Depending on the business expert I’m listening to and the day of the week, I know three truths:

1. Good employees who work together as a team outperform great employees who don’t.

2. Good employees with great processes outperform great employees with bad processes.

3. If an employee is irreplaceable you should immediately fire that employee.

From first-hand observation I know that when it comes to Information Technology organizations:

  • Great employees can and do overcome bad processes.
  • Great employees can and do overcome lousy managers.
  • Great employees can and do pull along mediocre teams.
  • Making one or two great hires is the most critical step in turning around an underperforming organization.
  • Well-designed processes can be pretty useful, too.

Which is to say, if you want an organization that works, you’ll get more leverage from hiring great employees than from any other single effort you can undertake.

Great employees can overcome organizational deficiencies to deliver useful results. They can’t, by themselves deliver a great organization. That takes a lot more.

The question of what makes a great organization tick is rife with superficial thinking. The usual approach is what you might call the “Tom Peters Fallacy”:

  1. Find a great organization.
  2. Identify a trait in that organization you like.
  3. Decide that this trait is what makes that organization great.
  4. Declare that this trait is the panacea for all other organizations.

As far as I can determine, there is no one characteristic that by itself can make an organization great.

Well, okay — there is one: excellent leadership. That only works because I define “excellent leadership” as “Doing everything required to build a great organization,” thereby begging the question.

So … what is required to make an organization great, as opposed to simply functioning?

Leadership: A great organization does start with strong leadership, in a non-question-begging way. If there’s no direction — no focus, no goals, no plan, no definition of excellence, no clearly stated expectations for employees to live up to; no alignment of purpose and standards — the employees will keep things going, but not much more than that.

Great employees: Not every employee has to be a superstar, although all must be competent. Great organizations do need enough top-notch performers to demonstrate that high standards are achievable, not theoretical.

Focus on achievement: The definition of “great employee” has been diluted through too many managers reading about “emotional intelligence.” Employees who are focused on getting along will concentrate on how irritating their colleagues are. Employees who are focused on achievement will value their colleagues’ contributions and ignore their eccentricities.

Teamwork: Just as the definition of “great employee” can’t ignore the importance of serious technical ability, it also can’t ignore the importance of working and playing well with others, and of providing leadership in the trenches.

Willingness to innovate: This is IT we’re talking about. Information technology. The field where if you can buy it, it is obsolete by definition. IT organizations and everyone who works in them must be willing to try new technologies, processes and practices … and even more important must be driven to constantly find improvements to the ones already in production … or they stagnate.

Willingness to not innovate: “State of the art” means “doesn’t work right yet.” Most of the time, the work required of IT is best achieved by extending what you have, not by chasing whatever is being hyped in this year’s press releases, aided and abetted by publications hungry for advertising revenue.

Evidence-based decision-making: Great organizations make decisions through the use of evidence and logic, not wishful thinking and listening to one’s intestines.

You’ll note the usual buzzwords are notably absent. Governance, ITIL, CMM and all the other processes and practices (I used to call them Processes and processes) that are supposed to lead to inexorable success don’t, in fact, lead to excellence.

Excellent IT organizations do have them. Even more important, they are kept in their proper place — as useful tools that help employees be as effective as possible.

The best woodworkers have band saws, coping saws, lathes and routers in their workshops, and not just hammers and chisels, but their tools aren’t what make them the best.

Great IT organizations are the same. They practice good governance; follow consistent application maintenance, enhancement, design and testing methodologies; adhere to clearly defined change control procedures; and otherwise avoid making things up as they go along.

Their processes and practices are important. They are, however, merely the signs of a great IT organization.

They are not its cause.

Tom Clancy, in A Sum of All Fears, offered this smug assessment: “The Roman bridges of antiquity were very inefficient structures. By modern standards, they used too much stone, and as a result, far too much labor to build. Over the years we have learned to build bridges more efficiently, using fewer materials and less labor to perform the same task.”

Seven years ago, InfoWorld published this response in KJR‘s predecessor, the Survival Guide (“The sum of all projects,” 8/14/2000): “… some of those Roman bridges are still standing a millennium later, while some of our more efficient ones have tumbled into the bay. Adherence to budgets and schedules is our preeminent ethic. One suspects Rome held different values.”

Last week, another American bridge, just 40 years old, tumbled into the Mississippi river in the middle of Minneapolis. Those built by the Romans continue to stand.

What exactly went wrong in Minneapolis isn’t yet certain. We do know already that recent inspections of the bridge did not report that all was well. They reported risk.

The state of Minnesota, my home state, has under-invested in its transportation infrastructure for at least 25 of the last 25 years. So has the rest of the country. We have no reason to believe the 35W bridge collapse will be the only consequence. Current estimates suggest we’ll need to spend $10 billion a year for 20 years to catch up just on bridge maintenance. That will require new taxes. Do you think many voters would support a preventive maintenance platform, should one party or another be to propose it?

In the meantime, roughly 150,000 bridges have a similar risk of failure.

For those who propose the BIG/GAS theory (Business Is Great/Government and Academics are Stupid) as the culprit — don’t even think about it. Business leaders are at least as prone to the same thinking. As a recent KJR explained (“The value of a little failure here and there,” 7/16/2007), they are far more likely to invest in revenue enhancement or cost reduction than in addressing risk, because investments in revenue enhancement and cost reduction yield tangible returns.

In that column I used risk mitigation to cover all ways of handling risk. Two correspondents — Tom Reid and Max Fritzler — recommended a different vocabulary and a more sophisticated way to think about the subject.

The proper cover term, which will be used here from now on, is “risk management.” To manage risk you can Avoid, Insure, or Mitigate (Max supplied the acronym, AIM).

Avoidance means reducing the likelihood that the risk will become an event. Preventive maintenance is one of the most important ways to avoid risk. Staff training, to increase competence, is another.

Insurance includes all tactics that deflect the consequences of risk to someone else. Insurance is the label because that’s the best-known way to deflect the consequences of risk, but there is another. It’s called blame-shifting and it’s quite a popular alternative. Quite a bit of political propaganda goes into blame-shifting. In business, backstabbing often has the same goal. Both are annoyingly effective at deflecting the consequences of risk.

Mitigation means reducing the impact should the risk turn into actual events. Fault-tolerant system design and business recovery planning are well-known risk mitigation tactics. So are cross-training and succession planning.

There is, of course, a fourth risk management tactic. It’s probably the most popular of them all. It’s called hoping. Synonyms are keeping your fingers crossed and denial. Theoretically, you can also accept the risk — consciously choose to do nothing. Usually, though, acceptance is just another synonym for hoping.

Denial has an antidote — developing a culture of honest inquiry. It’s how you get an accurate assessment of risk.

It is, perhaps, the most difficult change in business culture you can attempt. You have to constantly and insistently ask, “Are the data we have trustworthy? Complete? Can we get better data? Are we drawing the right inferences? Will they lead to the results we want?”

And then, “Do the data say our decisions gave us the results we want? If not, what did we miss? What was wrong about our inferences and decisions? What will we do differently next time?”

Tough questions.

You’ll note that most risk management fits our definition of a decision — it requires the commitment of time, staff and money. The exceptions are blame-shifting and hoping, which don’t.

Is it any wonder, then, that blame-shifting and hoping are the most common risk management strategies in America today?

Or that another American bridge has crumbled?