This grew out of my thinking about the proper place for Security and IT in organisations and my disatisfaction with the current fad of outsourcing, that didn't seem to have any logic to it.

Well, I believe an organisation, in reality, only has three layers:

  • The Core

  • The Capabilities and Resources

  • The Service Functions

So what do I see as the difference between these? The Core is what is the exclusive parts of the organisation, i.e. the parts that can't be outsourced, nor can they be absent in any way, as there wouldn't be any organisation if they were absent (of course, smaller organisations may have both the strategy and marketing part in one person, usually called the owner, but they are always present).

The Strategy creates the reason for the organisation to exist and decides what the reasons for its continued existance are dependent on. As a side effect of this, it also defines the culture that is prevalent in the organisation and is responsible for handling the stakeholders and their (maybe) conflicting interests.

The Marketing defines what customers to go after and with what tools (price, market coverage, distribution, sales force, etc) and with what kind of products (today and in the future). Also responsible for the communication of the organisation, both to internal and external parties.

These two combined creates the Core:

The Core

The next part is the parts of the organisation that are essential, but doesn't really need to be an integral part of the organisation (as can be seen on the current outsourcing trend) but that most Core members want to have control over to ensure the smooth functioning and the capability of making fast changes (in theory at least).

Finance may seem to be the most entrenched C&R as it is normally demanded of regulatory parties (like the IRS, the SEC, etc.), but it usually not mentioned that it must be executed by employees (in fact, a number of smaller companies uses accounting/auditing third-parties and subsidaries to larger organisations are usually handled by the parent organisations finance function). What may be seen as hard to outsource is the controlling and the RM functions, but as many organisations can't even agree on what controlling means/entails and very few have explicit RM functions, I see this as mostly an academic discussion (especially as auditing is done by third-parties and you can find RM companies that can probably do a better job than inhouse staff). Of course, this is usually never outsourced in larger organisations due to the need to have total control of the financial situation by the Core members (and the lack of status if it is not done inhouse), even though it easily could be done.

The Operations C&R is one of the most versatile and all-encompassing parts of the organisation, as it is usually different between organisations. A Telecom company sees the maintenance of the network and billing systems as part of operations, while a Law firm sees the case handling and legal research as operations or a Manufacturer usually sees manufacting, logistics, and procurement (aka supply chain) as Operations. All of them usually sees back-end support as being part of operations (and some also see the customer-facing support as part of operations, even though I personally sees that as Marketing). In short, Operations is usually seen as as core parts of the organisation, but as can be seen by the many telecom and computer companies (and also many traditional manufacturers) it is very easy to outsource Operations to other companies (even to other countries) as long as the Core remains intact within the organisation.

IT is another part that is a C&R within the organisation, as most organisations can't function without IT support (as can also, silly enough, be seen in the number of CIOs in management teams). Interestingly enough, it is currently a trend to outsource the IT function, which also means that it is very hard to control what happens with it and that the appropriate support exists to make it a valuable C&R for the organisation. This is of course true of all outsourcing (which is usually done by refering to economics of scale and cost cutting) but as it is usually done by management that by outsourcing its own capabilities only shows that they no longer can control the outsourced function, it seldom lasts very long, until the one or two changes in management makes it insourced (at great expense for the organisation) again.

Human Resources (HR) is the last, and most neglected, C&R of organisations (in fact, many SMEs don't even have HR functions and some larger organisations even calls their payroll people for HR).As payroll and benefits handling (like accounting) easily can be outsourced and staff handling easily (as in can be easily done, but is usually a very bad idea) can be handed off to the middle-management to handle as well as giving staffing planning to the functional or divisional managers to control (which usually means they have to hire HR staff anyway). In my view, HR can be a great tool (especially marketing wise) and correctly used, a great C&R.

This will give us a Core, surrounded by the C&Rs:

Augmented by C&R

If we then continue down to the Service level functions of organisations, we immediately find controversy, dependant of the organisation and its environment. Nevertheless, I have decided to utilise three distinct (or indistinct, dependent on your viewpoint) parts as representatives. As an interesting side-note, both of Sveiby's and Edvinsson's KM models state clearly that service functions has no value (not even a KM value) to any organisation. Please state that the next time you have a temp in the reception that just have insulted your VIP guest…

The first is of course the Legal service, as most organisations in any part of the world seldom find that they can live without legal counsel (for criminal, trade, tax, contract, civil, etc, issues). Also, some kind of legal authority is nearly always necessary for the creation and reporting of the organisation as well as its compliance to laws and regulations. Even though this is nearly indispensable for any organisation, many choose to use outside counsel, either by retainer agreements with law firms, usage of parent organisations legal departments or by utilising ad-hoc lawyers (usual inSMEs, due to the high costs involved). Nearly no-one (except affected legal staff or law firms) sees this as a core part in any organisation. In the organisations where it is used efficiently, it is usually seen as a great service to the other parts of the organisation, and therefore I have decided to classify it as Service function.

Where would any organisation be without the little people, or the so-called support Infrastructure (like restaurants, receptions, janitors, the staff that buys furniture and sees to it that the leasing car contracts are renewed, that the photocopier has paper, that the mail is delivered, etc.). This is the invisible part of any organisation, and even though they are usually partly outsourced functions (like janitors or restaurants) and partly inhouse staff. These are the service functions that ensure that the organisation can continue to function and concentrate on their special (usually functional) knowledge. Sadly, a very under-rated but vital service function in any organisation, as they usually are paid very low salaries, which is a bit surprising, as they usually has access everywhere.

And then we come to the Security services, which is a very strange hybrid, as it encompasses low-paid guards to highly-paid IT-security specialists, who all are supposed to be a minimal cost, low-impact services that defends the organisation against all known and unknown threats to tangible and intangible assets, usually without the assets being defined, nor their value (if this sounds silly, it is only because it is silly, but unfortunately true for most organisations).

This gives us the following picture of the organisation:

A full organisation

Below, you will find some very incomplete descriptions of what each functions contains. I make no claim of it being all encompassing, but I think it is a reasonable structure of most organisations.


  • Mission

  • Vision

  • Culture

  • Positioning

  • Stakeholder Handling


  • Segmentation

  • Sales

  • Promotion

  • Pricing

  • Research & Development

  • Customer Support

  • Distribution

  • Communication

Finance (Resource and Capability)

  • Accounting

  • Treasury

  • Finance

  • Controlling

  • Risk Management

  • Taxes

Operations (Resource and Capability)

  • Manufacturing

  • Logistics

  • Back-end services/support

  • Procurement

IT (Resourse and Capability)

  • Desktops

  • Servers

  • Systems

  • Networks

Human Resources (Resource and Capability)

  • Staffing

  • Benefits

  • Personell Handling

  • Payroll

  • Training

Legal Services

  • Company Secretary

  • Legal Counsel

  • Contract Handling

  • Compliance

Infrastructure Services

  • Reception

  • Janitors

  • Internal Services (restaurants, etc)

  • Furniture, cars, etc.

Security Services

  • IT Security

  • Information Security

  • Physical Security

  • Safety

  • Contingency Planning

Currently unrated


There are currently no comments

New Comment


required (not published)