diabetes

Neurological & Psychiatric

Ophthalmology

GI Urology

Gynecology

Respiratory/Pulmonary

Cancer

ENT

Circulatory

Musculoskeletal





9

• Unmet Clinical Need: Degree of human mortality and morbidity and economic cost given thecurrent treatment modalities available.

• Patient Population: U.S. intractable patient population in 2010.

• Medtronic Technology Opportunity: Relative Medtronic R&D strength and competitiveintensity.

• Medtronic Customer Opportunity: Existing Medtronic distribution channel and level offranchise.

Source: Medtronic Disease Platforms Team, August 31, 1999 Presentation

Based upon the above analysis, the team identified that the five disease categories that were most attractiveto Medtronic included Circulatory, Neurological and Psychiatric, Cancer, Musculoskeletal disease, and ENT.

The combined results of the Market Opportunity Map and the Disease Category Rating Chart corroboratedMedtronic’s current focus in Circulatory, Neurological and Muskoskeletal diseases. In addition, the teamdiscovered several opportunities in markets where Medtronic did not have an existing strategic focus. Theseincluded: Stroke, Hearing Impairment, Spinal Cord Injury, Osteoarthritis/Osteoporosis and Insulin-dependentDiabetes. Through a combination of internal development and acquisition, the team recommended exploration ofopportunities in these areas.

Many in the health care field questioned the traditional approach of acute care intervention since it did notassist patients in managing their chronic conditions, nor did it lower health care costs and the incidence ofdisability. Many believed that a new approach that emphasized self-care among people with chronic illness wasnecessary. This would not only prevent the progression of a chronic disease, but could also delay its onset. Thus,chronic disease management entailed early education and involvement of both patients and families early in theirdisease state, in addition to providing them greater access to a wide array of medical treatments. Many patientssuffering from chronic diseases were often trapped in a treatment regimen administered by a primary carephysician. However, the Medtronic team believed that disease management should enable chronic disease patientsto directly access the best medical treatment, while improving overall economic outcomes.

In Medtronic’s attempt to broaden its participation in the identified disease states, the team furtherrecommended that the company develop and deploy a strategic framework for disease management. Theframework would further leverage the company’s current core franchise to: (1) accelerate market penetration; (2)expand therapeutic and diagnostic product offerings; (3) enhance customer loyalty; and (4) improve the care ofpatients with chronic diseases.

Disease Category Rating Chart

CategoryUnmet Clinical

Need

Potential Patient

Population

Medtronic TechnologyOpportunity

Medtronic Customer

Opportunity Composite Total

18161514131312121199

CirculatoryNeuro & PsychiatricCancerMusculoskeletalENTGastroenterologyUrologyDiabetesGynecologyOphthalmologyRespiratory/Pulmonary

44543334323

5454345544

3

44333322322

54234321111





10

Finally, the team recommended that Medtronic establish “proof of principle” for the strategic frameworkby developing detailed business plans in targeted diseases. As of August 1999, two promising disease states forwhich business plans were already under development were heart failure and spinal disease.

Patient and Health Care Systems Team

The shift from acute care intervention towards chronic disease management was only one major changeoccurring in the health care environment. In fact, the foundations of the health care system in the United Stateswere undergoing significant changes. To address these radical shifts, the company assembled a team that wouldanalyze the future of the health care system and make recommendations on the following issues:

1. Will specialist physicians continue to be Medtronic’s primary customer?

2. Will Medtronic’s relationship with specialists change in the face of increasing patient activism?How?

3. Will patients assume a more direct role in the financial purchase of health care products andservices?

4. Which payor scenario is most likely to develop?

5. And what models of chronic care delivery are most likely to evolve?

Although the team was primarily focused on the role of patients in the management of their chronicdisease, they were charged with a much broader analysis of the numerous stakeholders involved in the health caresystem. These players included the patient, the physicians (primary and specialty physicians), the payors, theproviders and health plans.

After consulting with outside and internal experts, and continuous debate among its members, the teamdetermined that the largest force for change in the health care environment would be patient consumerism. Overthe past decade, empowered consumers had transformed the landscape of financial services, retailing and othersegments of the economy. The emergence of the Internet as an inexpensive and accessible source of informationand advertising for consumers led to disintermediation (and, in some cases, reintermediation) of traditionalchannels in many industries.4 For example, in the financial services market, the number of American householdsinvesting on-line doubled from 1.2 million to 2.5 million from the beginning of 1998 to the start of 1999.5 Theprimary drivers for this trend were lower-fees, a desire for self-service, improved transaction efficiency, and real-time account information availability 24 hours a day.

Many industry experts believed that the trillion dollar health care industry would not escape this wave ofconsumerism. Spurred by increasing levels of education, availability of information, investment in health care newmedia companies, and increased discretionary dollars for healthcare products and care, patients were catalyzingprofound changes in this traditionally staid industry. Recent data revealed that nearly 50% of online users, or 30.8million people, searched for medical information on the Internet in 1998. In addition, approximately 60% ofphysicians reported that patients had approached them with their own printed information from the Internet.6

4 For example: malls and physical retail stores were becoming increasingly threatened by the emergence of on-line retailers likeAmazon.com. Financial brokers were increasingly threatened by the surge in on-line trading, and traditional newspapers foundthat their major source of revenue—advertising dollars from classified ads—was eroding as consumers shifted their attention toonline distribution channels. See “Revitalizing Agents and Brokers,” Forrester Report, January 1998, p. 6.5 “Investors Grade eBrokers,” Forrester Report, February 1999.6 Time Warner, Pharmaceutical Survey, 1999





11

Not all health care industry players believed in the relevance of this data. For example, some argued thatthe largest group of chronically-ill patients were found in developing countries, where a majority of the populationwere not as well-informed or educated. In addition, despite increasing online advertising by pharmaceuticalcompanies, some argued that there was limited reach in the U.S. population today. Nevertheless, pharmaceuticalcompanies had placed their bets on both online and offline direct-to-consumer (DTC) advertising. The success oftheir efforts was evident in the following statistical findings:7:

• DTC advertising encouraged 21.2 million consumers to talk to a doctor about an illness theyhad not discussed before seeing the advertisement;

• More than 53 million consumers talked to their doctor about a medicine or treatment they hadseen advertised;

• Cardiologists noticed a 78% increase in patient requests for brand name prescription drugs;and

• 12.1 million consumers received a prescription drug as a direct result of seeing a DTCadvertisement

The role of the physician in the changing health care system, however, could not be overlooked. The teambelieved that, whether located in a specialty clinic or integrated services delivery network, specialists wouldincreasingly play a central role in the management of chronic disease.

There was also on going debate, in the industry and inside Medtronic, on whether specialists wouldpractice primarily in advanced care specialty clinics or in integrated service delivery centers—large multi-specialtyfacilities that coordinated patient care across primary and specialty care practice areas. After engaging in thisdebate, the Patient Team determined that, whether they practiced in specialty clinics or integrated service centers,specialist physicians would continue to play a key role in chronic disease management and, as such, Medtronicshould maintain the company’s strong relationship with this group.

The role of the primary care physician (PCP) in the changing health care system, however, remained animportant issue for debate. Some believed that the central role of PCPs in a patient-empowered health careenvironment would diminish. Although healthy patients would still utilize a PCP as the primary point of contactwith the health care system, patients with chronic illnesses would likely avoid these intermediaries and go directlyto the best source of information and care for their illness: the specialist physicians. This trend would be furtherstrengthened if the existing payment system evolved to encourage patients to take more responsibility for payingfor their health care via employer-sponsored medical savings accounts. Having a greater financial stake inmanaging their health, the team believed that patients would likely avoid costly fees to intermediaries, such asPCPs.

However, the Patient Team raised several counter arguments to the declining role of PCPs. According tothe team’s findings, PCPs were located closer to the patient, had more convenient hours and had a long-standingrelationship with the patient. This argument was based in part on a recent study conducted by the AmericanMedical Association that showed that while patients wanted open access to specialists, they continued to value therole of the PCP in managing their overall health care and for assistance in medical decision-making.

7 1998 Prevention/FDA Survey, evaluating DTC programs





12

Internal experts on the team also believed that the complex payor system would not necessarily be thesource of more patient consumerism since changes in the existing system would likely be hampered by politicalgridlock. Instead, the team concluded that consumers in the United States and Europe would find avenues toobtain the care they demanded despite the constraints on the health care financing system, and that suchconsumers would not continue to seek care primarily from their PCPs, but from specialists when confronted withchronic disease.

As the debate raged and the team worked toward conclusion, they also asked themselves: what differencewould it make whether one type of health care system prevails? Can we even predict what will happen, and evenif we can, would we be willing to take on different strategies proactively?

Based on their analysis, the Patient Team recommended the following strategy and supporting tactics:

Strategy: To be a major player in the management of chronic disease by building patient managementsystems that strengthen the role of the specialty physician, but include the PCP as a critical partner in leveragingthe specialist’s time and knowledge.

Supporting Tactics: Key tactics may include:

• Partner with providers in disease states to identify potential patients who need advanced therapies

♦ develop clinical paths in concert with well respected clinicians

♦ fund studies with providers and specialty practices to demonstrate improved outcomes andreduced costs by adhering to pathway

♦ provide physicians monitoring tools that make management of these patients easier

• Create direct patient demand for select Medtronic therapies among undiagnosed chronic patients—those who show symptoms and are not getting them addressed

Primary Care and Specialty PhysiciansPatient Attitudes

4 %2 %

9 4%

0%

25%

50%

75%

100%

Agree Disagree Don't KnowSOURCE:JAMA

8 %3 %

8 9%

0%

25%

50%

75%

100%

Agree Disagree Don't Know

SOURCE:JAMA

“I value having 1 primarycare physician who knows

about all my medicalproblems.”

“I value having 1 primarycare physician who knows

about all my medicalproblems.”

“It is helpful for my primarycare physician to

participate in decisionsabout whether I should see

a specialist.”

“It is helpful for my primarycare physician to

participate in decisionsabout whether I should see

a specialist.”

Although patients want access to specialists when the believe they needthem, most patients see value in one physician who coordinates their care





13

♦ leverage existing premier websites (e.g. Reveal on the Mayo site)

♦ symptom-based direct advertising

♦ continue to profile patient stories

• Provide a solution to physician frustration with “self-research” tendencies of patients, and lack of timeto educate and communicate

♦ give physicians web-based management practice tools

♦ link physicians to central Medtronic information that explains disease path, and positionsMedtronic therapy in a clinically credible context

Information and Communication Team

As evident above, the availability of real-time, relevant information and readily-accessible communicationchannels were believed to be major drivers of patient consumer power and the effective management of chronicdisease pathways. The Information and Communication (I&C) Team examined the effects of technologicalrevolutions of the late 1990s and 21st century on Medtronic’s present and future business. The team addressed thefollowing issues:

1. How will information and communication be used over the next decade in health care andwhat are the implications for Medtronic?

