YT YouTube2Text

YouTube2Text → Transcripts → Strategic Management 2 Policies Free MBA course

Strategic Management 2 Policies Free MBA course — Transcript

by Swiss School of Business Research · 4,052 words · 680 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00so hello everybody and welcome back to
0:03this module on MBA marketing management
0:06so if you cast your mind back to the
0:08first session we spoke about strategy
0:11strategic management and touched on the
0:14differences between policies tactics and
0:16strategies this module is purely focused
0:20on policy so creating policies and
0:23everything we need to know around that
0:25so before we continue and move on to the
0:27next slide have a think about policies
0:30that you've come across
0:32um and then just consider how easy do
0:35you think it is to create an effective
0:37policy so you might just want to stop
0:39the video here and just have a little
0:41bit of reflection policies that you've
0:43come across whether that's contracts
0:45that you've signed that have come up
0:47that include a policy or remember when
0:49you go and book a flight and it talks to
0:51you about the airline policy or maybe
0:53studying at the business school the
0:55policy that they have in place so think
0:57a little bit about do you think it's
0:59easy to create an effective policy
1:02so answering that question in more
1:04detail
1:05some of the rules for creating effective
1:07policies that we need to be aware of are
1:10around the fact that writing policies
1:12are inherently a little bit risky so
1:16it's a risk communication exercise that
1:18is performed frequently by people who
1:21lack the skills needed to create a good
1:24security policy
1:25so fortunately the use of a few best
1:28practices for planning and writing
1:30policy can make a huge difference in its
1:33Effectiveness in reducing risk
1:36so some of the challenges and issues
1:38what do you think they are because
1:40obviously it's inherently risky so what
1:43do you think are the key challenges and
1:45issues in writing a policy so have a
1:48little think about it and we will
1:50continue
1:51so some of the key challenges around
1:53writing policies are that for example
1:56security policies are developed by the
1:59security team in isolation and alienate
2:03the rest of the organization which could
2:05potentially lead to high levels of
2:06resistance and counterproductivity
2:09a rigid policy unnecessarily removes our
2:12ability to consider multiple options to
2:15hard or complex problems
2:17another key challenge regarding to
2:19policy writing is the fact that policies
2:22which are badly worded can introduce
2:24problems such as inconsistent policy
2:27positions the inability to ensure
2:31compliance unacceptably high risk
2:34profiles or unnecessarily high costs
2:37and security policies that are not
2:39adapted to changes in the business
2:40environment or the external environments
2:43will become Obsolete and restrict
2:45Business Development
2:47so now we're a little bit more aware of
2:49the key challenges in writing a policy
2:52what would you recommend to overcome
2:54these difficulties so what do you think
2:57needs to be in place to help us
2:59counteract these problems that we've
3:01highlighted here so stop the video for a
3:03few minutes and just pause to consider
3:07so to overcome these difficulties things
3:10that we need to recommend
3:11involve developing and maintaining a
3:15policy as part of a process
3:17so we need to engage heavily with
3:20stakeholders who are affected by the
3:22policy because this will build support
3:24and improve policy quality and
3:26pragmatism
3:28we need to ensure that our policy is
3:31flexible enough to support the array of
3:34risk appetites that may exist within our
3:36organization and we need to have our
3:38policies drafted by someone with
3:40competence in policy development
3:43the rules are only as strong as the text
3:45that expresses them and we need to make
3:48sure that our policy is pragmatic by
3:51testing it out
3:53so what do you think is involved in
3:55developing a policy what do you think
3:57are the key steps that we should follow
4:00so have a little think about that while
4:02you're reading the recommendations
4:04so
4:06when we are looking at developing and
4:09maintaining a policy we should
4:11definitely approach it as a process
4:13so it is a bit of a mistake to assume
4:15that you can successively develop policy
4:18by having a knowledgeable person compose
4:20a document in one sitting in isolation
4:23from the rest of the organization
4:25this will alienate the rest of the
4:27organization and lead to high levels of
4:31resistance and counterproductivity
4:35and successful policy outcomes almost
4:38always require
4:39consultation and iteration before a
4:43final sustainable policy position is
4:45drafted
4:46so if you can't defend your process you
4:49can't defend your policy
4:50and once your policy is published it
4:53should be reviewed occasionally for
4:55example every three years and it should
4:57include a consultation with other
4:59stakeholders internal and if necessary
5:02external along with an assessment of
5:04issues that have Arisen since the
5:06preceding review
5:08so the characteristics that our process
5:11in following this and making sure that
5:13we adhere to following the correct
5:15procedure in actually developing the
