Competitive advantage has been studied for decades. Porter (1998) concluded that Information Technology (IT) contributes to corporate competitive advantage through differentiation, efficiency, cost reduction, quality improvement, and innovation. The three IT factors often studied with varying results include: Leadership, Skill, and Infrastructure. While these constructs are critical to establishing and measuring competitive advantage, by themselves, they fall short.  We believe that robust measurement of IT-enabled competitive advantage must include Risk.

IT investments have become a predominant part of the capital expenditure budget of many organizations. As a result decision-makers are faced with difficult questions, like:

• How should investment in IT be managed to assure alignment with corporate strategy?
• How should future investments be justified?
• What in addition to technology is needed to realize the full potential of IT investments?
• What are the risk implications of IT investments?
• How can the value of IT investments be effectively managed over time?

And while these questions are not new, our practical experience and anecdotal evidence suggest that they often have not been answered satisfactorily --- if at all. Determining the value of IT investments is inherently difficult. Although the costs seem readily identifiable, many of the benefits are elusive (Kulatilaka et al, 1999).

There is growing research interest regarding risk management (RM). However, most of the current efforts focus on risk mitigation, avoidance, or acceptance. Our effort is to extend existing RM research by integrating the application of risk management within the context of IT, specifically the value and the risks of IT projects and initiatives. Doing so provides a unique, cohesive list of factors to identify if IT management of risk has a significant impact on explaining competitive advantage of an IT-enabled business strategy.

Moreover, the research published in this series will demonstrate effectiveness of Real Option Theory in identifying additional value that comes from risk. In contrast to the conventional risk adjustment methods, the real option approach takes into account the upside potential for risk, arguing that uncertainty can be used for prospective gains by observing the real world conditions and adjusting our behavior accordingly to increase the IT investment upside and to decrease the possible downside.

Figure 1 illustrates a high-level IT-enabled Competitive Advantage structured equation model that defines the constructs; specifically (Gonzales et al, 2009):

• IT Value and Risk is a construct that attempts to quantify the type of techniques used for assessing the risk of IT initiatives and accurately quantifying their value contribution to the organization in uncertainty.
• Leadership examines the person in the top position of the IT effort.
• IT Skill measures the ability of the IT team.
• IT Infrastructure focuses on the hardware, software, data, and communications network of the IT environment.

The IT Value and Risk construct is based on Real Options Theory which applies options trading principles to real world situations, such as IT Infrastructure projects. Real options research is uniquely qualified to be incorporated in the study of IT factors of competitive advantage; specifically, one aspect of real options research that examines how to optimally configure an IT investment portfolio to control risk and to maximize investment value to the organization given the uncertainty.

Our research and practice uses Structured Equation Modeling to better understand the causal relationships among the four constructs of Leadership, IT Skill, IT Infrastructure, and IT Value and Risk, as well as explain the variance of competitive advantage.

This is the first in a 5-part series of papers that outlines and demonstrates the application of advanced risk management techniques to support an overall model for IT-enabled competitive advantage. Each subsequent part of this series offers deeper examination of key topics for defining and explicitly applying risk management solutions to IT initiatives.