IT steering committees: charter, intake, and project prioritization

Reference article · 5 min read

Most agencies have technology governance on paper. A committee exists and meets when there is something to announce. The real test is narrower: when two departments want the same implementation staff in the same quarter, does the committee decide, or does the decision get made later by whoever escalates fastest?

A committee that decides has three parts: a charter stating what the group owns, an intake path every request travels with no side doors, and a scoring method members apply in the open against real capacity.

Settle decision rights before membership

Write the decision rights first, so anyone can tell whose call a given item is.

• The committee. Which requests enter the portfolio and in what order, which get implementation staff this period, whether a project continues or stops at a stage gate, enterprise standards that bind departments, and what goes to the governing body.
• The CIO or IT director alone. Architecture within adopted standards, security operations, procurement mechanics inside an approved solicitation, and daily assignment of IT staff.
• A department head alone. Business process inside the department, program policy, data content, and whether a department-funded request is worth submitting.
• The governing body. Appropriations and contract awards above the local threshold. Thresholds and delegation rules vary by jurisdiction, so confirm yours with purchasing and counsel.

Ambiguous decision rights are the most common reason a committee stalls.

Who belongs on it

Limit voting membership to people who control money, staff, or the process being changed.

• An executive chair who is not the CIO. An assistant manager or deputy director, so the meeting does not read as one departments may skip.
• The CIO or IT director as principal staff. Presents the portfolio, recommends, answers questions, does not chair.
• Three to six department heads or named deputies. With many departments, rotate seats annually rather than growing past the size where decisions get made.
• The budget officer. Recurring cost is where most requests fail, so finance belongs in the room when ranking happens.
• Standing advisors without a vote. Purchasing, records, security, accessibility, and counsel as needed.

Name seats by position, not by person, with one designated alternate each.

Cadence, quorum, and the record

Monthly works for most agencies. A quarterly cadence pushes decisions into hallway conversations between meetings, because requests do not wait. Cancel a meeting with nothing to decide rather than lowering the cadence.

• Quorum. A majority of voting seats, and say in the charter whether the chair or finance must be among them. Route routine items to a consent agenda.
• A decision log. One line per item: date, request, decision, any condition, and who carries it out. Over a year it shows how the agency allocates technology capacity, and answers most auditor questions.
• Meeting law. Whether the committee is covered by your state's open meeting law depends on how it was created and what authority it holds. Confirm with counsel before the first meeting.

A standard intake form

One form, one path, two pages at most. Require these fields.

1. Requesting department and a named sponsor at management level.
2. The problem in business terms, described without naming a product.
3. The driver and its source: a statute, audit finding, grant condition, expiring support date, or service gap.
4. What handles the work today, when that contract ends, and who is affected.
5. Cost, one-time and recurring, naming the fund that pays the recurring line.
6. Staff time required from IT, the department, security, and records.
7. Data involved, with classification and any protected categories.
8. Timing constraints: grant period, fiscal year, legal deadline.
9. What happens if the agency does nothing this year.

Return incomplete requests instead of scoring them. Scoring one with no sponsor or no recurring-cost line teaches departments that the form is decorative.

Scoring on mandate, risk, and cost

Use a short scale, define each point in a sentence so a score of three means the same thing to every member, and publish the weights before scoring.

• Mandate. How binding the obligation is and how near its deadline. A statute, a consent decree, a repeat audit finding, and a grant condition are not equivalent, and the scale should say so.
• Risk. Consequence and likelihood together: unsupported software, end-of-life hardware, a single point of failure in a public safety or revenue function, known security exposure.
• Cost and capacity. Total cost over a realistic period including recurring charges, plus agency staff time. At equal benefit, the lighter request ranks higher.
• Service value. Effect on residents or staff workload, and how it would be observed.

Rank against capacity, not against the list: draw a line where staff time and money run out, and record what falls below it as deferred with a review date rather than denied. Allow the committee to override the ranking by recorded reason.

How to start

Begin with the portfolio you already have: an inventory of every project in flight with its sponsor, spend to date, remaining cost, and status. Committees frequently find work there that nobody remembers authorizing.

Adopt the charter by administrative directive unless local policy requires board action, then revisit it annually. Where a request involves a vendor product, have staff get these answers during intake, not after selection: total cost over the full term including implementation and annual increases; what the agency must supply in staff time, data cleanup, and testing; how agency data is exported at termination; accessibility conformance evidence; and hosting location, security documents, and subcontractors.

HQT advises agency IT leaders on technology governance, portfolio assessment, and independent oversight of projects moving through a committee like this one.

Frequently asked questions