5:17policy should have the following
5:19characteristics
5:20so as we mentioned earlier we should
5:22have an iterative approach
5:24so it's not really feasible to write and
5:27enforce every potentially useful policy
5:29at once
5:31so starting with a small body of the
5:33most necessary policies and building on
5:36that over a period of years will result
5:38in a more effective body of policy
5:41another characteristic is that we should
5:44base policy on business risk priorities
5:47so it's not necessary to address every
5:49possible form of loss through written
5:51policy this results in too many policies
5:55we need to choose our battles and keep
5:57the body of written rules to a minimum
5:59by addressing only that most highest
6:02impact areas
6:05and also during the policy writing
6:07process we should keep notes and an
6:11explicit written goal for each policy
6:13element should be included during the
6:15creation of the policy and the review
6:17process
6:18and it should be filed for further
6:20reference
6:21so it's preferable to include the goal
6:23as a normal part of the published policy
6:25as an awareness building mechanism
6:28notes relating to the reason for the
6:30policy and its goal should be kept as
6:33background material for review Cycles
6:36so notes are especially useful during
6:38policy revision
6:40and and include the source of borrowed
6:42text and discussions over choices
6:45unused policies along with an
6:47explanation as to why it was not used
6:49can also be stored as a reference for
6:52future questions and possible future use
6:57and what we also need to think about is
6:59using a structured approach to support
7:01flexibility
7:03so large organizations normally have a
7:05number of semi-autonomous business units
7:08and without careful policy coordination
7:10such a structure results in an overall
7:13increase in Risk
7:15so Acquisitions widely varying lines of
7:19business and distribution across
7:20multiple countries are all facts of life
7:23that encourage battles over policy it
7:27can take many years to eventually arrive
7:29at policy consensus on some issues
7:32so can we think of some examples in this
7:36area so for example when we talk about
7:38these semi-autonomous business units
7:41they're all going to have dis different
7:42risk appetites
7:44so one example for example is a bank
7:46where a retail banking division will be
7:49far more risk-averse than an investment
7:52banking decision
7:53the policy therefore must be
7:55sufficiently flexible to accommodate
7:57these different risk appetites without
8:00compromising the entire organization
8:04and then a policy that is too rigid in
8:06its approach or its implications can be
8:09just as problematic as a policy that
8:11does not result in sufficiency or
8:13sufficiently strong security controls
8:18so for this reason it's really in
8:21sists is on risk management rather than
8:24compliance to a prescriptive set of
8:26controls
8:28and this can be achieved through the use
8:30of language
8:32so for example substituting
8:36um should using should instead of must
8:38or through the policy structure for
8:41example devolving some policy
8:43requirements to guideline level
8:45um what we're going to go through now is
8:47I'm going to show you an example where
8:49we demonstrate that and we work through
8:51an example of the policy and all the
8:53different
8:54subordinate layers
8:57um to give you an idea of what we're
8:58talking about so if you take a look here
9:01at this diagram if I explain it a little
9:04bit more in detail going from the
9:06charter through to the processes this is
9:08one of the ones that we actually saw in
9:10the last module what do we notice well
9:13we notice that we've got at the top
9:15we've got a charter so the Mandate for
9:17the policy is provided via this Charter
9:20and because the policy has been signed
9:22at the very highest level of the
9:23organization The Authority that it
9:26carries is preserved in the lower more
9:28detailed levels that the CEO does not
9:31need to see
9:32then working our way down we then have
9:35standards so the standards describe the
9:38functional requirements that must be
9:40universally met with no exceptions other
9:43than via a formal exemption process
9:46guidelines are almost exactly the same
9:49as standards and those follow except the
9:52individual business units are free to
9:54deviate from the guidance without
9:56seeking formal approval
9:59then working our way down
10:01we've got this idea that actually by
10:04doing that this is the mechanism through
10:06which a minimum standard of security can
10:09be assured while still allowing for
10:11flexibility amongst those divisions that
10:14have different risk appetites as we saw
10:17in the example of the bank
10:20so what we do we need to be thinking
10:22about is we shouldn't ever develop our
10:24policy in isolation we should build
10:26support by a process of Engagement
10:29so policies require Universal support
10:31and they include and accommodate
10:34relevant audiences across multiple
10:36business units
10:38so policies can be undermined if the
10:42stakeholders affected by them have not
10:44helped to shape the outcome
10:46so strong business unit resistance may
10:48lead to reluctance by the CEO to approve
10:51a policy and even if the policy is
10:53approved the security team may have a
10:56long and unproductive arguments with
