There are only a few ways we end up taking over a global program (as opposed to building it from scratch), whether it’s risk management, crisis management, business continuity, or security management. You can get hired into the role, get promoted to take over the role, or land the role after an organizational shake-up. Regardless of how it was achieved, it’s a proud moment for us. When we take over a program, we—at the very minimum—want to keep it and hope to enhance it. Most times, we want to make the program better-faster-cheaper. Less often, we have the opportunity to reimagine the program and create something completely different. But creating successful sustainable change in global organizations is extremely difficult.
The status quo is the proverbial 'box' for us in risk management, crisis management, business continuity and security management. We follow a lifecycle, maturity model, or an industry standard. We have a process for compliance and measurements. We have a hierarchy of management with defined roles and responsibilities. However, we don't get to think or play outside that 'box' unless something major happens. That something has to be big enough to shake the shackles of the organization's endowment effect. During this brief period when something major happens, we can make significant, lasting changes for our organizations. There are four major triggers that allow us to create unprecedented rapid change with overwhelming support:
1. Failed Audit
2. New Leadership
3. Failed Program
These four triggers create a window of opportunity that requires us to make choices and define a strategy. Each change brings an opportunity and a risk. Before we can discuss the four triggers and pick the right course, we need to first define where we want to go by answering four questions:
What is our desired end state? This helps us focus our intent, and our intent will define our design. From intent, we can shape our vision.
In a perfect world, where do we see the program in 10, 20, and 30 years? What do we want to accomplish? If we won an award, what would the acceptance speech say? What does success look like? What does failure look like? Defining the program goals is critical to answering these questions.
In a perfect world, where do we see ourselves in 10, 20, and 30 years? What do we want to accomplish? How do we see ourselves? How do we want to be recognized and remembered? What does success look like? What does failure look like? This is where defining our personal goals will help.
What is the organization’s ethos? What is the organization’s culture? How is success and failure determined? Understanding organizational situation is key.
The above questions—plus a little internal and external reflection—will identify for us the characteristics necessary to create a strategy framework. That framework gives us a map and the navigational capabilities to select the right course of action when the opportunity presents itself.
With our strategy framework in place, we can either create the trigger or wait for it to happen. The key is to be ready for it. That means building out a plan for each situation and constantly refining it as the situation changes. It is a rare and awesome opportunity, a decisive moment, to capitalize on the four triggers.
1: Failed Audit Trigger
Every organization has rules and lives within the framework of rules, regulations, procedures, protocols, and standards. An audit and its auditors act as the organization’s law enforcement—a governing body with authority and responsibility that defines those rules, regulations, procedures, protocols, and standards. These rules are designed to ensure specific behaviors are exhibited, drive expected results, reduce uncertainty, and create better functioning teams. Basically, keeping an honest person honest.
Centralized governance takes a broader approach than individual sites. We need to reduce residual risk, i.e. Increase risk for greater profit without balancing the risk; or as the saying goes, 'take the risk and run'—some leaders get promoted because of good numbers, use that promotion to get hired somewhere else… and leave a pile of risk for the next person. Basically, a game of hot potato. We also need to manage portfolio risk, and allocate resources aligned with vision, strategy and future of the organization. An audit makes sense.
So we’ve been audited. Now What?
Once the program has been audited, there will be findings against it. This means we have to do something to rectify the current status. It can no longer be ignored or postponed because of other priorities. This is the trigger or inflection point to do something. There are only a few ways to go with it:
1. Pass the Audit
2. Refresh the Program
3. Build a New Platform
The pass the audit strategy goal is to pass the class as fast and cheap as possible. We know risk management is not the highest priority of an auditor. Most times it means surveys and interviews with a stick. It means getting the data into the templates—and more is better. The goal here is to get by with as little as possible. Use the audit to check the boxes (i.e., new shrubs and fresh paint) and rectify each finding.
With the refresh strategy, the goal is to update all materials. The goal here is to have high-quality baseline using the existing structure—the same program, just updated. Use the audit to update all information, templates, plans, etc. (i.e., remodel, buy new appliances). This means doing the same things within existing parameters, just better. Software is great for this. Auditors love software and reports. We recommend using a game to get people to participate with enthusiasm.
With the build a new platform strategy, the goal is for the program to be different, to build a program for the future and use the audit to create a business case to rebuild for the long-term. It should be transformational—heads down, redesign, rebuild, gut the existing program and start with a clean slate. Using what we know and don’t know, start with a clean sheet of paper and rebuild.
Each of these strategies is appropriate. The key is ensuring the way we structure things and the process we use to get to the end state is aligned with our objective.
2: New Leadership Trigger
A new sheriff in town means a new way of doing things, whether at a program or executive level. This new sheriff will need to prove himself or herself; that is, make a strong stand—new thinking, new goals, new aspirations, new measures, and new players. It means new rules, written and unwritten. It also means they’ll bring as many of their loyalists (i.e., their entourage) with them from previous organizations they worked. And you’ll have two options: jump on board or walk the plank.
