Bob Lewis’s IS Survival Guide (MacMillan Computer Publishing) will be on the shelves by the time this column appears. For everyone who reads this column and wonders whether it’s worth buying I have only one thing to say: My kids need new shoes.

If you do buy the book and like it, tell your friends. If you don’t like it … pretend I’m your boss. Act like it’s the greatest thing ever, even though you know better. I have plenty of reality in my life already, and lots of friends and colleagues who minimize any risk of ego-inflation.

Of everything in the book, the chapter on measurement was the hardest to write. Measurement doesn’t lend itself to lively prose under the best of circumstances, and even among IS professionals the plague of innumeracy is rampant.

Worst of all, the state of the art when it comes to IT measurement is dismal. A recent conference in which I recently participated reinforced that conclusion.

The good-news part of the story is that we know how to understand the performance of data center operations. We have well-developed measures to help us understand how reliable our systems are, how well they perform, and how much they cost to operate.

Not only do we know how to measure operations, several professional benchmarking companies have extensive performance databases, so you can compare yourself to the rest of your industry, or to business as a whole. If you’re sub-standard, you can set up improvement programs to make yourself better. If, on the other hand, you’re ahead of industry averages you can … well, you can still establish improvement programs, because you always want to improve, don’t you?

Benchmarking really doesn’t do a lot for you, unlike baselining, which does. There are only two reasons for benchmarking, both of them social. The first is to defend yourself against executive-suite attacks (“We’ve just undertaken a benchmarking exercise and are ahead of industry averages, so QUIT YOUR GRIPING, FRED!”). The second is to break through internal resistance to change. It’s as common in IS as anywhere else for employees to figure they’ve already done as much as possible, so a benchmarking study that demonstrates sub-standard performance can help break through this resistance. (So can establishing a baseline and saying to employees, “I don’t care if we’re good or bad, we’re going to be better next year than this year.”)

Internally, we know how to measure operating costs. How about our contribution to the rest of the business? Well …

We do know how to measure how much process-improvement projects increase productivity. If anyone is willing to go through the effort, they can perform a before-and-after productivity analyses of the process being improved.

This doesn’t answer the question we’re asking. Process-improvement projects include not only new technology, but also process redesign, culture change, usually a new business model, and sometimes a new philosophy of leadership. What part of the productivity increase comes from information technology? It isn’t a meaningful question — technology is integral to the new process, not a bolted-on automator of activities you’d otherwise do manually.

Assessing the contribution of technology to productivity is what we’re best at and we don’t have an adequate framework for that, only a way to measure the impact of a specific process improvement project. We have no idea at all of how to measure the value information technology creates. Instead, silly notions like the Gartner Group’s Total Cost of Ownership and weak analyses like Paul Strassmann’s The Squandered Computer (both critiqued extensively in this space) still get a lot of attention.

It’s time for us to get a handle on this issue. If measurement of the value we create is important, it’s time to get on with it. If not, it’s time to formulate a clear-headed debunking of the whole concept.

Either way, we need to do better. Next week, we’ll start exploring how.

Issues arrive in five categories: Process, knowledge and skills, attitudes and behaviors (that is, culture), technology, and organizational structure. The fix doesn’t have to be the same as the cause, however. For example, you can fix a process problem with training to increase skills and knowledge.

Finding suitable solutions to problems while showing good judgment and a sense of perspective is an important characteristic of leadership. I just heard an excellent example … of the exact opposite.

The situation: IS, in the final stages of cleaning up after a computer virus, announced its plan for preventing future ones. Its “solution”: Eliminate floppy drives. My correspondents work in the marketing department. Floppy diskettes are their sole medium for exchanging data between the PCs they use themselves and the Macintoshes favored by their outside contractors, so they raised objections.

IS responded by offering to leave one PC intact, but with a locking device attached to its floppy drive. The user of this PC is to interrupt her work, unlock the drive, manually scan the diskette, transfer files, and re-lock the drive whenever someone needs to read a floppy. To satisfy the rest of the company, IS also plans to set up a central scan station it will administer and operate.

“We are not trying to make life difficult for you,” wrote the person responsible for this policy. It’s a true statement, too. “Trying” means expending effort, and as is usually the case, making life difficult is effortless. It’s making life easy that takes thought and work.

Three features of this case make it especially sad. The first is that whether the issue is virus-prevention, security, or data corruption, the first reaction of many in IS is to erect barriers that interfere with end-users’ ability to do their work. Getting rid of floppy drives in response to a virus attack is a predictable, baby-with-bath water response to the problem, equivalent to eliminating keyboards because someone sent out a letter containing erroneous information.

The second feature of this case, and an especially unfortunate one, is that the steps outlined by IS, while draconian, don’t solve the problem. The vast majority of viruses these days are macro viruses arriving through documents attached to incoming e-mail. Eliminating floppy diskettes is a lot like nailing the windows shut while leaving the front door unlocked – you get neither security nor fresh air.

And of course, there’s the third, most obvious flaw in IS’s strategy: Through the simple expedient of installing a reputable virus-scanner on every workstation, the enterprise could receive real protection from virus attacks.

Why did IS ignore this obvious choice? In the absence of hard evidence, we can only guess. One likely culprit is the budgeting process. IS would have to pay for the virus scanning software and the labor needed to install it (although in most cases virus scanners can be installed painlessly across the network). Floppy disk elimination moves most of the costs and all of the inconvenience to the rest of the business. So once again budgeting, a process that exists to promote good planning and fiscal accountability, instead has its customary effect of creating incentives to make wrong decisions.

No process is perfect – not budgeting, not inventory management, not salary administration – nothing. When you blame your own bad decisions on a process you’re making an excuse, much like a customer service representative who tells you, over and over again, “I can’t do that for you because it would violate our policy.”

Issues may stem from process problems, deficient skills, bad habits or attitudes, poor technology, or organizational barriers. In this case, a virus attack, the problem was technological – the susceptibility of modern PCs to virus attacks. IS (if our guesses are accurate) allowed the budgeting process to divert it from the optimal response of installing a companywide virus scanner, an easy technological fix.

Instead, it responded to one process problem by creating another one. Why?

The problem is one of culture, the attitudes and behaviors of an IS leadership that chooses to erect barriers to effectiveness throughout the company because it isn’t ept enough to find a creative solution to its budget limitations.