2. What are the opportunities for Medtronic that arise from our current business and potentialfuture businesses?

3. What are the threats that information and communication technology could pose toMedtronic’s current business, as well, as the company’s potential future businesses?

To tackle these questions, the I&C team focused on developing predictions for how the informationrevolution would influence the health care system and Medtronic’s business over the next ten years. The teamenvisioned the technological evolution of today’s Internet to a ubiquitous information and communicationplatform that they called, the “Evernet.” This new channel would replace today’s outdated information andcommunication infrastructure with a very high capacity, integrated network of both cable or wireless technologies,and allow for real-time video and visualization connectivity to patients in their homes, and to physicians andproviders around the world. Today’s single-purpose, “luggable” computers would converge to smaller, morepowerful and flexible network devices—including wearable and implantable monitoring devices.

The team believed that the ubiquity of the Evernet and the ready availability of multi-media health careinformation would have profound impact on the health care industry. Patients would have access to a vast sourceof health information and services, including real-time monitoring and diagnostics. (See Exhibit 4 for a futurepatient scenario.) Consistent with the Patient Team’s findings, the I&C team believed that the empowered patientwould leverage this information to exert greater control over their care. Further, patients would gather and controltheir health information and would determine when and how it would be shared with physicians, payors, familiesand an ever-expanding community of patients with similar concerns and conditions.

Physicians would also benefit from advances in information and communication technology. Intelligentagents would enable access to clinical information, including medical histories, diagnostic data and care pathmanagement recommendations. Generalists in remote areas would have direct access to world-leading experts andspecialists and the capability for remote diagnostics and even remote procedures would also be available and





14

affordable. Physicians would use the information, diagnostic tools and their knowledge to provide more efficientand effective care and to monitor outcomes of their therapies much more closely.

The ubiquity, ease of use, and connectivity of the Evernet would lead to disintermediation and, in somecases, reintermediation of health care delivery service channels. Transparency in pricing and the ability to providephysicians, providers and patients with more efficient and objective information would dramatically affect the wayproducts and services would be marketed and distributed. New market makers that aggregate both buyers andsuppliers would also provide this objective information and efficiency in transactions. While the medical deviceindustry may be a laggard relative to other medical supplies such as gowns, gloves, and pharmaceutical drugs, itappeared inevitable that the costly sales force of the 1990s would be, at a minimum, supplemented by, and in somecases, largely superceded by, digital approaches to handling transactions and providing services.

Rapid developments in information and communication technology would also affect acute care centers.For example, advances in visualization technology, such as anatomical mapping and manipulation would have aprofound impact on enhanced diagnosis, surgical planning, and the surgery procedure itself. In addition,communication technology that permits remote access would remove geographical constraints for specialists asthey contacted experts around the world. Ultimately, these same specialists would be able to perform proceduresfrom remote locations through advancements in robotic technology. (See Exhibit 5 for a future scenario of a wiredOR).

With growing opportunities in the information revolution, new players in the health care arena wouldlikely emerge to take advantage of mining, analyzing and disseminating data. The team developed a visualdepiction of the new landscape for 2010 (shown on the next page) and predicted two emerging themes. First,although no one company would likely possess all the required competencies to provide products and services inthe entire information chain, effective alliances would be formed among old and new players; this would cause thefour circles to increasingly intersect.

Source: Medtronic Information and Communication Team, August 31, 1999 Presentation

Active Implant Info-based Products and Services

3rd-party info sources• Dr. Koop• Mayo Clinic• Healtheon

Supplier Information• Branded info• Physician/Patient Ed.• Clinical Data• E-commerce•Disease Mgmt.

Users of Data:•Patient/Family•Physician•Payor •Provider •Supplier

Influences:•Technology•Security•Government

= Data Flow

Information and Communication in 2010

DATA

Application-focused info-based Products and Services

4

1

3

2





15

Second, despite the importance of data as the raw material for the knowledge economy, survival woulddepend on the ability to convert this raw material into information, from information into knowledge and fromknowledge into decisions and actions that create value for all stakeholders.

As Medtronic entered the 21st century, the evolution of the Internet to the I&C team’s vision of theubiquitous Evernet was already underway. By 1998, it was estimated that over $300 billion in U.S. revenues and1.2 million jobs could be attributed to the “Internet Economy.”8 The availability of robust technical systems hadenabled revenues from Internet commerce transactions to grow much faster than expected, rising from just $20billion in 1997 to over $160 billion in 1998, and it was predicted that global e-commerce revenues would exceed $1trillion by 2005. But, the evolution and penetration of the Internet was not just a U.S. phenomena; by 1998, the U.S.share of Internet traffic had dipped to below 60% and Internet access growth in Europe had outpaced the UnitedStates9

Although the team believed that the Internet would provide Medtronic significant opportunities, the teamalso recommended targeted strategies that focused on patient-centered connectivity. Today, Medtronic primarilygathered information at clinical “islands.” Patients’ traveled to clinics to have their devices interrogated and thedata was then archived in a local file on disk or paper. The I&C team recommended that Medtronic serve as ainformation and communication nerve center, connecting two broadly-defined constituents:

• the patient management community, which included physicians, disease management therapycompanies, and organizations that provide information and knowledge services andstandardization of care pathways;

• the patients and their families that would value information about their health and diseasemanagement.

Technology Team

Advances in medical technologies would also have a profound impact on health care in the next decade andbeyond. As part of Medtronic.Vision.2010, the company assembled a team of technical specialists from around thecompany to address the following issues:

1. How should Medtronic understand and react to major technological advances, and

2. Where should Medtronic’s technological emphasis be placed?

To tackle the first question, the team identified and prioritized potentially “disruptive” technologies—those technologies that had the capability to cause an existing market, technology or product line to becomeobsolete over a very short period of time. The team developed a framework that organized disruptive technologiesinto four distinct areas, depending on whether they involved new technology to Medtronic and/or new marketsfor Medtronic.

8 University of Texas at Austin, 19999 Gilder Technology Report, Vol. 4 (#7), July 1999.





16

Source: Medtronic Technology Team, August 31, 1999 Presentation

The team defined four categories of technology, as shown on the Disruptive Technology map, as:Enhancements, Breakthroughs, Category Killers, and Watchful Waiting.

• Enhancements leverage and extend existing technology in an existing market. Because themarket is already established and substantial in size, financial returns for disruptiveenhancements are likely to be large relative to the sunk investment. Thus, enhancements are“low hanging fruit,” since they represent technologies which often can be leveraged acrossMedtronic businesses. Historical examples of disruptive enhancements include the switchfrom mercury-zinc to lithium power sources, or the adoption of a new indication for anexisting product (e.g., “ablate and pace”).

• Breakthroughs employ existing core competencies and core technologies to create newproducts for a new market. These technologies provide incremental, new revenue streams,and thus can be thought of as growth opportunities. Failure to exploit a breakthrough is a lostopportunity, but does not adversely affect the core business. Historical examples of Medtronicbreakthroughs include SyncrhoMed, Activa and Reveal.

• Category killers employ technologies that are new to the company either in whole or in part.The final product cannibalizes or renders obsolete existing Medtronic products. Unlikebreakthroughs that represent missed opportunities, failure to be a player in category killers canbe expected to have negative, perhaps catastrophic repercussions on the core business. Onehistorical example is rate responsive pacing (Activtrax), which in its day allowed Medtronic togain rapid market share.

• Watchful waiting is a domain that represents both new technologies and new markets forMedtronic. At first glance, these technologies are likely to hold low priority for the company.Nevertheless, a continual review of this domain is necessary as technologies often evolve andmature, and may migrate toward the breakthrough or the category killer domain.

The Technology Team felt that the framework provided a useful approach to analyzing a long list ofpotential “disruptive technologies” and eventually identified ten key technology areas that would have a highlikelihood of creating significant business opportunity (or risk, if not pursued) for Medtronic. The team alsogrouped the key technologies according to key market trends (such as the digital revolution, advances in

Existing Technology New Technology

NewMarkets

Existing

Markets

BREAKTHROUGHS

CATEGORY KILLERS

WATCHFUL WAITING

ENHANCEMENTS

Medtronic

Today

Disruptive Technology Map





17

computing power and microelectronics and the biological revolution) and Medtronic’s strategic imperatives. Thoseconsidered to be in the first tier of importance and urgency for additional analysis and incremental investment

were marked with an asterisk.

These technologies were selected because they were viewed as sources of potential competitive advantagefor the company, i.e. areas where advanced skills will drive growth, overall performance, and/or reduced costs.Integration of these new technologies could fuel growth through new capabilities and functionality in Medtronicproducts, or could create new platforms and new market opportunities. Conversely, the team believed that failureto capitalize on these technologies could lead to vulnerability in Medtronic’s market position or significant missedopportunities. (See Appendix A for a summary and description of these technologies).

In addition to tackling the question of what technologies were expected to play a key role in Medtronic’ssuccess over the next decade, the technology team also asked the question of how Medtronic would stay on top ofrapidly advancing technologies, especially those that were peripheral to Medtronic’s current core expertise. Theteam identified the following strategic imperatives to address this issue:

• Medtronic must preserve and nurture a culture that will allow exploration of newtechnologies, and a “readiness” mentality to capitalize on those areas identified to besuccessful. The team recognized that living with the uncertainties of the fuzzy front end ofproduct development, nurturing an entrepreneurial mindset where innovation is rewarded,and allowing disruptive ideas to be sufficiently tested becomes increasingly difficult asMedtronic grows in size and complexity.

• Because of the relatively long development times for new technology, Medtronic must alsoimmediately invest in more speculative technologies that are not likely to see widespreadcommercial application until beyond 2010.

• Business needs must be the primary driving force for technology investment, and yet, at thesame time, the company must allow technology opportunities to bubble up to influencebusiness priorities and directions.

• Medtronic should develop and execute more systematic strategic technology scanning andforecasting as a means of staying on top of advances in technology and ensuring thatapplications of these advances across the company are consciously considered.

