The Alternate View

Friday, 20 February 2015

The Kids Are All Right

Age 19, when you're throwing up on your own shoes, privacy, security and liability don't matter; what the "going grey" generation call convenience, does. If you can get a taxi cab to deliver you safely to your door, you will happily give full access to your identity (the location of your comfy bed with a tactically placed bin at the side of it) and financial information (promise not to take the long way round).

This week, in the UK, the first integration of Apple's Touch ID came to banking applications. Cue uproar on how the technology has already been spoofed. Any security person worth their salt knows fingerprint biometrics aren't secure. Yes they may be more convenient than pass codes, but a high resolution camera or a shiny surface combined with a silica moulding kit and you have a security breach quite literally on your hands (well fingers).

The trouble is, that by the time you're old enough (in the "going grey" generation) to know the pitfalls, and you're suitably well established in your industry to be able to inform standards and best practice, you're no longer representative of the "yoof" generation who you're delivering products for. Nothing kills a great idea for the younger generation than their grandparents thinking it's cool. When your Gran sends you a snap of her running over someone in her mobility scooter, it's time to delete your account and move on to the next craze.

So are the people setting the standards and defining best practice really focussed on the right things? Are they really best placed to do so? For a banking application, is Touch ID too much security rather than not enough? Organisations want to know that the person making the transaction is authorised to do so, to enable them to prevent fraud, meet regulatory requirements, protect their customers and generally do the right thing. Yet from the customers perspective all they're concerned about is that if money goes from their account that they didn't authorise that they'll get it paid back.

Ultimately the role of the "going grey" generation is to warn, counsel and support the next generation. Informed choice rather than condescending control, and guided resolution rather than an "I told you so" attitude. Understanding the needs, views and opinions of "the kids" will drive better solutions focussed on outcomes of practical use. The younger generation don't value convenience; they expect it as a minimum! Whilst sometimes this may result in loss or distress for either party, consequences are thought about after the event and there is a customer perception (rightly or wrongly) that someone else will help clean up any fall out.

A new view on authentication is that it is something that occurs as part of the transaction rather than something the user knowingly does. Mitigating risk at other points before, during and after the transaction, will enable less reliance on strong authentication methods. Does the transaction fit within the normal patterns of behaviour? Is it being performed from a trusted device? Is the location identifiable and known? Is the value within acceptable risk tolerances? Can the transaction be reversed? And for what time period is it recoverable?

Within all this, the concept of informed choice by the end customer also needs to be considered. Rather than industry experts having an outcry of nay saying about technologies such as Touch ID being used for banking, rather they should be focussed on the needs of the customer and giving them more credit for being able to make informed choices. If any fraudulent transaction could be recovered then zero authentication transactions would be less risky.

Figuring out how, when at 3am your customer's account has been debited £50 that they can't recall authorising, you can resolve the dispute is a far more noble cause than worrying about the authentication method used to verify the transaction - particularly if your customer arrived home safely and able to sleep in their own bed, with their head rested on their bin.

After all, the kids are all right.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Thursday, 15 January 2015

The ridiculous mouse

“A mountain has gone into labour and was groaning terribly. Such rumours excited great expectations all over the country. In the end however, the mountain gave birth to a mouse.”

Phaedrus 4.24

At some point in our lives we’ve all been lectured that we only get out of life what we’re prepared to put in; and while on the whole there is a strong element of truth in this mantra, there are always tasks and activities where no matter what amount of effort we put in, the reward will never live up to expectation. My own boyhood dreams of being a professional footballer (soccer player) weren’t dashed by my lack of effort - I was never going to make the grade due to having two legs made for standing and none for that were made for kicking.

The inspiration for this post comes from observing a customer insight session for an online identity assurance transaction. The young man in the spotlight told the session facilitator how a lack of acceptable identity evidence impacted his life – how he was unable to open a bank account as he didn’t have the required documents to prove his identity to the banks standards; how he couldn’t get a mobile (cell) phone contract for the same reasons. This was a guy who had genuinely tried, yet for all his effort there was no reward – and so eventually he’d stopped trying. Instead he found other ways around the problem – his wages were paid into someone else’s bank account. His partner had taken out an additional mobile phone contract. This was a bright, savvy and confident individual who had been disenfranchised by a society who wouldn’t allow him access to basic services due to their inability to identify him.

Having partaken in a great deal of user experience sessions, this guy’s story was far from unique to me – financial and societal exclusion due to the inability to meet identity requirements is not uncommon. What stood out for me about this young man though was the way in which he embraced digital identity – not only did he show an amazing comprehension of the technology and verification methods, he also saw the benefits to him of going through the registration process. He understood with aplomb how the investment in time now would enable him to assert his identity in a simple yet secure way in future.

