Awkward and Insecure: New Zealand Businesses Struggling With Complexity

Awkward customer interactions and insecure handling of private information. Many New Zealand businesses exhibit behaviour that they know is wrong, but that they seem powerless to stop.

Self-Consciously Awkward

In my previous blog post I wrote about two businesses that were unconsciously awkward. That is, my encounters with them were demonstrably awkward, but as far as I can tell each business is completely unaware of its own awkwardness.

This is not surprising, really. No organisation sets out to be awkward, and no analyst or architect sets out to design awkward processes. Instead, these experiences usually stem from the interaction of multiple processes or technologies that have been designed independently from each other.

But sometimes an organisation exhibits behaviour that it knows — or at least, that somebody within the organisation knows — is inappropriate. This happened to me recently.

The Telco

One of the first things I needed to do when I left my last employer was to get my own mobile phone. I'd been relying on one provided by the company for four years so I needed to go through the whole process of signing up for a plan.

This is a process that includes getting a credit check, so I wasn't surprised to be asked to enter my driver's licence number. However, I was surprised by what happened next.

Sending a copy of an identity document unsecured over email is not a good idea. Here's Waka Kotahi's specific advice on this issue:

To express my concern, I called the Telco's customer service phone line and asked about this process. I was further surprised to be told that there was absolutely no way they would ever ask someone to send their ID over email. The whole thing was an elaborate fake! I had been scammed!

I was skeptical of this, but I didn't want to engage in a conversation about SSL certificates with a customer service rep. Instead, she took me through the correct sign up process, including directing me to a secure system to upload my ID. This was quite a lengthy process, so I was disappointed when we reached the end of it and she discovered that she couldn't actually complete my sign-up because I was already in the system.

What's Going On?

Of course, I was already in the system because I'd filled out an application on their website. It wasn't a scam; it was real.

This Telco appears to have two independent processes for signing up to a plan — one online and one on the phone — that don't intersect until the last possible moment. One process (via phone) handles information securely, the other (online) does not.

Unlike my previous examples of awkward enterprises — which both seemed unaware their processes were not aligned to their customer needs — this business is aware of what it needs to do. It knows it must handle this data securely, it has created a process and invested in systems to to do so; but it has failed to apply this process and technology to all customer channels.

And it's not alone in this. ACC has recently been in the headlines for its handling of sensitive information. Like my (former) Telco, ACC is clearly aware of the requirement for managing this data and has created processes for it. However, they appear to lack adequate systems to enforce or monitor compliance.

Why Does This Happen?

ACC and a Telco are both very different enterprises, but one thing they have in common is size. They are both large (more than 1,000 employees) organisations, and large organisations are necessarily complex.

Information siloing and compartmentalisation are well documented problems that have afflicted large businesses for decades, but the increasing power of technology and proliferation of data have exacerbated these. Interactions between customers, employees and systems that may otherwise be siloed and unaware of each other are increasingly prevalent; and with unexpected interactions come unexpected outcomes.

What Should We Do?

To deal with this problem, digital leaders must understand and embrace the complexity of their organisations.

By examining the interactions between people, technology and data we can unlock the potential to find simple solutions to complex problems. Businesses that do this will gain an advantage over those that can't or won't, as customers head to providers they feel they can trust.

In my next article I will write about some of the tools and techniques I use to help organisations to understand their complexity and to create very good technology solutions that set them apart.