* Communications (e.g., Wireless Telemetry)

* Information Management / User Interface

* Sensors and “Smart Devices”

• Device Miniaturization

* Imaging / Visualization / Navigation

* Diagnostics

• Combination Devices

• Electromagnetic Therapy

• Tissue Engineering / Advanced Materials

* Biotechnology: Biologic and Gene Therapy

Digital Revolution

Computing Power,Microelectronics

BiologicalRevolution

Leverage our core

Earlier Intervention, MoreEffective Disease Mgmt

Key Technology Modalities Identified





18

• One of the other technology-related challenges Medtronic faces is the difficulty of bringingnew core competencies into the organization. Senior management must create legitimacy fornew knowledge. The key is getting started. Organizations learn by doing. Therefore, it iscritical that top managers set up and fund specific, bite-size projects. Projects are the carriers ofnew learning, and require project teams with cross-disciplinary membership for successfullearning and application.

Central Vision Team Review

As the four vision team project teams generated their findings and recommendations, the Central VisionTeam led a series of meetings to debate the findings, develop integrative themes, and define a new vision andstrategic initiatives for Executive Committee approval. (See Exhibit 6 for a summary of key meetings andactivities.)

As the Central Vision team moved toward its final recommendations, senior executives remained activelyinvolved, continually challenging and debating the findings with the teams. At one meeting, Art Collinscommented:

Before we get too far, we need to define the meaning of a vision. What is a vision? What isit not? What will it mean to people all over Medtronic? Why is a new vision important now?

I think most Medtronic employees know our mission. Earl Bakken, back in the 1960s tookcare to develop our six corporate mission statements, and they have not changed since then. Ourvision should be much more directly linked to a strategy. The vision says where we want to goand the strategy says how we want to get there. The vision is really just that. It’s our thoughts ofwhat we will be in the future.

Bill George questioned the impact of the findings on the type of leadership that would be needed.

A new kind of leader will emerge in the 21st century that is a value-based leader of a value-based corporation. These leaders will have an intimate understanding of the people doing thework and their motivations. In fact, these leaders will be workers themselves, not mistakingdelegation of responsibility for abdication of responsibility. The 21st century leaders will careopenly about their people, and communicate directly to them instead of through traditionalhierarchical channels. Most importantly, these new leaders will empower EVERYONE to lead,creating an organization of leaders.

Medtronic.Vision.2010 Vision And Strategic Initiatives

In late December 1999, the Executive Committee finalized Medtronic’s new vision and defined three pillarsupon which the company would based the firm’s strategic direction for the 21st century. (See Exhibit 7.)

Patient Empowerment

The first major pillar of Medtronic.Vision.2010 was that health care in the new century would be radicallytransformed by the rising power of the patient and consumer. Medtronic would seize the opportunity to play ameaningful role directly with patients as advocates. Medtronic and the medical community would continue toprovide an ever-increasing number of life-enhancing solutions for chronic disease, and, in addition, Medtronicwould play a leadership role in creating greater patient understanding and awareness. With the goal of a more





19

knowledgeable, confident and independent patient, Medtronic would embark on a broad ongoing campaign ofpublic and patient-centered initiatives. Through the Medtronic web site, public advertising, media publications,foundation activities and a wide range of new business initiatives, Medtronic would emerge as a leading voice onchronic disease management.

Information Revolution

The second major pillar of Medtronic.Vision.2010 was that the use of advanced information andcommunications technology would be the most rapidly disruptive force health care would face in the next decade.Driven by the stunning impact of the Internet, the information revolution of the 21st century would have as great animpact on the way people communicate, transact and live as the industrial revolution did in the first half of the 20th

century. Medtronic executives believed that the information revolution presented a major opportunity totransform customer relationships, create product differentiation and create entirely new businesses and revenuestreams. They believed Medtronic should provide the direct connectivity between patients with chronic diseaseand their specialty physicians. George explained:

In the past, we generally used information to supplement our product offerings. However,based on the deep, rich information capability of many of our products (i.e. implantable micro-processor based products) as well as the critical clinical information that surrounds all of ourproducts, we will now be able to derive real economic value for that information and the relatedservices we can provide. Today, we use the term “e-business” to describe the adoption of digitaltechnology and the use of the Internet as the primary communications medium in our business. In2010 there will be no distinction between “e-business” and regular business. All businessinteractions will be either performed or facilitated by digital technology and will use the Internet asthe primary communications medium. From internal commerce applications, such as operationscontrol, to external connectivity applications such as patient management systems linkingphysicians and patients, Medtronic will move aggressively to become an “e-business.”

Technology Convergence

The third major pillar of Medtronic.Vision.2010 was that impending technological convergence ofpreviously distinct medical technologies would create major discontinuities in the competitive landscape andMedtronic’s opportunities. The optimal practice of medicine in the future would combine traditional mechanical,chemical and surgical interventions with new electrically-based therapies, biological treatments—all embeddedwithin and surrounded by innovative uses of information technology. Medtronic executives believed thatadvances in medical, biologic and information technology would be driving forces behind Medtronic’s ability tooffer more comprehensive solutions for people with chronic disease. Where traditionally, Medtronic haddeveloped technology to treat end-stage chronic illness, technological convergence would enable the company toexpand its focus. This would include the development of tools to increase physician and consumer awareness ofchronic disease and treatment options in the “wellness” stage, to advanced patient management systems for peoplewith advanced disease. In the 21st century, Medtronic would play a meaningful role along the entire diseasecontinuum

Where to From Here?

Never in the company’s history had Medtronic taken on such an all-encompassing change initiative. Overthe past year, the company had completed six major acquisitions and multiple significant new product launches.Medtronic had doubled in size and greatly increased its complexity. Yet, the senior management team recognizedthat the magnitude of change defined by the new vision and the speed with which the company needed to actwould stretch the company as never before. At the completion of his January 11, 2000 speech, Bill George





20

summarized the challenge to the leaders in Medtronic as they set out to define and execute strategic initiatives thatwould enable the company to achieve their new vision.

You can now see why I said that we stand at a major inflection point in Medtronic’shistory. Over the next decade, Medtronic will reinvent itself once again by providing a morecomplete range of products and services to a broader set of customers: physicians, health careinstitutions and patients. Our patient management systems will result in better quality of life forthose suffering chronic disease, lead to a reduction of overall health care costs, and provideMedtronic with new, ongoing revenue streams. The rapidly increasing complexity of our businessenvironment will demand new capabilities that do not reside within Medtronic. For example, it isimpossible for Medtronic to control all aspects of integrated patient management systems. As aresult, it is incumbent upon us to leverage capabilities outside of Medtronic’s prime strengths.Creating business partnerships will expand our capability and leverage what Medtronic doesuniquely well. Over the next decade we must also leverage our internal investment capability byfinding creative ways to use Medtronic’s financial strength and flexibility to access new sources ofcapital.

We believe that our new vision will enable us to reinvent Medtronic to play a broader role in health care. Itis now the responsibility of leaders throughout Medtronic to make Medtronic.Vision.2010 a reality.




800-

357

-

21-

Exh

ibit

1Fi

nanc

ial S

umm

ary

Yea

r E

nded

Apr

il 30

,19

9919

9819

9719

9619

9519

9419

9319

9219

9119

9019

8919

88

Net

Sal

es$4

,134

.10

$3,3

43.0

0$2

,944

.60

$2,5

70.0

0$2

,097

.00

$1,6

15.7

0$1

,490

.00

$1,2

97.9

0$1

,097

.00

$922

.60

$801

.10

$695

.90

Net

Ear

nin

gs90

5.4*

724.

7*61

5.7*

488

311.

925

2.1

216.

817

9.1

143.

511

8.6

104.

590

.3

Bas

ic e

arni

ngs

per

sh

are

1.57

*1.

28*

1.08

*0.

930.

620.

510.

420.

350.

280.

240.

210.

18

Ear

nin

gs

per

shar

e as

sum

ing

dilu

tion

1.53

1.25

*1.

05*

0.9

0.6

0.5

0.42

0.43

0.27

0.23

0.2

0.17

Div

iden

ds p

er s

hare

0.26

0.22

0.19

0.13

0.10

30.

085

0.07

0.06

0.05

30.

045

0.03

50.

03

Ret

urn

on

equi

ty25

.8%

*29

.5%

*29

.7%

*27

.70%

23.4

0%23

.90%

24.0

0%22

.30%

21.6

0%21

.60%

22.5

0%21

.90%

R &

D e

x pen

se42

9.2

367.

932

5.5

283.

622

5.8

176.

314

4.8

117.

194

.584

.769

.356

.1

Clo

sin

g st

ock

pri

ce71

15/

1653

34 5

/829

9/

1618

19/

329

13/3

28

3/16

8 3/

166

31/3

24

2 31

/32

2 3/

8

*N

et E

arn

ing

s, E

PS

, an

d R

etu

rn o

f Equ

ity e

xclu

de th

e im

pact

of $

551

.2, $

205

.3, a

nd

$50.

0 m

illio

n p

re-t

ax n

on-r

ecu

rrin

g ch

arg

ed re

cord

ed d

urin

g fis

cal 1

999

,1

998,

and

199

7.✞

Com

pou

nd A

nnu

al G

row

th R

ate

0.00

500.

00

1,00

0.00

1,50

0.00

2,00

0.00

2,50

0.00

3,00

0.00

3,50

0.00

4,00

0.00

4,50

0.00

9998

9796

9594

9392

9190

8988

8786

85

0

100

200

300

400

500

600

700

800

900

1000

9998

9796

9594

9392

9190

8988

8786

85

NE

T S

AL

ES

14 Y

R. C

AG

R✞

18.

8%in

mil

lion

s o

f d

oll

ars

NE

T S

AL

ES

14 Y

R. C

AG

R✞

25.

4%in

mil

lion

s o

f d

oll

ars

BA

SIC

EA

RN

ING

S P

ER

SH

AR

E14

YR

. CA

GR

✞ 2

5.9%

in m

illi

ons

of

do

llar

s

0

0.2

0.4

0.6

0.81

1.2

1.4

1.6

1.8

9998

9796

9594

9392

9190

8988

8786

85

0.0%

5.0%

10.0

%

15.0

%

20.0

%

25.0

%

30.0

%

35.0

%

9998

9796

9594

9392

9190

8988

8786

85

RE

TU

RN

ON

EQ

UIT

Y14

YR

. AV

G.

23.

