Excerpted with permission from Building Business Solutions:  Business Analysis with Business Rules, by Ronald G. Ross with Gladys S.W. Lam, An IIBA® Sponsored Handbook, Business Rule Solutions, LLC, October 2011, 304 pp.  URL:.  http://www.brsolutions.com/bbs

The Policy Charter is your battle plan.  It should be reviewed and fine-tuned with business leads to ensure you can 'win' the business battle.  The success of a business solution and the business system(s) that support it depend largely on the strategy.

To illustrate, consider a pizza business.  Pizza businesses are very competitive.  At some point the owner of a pizza business decides that in order to stay competitive, pizzas need to be delivered in 30 minutes instead of 1 hour.  Figure 1 illustrates his rethinking.  He doesn't proceed because he perceives the risk (undercooked order items) to be unacceptable.

Figure 1.  Policy Charter for 30-Minute Delivery for the First Company

Where the first pizza company sees unacceptable risk, a competitor looks harder and sees opportunity.  Figure 2 illustrates that company's finer-edged strategy.

Figure 2.  Policy Charter for 30-Minute Delivery by the Competitor

The competitor sees 30-minute delivery for some menu items as a new offering.  As illustrated by Figure 3, drilling down even more he arrives at a new business policy.

Figure 3.  More Drill-Down in the Competitor's Strategy

Key Point:  You shouldn't start developing a complete business model — and certainly not design or develop any systems — until all business questions like these have been resolved.  That's just common sense(!).

High-Impact Sponsorship The Policy Charter supports high-impact sponsorship, a distinguishing characteristic of our approach.  Benefits for the sponsor(s): Maximum leverage for controlling the business direction of a project with a minimum investment of time. The ability to manage projects by business benefit, rather than simply or primarily by cost.  As Gladys famously puts it, "Cost overruns are manageable if worthwhile business benefits are achieved; however, failing to meet business goals is always unacceptable." The Policy Charter enables sponsor(s) to monitor a project closely with minimal investment of time.  The Policy Charter equips the sponsor(s) with: An up-front opportunity to directly assess the overall strategy for the business solution, identify holes, and provide pin-point feedback. A clear, concise, and continuing framework to understand how business goals are met by the business model and subsequent design and development of some business system(s). A way to detect easily and early in the project life cycle if the project strays from original business intent so appropriate action can be taken in timely fashion.

Conflicts, Trade-Offs, and Risk Brackets

Consider the drill-down depicted graphically in Figure 4 in the strategy of a business solution supporting order fulfillment.

Business goals in this drill-down:  To stay competitive.  To keep customers satisfied.  To make a profit.  A business lead indicates a necessary business tactic Accept orders on credit.  The business tactic addresses two of the three goals:  To stay competitive.  To keep customers satisfied.

Associated with the business tactic is an obvious business risk Non-payment of purchases made on credit.  This business risk imperils the third business goal To make a profit.  So a conflict arises among the business goals.  How is the conflict best resolved?

Figure 4.  Strategy diagram illustrating a Drill-Down for Order Fulfillment

The business leads decide that orders over $1,000 present an unacceptable level of business risk.  To address the business risk the business leads formulate a business policy Orders on credit over $1000 should be credit checked.  (We often refer to a delimiter such as the $1,000 in this business policy as a threshold of pain, a specific limit in the degree of risk the business can tolerate.)

Where does that leave things?  The business leads have decided that orders up to $1,000 don't merit credit checks; that is, an acceptable business risk is:  Orders up to $1,000 on credit without a credit check.  Some important observations:

• Tight lips.  A threshold of pain can represent sensitive information.  In the wrong hands, it could threaten the very success of the strategy.  A Policy Charter, like any battle plan, should be treated as confidential.
  
  
• Metrics.  A threshold of pain represents a clear danger point in day-to-day operation of the to-be business capability.  How do you determine whether the business policy is being subverted?  The answer is metrics — key performance indicators — aimed around the threshold of pain.  Strategy-based metrics are critical.  To differentiate them from other kinds of metrics (e.g., metrics for business processes) we call them key strategy performance indicators.
  
  
• What's better left unsaid.  Documenting why business leads deem business risks acceptable is optional — not necessary.  Tread carefully here.  For example, suppose business leads deem the following business risk to be acceptable:  Failure to comply with regulations might result in a fine.  It turns out the cost of compliance far exceeds the amount of any potential fines.  Also, the chances of getting caught are slim.  In creating Policy Charters, situations like this one fortunately don't arise often, but they can.

Remedies

Sometimes, a business risk simply cannot be overcome in all cases by any reasonable means.  Then the right question to ask becomes:  How can we make the best out of a bad situation?

For example, suppose that despite all best efforts by the pizza business, traffic congestion is sometimes so heavy that deliveries can't be made in an hour (or 30 minutes).  No matter whose fault, hungry customers are still likely to be unhappy.  What can be done in those cases to achieve the business goal To keep customers satisfied?