The joy of seeing a user react with such delight was tempered by the harsh reality that he was unlikely, at least in the near future, to be able to achieve the requirements to reach the required level of assurance. For all the effort he would go through he would get no reward – his digital identity would afford him no more inclusion.

The rigid pass / fail nature of the four levels of assurance defined by the OMB and NIST which have been adopted as the de facto global standard are still mired in the constraints of face to face verification. A digital identity is capable of providing a far more granular level of assurance backed by a rich data packet to enable the service provider to take a risk based approach. In a mature marketplace the identity score should more likely take the form of the credit score – where identity providers constantly monitor and evaluate to provide real time granular scoring. A scoring mechanism would exist where the individual’s pattern of behaviour and existence activity varies the confidence of the assurance given at any moment in time.

In the meantime, whilst the sector matures and evolves, the short term step must be to relax the four level model. There is a need to introduce proportionate, defined, mid-levels of assurance. Whilst service provider’s compliance department may still clamour for least risk approach, a more customer centric view is needed. The registration should take the user through a journey proportionate to the transaction they are undertaking, in response to the data available to verify them. Without being more pragmatic and proportionate, the same people who are currently excluded will continue to be so. Service and Identity Providers cannot expect customers to labour if all they can reward them with is a ridiculous mouse.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Wednesday, 31 December 2014

Big Brother's Protection

We all know that only bad people need to fear the “Big Brother” state described so vividly in George Orwell's ‘1984’; if we don’t do anything wrong then what's wrong with the Government knowing about it? And while we offer resigned acceptance that the Government knows everything about us and how we live our lives, even as good people who live our lives as saints, we wouldn't choose to have Big Brother watching over us.

The truth is though, that even 30 years after Orwell's vision of the world, Governments don't know everything about us; bad people do bad things every day without being caught – even those who the Government know are bad aren't always monitored sufficiently to prevent them from committing the most horrendous of acts. So if the bad people can hide under the radar then why should the good people stand up and wave? Privacy to conduct your legitimate, legal, saintly business is a basic human right.

We go around believing that Big Brother is watching us, are outraged when bad people do bad things without being seen and demand privacy because we're good. So how do we create an Identity Infrastructure that supports this dichotomy?

Taking our identity as our name, address and date of birth, – a combination of details that makes us unique in the world – when we want to watch a movie the only thing that the cinema attendant needs to know about our identity is whether we are above the age restriction; a binary yes or no answer based on our date of birth. So for a binary decision the Identity Infrastructure shouldn't need to share all our details. Though there is also need to establish Entitlement; and while Identity and Privacy can co-exist quite easily, by adding Entitlement we muddy the waters.

At the cinema, our entitlement to watch the movie is met by having a valid ticket and receiving the binary yes from our identity regarding our age. The ticket provides the unique attribute that allows the cinema to grant us access to their service so we don’t need to provide the unique attributes of our identity. The cinema attendant doesn't care if we’re John Doe or Fred Bloggs or if we live at an address in the same town or not.

Governments don't sell tickets, so they need another unique attribute to establish entitlement. To be able to access local services they can ask the same binary style questions of your identity – is your address within this area? This is fine for a service you’re entitled to access as many times as you like, though for singular services – voting, social payments, etc. – they need to also establish uniqueness. The common way of doing this is for them to hold your name, address and date of birth in their systems and run a matching service against the Identity Infrastructure. Entitlement has just ripped a hole straight through your Privacy principles.

In India, their Identity Infrastructure is underpinned by the world's largest biometric database, with the aim that the entire 1 billion population will be issued with a random unique number; the ultimate Big Brother solution, or perhaps more appropriately “The Prisoner” solution. By having such a solution though they can balance Identity, Entitlement and Privacy. Being allocated a number could enable our ambition of being a free man.

If at the top of the Identity Infrastructure sits a single “Big Brother” database with a unique record for all citizens, supported by a layer of commercial sector Identity Providers providing a facility in which citizens establish and record their Legal Identity and associated attributes, this would enable any number of pseudonymous asserted identities that we’re free to transact our lives in effective privacy.

In this environment we can operate with relative anonymity any number of different transactions backed by a Trust Chain that only needs to be concerned with bad people; leaving the good people to go about their lives as they wish.