5%in

pe

rcen

tage




800-357 Medtronic Vision 2010

22

Exhibit 1 (continued): Financial Summary For Each Medtronic Business

$0

$1,000

$2,000

$3,000

$4,000

$5,000

$6,000

$7,000

FY 89 FY 91 FY 93 FY 95 FY 97 FY 99 FY 01

$ inMillions

Brady*

Tachy*

ExternalDefibrillation

Neuro &Spinal

Vascular

CardiacSurgery

$766 M$6,584 M

CAGR = 18%

* Brady also includes HF, Monitoring, and Outside Business;

Tachy also includes AF and Ablation

FY 02




800-

357

-

23-

Exh

ibit

2:

Com

peti

tion

by

Sect

or

Ove

rall

Car

dia

cR

hyt

hm

Mg

t.

Bra

dy

Tac

hy

Ext

ern

alD

efib

rilla

ltio

nD

rug

-Del

iver

yN

euro

Sti

mu

lati

on

Neu

roT

ech

no

log

ies

Sp

inal

Su

rger

yC

ard

iac

Su

rger

yC

orn

on

ary&

Per

iph

eral

Vas

cula

r

Cur

rent

Mar

ket S

ize

$4.1

bn

$2.6

bn$1

.4bn

$.5b

n$.

2bn

$.2b

n$.

4bn

$.9

bn$1

.7 b

n$3

.8 b

n

Mar

ket

Gro

wth

(FY

99 –

FY

02 C

AG

R12

%6%

21%

10%

32%

31%

15%

25%

2%7%

Par

ticip

ants

/E

st. F

Y 9

9S

hare

Med

tron

ic46

%

Gui

dant

27%

St.

Jude

16%

Bio

tron

ik3% Oth

er8%

Med

tron

ic50

%

Gui

dant

21%

St.

Jude

20%

Bio

tron

ik5% Oth

er4%

Med

tron

ic 4

5%

Gui

dant

44%

St.

Jude

10%

Oth

er4%

*sha

res

are

for

VT

/VF

onl

y

Med

tron

ic 4

3%

HP

19%

Zol

l 1

3%

Sur

viva

Lin

k2% Oth

er23

%

Med

tron

ic90

%

Arr

ow5% Oth

er5%

Med

tron

ic 8

7%

AN

S8% Oth

er5%

Med

tron

ic

40%

Str

yker

13%

Oth

ers

47%

*Neu

roT

echn

olog

ies

Mar

kets

incl

ude,

shun

ts,

neur

olog

ical

inst

rum

ents

and

imag

e gu

ided

surg

ical

tech

nolo

gies

Med

tron

ic 4

2%

J&J

(Acr

o/D

upuy

)19

%

Sul

zer

11%

Syn

thes

9%

Tyc

o (U

S S

urg)

7% Oth

er12

%

Med

tron

ic42

%

Bax

ter

20%

St.

Jude

16%

Cob

e/S

orin

16%

Ter

umo/

Sar

ns7% Oth

er15

%

Bos

ton

29%

Gui

dant

29%

Med

tron

ic 2

0%

Syn

thes

9% J&J

14%

Oth

er8%





24

Exhibit 3: GNP Per Capita vs Population in 2010

0 500 1000

$50

10

1 Africa

Canada

CA/LA

CIS

W. Euro

E. Eur

Near East China

JapanUS

India/Pak

Aust/NZ

Population (millions)

GNPPer Capita(thousands)

1500

Other Asia

?

Highest ability topay for technology




Medtronic Vision 2010 800-357

25

Exhibit 4: Future Patient Scenario

31-Year Old Patient in 2010

I am a healthy, 31 year-old in the year 2010. In my world:

• I communicate through the evernet—everywhere I go and with everyone—bandwidth is not anissue so most of my communication is through video. Voice recognition software has helpedreduce/eliminate manual input of data and the need for handwritten records.

• I have a Home Health Appliance (HHA) at home—it has multiple sensors that measure a widevariety of body functions from blood pressure to EKG to glucose levels

• I have a personal health agent who takes care of any “ordinary” ailments. My agent may or maynot be local but most of my communication is via the evernet. My agent has access, whengranted, to the data from my Home Health Appliance for diagnostic purposes. If I were todiscover any major problem, my agent would refer me to a specialist’s clinic. As a result of theavailability of more data, the analysis of this data, and the resulting therapies, my agent is able totreat a wide variety of issues for me.

• My HHA is provided by my health care insurance, which I receive through work.

• I chose my agent from the health insurer’s network – I was able to view a video interview, reviewtheir credentials, see their JD Powers’ rating, and see their fees. The portion I pay from mypaycheck is based on the fee-level of the agent I choose.

• I can access any information I need about health care and order any products I need on-line—including prescribed medication. I usually go to one of three locations to find this information—Ican access therapy and product specific information from the providers/manufacturers throughthese sites.

I keep my own health care information (for my entire life) in a secure on-line location – it isupdated by my HHA, my agent, specialists, and myself. I have the ability to sell this information if Ichoose to do so. Insurance companies, disease management companies, and researchers are allinterested in this information.

70-Year Old Patient in 2010

I am 70 years old in 2010. My agent has informed me that a change in some of the numbers from myHome Health Appliance signal early stages of heart failure.

• I am very informed about Heart Failure and my potential treatment options. Ihave also found through my agent and my own research a Heart Failure clinic inBoston that would be best for me despite the fact that I live in Idaho.

• I joined a videogroup for Heart Failure patients—I gain and provide informationand emotional support.

• I am to receive an implanted device that will provide constant data about myheart—it will communicate this to my HHA via my personal videophone so I’mnot restricted in where I go. I will go to the surgical center in Boise to have the





26

implant done while my Boston-based Heart Failure specialist will work with thesurgeon if necessary.

• The Heart Failure Clinic will have access to all my information and will bealerted if there are any concerns with my condition.

• Prior to the implant, the surgeon looked at my data; she has images of my heartand how it compares to a “normal” heart, and has planned the procedure.During the implant, the surgeon will have access to real-time images and useminimally invasive techniques.

• The clinic in Boston will now track all my information and proactivelycommunicate with me on a periodic basis to make sure all is well. Based on theinformation they learn from the implanted device, they will recommend a carepath.

• Information and Communication has allowed for the following “behind thescenes” scenarios to positively affect the efficacy of my care:

• Most, and eventually all, communications and transactions are doneelectronically between my agent, my insurer, my Heart Failure clinic, the diseasemanagement supplier, and myself.

• My agent and Heart Failure specialist have been able to keep abreast of the latestresearch and product capabilities through training offered by universities anddisease management companies.

• My agent, Heart Failure specialist, and myself have been able to access the latestresults from clinical trials being performed so we can evaluate new therapies.

• The outcomes of all disease management therapies is data that is provided by adata aggregator and purchased by disease management companies. Diseasemanagement companies are also the provider of a lot of the data.

• The implant I received was ordered by my specialist from the diseasemanagement company and all fulfillment, billing, and transaction processingwas handled electronically.

• The government has taken an active role in helping to make sure my data issecure. The concern of security of data has played an important role in the use ofit.





27

Exhibit 5: The Omniscient Operating Room (OOR)

The OR of 2010 will be an omniscient environment that will be able to anticipate the surgicalteam’s every need for information, connectivity and knowledge…

…The instant the patient, Tom, was diagnosed for a neurosurgical intervention, the OORbegan to function. It showed the physician the ideal times available for the surgery, even rearrangingthe OOR schedule to accommodate Tom’s need for a speedy surgery. The OOR automaticallynotified every person affected by the reschedule…even relentlessly reminding the head of PatientRelationships to phone the affected patients to explain and apologize for the inconvenience.

Days before the surgery, the OOR not only began to electronically reserve the equipmentneeded for the surgery, it began to notify non-hospital personnel of the date, time and nature of theprocedure. A neurologist specialist in Finland, who was on retainer to Medtronic, was alerted so shewould be available should a conference be required. Naturally, the OOR made available to her asummary of the diagnosis and the surgical plan, with relevant references to similar procedures doneover the past year and their current outcomes.

Medtronic’s Clinical Support Specialists, located at their spectacular facility near Vail, werealso notified. The lead Specialist, the one with the most relevant therapy knowledge, had hiscalendar hard-locked for the exact time of the procedure and notifications from other OR’s aroundthe world, scheduled for the same time, were routed to other Specialists.

The day of the surgery the OOR swung into high gear. Routing messages were sent duringthe previous night to begin moving the equipment into the OOR at specified times. The OORrealized the surgeons were approaching the hospital, as their PDA’s GPS10 signals transmitted to thehospital. By the time they were at the scrub sink and stepping through the bacterial detector screen theOOR walls were alive with information.

The OOR had anticipated every probable bit of knowledge and information the surgeonmight require. On one wall appeared all of the patient’s information relevant to this case.Radiographs were displayed…3-D renderings appeared and rotated at the surgeon’s touch orcommand to precisely show the surgical plan the doctor had developed from her tablet device severaldays earlier.

On another wall the Medtronic Clinical Specialist was seen sitting patiently at a table, readyto be recognized by the physician. As she finished studying the scan, the doctor glanced at the“support wall” and recognized the Specialist. She had had him support her before on similar cases.She had indicated her satisfaction with his support in her last post surgical survey check…anautomatic review done by Medtronic’s Customer Satisfaction people after every case in which anMDT therapy was used. Had she not been happy, she never would have seen him again andMedtronic would have known about what went wrong in their support and addressed the issue.

As the procedure progressed, the difficulty of the surgery began to clarify. Deep in the neuralstructures, the surgeon found some unexpected complications. The OOR was sensitive to this byanalyzing a stream of new information coming from an array of diagnostic monitors.

The OOR had notified the Medtronic Archive Engine and it was already combingMedtronic’s vast clinical archive for similar situations. The Clinical Specialist, queried by the surgeonabout what she was seeing, was checking his views of the surgery by scanning several of the 8

10 Global Positioning Satellite





28

cameras around the surgical field, including the Stealth images and the view through the microscope.The OOR was also delivering to him the real-time stream of monitor data. Sensing a consult might beuseful, the Specialist pressed the icon for the Finnish neurologist and a call was made by the system.

Despite the time difference, the Finnish neurologist, appeared on the Specialist’s videoscreenalert and ready to go. She queried him about the situation and his computer fed hers all of theclinical data. She also could see the video from the OOR, although she could not yet be seen on theOOR wall. It was OOR etiquette not to appear on any of the video walls without being requested bythe surgeon or introduce and admitted.

The neurologist recognized the unique physiological structure of this patient’s brain as someone with a rare affliction. She quickly scanned through the archives and began to feed the Specialistwith radiographic and text info from a similar case performed in Korea 6 months previously.

“Seen anything like this before?” the surgeon inquired of the Specialist.