10:58business units about how to implement it
11:01or how to comply to it rather than more
11:05satisfying and productive discussions
11:07about how security can help achieve
11:09future business aspirations
11:12so it's really important there that the
11:14focus is on doing the right thing at the
11:17start because otherwise time and energy
11:19is spent as it says talking about
11:22compliance and implementation rather
11:25than looking ahead at
11:27um creating or achieving future goals
11:32so who should be
11:33altered then in this policy what do you
11:35think so we've talked about the
11:36stakeholders but who are the people who
11:38should be consulted in in drafting a
11:40policy
11:42so basically it's necessary to consult
11:44with each business unit that is affected
11:47by the policy if the policy is to be
11:49politically and pragmatically viable so
11:52we need to consult widely with
11:54stakeholders and especially the
11:56following
11:58so in terms of the following
12:00considerations we need to consult wisely
12:03with the stakeholders and what we need
12:06to be doing in in these situations is
12:08actually identifying instances of
12:10potentially unacceptable policy outcomes
12:13such as in the banking example that we
12:15discussed so this can be particularly
12:17important in those instances where
12:19business units are distributed across
12:22different jurisdictions and they may
12:25have different needs and different
12:26abilities to impose controls so in these
12:29kind of cases the global global
12:31corporate policy
12:33can only address those few things that
12:36are applicable across the entire
12:38organization
12:39so we also need to focus on the fact
12:41that
12:43um every part of the organization needs
12:45to be consulted
12:47but also that the policy implications
12:49are very well understood so we consult
12:52with every part of the organization and
12:54the people and the different business
12:56units and teams and departments really
12:58understand
12:59so once approved there can be no
13:01complaints that this is a surprise
13:04so it is effectively a part of the
13:06awareness and education process
13:09another thing we should focus on is
13:11making sure that we build coordination
13:12among business units that might
13:14otherwise operate in ignorance or
13:16Defiance of peer business units
13:19and this ensures that a rogue business
13:20unit is not allowed to operate with a
13:23security profile that would otherwise
13:25introduce unacceptable risk to the other
13:27business units
13:31and then other than consultation during
13:33development
13:35we should also ensure wide-ranging
13:37support at the senior management level
13:39prior to seeking final approval from the
13:42CEO or equivalent position
13:45and and so when we're talking about
13:47these areas that we need to focus on and
13:49and who should be consulted and and
13:50who's involved in this
13:52who do you think should actually write
13:54these policies who is going to be
13:56responsible for ensuring that they are
13:58written and drafted correctly so stop
14:00the video for a minute and just think a
14:01little bit about that
14:04so
14:05what we do need to make sure is when we
14:07have a policy drafted it is drafted by
14:09someone with competence in policy
14:11development
14:12so the rules are only as strong as the
14:15text that expresses them
14:16so policy is a really important form of
14:19communication about risk and the impact
14:21on the reader will be maximized if the
14:25text is well crafted in organizational
14:27appropriateness and writing style
14:30so what do we mean by that so in terms
14:32of writing style
14:35um Gartner which is an American Research
14:37and advisory firm reviews policies on a
14:39very regular basis and it tends to be
14:42obvious when a policy has been written
14:44by a person who is not experienced at
14:46drafting policy and who has for example
14:49maybe primary skills in a different area
14:51such as technology management
14:54so what's really important is the person
14:56who drafts this policy has at the very
14:58least
15:00um is or has the policy that has been
15:02developed by or the rail is reviewed by
15:04someone with expertise in drafting
15:06policy
15:09and we need to develop guidelines for
15:11drafting policy documents so we're going
15:14to provide you now with some examples of
15:16the guidelines or the guidance that may
15:18be included
15:19so we need to make sure that when we are
15:22following these guidelines we need to
15:24make sure that we take into account the
15:25mindset of the reader so decide what
15:28specific effect a policy item should
15:30have on the reader and keep that purpose
15:33in mind while writing and editing
15:36another consideration is to avoid
15:38opposite obsolescence
15:40so policy text that it's highly specific
15:43in terms of dates service or product
15:46names personal names Etc can easily
15:49become very quickly outdated through
15:52changing circumstances that have no
15:54material effect on the policy
15:56so the policy needs to be kept generic
15:58enough to avoid the need for trivial
16:00changes
16:02another consideration is to make sure
16:04that we use a consistent level of
16:06abstraction
16:07so requirements documentation can range
16:11in abstraction level from a very general
16:13statement of purpose that is signed by
16:16the CEO to detail specifications for
