The Limits of Role Model Analysis

In our previous post we talked about a company that hadn't captured their organization in their HR system and how that crippled their ability to determine an optimum role model. While that's certainly an unusual case (we've seen it only once in 50+ IAM engagements), it is also true that no business tracks their organization down to the individual level at which access is assigned. The only organizations that I'm aware of that do this are military and paramilitary organizations, not just a chain of command, but an actual definition of personnel and their jobs from the top to the bottom of the organization (for example, FO, 2nd Plt, C Co., 2-1 INF, 172 SBCT uniquely identified myself and my job in an organization of roughly 900,000 people). It allows for tremendous efficiency at the cost of operational flexibility. That we even have a separate word for this: "paramilitary," whose primary definition means "organized like the military" — signals how rare such total organizational definition is. These are typically organizations with a very rigidly defined purpose (law enforcement, firefighters, medical teams); they function efficiently at the tasks they were created for, but are not good at adapting outside of their intended purpose.



I do not write this to suggest a company should be organized in this manner. Operational flexibility is far too valuable to sacrifice in the name of efficiency, and most companies know this. That's why below a certain size, the organization of their personnel is left fluid, managers and directors are allowed to re-allocate their teams as they see fit in order to meet changing business needs, and they should do this. However, this leaves a gap at the bottom of the company org chart where the access needs between the smallest organizational unit and the individual cannot be defined through Role Model Analysis, because no information about their organization exists outside of the communication between those individuals and their immediate supervisors. That means that Role Model Analysis leaves money and risk on the table at the bottom of the organization.

This loss and risk can be mitigated through direct manual intervention. At the first organization where we conducted a Role Model Analysis, the client identified this gap and we filled it by going to the managers and directors and asking what teams and sub-teams their reports were on and filling in the information gap manually. This is, as you might expect, time-consuming. It was a viable solution for a company with around 6,000 identities, but it would be a daunting task for an organization an order of magnitude larger. While we've always offered this as an option, the majority of organizations choose not to do it.

The question I asked in my last post: "How can we build an effective role model without organizational attributes?", doesn't just apply to poorly organized companies; it applies to all companies. This limit came to drive one of the largest design decisions in developing our visual roles solution.