73
5Chapter
Developing a Strategic
Planning Process
Strategic Planning is a process by which we can envision the future and develop the
necessary procedures and operations to infl uence and achieve that future.
Clark Crouch
How fast can you plan? Strategic planning as a process isn’t that complex. However, in a ready-
aim-fi re, culture it’s not easy to do. One person’s template is another person’s track over the edge.
Just read the reviews of any strategic planning book and try to fi nd consistent agreement about its
effi cacy and usefulness. We’ve watched a strategic planning process that makes perfect sense to an
IT security professional absolutely lose every single other security leader in the room. e IT pro-
fessional had worked for a year with the entire security group and, yet they abandoned the plan-
ning process wholesale because it was too IT and technical. e strategic planning process didn’t
make sense to the heads of the other departments, and most of them hadn’t had much experience
in strategic planning. As the security group continued on without much strategic direction and
even less fi duciary accountability, soon strategic direction was imposed by the new vice president
of the division. After a long and diffi cult year, the department as a whole began to master the art of
strategic planning. Within a couple of years, strategic planning grew easier for the entire security
department even as targets got more diffi cult to achieve. Practice, focus, and a basic strategic plan-
ning model go a long way toward garnering enterprise support for a security group.
In this chapter we will review the basics of most strategic planning processes from getting
ready to plan to planning itself and the implementation of a strategic plan. In a larger enterprise, a
security group’s strategic plan will be informed by a number of other strategic processes going on
in the extended enterprise. Often a security group’s strategic plan must be integrated with:
1. Enterprise strategic plans
2. Business units’ strategic plans
3. Functional strategic plans (as in the case of security being part of a shared services group)
TAF-K11348-10-0301-C005.indd 73TAF-K11348-10-0301-C005.indd 73 8/18/10 3:04:39 PM8/18/10 3:04:39 PM
74 ◾ Security Strategy: From Requirements to Reality
4. Operational strategic plans (including LEAN, Six Sigma, and Quality programs)
5. Technology strategic plans (including IT, physical security, and cloud services)
6. Other types of strategic plans such as business
A security group must be mindful of what other strategic processes going on around them are
likely to infl uence the framework of their own planning. ey may also manage at least two of their
own strategic plans simultaneously. Typically, an organization will manage at least two strategic plan-
ning cycles at the same time. For example, as one planning cycle is completed, another has typically
begun, so elements of a security group may be engaged in the fi nal tracking of the implementation
phase of one strategic plan while simultaneously preparing for the beginning of another strategic plan-
ning cycle. No one said strategic planning is easy! However, the strategic planning process becomes
simpler with practice and more seamless between strategy formulation and implementation.
Before you get started on strategic planning and engage a planning group, you should consider
several important questions:
1. Who are the appropriate people who need to engage in the planning eff ort?
2. Are the right stakeholders from both the internal organization and external enterprise
involved in the strategic planning process?
3. Are the executives who need to be involved in this strategic process informed and knowl-
edgeable about the process and the organization?
4. Who has the RAA (responsibilities, accountability, and authority) for the strategic plan?
( e RAA should include the fi nal completion of the plan, the process for completing the
plan, and the plan itself.)
5. Who will get the plan when it is complete?
6. Who are our enterprise champions, sponsors, and the like?
7. What constraints do we have around the planning process? (Time, personnel, resources,
information, etc.)
8. What other bigger picture (extended enterprise strategic plans) do we need to align to or be
aware of?
9. Is our present strategic plan relevant?
10. What are the roadblocks and barriers for strategic planning?
11. What are key success factors for us in planning?
12. What collaboration tools and/or technology do we have access to that can facilitate planning
eff orts?
Once you have developed clear answers to these questions, your team is ready to begin. Before
we begin our discussion of the overall strategic planning process, let’s review some of the basic
responsibilities that should be assigned prior to beginning a strategic planning process.
