Strexecution

A provocative piece on LinkeDin about the gap between strategy and execution set me thinking. Paraphrasing the original poster, managers admit to being generally lousy at executing business strategies, which may well be true (for some at least) but it could also be that:

  • Strategies are unrealistic, infeasible or impracticable;
  • Strategies are more stretch than target, intended to motivate and drive up performance without necessarily achieving the stated objectives;
  • Strategies are literally unworkable, krazy, completely divorced from reality;
  • Available/allocated resources are overstreched, inadequate or simply unable to execute the strategy;
  • The timing is wrong or inadequate (implementing long-term strategies typically incurs short-term costs and inefficiencies - creative destruction);
  • People generally struggle with change, significant change especially, hence it is easier for everyone to continue the old ways than to strike out into something new;
  • The entire corporate structure and culture is so conservative, set in its ways and staid that even small changes are resisted or blocked, overtly and covertly;
  • There are other higher/competing priorities and constraints, some of which may not have been evident to the strategists (hinting at governance issues, hidden agendas and company politics, plus a measure of good ol' incompetence and ignorance);
  • There are conflicting messages, metrics and mandates from senior management - for instance 'Get cracking on these new initiatives ... but don't neglect ongoing activities' or 'Your bonus is derived from the old metrics, but we want you to do something different';
  • Strategies are misunderstood/misinterpreted, perhaps being so esoteric and finely wordsmithed that they only truly make sense to their cunning creators;
  • Strategies are relatively rigid, whereas the operational environment is dynamic, fluid and flexible due to all the stuff going on routinely and exceptionally within and around the corporation.
Some of those reasons (the final bullet point in particular) led me to wonder why they are considered distinct, quite separate activities. Is it simply that senior managers enjoy their occasional 'away days', sloping off to some swanky club or hotel for a 'strategy session'? Could strategy be developed or at least refined routinely in the course of execution? Shouldn't the realities of execution inform or modify strategy? Is it feasible to run both activities in parallel, within the same management team? Would 'strexecution' work - and if not, why not?

So, what are the differences between them?
  • Strategies deliberately take a broad perspective, the helicopter view, consciously stepping back from the daily grind to consider the bigger picture: what the organisation is about, what it is or rather should be doing (core business), what are its primary products and markets, what are its strengths and weaknesses, which business opportunities might be worth opening up and exploiting, what is likely to threaten the business going forward ...
  • Strategies are long-term (whatever that actually means: years, decades, centuries ...);
  • Execution is myopically focused on the detail, the here-and-now, with a limited perspective and short-term outlook;
  • Strategising is creative, free-thinking, hand-waving, blue-skies stuff, unconstrained by reality, whereas execution most certainly has to deal with the realities such as finite resources and conflicting priorities;
  • Strategies make assumptions and involve guesses that may not turn out as expected - leaving execution to deal with the fallout;
  • Strategies predict and address a cloud, a broad spectrum of potential futures, possibilities that collapse down to whatever actually transpires in practice, whether as predicted or not.  
I have some sympathy with the old saw: failing to plan is planning to fail, in other words the planning process, the analysis and consideration, is more valuable than the product, the plan itself. Plans almost always turn out to be wrong, but not planning means everything comes as a complete surprise, leaving the organisation a hostage to fortune, constantly on the back foot.

This is opportune. I am currently helping to design and document the governance arrangements and strategy for a new voluntary organisation. While the founders are excitedly developing ambitious strategies for rapid progress and expansion, execution will need a team of willing volunteers performing the associated donkey-work - much less glamorous but no less important. It's a tricky balancing act, harnessing the founders' creative energy while also putting in place the appropriate organisation structure and management controls to build and guide the operations team, delivering on their ambitions.
 
I'm also working with a tiny NZ tech startup client to design and implement the information security controls they need right now, with a view to extending them appropriately as the company grows. Establishing and operating the company is consuming most of their energy and resources, constraining the amount that can realistically be achieved in preparing for the corporate growth and changes ahead. The opportunity to start from scratch is both exciting and daunting.
 
Resource constraints are a common factor requiring a degree of pragmatism, progressing the stuff that must be done without losing sight of the bigger picture. Strategy and execution are related and complementary, not separate. They need each other. We need 'strexecution'.

Popular posts from this blog

Pragmatic ISMS implementation guide (FREE!)

Image
Early this morning ( very  early!) I remotely attended an ISO/IEC JTC 1/SC 27/WG 1 editing meeting in London discussing the planned revision of ISO/IEC 27003:2017 . Overall, the meeting was very productive in that we got through a  long  list of expert comments on the preliminary draft standard, debated the objectives of the project and the standard and reached consensus on most points. In summary: 27003 is to be revised to align with the current 2022 releases of ISO/IEC 27001 , 27002 and 27005 : These changes are  mostly  minor aside from the new section 6.3 on ISMS changes.
Read more

Two dozen information risks that ISO forgot

Image
Selecting the wrong controls - controls that are inappropriate, ineffective, too costly, impracticable, fragile, unnecessary, counterproductive or whatever, often as a result of blind faith in fads and fashions of the day and FOMO e.g. MFA, AI, cyber Failing to select the right controls - controls that are ideal for the particular situation, both now and in perpetuity, for whatever reason - mostly ignorance and prejudice Selecting and implementing controls at the wrong time or in the wrong way (where 'wrong' includes ineffective, inappropriate, sub-optimal e.g. bolting on controls rather than designing and building them in) Inept and inaccurate identification, analysis and quantification of risk, including reliance on p oor quality (incomplete, inaccurate, out of date, misleading, unreliable ...) information about actual risks, particularly subtle and emerging risks plus those involving deliberate concealment and misdirection e.g. fraud, misinformation, disinformation, propagan
Read more

