An Executive Guide to Investment, Security, and Growth
Imagine your customer service team has proposed purchasing an AI assistant to reduce the backlog of requests. The tool performs well in an initial demonstration, but it is still unclear what information powers its responses, who is responsible for correcting its errors, and how faster response times will affect costs or customer satisfaction. This is where the manager’s decision begins—not with choosing a product or signing a contract, but with asking the right questions first.
What Is IT Management?
What Is IT Management?
IT Management is the process of aligning technology, data, infrastructure, cybersecurity, and people with business objectives. It goes far beyond maintaining systems; IT Management determines how an organization creates value from AI, protects its data, and turns digital investments into measurable business outcomes.
Today, technology leaders are not simply deciding whether to “buy or not buy” an AI tool. The real question is: Which business problem should technology solve? What data and infrastructure are required? What risks are involved? And who will be accountable for the outcome?
Why Has IT Management Become a Strategic Priority?
In the past, IT was largely viewed as a support function responsible for managing networks, software, hardware, and employee access. Today, however, technology sits at the heart of sales, operations, human resources, supply chain management, customer experience, and executive decision-making.
AI, cloud computing, data analytics, and cybersecurity have accelerated this transformation. As a result, the role of the IT manager—or Chief Information Officer (CIO)—extends far beyond maintaining system stability. Today, IT leaders are expected to demonstrate the measurable value that technology creates for the organization.
This transformation has brought three key responsibilities to the forefront:
Turning Technology into Business Value: Reducing Costs, Increasing Speed, Driving Revenue Growth, and Improving Customer Experience.
Digital Risk Management: Data Security, Access Control, Business Continuity, and Incident Response.
Leading Organizational Transformation: Preparing Employees, Redesigning Processes, and Creating a Common Language Between Technology Teams and Business Leaders.
As a result, IT management has become an integral part of an organization’s strategic management. Just as business strategy defines the path to
Responsibilities of an IT Manager
The IT manager elevates technology from a mere “tool” to a strategic organizational capability. They must balance immediate operational needs with long-term technology investments.
The key areas of responsibility include:
| Area | The Key Management Question |
| Technology Strategy | Which technology can have the greatest impact on business objectives? |
| Data and Systems Architecture | Are our data reliable, integrated, and usable? |
| Artificial Intelligence (AI) | Which AI applications can create real business value and scale effectively? |
| Security and Risk | Which data and processes are at risk, and who is responsible for controlling them? |
| Budget and Vendors | How is the return on technology investment measured? |
| People and Change | What skills do employees need to use technology effectively and responsibly? |
For example, if a company decides to use AI in customer service, the IT manager’s role goes far beyond selecting a chatbot. They must also design how the tool integrates with the CRM, ensure data quality, define access controls, determine how sensitive conversations are escalated to human agents, establish success metrics, and manage the risk of information disclosure.
A Running Example: A Service Company
Next, consider a hypothetical service company that receives 6,000 support requests each month. On average, each request takes 10 minutes to handle, and the team must switch between product guides, customer records, and internal messages to provide a response. All figures and outcomes in this example are hypothetical and intended for educational purposes only; they do not represent the performance of an actual company.
The customer service manager wants to reduce handling time, but an initial assessment shows that part of the delay is caused by outdated knowledge resources and inconsistencies in how support agents respond. As a result, the project begins by assigning responsibility for updating the knowledge base and standardizing support guidelines. In the first phase, the AI assistant only generates draft responses for agents to review. It is not authorized to send messages directly to customers.
How Has Artificial Intelligence Changed the Role of IT Managers?
Organizations are gradually moving from fragmented and experimental uses of AI toward deploying artificial intelligence across core business processes. This shift is transforming the role of the IT manager from being primarily a “system owner” to becoming a leader of the organization’s intelligent operating model.
IT leaders need to distinguish between four levels:
Individual Use of AI Tools: Such as summarization, drafting, or preliminary analysis.
Controlled Team-Based Use: Such as internal assistants for sales, human resources, or content creation.
Integration with Organizational Processes: Connecting AI to CRM, ERP, contact centers, or management dashboards.
Agentic AI: Systems that perform parts of a workflow based on defined permissions and established rules.
As organizations move toward higher levels of AI adoption, the importance of data, security, human oversight, and governance increases. A common mistake is to move directly to Level 4 while data remains unstructured, processes are unclear, and responsibilities are not well defined.
These four levels are a practical framework used in this article and should not be viewed as a ladder that every organization must climb to the top. For a sensitive process, having AI generate a draft that requires human approval may be more appropriate than fully automated execution. The key criterion is whether the level of system autonomy is proportionate to the potential consequences of an error.
What Is AI Governance and Why Does It Matter to Managers?
AI governance is a set of roles, policies, controls, and decision-making processes that determine where AI is used within an organization, what data it can access, what oversight it operates under, and who is accountable for its use.