Roles and Responsibilities
ere are many levels of roles and responsibilities to consider in strategic planning. e fi rst is who
is responsible for the plan to plan, facilitating the plan, participating in the plan, stakeholders, and
so on. Typically, the RAA for that level should be detailed in one of the planning documents for
strategic planning. at document typically presents the steps or stages of the planning process
itself and states who has responsibility for it. ose responsible vary from facilitator to the board
TAF-K11348-10-0301-C005.indd 74TAF-K11348-10-0301-C005.indd 74 8/18/10 3:04:40 PM8/18/10 3:04:40 PM
Developing a Strategic Planning Process ◾ 75
of directors, various executives, and internal planning staff . Several committees and subcommit-
tees may also be part of the RAA documents. Often there may be an executive sponsor for various
segments of the strategic planning as well. e typical stages included in a document that outlines
the RAA are as follows:
1. Preparation to plan
2. Review and revision of vision/mission/values, and so on
3. Data gathering for input to planning
4. Development of the plan’s framework
5. Creation of a strategic plan
6. Refi nement of the strategic plan (possible “catch-ball” process)
7. Reviews of the strategic plan
8. Approval of the strategic plan
9. Communication of the strategic plan
10. Predetermined reviews against the plan
11. End-of-the-year performance to plan
During the strategic planning process outside facilitators, coaches, outside stakeholder reviews,
independent third parties, various internal stakeholders, and outside experts of various kinds may
deliver both input or specifi c RAAs. A roles and responsibilities document will help you track who
is responsible for which elements as you proceed through a planning cycle.
Several industry groups like Toyota, Hewlett-Packard, and Bank of America include another
step in their systemic approach to strategic planning. Planning methods such as Hoshin Planning
developed by Dr. Yoji Akao will also use a “catch-ball” phase of the planning process that allows
the middle management groups to actively interact with senior management in order to create a
much more robust and practical strategic plan by further capturing and cementing strategic goals
into organizational reality. is additional stage of the process will create more revision cycles as a
strategic plan is integrated further down into the actual implementation segments of the organiza-
tion. e Hoshin Planning process can work quite well with the balanced scorecard approach and
is a method that further focuses an entire organization on a single goal.
Process and Procedures
e process and procedures may vary depending on the method of planning you choose, the size
and type of your organization, and the culture of the organization in which you work. However,
there remain some consistent guidelines in any planning process, notably:
Before you start, be clear about the process, methods, and materials you will need and ◾
produce.
Have full and active executive support. ◾
Have strong employee involvement. ◾
Be consistent and thorough in your planning, analysis, and implementation. ◾
Communicate your plan well to all stakeholder groups. ◾
Organizations are like people in regards to strategic planning. Both individuals and organiza-
tions who engage in regular strategic planning are more successful in achieving their goals and
TAF-K11348-10-0301-C005.indd 75TAF-K11348-10-0301-C005.indd 75 8/18/10 3:04:40 PM8/18/10 3:04:40 PM
76 ◾ Security Strategy: From Requirements to Reality
success. If you want a frame for your organization’s short-term budgets and fi nancial goals, if you
want employees to have a stronger sense of security regarding the organization’s future direction
and goals, if you want needed change and growth, if you want better control of operational prob-
lems, and better communications and relationships within and without your organization—then
develop strong strategic planning skills and use them.
Get Ready to Plan for a Plan
Over our careers we have found wide variations in groups’ experiences with strategic planning,
their ability to plan, and the results of that planning. Our experience ranges from groups that
had given up on strategic planning (because of bad experiences using complicated strategic plan-
ning models) to groups working in well-trained teams that
were quite comfortable with strategic planning (and had devel-
oped detailed processes that delivered quantifi able results and a
strong reputation within the organization).
Henry Mintzberg in his book e Rise and Fall of Strategic
Planning wrote that leaders, managers, and companies have
adopted methods of deciding what to do and how to imple-
ment them without considering the fundamental assumptions and experiences with those meth-
ods. He cites three fallacies that have arisen about strategic planning:
1. Discontinuities can be predicted.
2. Strategists can be detached from the operations of the organization.
3. e process of strategy-making itself can be formalized.
Mintzberg goes on to argue that strategic thinking should be encouraged in general through-
out the organization and that without involvement in the strategic process it is diffi cult to be
connected with a strategic direction. His point is that in many formal strategic processes there is
an inability to react quickly to sudden exogenous shocks. When strategists are too detached from
operations, they create plans that are not linked into the important processes of an organization,
which will have limited impact. When a strategic planning group is too formal, it is removed from
the organization, increasing the chance of offi ce politics, detachment from employees, and lack of
potential insights that reside in other parts of the organization. Like much of the quality move-
ment, Mintzberg argues that strategic planning cannot be done well without the involvement of
line management.