“You know it looks a little like a case here in the Medtronic Archive, let me put it on the wallfor you” he replied softly. She scanned it quickly, recognized the similarity and called for a consult.The Finnish neurologist appeared on the wall. After a brief exchange, the surgeon returned to workand successfully completed the case.

As she left the OOR she glanced at the Medtronic Specialist on the wall, “good to have you inmy OR again’. With a small smile and a nod, she was out the door.





29

Exhibit 6: Central Vision Team Activities

Dates Activities

April to August, 1999 The four projected teams conducted their analysis and shaped theirfindings. The teams sought guidance from numerous people withinthe organization and from experts outside the organizations. Sub-committees were formed to address separate issues. Each team metnumerous times and the Central Vision Team convened meetings of allproject teams to enhance communication and broaden analysis ofemerging issues and findings. Early in the process, a decision wasmade to develop a case study to stimulate debate and dialogue.

August 31, 1999 The four project teams presented interim findings sparking a wide-ranging debate between people from different businesses, functionsand management levels.

September 9, 1999 The Central Vision Team met during an afternoon-long meeting todebate the findings of the four project teams, develop integrativeconcepts and craft a preliminary Medtronic vision for 2010.

October 5-8, 1999 Medtronic’s top 125 leaders met in Phoenix to discuss firm strategy andMedtronic’s new vision. Discussion of the case study was led by threeHarvard Business School faculty.

October 8 to December10, 1999

Based on the discussion and recommendations of Medtronicexecutives, the Central Vision Team drafted the new Medtronic visionand the pillars that would drive the development of strategicinitiatives.

December 10, 1999 Medtronic’s Executive Committee met at an off-site meeting inMinneapolis to review and approve Medtronic’s new vision andstrategic direction.

January 11, 2000 Bill George, Art Collins and Glen Nelson lead a global, all-employeemeeting to share Medtronic’s new vision, outline the actions topmanagement would take and challenge people throughout Medtronicto make the vision a reality.





30

Exhibit 7: Medtronic.Vision.2010

Medtronic.comPatient Management

System

Empowermentof the Patient

InformationRevolution

TechnologyConvergence

Chronic Disease: A Major Unmet Medical Need

Medtronic Vision 2010 Findings





31

Appendix A: Technology Team Findings: Summary Description of Key Technology ModalitiesIdentified

Information and communication technologies is changing the way medicine is practiced,and these changes will accelerate over the next decade as the healthcare industry rapidly seeks toembrace the digital revolution. Medical devices will need to have elevated standards for userinterface, data capture, integration, storage, and information path management. Medtronic’sproducts will have to be integrated into the world of smart information devices, providing bothhealth care providers and patients with tools to better manage disease processes. It is vitallyimportant for Medtronic to develop advanced telemetry schemes and standards. This will haveimplications for all implantable devices that include electronic components, which is expected tobroaden significantly as embedded sensors and microprocessors become more common features indevices. Remote monitoring capabilities, i.e., the ability to move data into or out of an implantablecomponent from a distance of several feet, will be instrumental in expanding the market for newdiagnostics, monitoring devices, as well as therapeutic and interventional treatments.

Through advanced telemetry and information management technologies, devices willbecome a “node on the network.” That is, for data on implanted device performance to be includedin the decisions regarding patient care and therapy options, the data must be available in a useableform on the medical network. Medtronic has potential to bring breakthrough products (e.g.,telemetry C) to the market that could be very disruptive to our competitors. Decisions regardingpriority, resourcing, and a plan for implementation in product are high in both importance andurgency.

Sensors and “smart devices” encompass a wide range of allied technologies that are aimedat capturing physiological information and using this information to optimize therapy for patients.Today, Medtronic has successfully commercialized first generation implantable sensors for activityand pressure, and has developed several sensors and diagnostics for ex-vivo applications. The futureholds promise for sensors to be a major key to enhancing the effectiveness of medical devices and thesystems in which they operate. Micro-sensors, in general, are expected to see broad applicationacross many industries, including the medical industry. A wide variety of specific sensor types mayhave application to Medtronic, including acceleration sensors, flow sensors, chemical sensors, cell-based sensors, biosensors, optical sensors, etc. Advances and broader usage of sensor technology areclosely linked to advances in understanding of the underlying mechanisms and pathophysiology ofdisease. That is, as specific markers or indicators of disease become known, the importance of closermonitoring of these physiological indicators in patients identified to be at risk of a particular diseasebecomes attractive. Ultimately, closed loop feedback will allow therapy optimization in real time forthe individual.

Historically, issues associated with reliable long-term indwelling chemical and biochemicalsensors have been significant, and close monitoring of this field will be important to capitalize on anybreakthrough advances in this area. Investments in promising technology in chemical or biochemicalsensors are recommended because they are strongly enabling of diagnostics and monitoringproducts, thereby supporting a leadership position in a broader disease management strategy. Othercritical areas for investigation and/or partnership include MEMS and biosensors, including cell-based sensors. Novel ways to circumvent the need for long-term indwelling sensors by linking short-term, non-invasive or minimally invasive sensors to devices via telemetry would have immediateapplication and significant competitive advantage in the near-term.

Device miniaturization will continue to be an important component of competitiveadvantage for many of Medtronic’s businesses. Continued investments in integrated circuits,packaging, capacitors, and power sources will be important in meeting market expectations withrespect to device size. Newer technologies, such as micromachining and nanotechnology, have





32

potential to dramatically reduce the size of implants through novel designs. These and otherpotentially disruptive technologies that lead to miniaturization of devices require diligent monitoringand investment when they look promising for specific applications.

In addition to our current core businesses, miniaturization technologies will also beinstrumental in the development of tools and procedures for less invasive or minimally invasivesurgery. These technologies are synergistic with advancements in navigation and visualization inenabling targeted, localized therapies throughout the body.

Capabilities in Imaging, visualization, and navigation are rapidly expanding, largelybecause of the on-going increase computational power. Imaging and visualization technologiesinvolves a wide variety of underlying technologies, including sensors, displays, digital signalprocessors, optics, photochemistry, software, data storage, retrieval, and handling. The trend indeveloping image guided procedures (i.e., combining visualization and therapeutic elements into aninseparable system) underscores the importance of developing therapeutic systems in which all theelements of navigation, imaging, visualization, and therapy are compatible and optimized for aparticular application.

The next revolution in imaging is likely to be functional imaging at the cellular and sub-cellular level. “Seeing” disease at the first level of expression will facilitate new, precise treatments.Medtronic should actively watch for opportunities for investment or partnership in these areas astheir role in delivering therapy becomes clear. Among other areas, paying particular attention tofunctional imaging in the brain is recommended.

Diagnostics is a key to a more comprehensive disease management strategy for Medtronic.Non-therapeutic products or product features represents a large potential growth area, enablingidentification and earlier therapeutic intervention in patients at risk for particular diseases or acuteevents (such as stroke or myocardial infarction). A variety of technologies will be required forsuccessful diagnostic and chronic monitoring products, including sensors, implantable electronics,telemetry, and information management. Three main categories of diagnostic products are seen asrelevant to Medtronic: (1) Chronic monitoring devices (e.g. measuring cardiac output for CHF); (2)Extended event recording (e.g., ischemia detector, seizure detector); and (3) Measurement integration(e.g., emergency assessment). Many potential opportunities in this area also exist in the home healthcare market, as patients take a more active role in regularly monitoring their health status. Some ofthese home monitoring applications are likely to be home-use versions of clinical chemistry lab tests(measuring chemical indicators in blood, urine, saliva, etc., or other physical parameters such asweight, blood pressure, pulse, etc.). Capturing and utilizing such data as a means to identify patientsrequiring new intervention, or as follow-up to an existing device implant could be an importantaspect of the overall diagnostics movement, and one where Medtronic would benefit from aleadership position.

Overall, this area has high potential as an enabling technology for more effective andintegrated disease management for patients and health care professionals. We have barely scratchedthe surface or this opportunity area with our current devices aimed at detection and monitoring.Further technological and business assessment is recommended to refine strategies and delineatespecific product opportunities for Medtronic.

Combination devices are viewed as an opportunity to “harvest the white space between ourbusinesses.” By this term, combination devices, we mean devices that provide either (1) two (ormore) different types of therapy modality, (e.g., electrical stimulation combined with drug delivery);or (2) application of the same therapy modality (e.g., electrical stimulation) in multiple ways (e.g.,spinal cord stimulation for painless defibrillation). Subcategories of this technology include: (1)devices which traditionally have been considered “passive” that are now “activated”, such as amechanical device (stent) with a drug delivery coating; (2) Active devices (e.g., IPGs) combined with





33

a second technology (e.g., drug delivery) to increase efficacy; and (3) Active devices designed todeliver one therapy modality to multiple targets in the body (e.g., delivery of multiple drugs to oneor more site).

Combinations of our existing technological capabilities and platforms offer the opportunityfor high leverage of in-house knowledge, systems, and expertise for accelerated development timesand minimal regulatory hurdles. Drug delivery is a central theme in many manifestations ofcombination devices, which means that Medtronic is uniquely positioned for breakthrough productsbecause of our existing core competency in this area. Some exploratory efforts in this regard arealready underway in various parts of the company. The specific recommendation of the technologyteam is to identify opportunities for combination devices and organizing to quickly assess technicalfeasibility and clinical efficacy using focused, cross-divisional product development teams.

Electromagnetic therapy, or the application of electrical energy to stimulate, defibrillate, orselectively damage excitable tissue, is a core therapeutic technology at Medtronic. Electromagnetictherapy is being considered for a wide range of disorders, e.g., angiogenesis multiple sclerosis,depression, rheumatoid arthritis, pain after shingles, and many more. Bioelectric technology can beapplied to cells and tissues in the full range of energy levels, from use of sub-threshold stimulation oftissue to modify cellular function to the use of high energy for ablation or tissue removal. Someaspects of electromagnetic therapy, such as electrical stimulation, are empirically mature. However,breakthroughs for more efficient excitation of nerve and muscle tissue appear to be theoreticallypossible. Understanding how electrical fields can be used to modify cellular or molecular events, orallow selective transport across membranes, may open up a diversity of opportunities for newtherapies for Medtronic that would heavily leverage existing know-how. The general consensus ofthe technology team is that we have a great deal of untapped potential in this core therapeutictechnology. Currently, active research in this area is very limited. Investment of modest R&D dollarswould have high probability of adding business value to current and future products.