In 2084, Big Brother is the trusted single version of identity yet knows nothing of our Legal Identity, the movies we've been to see, the way we vote, the money we receive from the state, where we work or the blogs we post on the internet. We may establish our Legal Identity with any number of approved Identity Providers and we may publish as many pseudonyms as we like; while ever we remain good people doing legitimate and legal things we can chose what attributes we share with service providers; service providers can happily ask binary questions about us and trust the assertion that they receive.

And when good people turn bad? Their assigned unique randomly allocated number - the thread that underpins their identity, establishes their entitlement and protects their privacy – enables Big Brother to lay bare their every movement, every interaction that they've made – within a legal framework of course.

The Orwellian vision of Big Brother becomes like a real life big brother – one who will protect us, help us and look after us – but who is prone to snitch on us when we do something bad.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Friday, 21 November 2014

In pursuit of mediocrity

Remember when, if your boss called you into her office and shouted at you then you needed to up your performance? And if she came to your desk and patted you on your shoulder you were doing well? This is what is now known as a Performance Management System, though it’s inevitable that it will come with a documented process, some kind of IT system with a name contrived from buzz words and the much loved appraisal cycle. It’s rare these to find any organisation, no matter what size or what sector, that doesn’t have a Performance Management System.

It is the ubiquitous nature of the Performance Management System that is often its downfall. All too often organisations lose focus on what they are trying to achieve.

How many of us have worked in organisations that operate on an annual cycle that ends up with the allocation of a score? Twelve months of effort, summarised into a few paragraphs – graded, uploaded to the IT system – never to be looked at again as we move into the next appraisal cycle.

And with almost every scoring system comes the “bell curve” – where the majority of the workforce sits in the middle of the scoring system. What these organisations are saying, quite proudly, is that their Performance Management System has measured and evaluated its entire workforce, in a fair and consistent manner, and concluded that the majority of them are average performers. We have an average workforce and therefore we are an average company.

Yet if we strip back to basics, what we’re trying to achieve is fairly simple:

we want our people to deliver the company strategy
we want them to understand their goals and what we expect of them
we want them to be the best that they can be
we want to “manage” them, to help and support them, to achieve their goals
we want to motivate and inspire them
we want to get rid of the dead wood

Why then, for something so simple, do organisations fail so often in implementing an effective Performance Management System? The answer generally is because we focus too much on the process and too little on the individual. In the desire to ensure consistency and fairness we focus on measurement at the expense of management. It’s far easier to measure how many times someone has forgotten to complete their weekly report than it is to measure how their work contributes to the company strategy. It takes far less time to cascade a generic set of objectives to the entire workforce focussed on the process tasks that everyone does, rather than setting individual objectives based on what we really want the individual to do as their “day job”.

When we focus on the individual, we understand their ability, their motivation, their needs and their ambitions. We can tailor the goals so that we set them up to succeed. If the individual owns their goals they are far more likely to want to achieve them than if we just cascade generic low value objectives. Rather than cascading a ream of irrelevant objectives, the one size fits no-one approach, we agree a small number of high priority personalised goals that focus the individual’s performance.

Having agreed these goals, the role of the manager is now to help and support the individual in achieving them. The attainment of these goals is shared between the individual and their manager, if the individual doesn’t hit their goals, it isn’t just them who have failed – win together, fail together. By adopting this approach it fosters a shared desire for success.

Look at most organisation’s process and you will see a performance management cycle diagram – it starts with defining the business strategy and ends twelve months later with the annual appraisal. This annual approach to performance management is driven by the need to measure and categorise the workforce. It has nothing to do with managing individual performance – it is the drive to achieving the average workforce, often linked to pay raise or bonus schemes. Performance management should be about short cycle – Plan, Manage, Review and Renew - something that is ingrained into our working day. What am I expected to do? What support do I need? How am I doing? How do I improve / How do my goals evolve? These activities are all focussed on the individual and should happen regularly and continuously.

The organisation elements of business strategy, measurement, comparison and reward (or reprimand) should sit around performance management cycle. Feeding in and taking output from the short cycle performance management elements.

By separating these concerns it allows individuals to achieve brilliance without the constraint of the organisation needing to measure and compare across the entirety of its workforce. We can set individual goals that are prioritised and focussed on what is important rather than cascading arbitrary collective, common tasks. We also break the link between an annual pay review and on-going performance management. How often and over what timescale the organisation performs its cycle does not constrain the short cycle performance management of the individual.

Through stripping back of bureaucracy by empowering the individual and their manager to continuously improve we encourage individuals to perform at their full potential. And it is done without needing to check to see whether your goals are comparable with the goals of someone with different abilities, motivations, needs and ambitions performing a different role.

