Those companies, which also tend to have good risk management and understand what it takes to be innovative, and to hire staff, promote them and train them, will continue to succeed but will remain a small minority, he says.

"I think less than 5 percent of corporations here in the US have CIOs or ex-CIOs on their board, so it's a very small percentage. It is, however, a group that I think will continue to do well, and be able to globally compete," Charette says. "The other corporations are going to find it harder and harder and are going to be hurt more and more by their lack of innovation and lack of leadership.

"In today's corporation, if someone were to ask me to serve as the CIO, the first question I'd have to ask myself is: Why do I want to be the CIO if I don't have visibility with the board? You know, if IT is so bloody important to corporations, wouldn't you think that you'd want to have people who are responsible for talking IT to them, telling them what they need?

"Now we find ourselves in this mess - corporations who can't innovate populated by management who can't decide and led by executives who don't have a clue about what leadership means. Worse, we don't have a clue how to get out of it," Charette says.

"We are approaching that Gordian Knot situation where unless there is a clean swipe of the sword, it is not going to get untied."

SIDEBAR: The Great Leveller

Where you are, and where you should be, are two different things

ITABHI Corporation's Robert Charette concedes his views on Capability Maturity Model (CMM) certification might shock some CIOs, but insists all his experience backs his conclusions.

"We've found lots of organizations that were Level 3 or Level 4 where the organizational performance did not get the job done," he says. "People don't understand that CMM compliance does not necessarily mean that you are performing to the level you need to for the environment or the context you find yourself in."

You can picture the path most organizations take to CMM maturity as an upside-down funnel, Charette says, with Level 1 on the bottom and Level 3 at the point where the funnel starts to rise. At Level 1 there are many chaotic processes at work. These are weeded out as they are brought under control, which is good. But, once organizations reach Level 3, they become reluctant to change the processes that they have worked so hard to bring under control. They see reaching the right CMM or CMMI (Capability Maturity Model Integration) score as the height of their efforts, rather than being prepared to consider the process stability gained as the ideal platform from which to experiment or be innovative.

A mature CMM or CMMI organization should look more like an hourglass, Charette says, with more innovative processes being added to its portfolio as you move to Levels 4 and 5, rather than a funnel where processes are forever being finely tuned.

When decision makers kept an open mind on ways to tailor their efforts to focus on ultimate performance and innovation, their CMM efforts paid huge dividends. Mould breaking organizations also displayed much greater realism in their risk exposure and means to address it. Most important, they were willing to test their assumptions, an attitude that in itself could help foster innovation, Charette says.

SIDEBAR: Transformation Tips

Robert Charette describes the 15-year journey communications and aviation electronics firm Rockwell Collins took to create a world-class risk-taking organization in Profiting From Risk: A Transformation of One Company's Risk Culture. Charette, who is the president of business and technology risk-management company ITABHI and a Cutter Consortium Fellow, says an organization looking to transform itself into one that is more innovative and risk-taking can look to the Collins journey and find valuable lessons. These include:

Recognize that Risk is Strategic: Explicitly incorporate enterprise risks to achieve best fit for your business model, with regard to market opportunity, competitive threats and weaknesses, as well as its financial plans.

It's All About Making Better Decisions: There is no value in risk analysis itself - value is derived from decisive execution of logical action plans based in part on that analysis.

Don't Confuse Motion With Progress: Culture change must be organized around a few core processes that provide revenue, growth and increased capability to serve real customers.

Instil Principle-Based, Process-Focused, Behaviour-Driven Risk Management: Risk management is not yet another corporate process, but a different way of thinking and acting. Unless an organization thinks about what behaviours it wants its employees to take in the face of risk, a proactive risk management culture is never going to take hold.

Plan, Do, Check. But Most Important - Act: You cannot succeed without acting. Many plan for cultural change but few actually give it a real hope for success.