A Little Decision-Making Forensics

What makes a decision strategic? As I am confronted with the usual conveyor belt of issues — both large and small — that cross my desk every day, how can I choose those that warrant deeper attention? We all engage in this sort of triage process, and it's usually as informed by the practical demands of our environment — politics, personnel, deadlines, and resource constraints steer our attention as much as technological or mission-related demands.¹

Unfortunately this also means we miss things. Critical issues get short shrift; minor issues can consume us. So a number of years ago I spent some time looking into the nature of strategic decisions, hoping to find a consistent way to test issues (problems, projects, and questions) and tease out the more strategic items to help frame them in a useful way.

We all recognize that strategic decisions are the big picture, visionary decisions: a strategy is a plan for getting somewhere important or valuable. Our strategy may be to eat less to become more fit (and thus live longer); our tactic is to eat fewer sweets every day. But what are the defining characteristics of strategic decisions?

• The impact of strategic decisions will be long term and create some institutional advantage. Strategic decisions are difficult to reverse, affect organizational scope, and stretch resources and competencies. They are complex and subject to change due to uncertainties in foreseeing the future.
• Strategic decisions may require cross-functional/organizational teams to actualize, require greater than one area of expertise, generally require an increase in resources, and may require significant change in organization.

Critically, strategic decisions are intrinsically risky and "usually involve a high degree of uncertainty: they may involve taking decisions on the basis of views about the future which it is impossible for managers to be sure about."² Strategic decisions therefore should be reserved for the most senior managers in any organization — those individuals with an institutional scope of authority.

In order to test whether the list of attributes I've listed above (largely gleamed from the rather enormous literature on strategy) and to quantify the process, I've created and used a simple scorecard. A higher score implies the characteristic is more strategic for the item under consideration.

It would be a stretch to call the scoring (values of 1, 2, or 3) a methodology — it just seemed simple and sufficient; ditto the values in each column. They seemed reasonable to me, but you may want to roll your own. The point of the scoring and matrix is to quickly understand how many strategic characteristics your project or decision has. Projects with higher scores are more strategic and deserve more of my thinking and attention; projects with lower scores are more operational and perhaps deserve less time or can be delegated to another individual for handling.

Characteristic/ Score	Score of 1	Score of 2	Score of 3	Score
Duration of impact of decision	1–3 years	5 years	6+ years
Reversibility (time required to)	Immediate	6 months	18+ months
Change of scope of organization	None	Natural extension/evolution	Definitional
Stretch existing resources?	None/minor	Challenging but understood	Greatly
Require new competencies	New product or service skills only	New technology or protocol skills	New architectural skills
Need for decision may disappear in x years?	1	5	6+ or never
Cross-functional impact	Primarily within 1 group or team	Multiple units	Entire organization
Require organizational change or restructure?	Merely project teams	Some new staff or staffing assignments	New groups or functional areas
			Average:

As an example, I'll complete this table for our major identity and access management (IAM) replacement project.

Characteristic/ Score	Score of 1	Score of 2	Score of 3	Score
Duration of impact of decision	1–3 years	5 years	6+ years	3
Reversibility (time required to)	Immediate	6 months	18+ months	3
Change of scope of organization	None	Natural extension/evolution	Definitional	2
Stretch existing resources?	None/minor	Challenging but understood	Greatly	3
Require new competencies	New product or service skills only	New technology or protocol skills	New architectural skills	3
Need for decision may disappear in x years?	1	5	6+ or never	3
Cross-functional impact	Primarily within 1 group or team	Multiple units	Entire organization	3
Require organizational change or restructure?	Merely project teams	Some new staff or staffing assignments	New groups or functional areas	2
			Average:	2.75

It's easy to be a little snarky and say, "You dope, of course replacing an IAM system is strategic!" So, let's try this exercise with a different and less clear-cut example. Like many of you, we're in the midst of evaluating "next gen" antimalware products (hint: putting "next gen" in front of a project name always makes it seem more strategic and important). Let's score that project.

Characteristic/ Score	Score of 1	Score of 2	Score of 3	Score
Duration of impact of decision	1–3 years	5 years	6+ years	2
Reversibility (time required to)	Immediate	6 months	18+ months	1
Change of scope of organization	None	Natural extension/evolution	Definitional	1
Stretch existing resources?	None/minor	Challenging but understood	Greatly	1
Require new competencies	New product or service skills only	New technology or protocol skills	New architectural skills	2
Need for decision may disappear in x years?	1	5	6+ or never	1
Cross-functional impact	Primarily within 1 group or team	Multiple units	Entire organization	1
Require organizational change or restructure?	Merely project teams	Some new staff or staffing assignments	New groups or functional areas	1
			Average:	1.25

No surprises here either, but it can help put projects into perspective. This little scorecard probably isn't going to rock your world, but it (or some variation thereof) can help you think through competing projects to decide where best to spend your precious time. What I enjoy about this scorecard is its applicability to projects both small and large, operational and strategic.

Obviously, we could extend this little model quite freely. How about unseen consequences, the impact of which may be strategic? What if, for example, a technology decision made today, based entirely on operational requirements, poorly positions your organization to take advantage of a strategic opportunity at a later date? Should that decision be considered strategic (and thus subject to the rigor, evaluation, and full set of approvals a strategic decision warrants)?

We could attempt to measure the general influence a decision will have on future actions. Should we try to describe something such as a "length of impact tail" (i.e., how broadly will this decision impact future decisions)? For example, one could propose that an organization adopt an older or obsolete programming language for all future development. Presumably, most system development tasks could be handled by a robust, mature development team; however, selecting a language so far removed from the mainstream of the modern development toolkit suggests that it would be difficult to take advantage of contemporary architectures and protocols as they emerged. Though operationally sustainable, making such a decision appears to our common sense as strategic in that it has a long impact on the ability of the organization to reach its objectives. (Assuming that staying current is an objective!)

The germ of the idea here comes from an earlier point in my career when I was first confronted with contributing to organization-wide leadership issues. But as a little thought experiment, it's one I've returned to many times over the years.

I hope you'll share your defining characteristics of strategic decisions or your methods for identifying strategic projects in the comments below.

Notes

1. The contribution of being opportunistic to our successes is often overlooked — it's long been the bedrock of my strategy.
2. Gerry Johnson and Kevan Scholes, Exploring Corporate Strategy, 4th ed. (New York: Prentice Hall, 1997).

---

Michael Corn is the chief information security officer for the University of California San Diego.