Most importantly because it focusses on the individual, we don’t need to hit a bell curve – brilliance is embraced in the organisational culture. The pursuit of mediocrity is driven out.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Monday, 10 November 2014

I don’t know who I am anymore

How do we prove who we are? It’s easy isn’t it? When we’re younger our parents tell people who we are – they register us at the local school, our teachers introduce us to our classmates, they become our friends; the circle of people who can identify us grows. Then when we need to get our first passport - our parents, teachers, friends, friend’s parents, school crossing guard and local shop keeper can all vouch for who we are. We open a bank account; we use our passport and a letter from our school teacher to vouch for who we are. Proving our identity is pretty straightforward – our identity just exists and it belongs unequivocally to us, from the day we were born and we expect it to remain so until the day that we die.

Imagine though not having this circle of people who can vouch for us – not having the identity documents that would allow us to flash our smile and get people to trust that we are who we say we are. For many people, at some stage in their lives, they will be unable to prove their identity sufficiently to allow them to complete a task or activity. How many of us have been asked for proof of age when buying alcohol? Proving your identity to establish legal eligibility to purchase a restricted product; at 18 it’s annoying, at 30 it’s flattering, at 40 it’s embarrassing and at 50 it is ridiculous (and a bit flattering).

For those “inconvenient” occasions, we find ways to subvert the process – at 18 (cough) we find the friend who can grow a moustache to go and buy alcohol for us – or we go to the little corner shop who charge more but are also more trusting that we really are old enough. Yet when the inconvenience actually becomes a barrier to taking a full part in society – when we can’t open a bank account because we can’t provide 2 documents from list A, 5 documents from list B and don’t know our inside leg measurement. The “workarounds” for this not only limit our engagement with society, they also mean that we pay for the privilege because the best deals and offers aren’t targeted at the socially excluded – or those new to country, the young or the elderly.

Our identity is often taken to be our name, address and date of birth – a combination of details that give us uniqueness from everyone else on the planet. Yet these details are too widely and commonly known to be able to use them to prove who we are – so additional safeguards are required – things that only the true owner of the identity could have access to, whether it be knowledge or documentation. Though the information that we can provide also has to be verified by someone else – it’s no good telling the bank manager what school we went to and what childhood goldfish was called unless they can check with your parents… and that your parents can prove their identity… and that they are related to you.

For something so basic in life, something that everyone has and that everyone owns - your identity is incredibly difficult and complex to prove. As we begin to transact our lives more in more in a digital way, sat at the end of a computer, tablet or smartphone, the problem of proving to the system on the other end of the internet that it really is us becomes a whole new level of difficult.

We’d all be horrified if it was so simple that anyone could pretend to be us yet at the same time we don’t want to be inconvenienced; we really are who we claim to be – so it should be easy for us; it’s the people pretending to be us that it should stop. How to solve this dichotomy certainly isn’t going to be easy.

We can start by opening up trusted sources of data, such as our personal data that Government and the NHS hold, to trusted organisations – though to do this we need to work out which organisations we can trust and ensure that they have valid consent to access the data – and by utilising technology to enable digital identities to be established.

The problem with technology and digital transactions though is that we expect immediacy and we demand convenience; having to register for a digital identity and then wait until we’ve gone through school and build up our network of guarantors, body of data and evidence, to be able to prove who we are just isn’t going to work. In the short term – those who have less difficulty proving their identity in the real world will find it easier to prove their identity in the digital world.

A large part of our digital footprint currently used to identify us is based on credit information, so those who live by “neither a borrower nor a lender be” may also face difficulties proving who they are online. A great deal of innovation is required to support the propagation of digital identities at scale as well as a great deal of stimulus in the marketplace to develop broad accessibility and availability.

Supporting registration and subsequent use of digital identities in the real world will undoubtedly play a role in the proliferation and adoption; being able to assert our identity as easily at the checkout as we can when shopping online with the supermarket.

Once digital identities begin to become more commonplace the opportunities for organisations to improve existing practices and to open up new ways of serving their customers will swell. Whether it be allowing customers to transact regulated products in the financial service sector entirely online, reducing social media trolling by removing the ability to hide behind anonymity, reducing eCommerce fraud by linking payment to an identity or for confirming eligibility for age restricted products. Yes indeed – a digital identity could replace the need for bad teenage top lip fur.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
Three Little Words - What it means for your business to be agile

Sunday, 19 October 2014

Three Little Words

There are three little words that are easy to say yet extremely hard to actually demonstrate; sometimes you say them too soon, letting your heart rule your head. Once you’ve said them you can’t take them back – they linger there, waiting for you to prove that they’re not just empty words. So once you’ve said “we are agile”, how do you set about showing it?