One idea might be to offer the customer a free-pizza coupon.  Some restrictions (read business rules) would naturally have to apply, but those can be worked out later.  The new business policy Customers should be offered free-pizza coupons when pizzas cannot be delivered within one hour.  A business policy like this one provides a fall-back position or remedy when all else fails.

Remedies can go too far, of course.  Suppose the tardy-pizza customer were given free pizzas for a month.  Turns out the customer has a household full of teenagers.  You can see that situation could get out of hand very quickly.  Always keep balancing business goals in mind — for example, To make a profit.

The key to excellent strategy is optimizing trade-offs when business goals conflict.  Remember, at some level of drill-down, business goals always conflict.

Risk Brackets

Optimizing trade-offs sometimes requires calibrated responses to a business risk.  By distinguishing risk brackets, each threshold of pain can be addressed selectively by an appropriate business policy.

For example, a business capability supporting purchasing identifies the business risk Wasteful or fraudulent expenditures.  Addressing this business risk in optimal fashion requires calibrated trade-offs between two business goals:  To protect financial resources and To ensure efficient operations.  Selective business policies for different risk brackets are presented in Table 1.

Table 1.  Selective Business Policies for Different Risk Brackets

Risk Bracket	Selective Business Policy	Calibration
1. Expenditures under $10,000	Expenditures under $10,000 may be processed by operations staff without any approval.	This level of risk is deemed acceptable.  The business goal To protect financial resources is preempted in favor of To ensure efficient operations.
2. Expenditures from $10,000 up to $100,000	Expenditures from $10,000 up to $100,000 should be approved by a supervisor.	The conflicting business goals are balanced against each other, but more in favor of To ensure efficient operations.
3. Expenditures from $100,000 up to $1,000,000	Expenditures from $100,000 up to $1,000,000 should be approved by a regional manager.	The conflicting business goals are balanced against each other, but more in favor of To protect financial resources.
4. Expenditures over $1,000,000	Expenditures over $1,000,000 should be approved by the president.	This level of risk is deemed unacceptable.  The business goal To ensure efficient operations is preempted in favor of To protect financial resources.

Best Practices for Policy Charters

Best Practice 1:  A business tactic should never be expressed as a sequence of actions.  A business tactic is a course of action, not a series of actions.  Important difference!  Avoid getting bogged down at this point in process flow.

Wrong way to express a business tactic:  A repair shop continues to create supplements for an estimate, and the estimator approves or denies.  The estimator returns to the Claims Office where supplements are keyed into the estimating pad.  A copy of the new original estimate is sent to the repair shop.

Good expression of a business tactic:  Provide estimators with the ability to perform on-site supplement reviews when an estimating pad is unavailable.

Best Practice 2:  A lousy business tactic is a lousy business tactic, not a business risk.  Perceiving business risks correctly is an essential step in finding suitable resolutions.

Lousy business tactic:  Piece-meal billing on an individual order-by-order basis.

If a customer receives a hundred separate invoices for $10 each, that's asking for trouble.  But what's the true business risk?

True business risk:  Unhappy high-volume customers.

The lousy business tactic forces customers to process a great many invoices each month, resulting in frustration and wasteful use of resources.  Possible replacement business tactic:  Monthly billing on an account basis.

Best Practice 3:  Be alert for motivation gaps.  A publishing company has the business goal To make a profit.  The business tactic in Figure 5 is proposed:  Offer discounts to intermediary companies.

Figure 5.  Motivation Gap

The motivation for the business tactic is not obvious.  How can offering discounts result in boosting profits?  Something seems to be missing.

Between the business goal and the original business tactic lurks an unstated business tactic.  Figure 6 reveals that business tactic and clarifies the motivation.

Figure 6.  Filling in Motivation Gaps

The new business tactic has been added in:  Stimulate business with intermediary companies.  Now the motivation for the discounts is clear.  They will stimulate business with intermediary companies, resulting in a greater volume of business.  The greater volume will presumably more than compensate for the discounts, thereby boosting overall profits.

Figure 6 illustrates a drill-down from one business tactic to another business tactic.  'Decomposing' business tactics in this fashion often proves useful.

Best Practice 4:  Be on the lookout for missing business goals.  A missing goal means that architectural scope should be adjusted right away.

Business goals for a prison system:  To rehabilitate offenders.  To punish offenders.  To protect society.  Someone proposes the business policy A non-violent inmate should not be housed with a violent inmate.

Assuming the business policy is appropriate, its motivation is problematic.  The business policy doesn't clearly address any of the business goals.  Perhaps a business goal is missing:  To protect the physical welfare of the offender while in prison.

Here again we see the Policy Charter ably serving a crucial secondary purpose — to solidify architectural scope as early in the game as possible.

More on the Role of Business Policies in Strategy

Business policies are crucial for defining the fine-weave of a strategy.  They are how you win the business battle.