Simply put, AI governance answers this question: “If an intelligent system makes a mistake or takes a high
The NIST AI Risk Management Framework (AI RMF) is a voluntary framework that defines four core functions: Govern, Map, Measure, and Manage. It can provide a useful foundation for structuring organizational questions and controls; however, using the framework alone does not constitute an endorsement of, or guarantee the safety of, any particular AI system.
For every AI project, managers should clarify these five points from the outset:
Business Objective and Project Success Metrics
You’ll get smarter responses and can upload files, images, and more.
Roles and Authority of Users and AI Systems
Points Requiring Mandatory Human Approval
Processes for Logging, Monitoring, and Responding to Errors or Security Incidents
In the hypothetical company, the customer service manager is accountable for the outcome and quality of responses; the IT manager is responsible for system integration and access controls; the security lead assesses the risks associated with data access; and the designated executive makes decisions regarding residual risk. Requests for refunds, changes to contractual commitments, and sensitive complaints are escalated to the appropriate authorized individual. This division of responsibilities should be documented before the pilot begins.
McKinsey’s survey, titled “The State of AI: How Organizations Are Rewiring to Capture Value,” published on March 12, 2025, found an association between workflow redesign and the reported impact of generative AI on operating profit. This finding is based on survey data and correlation; it does not guarantee that a specific action will produce the same result in every organization. The key management takeaway is the need to examine how work is performed alongside the choice of technology.
How Should IT Investments Be Evaluated and Decided?
Technology investment should begin with one question: What important business problem are we solving?
If the answer is simply, “Because our competitors are using AI,” the risk of wasting budget increases. The right investment starts with the business problem, not the technology.
A 5-Stage Decision-Making Framework for IT & AI Investments
1. Define the Problem
For example: customer response times are too slow, executive reporting is done manually, or order processing error rates are high.
2. Quantify Expected Value
Convert time savings, error reduction, sales growth, customer satisfaction improvements, or risk mitigation into measurable KPIs.
3. Assess Organizational Readiness
Is the data sufficient? Is the process clearly defined? Are existing systems integratable? Does the team have the capability to adopt and use the tool?
4. Execute a Small, Real-World Pilot
Instead of an extensive project, define a pilot with a limited scope and clear success metrics.
5. Scale the implementation after value validation.
If the pilot succeeds, develop the security, ownership, support, and budgeting models for full-scale deployment.
Calculating Value and Cost: A Service Company Example
Assume testing shows that the average handling time decreases from 10 minutes to 7 minutes without any drop in response quality. For 6,000 monthly requests, a 3-minute reduction per request equals 18,000 minutes—or 300 hours of freed-up capacity. If the fully loaded labor cost per hour is assumed to be 200,000 Tomans, the nominal value of this monthly capacity would be 60 million Tomans.
Now assume an implementation cost of 120 million Tomans, alongside a monthly operating, review, and maintenance cost of 20 million Tomans. Only if all freed-up capacity converts into realizable economic benefit will the net monthly gain be 40 million Tomans, with a simple payback period of three months for the initial investment. This simplified calculation excludes the ramp-up time to full utilization, taxes, financing costs, and potential cost fluctuations.
Freed-up time is not automatically cash in hand. If payroll and service volume remain unchanged, the organization gains extra capacity, but does not necessarily reduce its expenses. The actual benefit may come from cutting overtime, avoiding planned hires, or absorbing higher demand. Each must be measured separately, and a single hour saved must never be double-counted in the financial calculations.
If only half of the freed-up capacity is economically usable, the monthly benefit would be 30 million Tomans before operating costs and 10 million Tomans after; the simple payback period extends to 12 months. This disparity illustrates why leadership must evaluate conservative scenarios prior to making an investment decision.
| Testing Criteria | Evaluation Method in the Hypothetical Company |
| Handling Time | Comparing identical request types before and after implementation |
| Response Quality | Reviewing sample responses against standardized criteria and logging critical errors |
| Customer Experience | Measuring satisfaction and re-contact rate for the same issue |
| Employee Adoption | Reviewing actual usage and draft revision rates |
| Actual Cost | Total cost of tools, integration, review, training, and maintenance |
The acceptance threshold for each metric must be defined before the experiment. Increasing speed at the expense of incorrect responses or higher re-contact rates is not considered a project success. The decision to scale must also rely on the results of a representative period of actual work, not just a few successful demonstrations.
Purchasing off-the-shelf tools or custom development
To choose the implementation approach, first compare integration capabilities with existing systems, response quality in the business’s specific language and domain, total cost of ownership (TCO), and exit strategy/lock-in terms. An off-the-shelf tool may shorten time-to-market, but it often comes with access and customization constraints. Custom development provides greater control, but it also increases testing, support, and maintenance responsibilities. A vendor’s demonstration must be validated using actual, authorized organization samples.
