Cio Should Report Directly to Ceo.

Sony was another victim of hacker attacks. The problem might be the result of the corporate reporting structure at Sony in which CIO does not report directly to CEO. Less than half of the firms also don’t have CIO report directly to CEO. CIO has to report through an additional layer of management instead. This fact is surprising since data security becomes increasingly important in today’s businesses.  According to Vasant Dha, the head of the information systems group at New York University, this corporate reporting structure is an old-fashion thinking. CIO’s responsibilities are expanding from managing company’s internal network to managing corporate interactions with customers and vendors via internet. All of these increase the risk of hacking. Thus, it is wise for companies that rely heavily on data to have CIO directly report to CEO. This reporting structure will ensure that sufficient information is provided to the top without delay.

In my opinion, there is no one size fits all solution to decide whether CIO should report directly to CEO. There are several factors that need to be considered as follows:

1. Strategic goals of the organization

According to Griffith (2013), CIO reporting structure depends on the strategic goals of the organization.  Griffith refers to the research from Dr. Rajiv Banker and colleagues at Temple University’s Fox School of Business which found that organizations with cost leadership strategies have higher performance when CIOs reports directly to CFOs as compared to peers with CIOs report directly to CEO. On the other hand, organizations with product differentiation strategies have higher performance when CIOs report directly to CEOs and not CFOs. Alignment with strategic goals of the organization is the key to higher business performance.

2. Roles of IT in the organization (Key player or supporter)

It is critical that CIO role must justify a direct reporting line to CEO. According to Tillmann (2009), CIO reporting to CEO is the right structure when IT is a key player in that organization. This means that IT directly contributes to the development or production of the company’s products, creates sales and satisfies customers.

Additionally, Raskino (2011) provides some specific situations in which CIO should report directly to CEO as follows:

1. The company and industry is highly or moderately information intensive such as banking, media, and service industries (for example travel and retail companies). In this case, data security is extremely important to the well-being of the firms.
2. A technology-dependent business model or company transformation is under way such as M&A process integration.
3. Information related threats of a company are high. Examples include cyberwarfare, industrial espionage, regulatory compliance and information-intensive business volatility.

Situations in which CIO is not a good candidate to report directly to CEO is when IT is merely an observer or a supporting system of the organization. Tillman (2009 stated that in such case, CEO cares more about products (manufacturing and R&D departments), sales (sales department) and customers (customer service department). Those areas are key players and they play integral roles in driving the business. Time is valuable and thus CEO should dedicate more attention on those areas rather than dealing directly with CIO.