16:19registry settings on a specific instance
16:22of windows
16:23so treating your policy documents as a
16:26hierarchical set of separate documents
16:28as we saw in the in the image earlier
16:31will make the policy more accessible to
16:34the reader and will help maintain it
16:38and another important consideration when
16:40drafting policy is to make sure that it
16:42is direct and specific so make it clear
16:45what is to be done and who is going to
16:47do it
16:49and then other considerations in terms
16:52of the language is to really avoid the
16:54use of legalese and pompous language so
16:58policy writers sometimes get concerned
17:00that plain language will lack impact and
17:03actually it's the opposite because when
17:05I'm tempting to influence people the
17:07more clear we can be and the higher
17:09level of clarity the easier it is to
17:10understand
17:12so using pretentious words such as
17:14whereas and therefore or mimicking
17:17contractual Language by using two words
17:20when actually one will be enough
17:22sends a message that the writer lacks
17:25confidence in the innate importance of
17:27the policy
17:29another thing in terms of writing the
17:31policy you need to make sure we stick to
17:32a consistent Style
17:34so they're very subtle differences
17:36between should must and will and
17:39therefore it's important to choose a
17:40verb and stick with it and also use a
17:43consistent person I'll be saying you
17:45they won and Etc
17:49and then finally once that's been all
17:51put together and um written in the most
17:54effective way possible then what is
17:57really important is that the document is
17:58really edited very carefully
18:01so subject matter experts are not always
18:04the most effective communicators so
18:06finding a skilled technical writer to
18:08ensure that the final document commands
18:10respect from the reader is actually
18:12really important
18:13so have the policy reviewed by several
18:15members of the target audience to ensure
18:17that it is clear and realistic
18:21and then what do we need to think about
18:23well if we're writing for an
18:24international audience
18:27a multi-organization a multinational
18:28Organization for example has no choice
18:31but to make compromises in the
18:32communication of I.T governance policy
18:35it's not realistic to expect that the
18:37larger body of IIT administrative policy
18:40let alone standards and guidelines will
18:43be translated into every national
18:45language although it is normal to
18:47translate a small amount of user policy
18:49into multiple languages and of course
18:51English has become the default language
18:53for it in many organizations
18:56so what do we need to bear in mind in
18:59terms of the use of language well as we
19:01discussed before the avoidance of
19:03legalese being specific in or being
19:06consistent in the types of verbs that we
19:08use and really keeping language simple
19:11so keeping short keeping sentences short
19:14and words short avoiding slang avoiding
19:18culturally specific references and
19:21whether or not a document is translated
19:23the simpler it is the more likely it is
19:26that it will be correctly understood by
19:28non-native speakers
19:31and another important consideration is
19:33to make sure that a native speaker
19:34reviews the final document so countries
19:37in which English is widely spoken
19:39inevitably inevitably develop their own
19:42idiosyncrasies that are not understood
19:44by Outsiders
19:46for example
19:47um in Swiss Germans refer to servers as
19:50productive systems instead of production
19:52systems so in any in any country there's
19:55always going to be Regional variations
19:57and development of a language that is
20:00used which is perhaps a little bit based
20:02on yeah local local variations and and
20:06vernacular so what's really important is
20:08that those are understood in this in the
20:12sense that it's it's understood and
20:14reviewed by somebody who's a native
20:16speaker
20:18and then remember that language usage is
20:21not consistent between countries so the
20:23language is named after England France
20:25Spain Portugal China and Germany can
20:28vary significantly when used in other
20:30countries for example the verb to table
20:33has opposite meanings in the US and the
20:36UK
20:39and then what's therefore important is
20:42to make sure there are representatives
20:43of each region to review the final
20:45document because language problems go in
20:48both directions so even text that seems
20:51very simple and clear to a native
20:52speaker may contain a concept that
20:55actually is easily misunderstood by
20:57other cultures
20:59and then therefore it is important to
21:02take time out to learn about the
21:04cultural environmental differences
21:05because every country has its own forms
21:08of control and methods of mediating
21:09disputes and its laws reflect that so
21:12there can be significant differences
21:13between countries within the same
21:15continent that speak the same language
21:17let alone between countries on different
21:20sides of the globe so we shouldn't
21:22assume that every part of our
21:23organization has the same leadership and
21:25discipline customs
21:27and therefore
21:29um using a user guide is is quite an
21:32important consideration because it will
21:34be difficult for staff to comply with