Cybersecurity: IT unit responsibility or board of directors’ concern
Cybersecurity is no longer just an issue for the technical team. Every decision regarding AI, cloud computing, remote work, software integration, or data sharing is a managerial and risk-based decision.
Senior executives must understand that digital risk can lead to operational disruption, damage to customer trust, legal penalties, data loss, and brand damage. For this reason, security must be integrated at the beginning of project design, not after its launch.
Minimum questions that the board of directors and CEO should periodically ask the IT director:
What are the organization’s most critical information assets?
Which risks have the greatest impact on business continuity?
When was the last data recovery and business continuity test conducted?
Which systems or vendors have access to sensitive data?
What is the framework for employees’ use of AI tools?
What metric shows whether the organization’s security status has improved or worsened?
Reliable data and the path forward during a disruption
In the hypothetical company, general responses are separated from specific customer records. The assistant only accesses information necessary for the specific task; one customer’s records must not appear in the response to another. Before using actual data, procedures for retention, deletion, potential use for model training, and vendor access must also be clarified.
For each knowledge source, designate a content owner and a review schedule. If terms of service change, simply connecting the assistant to the document repository is insufficient; it must be clear which version is valid, and how the old version is retired from the response cycle. Responses lacking a valid basis must be referred to an expert.
Another important executive question is how the team continues to provide service during an internet outage, vendor disruption, or assistant failure. The example company maintains the ability to provide manual responses and access guides, and defines the person responsible for system shutdown in advance. Testing this alternative path is part of operational readiness.
What skills do IT managers need?
IT management is an interdisciplinary role. Technical knowledge is essential, but it is not sufficient for senior-level management.
Technical Expertise & Analytical Insight
Systems Architecture, Cloud Computing, Data, and Integration
Cybersecurity, Identity and Access Management
Applied Artificial Intelligence, Data Analytics, and Automation
Data Quality Assessment and Technology Risk Management
Financial Literacy for Evaluating Total Cost of Ownership and Return on Investment
Management and Leadership Skills
Strategic Thinking and Prioritization
Project Management and Organizational Change
Vendor Negotiation and Contract Management
Translating Complex Technical Concepts into Business Value
Leading Cross-Functional Teams and Cultivating a Learning Culture
To cultivate these competencies, transform a real-world organizational challenge into a collaborative exercise between the technical team and business leaders: estimate the cost of the status quo, establish clear success metrics, and reach consensus on system governance. This exercise effectively identifies whether the primary gap lies in technical proficiency, financial analytics, or change management.
Managers seeking to enhance their proficiency in financial analysis, strategy, and organizational leadership are invited to compare the curriculum of Mahan’s Strategic Business Management (MBA) program against their professional requirements. Management education serves as a complement to technical expertise, not a substitute for hands-on technical experience.
IT Management vs. Digital Transformation: What Is the Difference?
IT Management oversees an organization’s digital capabilities and resources, including infrastructure, data, security, systems, budget, and the IT team.
Digital transformation is a broader concept, encompassing the transformation of business models, customer experience, organizational processes, and culture through technology. While IT Management serves as a foundational pillar of digital transformation, this transformation is not solely the responsibility of the IT department; it requires the active involvement of the CEO and the entire executive leadership team.
In practice, business systematization lacking data and technology limits scalability. Conversely, implementing technology without process redesign and employee buy-in leads to costly, underutilized solutions.
Proposed Implementation Roadmap
The following timelines serve as planning benchmarks and should be tailored to data complexity, team capacity, and process criticality. For high-risk initiatives, advancing through each phase demands more rigorous verification and control.
| Proposed Timeline | Core Deliverables & Scope | Reviewable Deliverables |
| Days 1–30 | Problem Definition and Baseline Assessment | Project Owner, Baseline Metrics, Data Sources, and Kill Criteria |
| Days 31–60 | Pilot Testing with Targeted Cohort | Quality, Schedule, Cost, and Deviations |
| Days 61–90 | Decision Gate: Refine, Scale, or Terminate | Decision Justification Report & Operational Ownership |
“Ultimately, there are three viable strategic paths: scaling an initiative with proven business value and operational control; refining a project with clear, remediable challenges; or terminating one whose costs or risk exposure are no longer justified. Timely termination is, in itself, a hallmark of disciplined capital allocation.
Executive Summary & Strategic Next Steps
“In the era of AI, IT leadership is not about managing tools; it is about steering business value, mitigating strategic risk, and cultivating enterprise digital capabilities.
“To turn AI, data, and technology into a sustainable competitive advantage, organizations must:”
Align technology with strategic business priorities
“Start with small, problem-driven initiatives
Embed data governance, security, and human oversight by design throughout execution
Clarify accountability for AI and digital risk
And empower leadership teams to make data-informed decisions in a technology-driven landscape.
Technology transforms into a competitive advantage only when managed purposefully, securely, and in full alignment with a clear strategy.
