Reciprocity

Think for a moment of someone who's gladly done you a favor.

Gave you a ride to work when you had a flat.
Helped you prep for a difficult interview.
Loaned you a book you really loved.

Whatever it was, they did it gladly, as if they really wanted to help you.

How'd that feel?

I'll bet that, for a while at least, you might have looked for some way to pay them back.

Not because they expected it. Just because you wanted to.

Now think a moment about someone who frequently asks you for help.

I'm sure you do your best, but I bet you're not trying very hard to think of new ways to help them.

What's going on here?

It's a simple human behavior called reciprocity:

Someone helps me, I somehow want to help them. Someone keeps asking me for help, I somehow kinda don't feel so motivated.

This may be something to consider as you shape your communications strategy.

Of course your newsletters and emails are meant to support your mission.

But what if you could also find a way to let them help the people who are reading them?

Wouldn't they be even more motivated to help you in return?

Yeah. Yeah they would.

All the best,
A.

Coaching session extras: message templates

Last week I had a coaching session with a client, in which there were a couple of technical questions that we didn’t have time to cover.

On a hunch that others might like to have the answers, I’ve worked up a couple of quick videos to answer these questions, and share them with you here:

1. Why can’t I see contribution-related tokens when editing the message templates for my thank-you letters?
   Video: CiviCRM: accessing contribution-related tokens in Thank-You message templates (5 min, 9 sec)

2. How can I create conditional logic in message templates? For example, if a given field has value “A”, I’d like to display a certain block of text, and otherwise omit that text entirely.
   Video: CiviCRM: conditional logic in message templates, via Smarty templating engine (17 min, 13 sec)

The real value of my coaching sessions is in exploring strategies toward specific priorities and goals, but these little technical tips can be useful too.

All the best,
A.

What needle are you trying to move?

There's that nagging feeling that something needs to change — but you don't quite know where to act.

Do you feel it?

Many of my clients do.

The ones who get past it, who take action and get results, have one thing in common:

They start by defining what they want to achieve, and why it would be valuable to achieve it. Only after that do they think about what steps they might take to achieve it, and how effective — or how difficult — those steps might be.

If you're trying to "move the needle" on something, don't waste time guessing about how you can do it, until you've first identified, very clearly, exactly which needle you're trying to move.

Once you've got that, it's a lot easier to separate good ideas from bad ones regarding how you can actually make it happen.

All the best,
A.

Scanning for duplicate contacts — in your sleep

Do you make a regular practice of scanning for duplicate contacts in your CRM?

Rather like flossing your teeth, this is both not-exactly fun, and a valuable practice that will save you a lot of headaches.

But if you have more than a few hundred contacts, you may find that the scanning itself can be a bit of trouble:

• Scanning across all contacts takes forever, and it can even lock up or crash your site.

• You can of course set the scan to compare only a portion of your contacts, but breaking them up into small chunks is a tedious process.

• The scanning itself is rather tedious; it's a bit of chore to sit there waiting for the scan results to load in your browser — and if you can't process them all in one sitting, you'll have to repeat that scan again later.

I know several organizations where staff, facing these challenges, have just avoided scanning for duplicates, or put it off as long as possible. Meanwhile the number of duplicate contacts just keeps growing, which will make future scans take even longer.

If that's your situation, you might want to have a look at the Dedupe Monitor extension. It scans for duplicates while you sleep, is careful not to crash your site while doing it, and then alerts you to any duplicate candidates that the scans have identified.

Your staff can then review those duplicate candidates, and use CiviCRM's standard duplicate-merge features to either merge them or mark them as "not a dulicate."

It's been in use by several organizations for over a year now, and they're reporting great results, trimming down litterally thousands of duplicate contacts out of their systems.

You can learn more about it in this blog post on civicrm.org: Dedupe Monitor: Easy Dedupe Scanning Across All Contacts

All the best,
A.

Data quality: does your team know why?

You've probably learned by now that your CRM is only as good as the quality of its data.