The revolution in the biosciences is at the heart of new technology opportunities in the areasof tissue engineering, advanced materials, and biologic and gene therapy. The long-termimplications of these areas is enormous and pervasive for health care, and is captured by thisstatement by William Haseltine from Human Genome Sciences: “We are entering into an era whendisease will be predicted before it occurs. Medicine is basically going to change from a treatment-based to a prevention-based discipline.” A key milestone in this revolution will be the mapping ofthe human genome, which is predicted to be completed in 2001-2002. However, this is only the start,as it represents an enormous database of genes whose function is largely unknown. Use of this datafor diagnostic purposes will be the first wave of useful information. Secondary to that, interventionfor diseases caused by monoclonic genetic defects will be possible. Thorough understanding of themore complex diseases involving multiple genes and other environmental influences and risk factorswill follow more slowly over the next 2 to 3 decades. However, parallel to development of this morefundamental understanding, and in fact, providing insights via practical trials, will be many andvaried clinical interventions using gene and biologic (i.e., protein) therapy aimed at specificbiochemical pathways. Numerous clinical trials are underway today and will continue to expand innumbers and variety over the next decade. This will naturally include emphasis on the diseases ofhigh market opportunity (i.e., high unmet clinical need and high patient population) identified by theVision 2010 disease platform team, which includes Medtronic’s core disease categories ofcardiovascular, neurological, and musculoskeletal diseases. Medtronic must be poised to participatein these gene therapy technologies, as they frequently represent disruptive technologies in either thebreakthrough or category killer domains.

Gene and biologic therapies represents an area where Medtronic must develop a strategyunder high levels of uncertainty. As these therapies are proven to be clinically efficacious, they willhave a high likelihood of being adopted quickly, thereby rendering “old” technology obsolete.Having the in-house knowledge and expertise to recognize and assess opportunities in this area is





34

essential. We must be able to see and quickly respond to market developments in order to maintainleadership positions in the treatment of the chronic diseases that are core to our business. In general,we recommend that Medtronic partner via equity investments and establish research collaborationsthat put us in a privileged position to participate in the market opportunities that will inevitablydevelop in gene and biologic therapies. Each business must take a proactive role in identifying andinvesting in specific technologies in this broad area that have high probability of impacting ortransforming their business.

One special category of gene and biologic therapy deserves significant attention andimmediate exploration, i.e., the intersection of electrical stimulation and biological therapy. Wewould be well served to aggressively pursue broad intellectual property in this area with the goal ofowning this interface between our most fundamental core technology and the fast-moving biologicalrevolution. Examples of the possible intersections of electrical stimulation and biological responsesinclude such areas as (1) use of sub-threshold electrical stimulation to stimulate angiogenesis inischemic tissue; (2) use of electrical stimulation as a means to control gene expression; (3) use ofelectrical stimulation in cardiac repair using cellular transplantation; or (4) use of electricalstimulation to enhance efficiency of gene uptake in targeted cells. The potential advantages ofexclusivity in these types of applications of electrical stimulation are substantial, and justifyimmediate assessment, prioritization, and fast-track implementation of necessary experimentaldevices and protocols.

Tissue engineering is another technology area where there is a substantial biologicalcomponent, and it is important to note that it is not a new concept to Medtronic. It has been stated bya respected expert and long-standing Medtronic consultant, Fred Schoen, that Medtronic today hasthe largest market in a tissue engineered product—our steroid-eluting electrode. This importantproduct feature of our cardiac leads is designed to influence the healing of tissue immediatelysurrounding the implanted electrode in such a way as to improve device performance. The futureopportunities to use tissue engineering to repair or replace tissues, or to restore function of tissues isbroad-reaching and potentially impacts all Medtronic businesses. Tissue engineered products cantake a variety of forms: (1) combinations of living cells and biomaterials to form hybrid tissuestructures; (2) use of living cells as therapeutic or diagnostic reagents (e.g., encapsulated cells as mini-drug pumps); or (3) use of functional biomaterials with receptor-mediated or other biospecific tissueinteractions. In general, tissue engineered products include three component technologies: materials(scaffolds or membranes), signaling molecules (growth factors, cytokines, etc.), and cells (either host-derived or transplanted).

First applications of tissue engineering are in the general area of structural tissues. Alreadyon the market or in advanced development are skin, collagenous tissues, and various orthopedicproducts such as ligaments, tendons, and scaffolds for bone regeneration. Structural tissueengineering in vascular, cardiac, neurological, and spinal applications are ripe for investment today.In fact, several small programs and outside investments are currently underway. Continued fundingof a modest in-house program with multiple outside partners is recommended to develop experiencein the area and exploit near-term opportunities.


Mount Auburn Hospital: Physician Order Entry

Case 135© The McGraw−Hill Companies, 2004

9-603 -060RE V : FE B R U A R Y 2 0 , 2 0 0 3

________________________________________________________________________________________________________________

Professor Andrew P. McAfee and Research Associate Sarah M. Macgregor and Michael Benari, M.D., prepared this case. HBS cases aredeveloped solely as the basis for class discussion. Cases are not intended to serve as endorsements, sources of primary data, or illustrations ofeffective or ineffective management.

Copyright © 2002 President and Fellows of Harvard College. To order copies or request permission to reproduce materials, call 1-800-545-7685,write Harvard Business School Publishing, Boston, MA 02163, or go to http://www.hbsp.harvard.edu. No part of this publication may bereproduced, stored in a retrieval system, used in a spreadsheet, or transmitted in any form or by any means—electronic, mechanical,photocopying, recording, or otherwise—without the permission of Harvard Business School.

A N D REW P . M C A FEE

SA R A H M . M A C G REG O R

M I C H AEL BEN A R I


Introduction

In September of 2002, Robert Todd, the head of information systems (IS) for Mount AuburnHospital in Cambridge, Massachusetts, reviewed progress toward the launch of the hospital’s newcomputerized physician order entry (POE) system. The committee overseeing the project consisted ofan across-the-board selection of hospital representation, including physicians, pharmacy staff, nurses,administrators, and IS operations staff. The POE system was scheduled to “go live” on a pilot basisin the middle of October in the hospital’s labor and delivery unit.

It had not been difficult to mount support for the project. POE systems had been demonstrated toreduce error rates, and medical errors were widely recognized as a large and serious problem inhealth care. A landmark study published in 19911 estimated that 1.3 million injuries occurredannually in U.S. hospitals, 69% of which were at last partially due to errors in patient management.The study found that 13% of injuries resulted in patient death, “a rate that if extrapolated to theUnited States as a whole suggested that approximately 180,000 deaths a year were, at least partly, theresult of injuries received during the course of care.”2

This study also found that adverse drug events (ADEs) accounted for nearly 20% of total injuries(making them the largest injury category) and that 45% of ADEs were the result of errors. A laterstudy at two Boston hospitals found that 6.5% of admitted patients suffered an ADE, and that 28% ofthese were due to errors.3

1 L.L. Leape, T. A. Brennan, et al., “The nature of adverse events in hospitalized patients: results of the Harvard MedicalPractice Study II,” New England Journal of Medicine 324 (1991): 370–376.

2 Ibid. Other death rate estimates were lower, but there was consensus that more people died from preventable hospital errorseach year than from vehicle accidents, breast cancer, or AIDS, as cited in the National Institute of Health’s 1999 report, To Err isHuman: Building a Safer Health System, <www.nih.gov>.3 L.L. Leape, D. Bates, et al., “Systems Analysis of Adverse Drug Events,” Journal of the American Medical Association 274 (1)(1995): 35–43.



Case136 © The McGraw−Hill Companies, 2004

603-060 Mount Auburn Hospital: Physician Order Entry

2

These abstract statistics were made local and concrete in a tragic way in 1994, when the BostonGlobe’s health reporter, Betsy Lehman, died from a preventable ADE. A physician wrote the entiredose for her four-day chemotherapy treatment on a form for daily drug administration. She receivedthis dose each day for four days, which proved fatal.4

Careful research and vivid tragedies combined to raise awareness of medical and medication errorand to pressure hospitals to improve the situation. The Leapfrog Group, a coalition of more than 100large employers (both public and private) that provided health-care benefits, “. . . was created to helpsave lives and reduce preventable medical mistakes by mobilizing employer purchasing power toinitiate breakthrough improvements in the safety of health care and by giving consumers informationto make more informed hospital choices.”5 POE was one of the three “breakthrough” practicesadvocated by The Leapfrog Group (see Exhibit 1 for The Leapfrog Group’s principles andrecommendations).

Mount Auburn Hospital’s President and CEO Jeanette Clough, too, saw computerized POE as acritical patient-safety tool and gave her full support to the project. For Mount Auburn, a Harvardteaching hospital in a significant hospital community such as Boston, there was really no questionabout whether to implement POE.

The POE project at Mount Auburn Hospital had been underway for over a year. POE was anextension of a commercial information system supplied to Mount Auburn and other hospitals byMEDITECH, a New England-based medical software company. The MEDITECH system consisted ofa series of application modules, including one for patient information called patient care inquiry(PCI). By 2002, the MEDITECH system had been established for many years as a tool routinely usedby all hospital staff.

The POE implementation team planned to introduce the new system in the hospital’s labor anddelivery unit because medication orders in this part of the hospital were fairly simple. Todd and theimplementation team felt that this location would provide a relatively calm environment in which tointroduce the new system and the new medication ordering processes that accompanied it and toaddress several important questions. How much training, and what kind, should physicians andother system users get? How quickly should the online ordering be expanded throughout thehospital? How quickly should more advanced capabilities of the system be introduced? And howwould the hospital know if the POE system was accomplishing its goals? Hopefully, the pilot projectwould start to answer these questions.

Mount Auburn Hospital

History

Mount Auburn Hospital was a community teaching hospital affiliated with Harvard MedicalSchool. It was incorporated in 1871 as the first hospital in Cambridge, Massachusetts. In the fall of2002 it was a community hospital with a medical staff of more than 500 physicians, caring forapproximately 11,000 inpatients, 2,600 observation patients, and 255,000 outpatients annually. Thehospital was also part of a regional health network, CareGroup, consisting of six area hospitals.

4 S. Patton, “The Rx Files,” CIO, November 1, 2001, pp. 104–118.

5 The Leapfrog Group Web site, <http://www.leapfroggroup.org/about.htm>.




Mount Auburn Hospital: Physician Order Entry 603-060

3

IS Infrastructure: MEDITECH System

Mount Auburn Hospital’s MEDITECH system, which had been in place since 1996, offeredsecurity and access by job class, with a broad range of administrative and clinical data includingfinancials, registration records, lab and radiology reports, and patient clinical data. Medical staff(physicians, nurses, lab staff) had access to a patient’s clinical data, including medicationadministered, allergies, and admission, and treatment and lab histories via the PCI module (seeExhibit 2 for a sample PCI screen). The POE system would be an additional module of MEDITECH.