Well first off you need to understand the difference between “agile” or “Agile” – the principles are still the same. When you talk about Agile with a capital A you probably mean software development. This is easy to implement as an IT project delivery method – get your IT supplier to find some guys who ride fold up bicycles to work, have humorous stickers on their laptop lid, whose idea of dressing up for a client meeting is to wear clean socks with their sandals, who have shares in 3M so they can do insider trading on post-IT notes – hey presto you’re doing Agile.

Yet even moving to Agile IT project delivery doesn’t make your company agile. Without the lowercase “a” being adopted by your organisation, the uppercase “A” will invariably fail. Your IT supplier will hoodwink you back into doing Waterfall whilst using Agile as a ready-made stick to beat you with.

So what does “we are agile” actually look like. What will those three little words really mean for your company? The best place to start is the dictionary – Agile (adjective):

Able to move quickly and easily

To be active and lively

Marked by an ability to think quickly

Synonyms: Nimble, Quick, Dexterous, Lithe, Rapid, Sprightly, Swift

For a company to be agile, its people must have the ability to perform in accordance with the definition; the people must have a combination of skills, knowledge and experience - yet what makes them truly able is being empowered.

Agile is an iterative approach to working that encourages a rapid and flexible response to the present situation; it promotes incremental evolutionary enhancement through prototyping and collaboration by adapting to and embracing change. The key principles of being agile are valuing:

Individuals and interactions over processes and tools
Tangible output over comprehensive documentation
Collaboration over Contracts
Responding to change over re-planning
Adaptability over predictability

The most valuable asset of an agile organisation is its people – the tools and processes are always secondary to the people, they must only exist to support the people. If your organisation requires someone to have completed a process, to have filled out the correct form, then you are not agile. An agile organisation focuses on the result – 3+6 or 7+1+1 or 3x3 or 11-2 –how you get there is less important than getting the right result. An agile organisation doesn’t throw process and paperwork out of the window though – it just makes sure that they are proportionate to the outcome they support and that the successful output is valued above the process that supports it.

Before you even dare to utter those three little words “we are agile”, you have to get used to the four letter “f” word. It isn’t a bad word; agile organisations aren’t afraid to use it and they certainly don’t castigate their people for saying it or for doing it! Stand up, take a deep breath and shout it out loud “FAIL”. If you don’t fail, you don’t learn. If you don’t fail, you aren’t prepared to take risks. If you don’t fail you can’t reach your full potential because you don’t know where the limit is. Good agile organisations fail often because they fail fast. They are brave enough to try something new. They manage their risks and exposure. They recognise (and sometimes reward) failure when it happens so that they can stop before any damage is done. They honestly evaluate, assess and analyse their failures so they benefit from them. They refocus their efforts at the earliest opportunity to do something new.

Within an agile organisation, the whole team works towards the same outcome; stakeholders don’t sit on the edge saying why something can’t be done the way you want to do it – you don’t have committees to decide what needs to happen – you don’t have gatekeepers telling you when you’re not following the procedure. Agile organisations are structured so that if you’re a stakeholder you are part of the team; you are responsible for deciding what needs to be done and for getting it done. Change isn’t a function or a set of processes – change is something you expect, so you don’t need to re-plan when it happens; agile organisations accept change, they embrace it and most importantly they respond to it. Agile organisations don’t set off with certainty of outcome; they fail fast, they adapt to the current situation; they prioritise what is important and focus on relentless attainment of the things that add the most value.

Agile organisations don’t pursue perfection – they know the reward isn’t worth the effort. They are sometimes excellent, often brilliant, regularly good and rarely poor. We all know someone that stands looking at themselves in the mirror for hours before they go out to buy a pint of milk from the corner shop. An agile organisation would happily head out in their onsie, knowing that it will keep them warm, it won’t offend anyone (or if it does they will deal with it) and it will enable them to get the real task done.

The final trait of an agile organisation is that every strand of the company DNA is agile. It is a binary state – your organisation is either agile or it is not. If one person, one department, or one committee penetrates the organisation with their process it will creep through to every part; it will grow and it will spread. People will no longer be empowered; they will counter it with their own process; your organisation will no longer be agile. Whether it is how you get time with the CEO or how you order paperclips, value the outcome over the process in exactly the same way for both.

So whether you have thought long and hard about it or you have just blurted out – if you are prepared to back up those three little word by real action then maybe, just maybe people will look at your organisation and think – I love you.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online