For a relatively short period of time, the organization will give the new guy absolute authority to do what they need to do. However, as time continues, they’ll be integrated into the system. This is why the first two years are highly sensitive under new leadership. Understanding the new political environment will be essential for survival.
How new management enters the organization is important. New management can come in the form of an acquisition, a rock star hire (this is the worst situation, by the way), natural attrition, organizational restructure, etc. It’s important to think like both a politician and an entrepreneur. You will need to solicit new management's thinking on the matter and augment it with yours.
Our strategy here is to present a formal plan and a business case that aligns with the new leadership vision and leadership style. However, we need to consider a few new leadership techniques before presenting our case:
1. Clean-House Leadership
2. Dead Beat Dad Leadership
3. Genuine Leadership
The clean-house leader’s plan is to nuke the existing program and rebuild with loyalists from previous jobs. It’s a really good way to show immediate change and success (not sustainable success, mind you, just immediate success). I see this when organizations hire a hot-shot consulting manager, someone who promises amazing changes. This type of leader makes me think of that song from the LEGO movie. All you hear him or her say is… Everything is Awesome!
The dead beat dad leader’s plan is friendly but favors one specific competency, such as insurance, cyber, or loss prevention. Their attitude is 'Do whatever you want, just don't bother me.' This can occur when there is low perceived value or constant change. The program stays adrift. I also see this when the new leader is highly specialized in one area, and therefore naturally favors what they know best. He’s worried about the paint job, and here you are trying to keep the wheels from falling off.
The genuine leader’s plan is to enlist the existing organization to reach a shared desired end state. They desire positive change.
But fighting the new system is like fighting the wind when sailing: You are going to lose. You need to harness and tack. And, as in sailing, it will never be straight line or with precision.
3: Failed Program Trigger
Denial or fear of failure will prolong a bad program until it’s an utter disaster. People tend to go down a bad path for far too long before they course-correct. Fear of failure is a big reason for this. I have seen a few programs struggle for decades—they’ll take one step forward… then two steps back. Continuous failure or little success is soon followed by a tainted brand.
But a persistently struggling, failed, or tainted program is an excellent opportunity to make change.
The situation gives you the opportunity go big and bold, because whatever is currently being done (or had been done in the past) is not working—and typically it hasn’t worked for a very long time. This gives you the chance to experiment. The opportunity here is called the Big Bath Theory. All of us—executives, shareholders, and customers—can handle 'bad things' here and there, but those things need to be far and few in between. If it’s all going south, just take a big bath; that is, dump all the bad stuff and even the only-possibly-bad-stuff into one big clean up story. For example, if you think it is going to take 2x (e.g., time, resources, money) to fix the problem, make 6x. The key is to make sure you don’t have to go back to the well for a very long time. You need to promise to fix the problem once and for all.
Like any relationship, every contract or project, even every purchase is personal and emotional. Repent and make amends! Use this opportunity to tell the story about how things will be different now. There are three strategies to consider with a big bath strategy:
1. Acquire, Merge, Divest
2. New Position
The goal of the acquire, merge, or divest strategy is to restructure the program to be more efficient and effective, as well as build a better brand. Organizational programs grow organically from existing programs and relationships or through company acquisitions. After awhile, the single, large program(s) doesn’t work and we end up with many individual silos of excellence. These programs can grow into mini-empires that are politically—as well as monetarily—incentivized to remain segmented. The best way to shake-up these structures is with, well, restructuring.
The goal of the create new position strategy is to establish leadership with the authority at the highest level and consolidate programs underneath.
The goal of simplify is to strip the program of everything except the absolute necessities. It’s similar to taking someone off all their medication and starting over. We want to ensure that every piece of information, every hour of work, every meeting, etc. is absolutely necessary. We want to make share anything we do is of the highest quality and has absolute buy-in.
4: Crisis Trigger
Sometimes a crisis is the only catalyst for change in an organization and in our own personal lives. A crisis offers a brief window to create drastic change. With a crisis, we have everyone's absolute attention. When a major event occurs we only have a few months, sometimes only weeks, to capitalize on a good ol’ crisis. All bets are off during and immediately after one. Rules are thrown out the door. You have everyone's undivided attention. People will do anything and give you anything to help… and make it all go away. The technical term is “shock therapy.”
There are three strategies to consider with a shock therapy strategy:
1. Investigative Assessment
2. New Policy
3. Blame and Shame
The goal of the investigative assessment is to perform a thorough analysis of the organization and design a new program based on the assessment. The fact is something is just not working, so let’s figure out why and fix it. This process will include using a mental model approach as well as assess after action reviews (AARs).
The goal of the new policy is to change the rules and dynamics of the program to create conditions for success. The new policy should provide the necessary authority and structure to change behavior and drive action.
The goal of blame and shame is to say I told you so—in a professional and constructive manner, of course. This is a situation where we have been saying and demanding certain things from leadership but haven’t gotten anything. The crisis illustrates the results of the errors.
In summary, the goal is to recognize and take full advantage of the rare opportunities to make rapid successful sustainable change. It is important not only advance our career but do the right thing for our organization.