The addition of the MEDITECH system had significantly changed the hospital’s administrativeprocesses. For example, it allowed the financial departments to access and maintain patient billinginformation, resulting in more accurate insurance, referral, and contact information. It also changedthe practice of medicine by allowing physicians to look up comprehensive information about patientsfrom any online computer, whether in the hospital or not.6 Online clinical data was initiated,updated, and maintained by nonphysician staff members.

Since Mount Auburn and MEDITECH began collaborating on information systems in 1990, thehospital had relied heavily on the vendor for programming and support.

Adverse Drug Events

In 1995, researchers at Boston’s Brigham and Women’s Hospital published a study “to identifyand evaluate the systems failures that underlie errors” resulting in ADEs.7 Within a six-month periodthe study evaluated all nonobstetric units at two Boston hospitals. The study classified an ADE as an“injury resulting from medication intervention related to a drug.” Some proportion of ADEs werejudged to result from correctable errors; these were termed preventable ADEs. The study alsoattempted to determine how many errors occurred that did not lead to injury; these were termedpotential ADEs. Potential ADEs could have been intercepted by a health-care provider, or non-intercepted, in which case injury was averted only by chance. In all, 334 errors were detected as thecauses of 264 preventable and potential ADEs. These errors are categorized by type and medicationprocess stage in Table A below. The study concluded that the most common error source was “thedissemination of drug knowledge, particularly to physicians.” Major error cause categories are givenbelow in Table B.

6 Unlike PCI, the POE system was only going to be available within the hospital.7 Leape and Bates, pp. 35–43.





4

Table A Errors by Type of Adverse Drug Event (ADE) and Stage of Drug Ordering and Deliverya

PhysicianOrdering No.(% of total at

this stage)

Transcriptionand

VerificationNo. (%)

PharmacyDispensing

No. (%)

NurseAdministration

No. (%) All No. (%)

Preventable ADEs 41 (32) 2 (5) 4 (11) 40 (32) 87 (26)Potential ADEs,

nonintercepted 26 (20) 25 (63) 21 (55) 84 (67) 156 (47)Potential ADEs,

intercepted 63 (48) 13 (33) 13 (34) 2 (2) 91 (27)Totals 130 (100) 40 (100) 38 (100) 126 (100) 334 (100)% by stage 39 12 11 38 100

Source: Adapted from Leape and Bates, pp. 35–43.

aPercentages may not add to 100% due to rounding.

Table B Distribution of Errors by Proximal Cause and Stage of Drug Ordering and Delivery

Proximal Cause

PhysicianOrdering No.

(%)

Transcriptionand

VerificationNo. (%)

PharmacyDispensing

(%)

NurseAdministration

No. (%)All No.

(%)

Lack of knowledge of the drug 47 (36) 6 (15) 0 (0) 19 (15) 72 (22)Lack of information about the patienta 31 (24) 4 (10) 0 (0) 13 (10) 48 (14)Rule violations 25 (19) 0 (0) 6 (16) 2 (2) 33 (10)Slips and memory lapses 14 (11) 0 (0) 0 (0) 15 (12) 29 (9)Transcription errors 0 (0) 29 (73) 0 (0) 0 (0) 29 (9)Faulty drug identity checkingb 0 (0) 0 (0) 11 (29) 13 (10) 24 (7)Faulty interaction with other services 1 (1) 0 (0) 3 (8) 13 (10) 17 (5)Faulty dose checking 0 (0) 0 (0) 3 (8) 13 (10) 16 (5)Infusion pump and parenteral delivery

problems 0 (0) 0 (0) 0 (0) 16 (13) 16 (5)Inadequate monitoring 11 (8) 0 (0) 0 (0) 4 (3) 15 (4)Drug stocking and delivery problems 0 (0) 0 (0) 3 (8) 0 (0) 11 (3)Preparation errors 0 (0) 0 (0) 3 (8) 6 (5) 10 (3)Lack of standardization 0 (0) 0 (0) 0 (0) 8 (6) 8 (2)Unclassified 1 (1) 1 (3) 0 (0) 4 (3) 6 (2)Totalsc 130 (100) 40 (100) 38 (100) 126 (100) 334 (100)

Source: Adapted from Leape and Bates, pp. 35–43.

aIncludes 24 errors related to medications to which patients had known allergies.bIncludes 10 cases involving errors due to name confusion.cPercentages may not add to 100% due to rounding.





5

POE Systems

To many, POE systems represented a large opportunity to decrease preventable ADEs. A 1998study, also conducted at Brigham and Women’s Hospital, found that computerized POE had asubstantial positive impact on the nonintercepted ADE rate (error rate reductions are summarizedin Table C below, and Exhibit 3 contains excerpts from this study giving its methodology andconclusions).

Table C Paired Comparison Rate of Nonintercepted Serious Medication Errors, Adverse DrugEvents (ADEs), and Potential ADEs Before (phase 1) and After (phase 2) Interventions WereImplemented

Phase 1 RateEvents/1,000 patient

days, mean

Phase 2 RateEvents/1,000 patient

days, mean % Difference

Nonintercepted serious medical errors 10.7 4.86 -55Preventable ADEs 4.69 3.88 -17Nonintercepted potential ADEs 5.99 .98 -84

All ADEs 16.0 15.2 -5Nonpreventable ADEs 11.3 11.3 0

All potential ADEs 11.7 3.38 -71Intercepted potential ADEs 5.67 2.40 -58

Source: D. Bates, L.L. Leape, et al., “Effect of Computerized Physician Order Entry and a Team on Prevention of SeriousMedication Errors,” Journal of the American Medical Association 280 (15) (1998): 1311–1316.

Researchers concluded that while a wide range of proximal causes contributed to the occurrenceof ADEs, an integrated approach to POE could substantially lower the rates of preventable ADEs thatoccurred due to

� Lack of information about the patient (e.g., drug allergy)

� Rule violations

� Slips and memory lapses

� Transcription errors

� Faulty drug identity checking

Debate

The advent of POE systems led to some controversy within the medical community. While theinitial research on error reductions resulting from POE introduction was solid, some commentatorsfelt that it was conducted within an unusually favorable environment. Others pointed out thatpiecemeal POE implementations were likely to be less effective at reducing error than comprehensiveor integrated ones, and that these systems could actually have a negative impact by providing a falsesense of confidence that medication safety was “guaranteed” by the computer. (Exhibit 4 containsexcerpted commentary on POE systems.)





6

The Mount Auburn POE Project

Existing Drug Delivery Process

The hospital medication process—from initiation of physician order to the ultimate patient receiptof medication—consisted of five stages: ordering, transcription, dispensing, administration, andmonitoring.

Prior to the POE implementation, the ordering phase by Mount Auburn physicians could beinitiated in one of two ways:

Drug Delivery Method 1: Submission of Handwritten Order

ORDERING TRANSCRIPTION DISPENSING ADMINISTRATION MONITORING

STEP 1.Physician submitshandwritten orderto staff member(see Exhibit 5 fora sample order)

STEP 2. Staff membertranscribes order tomedicationadministration record(MAR).

STEP 3.Staff member faxesorder to pharmacy.

STEP 4.Pharmacist fillsorder.

STEP 5. Nurse dispensesmedication.

STEP 6. Patient receivesmedication.

Drug Delivery Method 2: Verbal Request

ORDERING TRANSCRIPTION DISPENSING ADMINISTRATION MONITORING

STEP .Physician makesverbal request tonurse or staffperson to placeorder.

STEP 2.

Administrator

transcribes order to

MAR.

STEP 3.

Staff member faxesorder to pharmacy.

STEP 4.Pharmacist fillsorder.

STEP 5.Nurse dispensesmedication.

STEP 6.Patient receivesmedication.

Planned Drug Delivery Process

Changes to ordering Mount Auburn Hospital’s computerized POE system would allow thephysician to enter drug orders directly. The POE system would thus streamline the order process,eliminating the risk of misinterpretation at transcription stage and ensuring that drug orders werereceived by the pharmacist directly.





7

Drug Delivery: Planned Method with POE

ORDERING DISPENSING ADMININSTRATION MONITORING

STEP 1.Physician enters order intoPOE system.

STEP 2.Pharmacist receives andfills order.

STEP 3.Nurse dispensesmedication.

STEP 4.Patient receivesmedication.

Decision support for ordering Mount Auburn Hospital’s POE system also included adatabase of medication “rules” that, when integrated with the MEDITECH system and its PCIcomponent, would allow both physicians and pharmacists to better consider drug treatment based ona patient’s record of

� Allergies

� Current or previous medications, or other medical treatments (to check for drug-druginteractions)

� Physical condition, such as height, weight, and other factors critical to specifying dosagecorrectly

The initial POE system within the labor and delivery unit at Mount Auburn would incorporatethese decision-support capabilities. A major question was whether the labor and delivery ward,where medication orders were relatively simple, would provide a thorough enough test of thesedecision-support capabilities. More advanced capabilities, such as the ability to recommendmedications based on the results of a patient’s previous diagnostic tests, would not be part of MountAuburn’s initial POE system. The implementation team would have to decide whether and how toincorporate them.

Costs

In 1990, Mount Auburn Hospital invested $40,000 in the initial MEDITECH software. In 2001,Mount Auburn had paid $27,000 for POE software, plus a $10,000 implementation and training fee.In addition, the project’s budget included $150,000 for initial hardware expenditure for the pilotphase of the project, with $150,000 more appropriated for additional equipment hardware over thecourse of the implementation. Overall, the cost of the project was considered to be minimal: cost forcomparable POE systems ranged generally from $100,000 to well over $1 million. The hospital was toserve as one of the first users of MEDITECH’s new POE module.

Implementation and Rollout

To date, a major implementation activity had been defining the POE system’s menus and ordersets. Menus were designed to guide physicians through the medication ordering process, requiringphysicians to specify all necessary elements of an order, including dose, frequency, and route (oral,intravenous, etc.). Order sets would streamline the ordering process by allowing a physician tospecify with only a few keystrokes a standard grouping or sequence of medications. Since thehospital’s physicians were already accustomed to specifying order sets using paper forms, it wouldbe important for the POE system to replicate this convenience. (See Exhibit 6 for sample POEscreens.)





