"I've been fortunate enough to take the technology awareness and experience that I've had, and then complement that with the product and the program experience and the business experience and then brought that all together to perform this role," he says. Being able to draw in product experience, program management experience, IT and technology experience and commercial experience helps him gain a unique understanding of the needs and wants of the average customer, Spooner says. "If you get a combination of all of those, it's pretty powerful and enables you to really operate at that executive level without being focused, like a CIO, on one particular niche area."

Spooner says for CIOs without such a broad range of experiences, understanding customer expectation means learning to understand all the drivers of the business, and doing everything possible to develop commercial and business awareness. "At the end of the day it's about understanding what our audience needs are, understanding then the translation of those into business requirements, and then finding out what technology or IT must be delivered to enable and support those," Spooner says.

"We've used a number of different sources from direct customer feedback to market awareness and market insights to competitive behaviour. We look at all of those things to see how they relate and how they influence our business. I then take that and translate that into: Okay what do we need to do as a business? What does that mean in terms of products? What does that mean we need to do in terms of customer offerings? And only then do I look at it from an IT or a technology perspective."

Some organizations obsessively survey their customers and imagine that's all they really need to do, Spooner says, rather than spending time translating that understanding into strategy. Being too technology focused or technology led is dangerous if it leads you to deliver brilliant technology that still fails to support and deliver customer expectations. It's the translation of that awareness into strategy, drawn up against an understanding of all the drivers in the business, not just the technology drivers, that matters, Spooner says.

Business is all about customers, notes AGIMO Division Manager Patrick Callioni. Without customers there is no business, no matter how good your business processes, technology, cost control and resource management. A CIO who understands the organization's customers is much more likely to be able to assist the business to respond to or preferably, anticipate what needs to be done to satisfy the customer.

"Assessing and managing risk is important because it provides context for the decisions a CIO has to make in balancing the requirements of the internal client (the business) and the (external) customer. Doing this right requires CIOs to consider and manage many factors, often competing with one another for attention and for resources," Callioni says. "The CIO has to assist the business to succeed without falling into the trap of thinking that she or he knows the business better than the managers responsible for it, while, at the same time, preventing those managers from deluding themselves that they know all there is to know about the potential of technology to support business objectives."

Callioni says using industry standards for risk management (AS 4360) can help the CIO and the business to engage in a constructive dialogue about the linkage between the technology and business processes, by providing a common language and tool set. Similarly, by developing a common understanding of the risk and opportunity environment for the business as a whole, including technology, the CIO can work with management to shape complementary strategies and action plans.

"This is a simple solution that is hard to implement," Callioni says. "It is hard to implement because most managers, including CIOs, treat risk assessment and management as a tick and flick exercise, rather than using it as the powerful strategic and management tool it is designed to be. Once this cultural barrier is overcome, AS 4360 is easy to use and does not require the organization to bring in expensive consultants. In fact, using a standards-based approach to risk management may help the organization avoid the need to bring in consultants to solve strategic or business design problems."