Ron's Favorite Business Policy Any customer can have a car painted any color that he wants so long as it is black. Henry Ford, My Life and Work, 1922, Chapter IV Henry Ford developed a successful strategy to create a mass market for automobiles.  His strategy included such well-known innovations as assembly lines (in strategy terms, a business tactic) and wages high enough so workers could buy cars (a business policy).  To create the mass market, prices had to be kept low (a business tactic).  Among the business policies adopted to support low prices was the one above (here reworded):  All cars should be painted black.  No variation in color equaled lowest possible cost.

Let's review some additional roles that business policies play.

Identify Mission-Critical Business Rules

Business policies provide the basis for the most critical business rules in the to-be business capability, core business rules.  We think of a business policy as some business rule(s) in the making.

Disallow Business Tactics or Business Policies

Business Policy:  We will not make on-site visits.

This business policy precludes any business tactic prescribing on-site visits.  Perhaps on-site visits are too expensive and time-consuming or set the wrong expectations.

Suppose a business goal is:  To stay in close contact with customers.  Even though business tactics involving an on-site visit might prove effective in achieving that business goal, they cannot be admitted to the strategy.  On the other hand, a business tactic involving sending holiday courtesies by mail would be acceptable.  It involves no on-site visits.

Business policies can also protect against inappropriate reduction of operational freedom.  Example for an international bank:  Accounts may be held by a person of any age.  No business policies placing restrictions by age alone in holding accounts are permitted.

Govern Business Processes

Business policies shape both the form and operation of business processes within the to-be business capability.

At the extreme, business policies (or their absence) can even preclude the need for some business process(es).  For example, if there were no business policy that you need a driver's license to drive, there would be no process for getting a driver's license(!).

Hold on though.  Isn't requiring a driver's license a law rather than a business policy?  Yes, but with respect to strategy and motivation, it doesn't matter.  Laws work essentially the same for societies as business policies do for businesses.

Think about the motivation (goals) for the driver-license law:  To ensure public safety on public roads.  To identify drivers and their driving history uniquely.  To certify knowledge of traffic laws.  Operating any complex capability implies strategy, whether for societies or for business capabilities.  By the way, a bad strategy, or a strategy by default, is still a strategy!

No Policy Charter?  Take this Two-Part Test! Do you find yourself in the middle of a project that didn't create an up-front Policy Charter?  Here's a two-part test to determine how much trouble you might be in. See if you can pull together all the elements of your implicit strategy for the business solution (i.e., business goals, business tactics, business risks, and business policies) into a coherent document of modest size.  Be sure not to include any elements of project definition (e.g., project objectives, project risks, etc.). See if you can summarize the strategy as an 'elevator pitch'.  The sponsor should be able to absorb the key points, ask an intelligent question or two, and give an informal thumbs-up or thumbs-down in one elevator ride. If you truly understand the business solution, you shouldn't find these tests too hard and they shouldn't take very long.  You'll end up with excellent new communication tools. If you can't document the implicit strategy for the business solution with reasonable effort and summarize it coherently, yes, you could indeed be in trouble.  Hard work and good intentions seldom compensate for lack of a solid battle plan. Think seriously about lobbying for a freeze on further development.  Quickly set about undertaking some Policy Charter sessions.  The time and energy couldn't be better spent!

How Long Does It Take to Create a Policy Charter?

With the right people in the room (major caveat), good facilitation, and a solid ballpark view of scope, creating a Policy Charter in draft form doesn't take that long at all — sometimes as little as a half-day.  We've proven time and time again it's possible to create a Policy Charter that fast (or faster).  It's simply not as hard as you might think — again, if you have the right people in the room and the right approach.

Why?  The appropriate business leads have already been thinking about new and better ways of conducting business.  Intuitively they understand what business risks and trade-offs are involved.

Remember it's not about IT, so it's natural for them.  The Policy Charter simply provides structure so they can lay out their thoughts clearly and work through problem areas.  Strategy is exactly the conversation the business leads want to have!

Another important caveat:  If the strategy for the business solution requires approval beyond the sponsor(s), more time may be required.  One Policy Charter we did involved a new business policy that literally had to be approved by the U.S. Congress.  That one took a while(!)

When is the Strategy 'Done'?

Work on the Policy Charter should continue as long as business leads or sponsor(s) can think of additional business risks.  Each business risk deemed unacceptable must be addressed by one or more business tactics and/or business policies.  In addition, no business tactic or business policy can rely on any item not in architectural scope.  Either the item must be brought into architectural scope or the strategy modified.

The Policy Charter is complete when all remaining business risks are deemed acceptable.  Then the business sponsor(s) must sign off.  Their approval may take several iterations.

The actual size of individual Policy Charters can vary depending on architectural scope, level of drill-down, and presentation style.  Short and concise is always best.  Remember, no fluff allowed!

Summary

Strategy is never static for an organization.  It must be periodically revisited after the business solution and business system(s) that support it have been delivered.  What better means to do that than by retaining and revising the Policy Charter?!

To achieve true business alignment, your approach to business requirements needs to be based on a Policy Charter.  Also, the performance of the business capability, once deployed, should be measured according to the key elements of the strategy.

A periodic conversation about strategy is exactly what your business leads are looking to have.  A Policy Charter gets right down to the business — literally.

# # #