8

The rollout of the implementation would occur in three phases, beginning with a two-week trial inthe hospital’s labor and delivery unit. The first phase (in the labor and delivery unit) would pilot thegeneral POE medication order process and test the system’s order sets. In the second phase, theimplementation rollout would be extended to other areas of the hospital. For the final phase,additional types of order sets would be tested (including radiology and lab testing). The rollout wasscheduled to begin in mid-October 2002. Physicians were to be trained on the POE system beginningin early October. The expectation was that physicians trained on the POE system would no longeruse noncomputerized channels for placing medication orders.

The plan to provide more widespread physician access to the MEDITECH system includedinstalling a new terminal for every two hospital beds, with dedicated printers located in each area sothat all “e-signed” orders could be printed immediately and placed into patient charts.

Conclusion

Todd knew that the implementation team still faced several important decisions. For example,what should POE training consist of? How much training would physicians need about using thesystem, and how should it best be delivered to them? It would be technically straightforward torequire a physician’s user ID to submit a medication order—was this the right approach? If so,would it also be necessary to instruct the pharmacy to stop accepting medication orders from laborand delivery over the phone or by fax and other non-POE channels? Would such instructions, ifissued, be obeyed? Physicians and other staff had been told about the new POE system via thehospital’s internal newsletter, memos, and other communications, but Todd knew that much morework would be required to get them ready to actually use the system.

Also, how would Mount Auburn evaluate the new system once it was in place? The hospital wasnot in the middle of a comprehensive ADE study like the one conducted previously at Brigham andWomen’s Hospital and did not know with any certainty its ADE and medication error rates. Giventhis, how could the performance of the POE system be evaluated? Would the labor and delivery unitprove to be an adequate testing ground for the POE’s decision-support tools, such as allergy anddosage checking? Fundamentally, how would Mount Auburn know whether POE was working?





9

Exhibit 1 The Leapfrog Group Principles and Recommendations

“All members of The Leapfrog Group have agreed to implement the following principles, either directly or throughthe help of intermediaries such as health plans or ‘purchasing cooperatives’:

A. Inform and educate employees

B. Use comparative rating

C. Use substantial incentives

D. Focus on discrete forward leaps in patient safety

E. Hold health plans accountable for Leapfrog implementation

F. Encourage the support of consultants and brokers”

The Leapfrog Group’s initial three recommended patient safety practices:

“Hospitals are already taking important steps to ensure patients’ safety. Based on overwhelming scientificevidence, The Leapfrog Group decided to focus on three practices that have tremendous potential to save livesby reducing preventable mistakes in hospitals. While these steps will not prevent all mistakes in hospitals, theyare a vital first effort. If these practices are implemented, they could prevent a substantial number of hospitaldeaths caused by preventable mistakes every year.

Computer Physician Order Entry (CPOE)Prescriptions in hospitals should be computerized. With computerized prescription systems, doctors enterorders into a computer rather than writing them down on paper, and the prescription can be automaticallychecked against the patient’s current information for potential mistakes or problems. For example, beforethe doctor can complete the prescription order, the computer would check to see if the new prescriptionwould interact badly with another drug the patient is taking, or if the patient has a known allergy to it.This type of system also reduces mistakes that occur from misreading a doctor’s handwriting. Studiesshow a computerized prescription system can reduce serious medication mistakes by up to 86 percent.Click here for more details about this patient safety practice.

Evidence-based Hospital Referral (EHR)It is important to select hospitals with proven outcomes or extensive experience with specific high-riskconditions or procedures that have a high risk of death or complications. The best way to determine whichhospitals are the best at performing certain high-risk treatments or procedures is by knowing the actualresults their patients experience. A few states have systems set up in which hospitals report thisinformation publicly, but most do not. The best alternative is to track how many of a certain type of high-risk treatment or procedure a hospital performs each year. Over 100 scientific studies have demonstrateda relationship between a hospital’s annual number of certain high-risk treatments and procedures andpatient outcomes. Patients who go to hospitals that frequently perform these high-risk treatments orprocedures, or to hospitals that have demonstrated a good record for patient outcomes, have the bestchance of surviving and successfully recovering. This website displays data on hospitals’ annualexperience with seven specific high-risk conditions and conditions . . .

ICU Physician Staffing (IPS)‘Intensivists,’ physicians specially trained to care for critically ill patients in Intensive Care Units (ICUs),should staff ICUs. More than four million patients are admitted to ICUs each year in the U.S. and morethan 500,000 of these patients die. Studies reveal that at least one in ten patients who die every year inICUs would have an increased chance to live if intensivists were present in the ICU and managing theircare for at least eight hours per day. While not every hospital’s intensive care unit can assure 8 hours perday of intensivist care because there is a shortage of intensivists in the United States, this staffing level isan important factor to consider when choosing a hospital if your doctor expects that you are likely to stayin an ICU during your hospitalization.”

Source: The Leapfrog Group Web site, <http://www.leapfroggroup.org/safety.htm>.





10

Exhibit 2 MEDITECH’s Patient Care Inquiry (PCI) Screen

Source: Mount Auburn Hospital.





11

Exhibit 3 Excerpts from POE Study

Result: . . . Physician computer order entry decreased the rate of nonintercepted serious medicationerrors by more than half, although this decrease was larger for potential ADEs than for errors thatactually resulted in an ADE.

ADEs occurring after hospitalization have been projected to cost hospitals $2 billion per year, notincluding malpractice costs or the costs of injuries to patients. Hospitalizations initiated by ADEsappear to be at least as expensive.

This intervention primarily targeted the administration and dispensing of drugs.

The POE intervention represented a major systems change and included many features that would beexpected to reduce errors. As part of the POE application, physicians were provided with a menu ofmedications from the formulary and default doses and a range of potential doses for each medication.Physicians were required to enter dosage, route, and frequency for all orders.

Transcription was greatly reduced, although not eliminated, because the medication administrationrecord was still on paper. For a number of medications, relevant laboratory results are displayed onthe screen at the time of ordering (e.g., potassium levels when furosemide was ordered). Otherfeatures included consequent orders, which are orders that should follow from other orders, andlimited drug-allergy checking, drug-drug interactions, and several drug-laboratory combinations(e.g., potassium levels in patients receiving potassium).

The POE application functions as part of an internally developed information system, BrighamIntegrated Computing System, which manages the hospital’s administrative, financial, and clinicaldata. All orders are written using this application, primarily by the officers, although fellows andattending physicians also write orders. Approximately 16,000 orders are written daily, 40% of themfor medications.

These results suggest that implementing even a modest POE system can result in important errorreduction, if the system includes a dose selection menu, simple drug-allergy and drug-drug checking,and the requirement that clinicians indicate the route and frequency of drug doses.

However, potential ADEs were prevented out of proportion to those that actually resulted in an ADE.While we had not expected the decrease in the preventable ADE rate to reach statistical significance,we did hope that these events would be decreased in proportion to the potential ADEs. That this didnot occur suggests that errors that actually cause injuries may be different, and examination of theindividual events bears this out. In particular, 42% of the preventable ADEs that persisted in phase 2were due to judgment errors associated with the use of multiple sedating drugs.

Our findings do illustrate the difficulty of linking process improvements to reduction in ADE ratesand suggest that small changes are likely to have limited overall impact.

We were surprised that the error rate did not fall as much for the ordering stage as rates for otherstages.

Source: D. Bates, L.L. Leape, et al., “Effect of Computerized Physician Order Entry and a Team on Prevention of SeriousMedication Errors,” Journal of the American Medical Association 28 (15) (1998): 1311–1316.





12

Exhibit 4 Excerpts from Commentary on POE Systems

[POE] should not be there to preserve disorder.

[POE] needs to be seen as a redesigned infrastructure for prescribing. This infrastructure requires theintegration of three types of information—clinical data related to the patient, the patient’s drughistory, and phramacotherapy knowledge—information and linkages that are largely absent frommost marketplace products.

A disconnected electronic prescription-entry screen is an empty solution to the real problems we facein improving pharmacotherapy.

Without this infrastructure and vision of how these elements ought to be designed and deployed tooptimize [POE], this technology will fall far, far short of its potential.

A narrow focus on handwriting-related and “fulfillment” errors underestimates the magnitude of theproblems faced by prescribers and the public and sells short the enormous potential of [POE]technology. Let us not squander this opportunity to optimize health care outcomes for patients.

Source: G.D. Schiff, “Computerized prescriber order entry: models and hurdles,” American Journal of Health-SystemPharmacists 59 (2002): 1456–1460.

Has . . . IT vanquished . . . medication errors? I think not . . . The rumbling juggernaut of IT is gainingmomentum, but the technology assessment programme is lagging behind. We continue to makejudgments on technologies implemented at pilot sites that seethe with committed able enthusiasts,but we often fail to evaluate the next stages of rollout. Consequently we do not know why thetechnology works as it does, where it does. We do not know the extent to which findings aregeneralisable to different settings; we cannot answer the question “Will it work for me? “

There is a pressing need for “realistic evaluation.” IT and robotics have great potential but so, too, dohumans.

There is a need first to identify errors, and then for a system to bring them to the attention of theprescriber and others so that learning and improvement can take place. A significant problem is thatindividuals who make an error are often ignorant of that fact, so others have to identify it and feedback to the prescriber; this, in turn, can lead to interdisciplinary tensions unless the organizationalculture is right.

Source: R. Kaushal and D. Bates, “Safer prescribing: Information technology and medication safety: What is the benefit?”Quality Safety Health Care 11 (2002): 261–265.





13

Exhibit 5 Sample Handwritten Physician Order






14

Exhibit 6 The Sequence of POE Screens as Accessed from the PCI Window

Screen 1: Physician allowed to review patient’s medication order history (see Screen 2 below) or to enter a neworder (see Screen 3 below).

Screen 2: The Review Orders screen, with multiple function access.





15

Exhibit 6 (continued)

Screen 3: The Enter Order screen (place orders through medication and order sets).

Screen 4: Physician highlights medication order and double clicks to make selection.





16


Screen 5: Physician is offered a dosing string but can choose to modify the dosing if necessary (see Screen 6below).

Screen 6: The dosing modification screen.





17


Screen 7: After filing the medication order, the system returns to Enter Order screen, where the physician canselect an order set.

Screen 8: Available order sets are displayed (as are medication sets).





18


Screen 9: After physician has selected an order set, the system returns to the Enter Order screen. After clickingSubmit to file the order, the physician is prompted to sign the order electronically to complete the order process.


Documents

McGraw-Hill/Irwin - Canis Learning · DBMS Report generators Marketing Views program Accounting program Database FIGURE 1.3 Managing Information with a Database and Database Management