21:36the policy if they do not understand it
21:37so while the language in the policy
21:39statement is presumably safe from an
21:42administrative and legal perspective
21:44staff members May simply not understand
21:46what it actually means
21:49so it is therefore important to maybe
21:52consider engaging a professional writer
21:55to develop a user guide so this is a
21:57document that is intended to be
21:58understood by all staff members
22:00regardless of whether they are
22:02technically proficient security
22:04proficient or legally proficient
22:07so it's written in a manner that engages
22:09normal late the normal lay person and
22:13maintains their interests and explains
22:15requirements to them in a way that can
22:17be easily understood
22:20um and if you've got a professional
22:21writer interview the policy writer if
22:25you have a professional writer interview
22:26the policy writer then these questions
22:27are more likely to be answered and the
22:30writing style of the user guide is
22:32likely to be more in keeping with the
22:34goal of educating the audience
22:36so these are some guidelines about how
22:39to make the policy as effective as
22:40possible what do you think are some of
22:43the common criticisms of policies so
22:46stop the video for a second and just
22:48pause maybe policies as I mentioned
22:49earlier that you've come across what do
22:51you think are are common problems and
22:53criticisms
22:56so basically one very common criticism
23:00of policies and standards is that they
23:03often can tell people what they cannot
23:05do but rarely tell people what they can
23:08do
23:09so it's important therefore to test out
23:12a number of actual scenarios that staff
23:14members are faced with and determine how
23:16the policy supports or inhibits them
23:19so consider including a section in a
23:21user guide as discussed earlier that
23:24outlines common situations that people
23:27may find themselves in and then describe
23:30how they can do their work
23:33so we're going to see here an example so
23:36for example what if a staff member is
23:39working remotely and staying in a hotel
23:42how would you respond if a line of
23:44business can make a legitimate case for
23:46the use of cloud technology what about
23:48the use of personal cloud service
23:52how will the policy work with a bring
23:54your own device program
23:56if another organization has control over
23:58your information for example because of
24:01Outsourcing how will this work when the
24:04policy changes
24:05will the vendor continue to use the old
24:08policy or will there be a commercial
24:10implication to switch to the new
24:12policies
24:13so use high profile events reported in
24:15the media or important new legal
24:17developments to develop scenarios for
24:20verifying the extent to which your
24:22policy protects your organization
24:25and how will you therefore ensure
24:27compliance what do we need to consider
24:30so we do need to think about is
24:34um the policy can only be effective if
24:36we can verify compliance
24:38so what we might want to do is consider
24:40going through each policy requirement
24:42and expressingly considering the
24:45following questions
24:46so if a user asks you how do I comply
24:50what specific measures will you
24:52recommend
24:53how will you measure compliance how will
24:56you detect non-compliance
24:58and how will you report on compliance in
25:01terms of both the extent and the
25:03business value
25:06and if you cannot verify compliance that
25:09it's possible that the policy statement
25:11may be unenforceable and this may
25:14eventually lead to a situation in which
25:16an auditor will issue an audit finding
25:19that you are unable to address
25:21and more importantly you are left with a
25:24control that is not fully effective in
25:26mitigating risks
25:29so just some notes regarding this as we
25:33are now reaching the end of this session
25:34so in terms of document lifetimes
25:38document lifetimes are suggestions only
25:40and local preferences may vary so local
25:44preferences may also dictate preferred
25:46locations for some of the content of the
25:48policy for example some organizations
25:51include security principles in the
25:53Enterprise security Charter whereas
25:56others actually include them in the
25:58policy
25:58another thing to be consistent of is
26:01using a consistent style so the paper
26:04the article keywords for use in request
26:07for comments to indicate requirement
26:09levels
26:10um uh RFC for short contains
26:13internationally accepted guidelines on
26:16the use of these words so a couple of
26:18footnotes there for you to think about
26:21so we've now finished this session on
26:24policies hopefully now you've got a much
26:27clearer idea on how to create an
26:29effective policy in terms of the process
26:31to follow the language to use taking
26:34into account International audiences and
26:36therefore who should be involved in the
26:38development of a policy and maintaining
26:40it okay so thank you for listening and I
26:43will see you in the next session

About this transcript

This page contains the full transcript of Strategic Management 2 Policies Free MBA course by Swiss School of Business Research, generated from the public captions YouTube serves with the video. The transcript has 4,052 words across 680 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.