Philosophical phriday - compliance risk

Image
According to a vendor's promotional video interview I saw recently, the 'cybersecurity compliance burden' has allegedly become so significant that [customer] organisations are eagerly buying [their] software tools and services to help them manage and fulfil their obligations. The vendor's argument goes that, instead of accumulating a ragtag bunch of policies and other controls relating to user Identification and Authentication (I&A), for instance, it makes sense to:  Identify all the cybersecurity-related laws, regulations and standards that apply to the organisation; Examine them for any security control requirements relating to, say, I&A; Rationalise the I&A controls down to the smallest set that satisfies all the requirements - the lowest common denominator; Design, implement, use, manage and maintain those I&A controls; Have the I&A controls checked or audited to gain assurance that the compliance requirements are met.  OK so far? Sounds reasonab
Read more

ISMS internal audit priorities

Image
A thread on the ISO27k Forum sparked my imagination over coffee this morning. Hope had previously asked for assistance with an ISO/IEC 27001:2022 audit plan.  Bhushan offered a lengthy and generally sound response explaining how to use a spreadsheet with tabs to plan and record the audit work performed on 100% of the main body clauses and 50% of the 93 Annex A controls, day-by-day. That's OK ... except it wasn't entirely clear that he was interpreting and elaborating on the standard's actual requirements. ISO/IEC 27001 does not explicitly require, for example, that (as Bhushan stated) "ALL the management system clauses from 4 to 10 AND their sub-clauses need to be listed and audited" in an ISMS internal audit, although evidently he interprets it in that way. In clause 9.2.1, the standard states a requirement for internal audits to provide information on whether the ISMS conforms to the organization’s own requirements for the ISMS plus the requirements of the stan
Read more

Reading between the lines of ISO27001 [L O N G]

Image
ISO/IEC 27001 is a succinct, formally-worded standard for two key reasons: It is deliberately generic, being applicable to all manner of organisations regardless of difference in location/s, size, industry, maturity, structure, information risk and security status ... and so on. In effect, it specifies the lowest common denominator - the things that ALL organisations should be doing to manage their information security controls, as a minimum. The hurdle is set low enough that every organisation ought to find value in designing, implementing and operating an I nformation S ecurity M anagement S ystem as laid out in the standard. It is a certifiable standard, explicitly specifying the characteristics that every certified organisation's ISMS is expected to have. Again, it is a minimal specification with no concept of typical, average or maximum security: that is entirely down to the organisations themselves to determine, following the information risk management processes minimally de
Read more

Passionate dispassion

Image
Someone who is actively involved in, or is managing, an activity is patently not independent of it. They may well make a conscious, rational and determined effort to be objective, dispassionately reviewing evidence etc ., but their subconscious/emotional biases/prejudices and beliefs/value-systems will inevitably influence what they do. With the best will in the world, they will struggle to challenge and assess their past decisions and activities, especially if they were "certain" or "determined" or genuinely believed they were "doing the right thing". Furthermore, it is very hard for anyone to review the things they did not do, decisions they did not make or options they did not even consider. Mostly, they remain out of sight or out of the question.
Read more

45 ISO Management Systems Standards

Image
The ISO website  currently lists 45 published M anagement S ystems S tandards: 1. ISO 7101:2023 Healthcare organization management — Management systems for quality in healthcare organizations — Requirements 2. ISO 9001:2015 Quality management systems — Requirements 3. ISO 10012:2003 Measurement management systems — Requirements for measurement processes and measuring equipment 4. ISO 13485:2016 Medical devices — Quality management systems — Requirements for regulatory purposes 5. ISO 14001:2015 Environmental management systems — Requirements with guidance for use 6. ISO 14298:2021 Graphic technology — Management of security printing processes
Read more

Philosophical phriday - a noncompliance ramble

Image
In a previous philosophical phriday post , I moaned about vendors of security compliance support/management tools and services over-promising and under-delivering - an admittedly biased, even cynical opinion piece about the compliance imperative . A recent article in Corporate Compliance Insights notes that "CISOs are not just defenders against cyber threats but also champions of compliance and operational resilience". Hmmm, are CISOs 'compliance champs', really? Today, I'm discussing alternatives to being compliance-driven. How else can organisations drive their information risk, security and related concerns in a positive direction?
Read more

Adaptive SME security Crowdstrike special

Image
As if on cue, along comes a golden opportunity to consider what the Adaptive SME security  approach has to say regarding the Crowdstrike incident: That's not 20/20 hindsight but foresight: I've picked out the most relevant rows from the security controls table published in the guide 24 hours before the incident.  Although Crowdstrike primarily supplies much larger enterprises than SMEs, the incident could equally have afflicted other security software, or indeed operating systems such as Windows and assorted cloud apps commonly used by SMEs. Regardless of the details, it is a wake-up call, an opportunity to consider and respond to the information risks ... and to adapt , accordingly.
Read more