Citigroup’s Secret

Tom Sanzone, CIO of Citigroup's Global Corporate and Investment Banking Group, hopes the first thing he sees in the morning isn't red -- green or yellow he can deal with, but not red. Each morning Sanzone walks into his office, sits down with his assistant and gets a rundown of where the 15,000-20,000 development projects within his group stand. On this particular morning, his adviser reports that a risk-management application had been completed the day before. It was on time and on budget. However, another project needs an extension, and yet another is slightly over budget. The list continues.

After his initial consultation, he is well informed and prepared to start his day. Sanzone has never had an assistant like this before -- one who can give him the exact status of each project, where each is trending related to its original budget, and the level of customer satisfaction after each job is complete.

Since this assistant came on board in 2001, Sanzone has been able to decrease his budget by $200 million. Contrary to what one would think, his assistant is "by no means expensive," as it is not a high-salaried consultant. Rather, this trusted adviser is a sophisticated portal that helps manage the firm's many projects, as well as its 15,000 developers. And, at a cost of a small development team, it was well worth the price, Sanzone says.

Sanzone, who was the visionary behind the portal, named it Mystic, for My Systems and Technology Information Center. The goal of the system -- used by both developers and tech and business managers -- is performance improvement, knowledge sharing and standardization.

Performance was first noted using the colors of a traffic light -- green, yellow and red. Projects coded in green meant the project was proceeding as planned. Yellow meant there could be a problem but further investigation was necessary. And red meant something was wrong.

"When we started out, we were probably 60 some-odd percent on time (with our projects). If you look at it now, it says we're around 80 percent," the CIO says. Using Mystic, Sanzone was able to cut the $200 million from his budget through better management of projects and people. This cost savings also came from the ability to share components throughout the global enterprise using Mystic's applications repository. Rather than constantly recreate the wheel, the system provides an index of applications that have already been developed, so they can be reused.

In addition, Mystic makes it possible for Sanzone's managers to manage larger portfolios, he says. Citigroup used to have one manager for every five developers, now that has changed to one manager to 10 developers, enabling managers to do more, notes John D'Onofrio, head of development engineering, who reports to Sanzone.

Now that the portal is proven, Citigroup is considering selling it to other institutions or companies that are looking for a system to monitor performance and standardize practices. "It's in the exploratory stage, we're just feeling it out," Sanzone says, declining to comment further on when a decision would be made or what the price tag would be.

Hams El-Gabri, an analyst with Stamford, Conn.-based research firm Gartner, calls this portal a project-portfolio-management (PPM) system and notes that the space is poised for growth. "It's not yet mainstream. When people think of project management, they think of Microsoft's project server," she says, explaining that Microsoft's tools are helpful when managing a single project, but not a portfolio of projects.

The Vision

Sanzone credits the creation of Mystic to Citigroup's merger phase. The company needed a way to standardize all the different technology processes across the organizations that came together.

"Mystic was really envisioned after we had put a whole bunch of disparate tech organizations under one management," Sanzone says, adding that he was put in charge of the development organization for the new Citigroup in 2000. The concept was to standardize the development processes on a global scale. The goal was, for example, that Citigroup in Asia would have the same processes as Citigroup in New York.

He adds, "Given that these (development groups) came from different companies, we didn't have any consistent processes of any size around the globe. We had 50 different flavors at that point and therefore one of the goals was to have predictability in performance."

Sanzone originally came from Salomon Brothers. There, he said, projects were managed on a decentralized basis by group. Each group had its own practices, its own Microsoft project plans, and its own way to work with each client base. "None matched across the organization."

The Mystic platform changed all that, and did a lot more, according to Sanzone.

How it Works

Today the portal has five components: performance management, portfolio management, asset management, knowledge management and process management. The newest module, which is being beta tested, is risk management.

Performance management helps business or technology managers monitor the performance of their team or department. It helps Sanzone manage the performance of his 15,000 developers worldwide. It monitors their productivity and tracks the financials and quality of the development work using performance metrics. Each project is measured to determine whether it is meeting its original specs of time and budget.

Sanzone notes that the system has been through a few iterations. "We came out of the gate with a traffic-light scenario ... That module was implemented quickly and people were taken aback." He explains that while red would indicate something was wrong, it wasn't always the case. For example, a developer could have a project that was late due to an external factor. Because the project's end date slipped compared to the original date, it would have been coded red.

As a result, Citigroup moved to a green and yellow color-coded system. Yellow means it needs to be looked into, but it doesn't necessarily mean a project has veered off track, Sanzone says.

