In boot camp, the military first starves recruits to get rid of their flab. Then it feeds them to build muscle.

Or at least, that’s what I’ve read in various fictional accounts. Not having had the pleasure, I can confirm neither the truth nor the efficacy of this technique. It’s remarkably similar to one I don’t particularly like, but whose efficacy I must admit, for shaking the dust off a complacent organization: Shrinking it through layoffs, then gradually adding the staff necessary to create a newly effective organization.

Among the hallmarks of a complacent organization is the accumulation of second-rate and third-rate employees. You know who I’m talking about. Second-raters just barely pull their weight. Third-raters don’t even do that, but have perfected the ability to hide behind the few strong performers who produce most of the organization’s results. How does this happen?

Complacent leaders hire placeholders who, on paper, have the right skills and who, in their interviews, make it clear they won’t rock the boat. Hiring happens quickly so the hiring manager can go back to sleep. Then the few strong performers, who already have a well-developed bad habit of carrying everyone else, will carry the new faces as well. It’s just business as usual.

And in you come, ready to get your motor running and head out on the highway. What are you going to do? Surgically remove the second and third-raters one at a time?

Which is why the starve-then-feed method is both popular and effective. It’s quick, and it avoids the overwhelming effort needed to document termination-worthy performance one employee at a time. Which in many cases won’t be possible, as many of the employees who need replacing perform at a level that’s just good enough, and report to managers who are incapable of distinguishing good enough from better.

This makes the starve-then-feed gambit hard to argue with. It’s distasteful, but sometimes it’s the only practical tactic.

If you’re in this situation and see starve-then-feed as your only practical option, please … retain and lay off based on merit, not seniority. The whole point is to raise the bar after all. Make it your choice, not an opportunity to volunteer for a generous severance package.

But take the following steps before you do. They’re essential to making sure the organization survives the experience:

  • Develop effective means for communicating directly with the IT staff — listening to them, informing them, and persuading them. Don’t rely on your chain of command. It’s a big part of the problem. It certainly won’t transmit ideas in either direction with high fidelity.
  • Define the desired change in culture, and start the process of culture change. You need a clear picture of where you are now, and a precise description of the change you’re about to undertake. If you don’t, you’ll find yourself overwhelmed with case-by-case decision-making, which inevitably you’ll make in inconsistent ways that cause you to undermine yourself. When you can articulate what you want, start the program. Everything that’s going to happen must fit the design of the desired culture, not the old one.
  • Replace your problem managers. There’s a reason the organization has accumulated so many ineffective employees — the people who hired them and kept them on. Leave the same managers in place and they’ll simply replace the old group of ineffective employees with a whole new group of employees just like their predecessors, except the new ones also lack deep knowledge of your company and its systems.And by the way: One of the most important reasons for developing direct communication channels with staff is that you’ll be replacing many current managers — the existing chain of command.
  • Preserve critical staff. Remember those few strong performers who are carrying everyone else? You can’t afford to lose them. Identify them, develop personal relationships with them; promote those who are looking for that kind of opportunity; give them raises; and let them know — overtly and without any tiptoeing around the subject — that you consider them essential to the organization.
  • Give everyone a chance, but not a lot of breathing room. Managers first: Some have been itching for a chance to lead well but have been stymied by the old leadership and culture. That goes for the staff even more. They deserve a chance.It’s a fine balancing act, though. If you give them too much of a chance, you’ll find yourself reinforcing the old culture instead of promoting the new one.

On the other hand, if you don’t give them any chance you’ll unnecessarily jettison important skills, organizational knowledge, and loyalty. Replacing that will cost a lot. Not only that, but by providing opportunities to succeed, you’ll have fewer sleepless nights yourself.

Think of it as enlightened self-interest.

Most IT professionals understand the need to work late from time to time. Suggest it’s a normal part of the profession, though, and you’ll get an earful. If I were a cynical sort, I’d think many IT professionals just aren’t happy without something to complain about.

Several weeks ago, I listed IT being a ghost town at 5pm as one of seven warning signs of a complacent IT organization. Not, I hasten to add, a certain diagnostic — just a warning sign. Into the fray steps Steve Delahunty:

“I had a … boss who complained that people were complacent … The problem was that when he left he didn’t peek into every cubicle and office. The lack of people around the halls in his view meant there was nobody there late. But also, we now can all work as easily at home as from the office. Meaning that I would often get online at night and see so many of my staff on their instant messenger clients it was like we were almost fully staffed online at 9pm with many folks working on work projects.”

Which brings up two points. The first is to be careful how you interpret what you see … and don’t see. Just as a doctor, facing a patient with a high fever, has a lot more work to do before reaching a diagnosis, a manager facing empty cubicles needs to dig in a bit before reaching a diagnosis of complacency.

The second is the subject of this week’s missive (credit where it’s due: it’s a recommendation by my partner, Steve Nazian): If you haven’t developed an instant messaging strategy for your company — one that facilitates its use while building in secure design, not one that locks it down — you’re creating, not preventing, a security hole.

We have more than two decades of experience managing and mismanaging personal technologies. Personal computers, electronic mail, remote system access, contact management software, personal digital assistants, Blackberries … it’s always depressingly the same:

1. IT forbids their use.

2. They leak in through the windows and side doors anyway.

3. A few employees are disciplined for violating company policy.

4. A rational executive somewhere in the business raises a huge stink about IT preventing employees from doing their work.

5. The CIO, recognizing the political liability of trying to keep the tide from coming in any longer, develops a strategy for managing the new technology instead of banning it.

This time it’s instant messaging. If you try to prevent it, employees will figure out a way to use it anyway. And once again, because their use is illicit, the workarounds will almost certainly create security holes. It’s akin to the well-known consequence of requiring strong passwords and forcing frequent changes: Post-It notes containing the hard-to-remember passwords stuck to computer monitors throughout the company.

There are still, in this industry, those who think the goal of security is to create an environment in which intrusions are impossible. If you’re one of these people, I can help. It’s actually quite easy. You can achieve it with three simple steps:

First, disconnect your internal network from the Internet. Second, disconnect all personal computers from the internal network, remove all disk drives and USB ports, and make printers illegal. And third, ban laptop computers from the enterprise altogether.

Of course, you’ll prevent employees from performing any useful work, but that’s just the unfortunate and unavoidable side effect of making the enterprise secure. It’s the nature of the beast. Security creates friction in business processes. The more secure you are, the higher the cost and slower the pace of doing business.

The best IT professionals put into practice what IT executives advise the rest of the company: They use information technology to maximize their own effectiveness. The best employees elsewhere in the company do likewise. Isn’t that the whole point of information technology — to help individual employees, workgroups, departments, divisions, and the enterprise as a whole work more effectively?

Instant messaging is simply the latest of the many tools available for enhancing personal effectiveness. In dealing with it, you have two choices.

You can either embrace it, and in doing so promote the very healthy attitude it represents. Or you can try to prevent it. Which is to say: You can either encourage a good attitude and improved security, or a bad attitude coupled with security holes.

Sad to say, far too many IT executives, faced with these alternatives, will instinctively choose the latter.