Another important element of Mintzberg’s discussion is the type of strategic intents created in
planning. Typically, the strategic literature refers to two types of strategies: deliberate and unreal-
ized. Deliberate strategies have to do with the strategic intents that have been realized by an orga-
nization, whereas unrealized strategies are those that were planned but not realized. A third type
of strategy that Mintzberg encourages organizations to develop is called emergent strategies. ese
strategies usually happen outside of a published plan, but they are not necessarily bad strategies.
e question is how can strategic planning better incorporate the learning from emergent strate-
gies instead of ignoring them or trying to cover them up because they don’t fall inside the scope
of deliberate planning?
Regardless of the formality or informality of the method your organization employs in strate-
gic planning, the important questions are, “How are you involving the people in your organization
If you ask managers what they do, they will
most likely tell you that they plan, organize,
coordinate and control. Then watch what
they do. Don’t be surprised if you can’t relate
what you see to those four words.
Henry Mintzberg
TAF-K11348-10-0301-C005.indd 76TAF-K11348-10-0301-C005.indd 76 8/18/10 3:04:40 PM8/18/10 3:04:40 PM
Developing a Strategic Planning Process ◾ 77
in planning?” and “How are you incorporating emergent strategies and the lessons learned that are
happening every day in your organization?”
We have the following conventional assumptions about strategic planning. First, planning is
part of the overall strategic management process and is strongly associated with organizational
processes and fi scal performance. Second, it is more than probable that the competitive elements
of your environment engage in strategic planning; if you don’t, you are more likely to be at a
distinct disadvantage. ird, we believe that developing and documenting your strategic process
helps you get better results and learning throughout your organization. Fourth, we believe that
with all elements of your organization engaged in the strategic planning process, you will increase
organizational teamwork, responsiveness, fl exibility, creativity, and eff ectiveness. Remember to
keep the strategic process moving and engaging. We will consider the strategic planning process
in terms of four basic stages: planning, preparation, facilitation, and completion.
Planning, Preparation, and Facilitation
Some basic keys for setting the tone within your organization are the following:
1. Study—Take time to learn about planning methods and the culture you are working in,
what planning method best suits the culture you work in, and the time frame that you will
have for planning.
2. Make time—Make the time to plan; investing time in planning is crucial for strong execu-
tion, and it requires top management support and engagement. Be clear about the time and
resources that it takes to conduct strategic planning and get them in place through negotia-
tion and buy in from executive management. Time and resources will be required in every
stage of strategic planning including implementation and metrics.
3. Choose participants, facilitator, and results wanted—Determine who will be involved in
strategic planning, assign a core planning team, and determine whether you will be an inter-
nal or external facilitator, or both, and for which planning sessions. ere are advantages
and disadvantage to each. Table 5.1 examines a number of the advantages and disadvantages
of using an internal or external facilitator.
4. Develop a clear statement of what you wish to accomplish (for both the entire process
and each individual session)—Use the facilitator to help you if needed, and then commu-
nicate to the planning group and your organization.
5. Defi ne the outputs and outcomes expected from the strategic planning process—What
you will have when you are fi nished are, among other things, vision and mission creation or
assessment, strategic initiatives, perspectives, objectives, performance measures and targets,
strategy maps, documentation, reports, white papers, balanced scorecard draft.
e inputs your process will require include environmental scan information and reports, busi-
ness drivers, SWOT analysis, market reports, benchmarking data, audits, customer/stakeholder
feedback, and emerging strategies that came about during the last implementation cycle.
6. Choose a strategic planning process—Explore the variety of formats or variations of pro-
cesses available to conduct strategic planning and choose the one that best fi ts your orga-
nizational culture, resource, and time constraints. ere are advantages and disadvantages
to each format, and every organization not only has its own culture, but how it performs
strategic planning varies tremendously. Many well-tested models are readily available in the
marketplace.
TAF-K11348-10-0301-C005.indd 77TAF-K11348-10-0301-C005.indd 77 8/18/10 3:04:40 PM8/18/10 3:04:40 PM
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.