"The manager's and the developer's job is to look at the yellows and say, 'If it's a problem, fix it,'" Sanzone says. The performance-measurement component is Sanzone's homepage. "So, yes, I definitely come in and take a look at this right away. People have gotten very used to me calling them up after seeing a yellow light."

Although Sanzone has access to everyone's performance, a manager who has a development group of 20 would only have access to his or her team's projects. Each developer has access to their metrics, their team's metrics and their manager's metrics, he notes. This allows everyone to know where they stand compared to their peers.

The second component, portfolio management, works with the performance-measurement component by sending alerts to managers with status reports on their many projects.

Gartner's El-Gabri notes that she hasn't seen too many financial-services firms developing these types of systems and hadn't seen PPM systems on the market until 2002. There weren't any vendors in this space when Citigroup began looking, so they had to develop it, she says.

Creating this type of system in-house is a huge investment -- not specifically around technology development but process implementation, notes Robert Hegarty, vice president of TowerGroup's Securities and Investment Practice, who points to Fidelity as another company that has put a PPM in place. "It's tough to swallow for some firms. The reason we're seeing some of it now is because a lot of CIOs put their reputations on the line by saying, 'I can save you X, but we need to put up Y to get there.'" He adds, "It depends on whether or not the CIO is a risk taker, because they're putting their careers on the line."

Another core component is the asset-management module, which offers a database of the applications and components that exist throughout the enterprise. If, for example, a specific application is being upgraded, a query could be done across the enterprise to find out where it is being used. As a result, the application can be upgraded or replaced on an enterprise-wide basis.

Augmenting this is the knowledge-management module, which provides a collection of tools and reference centers for developers, allowing them to share critical information across the organization. For example, if a developer in Asia was having trouble with a standard or application, the person could query the knowledge center. This would produce a report detailing which other Citigroup developers had created similar components. As a result, the developer placing the query may decide to use the existing component or call its creator for assistance.

"This is not uncommon for large conglomerates to have," says Hegarty. "They often have a way to inventory projects, which can save them money." However, he notes that the trick is being able to implement a process that people will use.

Standardization

The fifth component is process management. This provides what Citigroup calls a "lifecycle for development" -- in other words, the steps that must be taken to turn a project from theory into reality. This is where standardizing the project-development methodologies comes into play, which is important when trying to comply with Office of the Comptroller of the Currency regulations for development, Sanzone says.

In a way, standardizing the process is similar to the Capability Maturity Model (CMM) certifications that many organizations are considering moving toward. However, Sanzone says, "We're going along our own path of maturity and practices. Are we formally following CMM? No. But we are consistently trying to improve our practices."

Larry Tabb, founder and CEO of Westborough, Mass.-based The Tabb Group, says, "I think this is the next step in trying to better manage cost. We're starting to see that outsourcing is not a panacea. We need to get project management together to get outsourcing under control."

D'Onofrio says that this system has benefited Citigroup's outsourcing arrangement. The outsourcing partners, whom he declined to name, tap into the system and their projects are managed the same way internal projects are.

Knowing When to Pull the Plug

The newest component, being rolled out in 2004, is being called risk management. It was designed to monitor and track the performance of applications, while highlighting areas of concern. This component can help a manager assess his/her inventory and the costs associated with running certain technology. For example, it monitors the maintenance costs of running systems, so if maintenance is excessive on an older system, it might make Sanzone consider scrapping it for a more efficient one.

In addition, what Sanzone calls the "proactive" risk-management tool monitors systems' performance and will alert a manager to inefficiencies. The system tracks performance so a manager can react and fix the problem before it even occurs.

Gartner's El-Gabri says, "This is extremely important going forward. Not a single company is offering this right now."

Mystic on the Market?

Selling Mystic could be lucrative for Citigroup. However, it has its critics. Hegarty and El-Gabri agree that the technology is important and valuable, but process and training are also important. "PPM is 90 percent service methodology and 10 percent software," says El-Gabri.

Hegarty notes that Citigroup was successful in its roll out, as the system has helped the institution cut $200 million from its budget, but it might be more difficult for others. "Getting accurate data to flow through the system is the issue," Hegarty says, adding, "You have to change the culture and workflow of projects throughout the organization." For Citigroup to sell this, "They almost have to get into the professional-services business -- either that or partner with an Accenture, Deloitte or KPMG. It's a whole new way of managing."

This article originally appeared in Wall Street & Technology, Jan 2004.