That means constantly ensuring your data is accurate, up to date, and consistent.

And that's not easy to do. It's not always fun. It competes for attention with phone calls, meetings, and deadlines.

And since you're relying on your team, if you have one, to keep up that data quality, you'll want to be sure they understand why it's important.

Explain to them that good data quality is critical for:

1. Making staff tasks more efficient and enjoyable.

2. Avoiding errors in communication that can embarrass and frustrate your constituents, staff, and sponsors.

3. Allowing the organization to allocate resources wisely and plan effectively to further your mission goals.

Your staff are good people, but their time and attention are limited (just like every valuable resource you have).

You can help them by reminding them not only how to keep your CRM data in good order, but also why it's important to do so.

All the best,
A.

Fixing it with paint

The Summersal Cottages in Derbyshire, England were built between 1862 and 1864.

Once a working farm, these beautifully renovated buildings are now a thriving retreat center, currently the home of a 5-day working retreat where I and about 20 other volunteers are working to further improve CiviCRM and its many extensions.

Enjoying a hot cup of coffee after breakfast this morning, I came across this little detail in the framing around the front porch of the farmhouse.

What I see here is well-crafted woodwork, rotting after years of service, and repaired several times — with paint.

Paint. Over rotting wood.

Now, you can probably guess that paint is not a cure for rotting wood. And that paint doesn't even hold well on rotting wood.

But the keepers of this fine little country estate have decided more than once to paint it and leave it, as is.

Some people would shake their heads. Say it's poor maintenance. Say it's a shame.

But it's none of that. It's just a choice.

Time and money are limited resources. The owners are choosing to focus on certain areas of maintenance, and to leave others for later.

Is it a moral failing? Is it a travesty?

Nope, it's just a cost-benefit decision, based on their priorities and their resources, as they understand them.

Considering that this place is usually booked up months in advance, their approach seems to be working just fine.

Here's the thing:

We all have choices to make.

We have our ideals, our desires, our wish to make every little thing just exactly right.

And we have priorities, and goals, and a concept of what we really want to accomplish, and what really matters.

Finally, we have our resources. The time, and funding, and connections, and good will, which we can use to achieve those goals.

Almost always, our resource limitations will force us to make a choice.

We can choose to spend our resources on making every little thing perfect (however unlikely that may be).

Or we can choose to invest in what matters most, as we see it, and to leave some of the little things for later.

My hope is that you can see your priorities clearly, and remember to put your resources there.

There's nothing wrong with painting over a little rotten wood, if it means you can keep the house standing long enough to serve the people you care about.

All the best,
A.

Easily find a custom field

Having over 100 custom fields in CiviCRM is not terribly unusual.

But then, how do you find the one you're looking for, when it might be scattered across 30 or 40 custom field groups?

The administration UI for custom fields begins with the list of all your custom field groups, but you still have to open each group to see what fields are in it. So it’s not always easy to find any given custom field.

What if you could make it easier?

Here’s how it looks by default:

And here’s how it could look, with one small change to your CiviCRM config:

You can get these benefits simply by enabling the “AdminUI” extension in CiviCRM. It’s disabled by default, but you should see it in the list of available extensions.

Then you can easily find whatever custom fields you’re looking for. (You’ll also get similar improvements in some other admin pages within CiviCRM.)

All the best,
A.

100 priorities?

Can you have a hundred priorities for your CRM systems?

Obviously not. That's a contradiction in terms.

Sure, you may have a hundred demands being placed on you.

But if you want to start making better progress in your work, you've got to have one or two items you can focus on, ranked by the priority you actually place upon them.

If you've got that, congratulations. You're in a good spot.

If you don't, what's stopping you?

All the best,
- A.

“I have no tolerance for risk”

You've got things you want to achieve. Everybody does.

You're probably working on one of those right now. I certainly hope you are.

So let me ask, what is your tolerance for risk in that work? What degree of failure are you willing to risk in return for the possibility of success?

If you're a particularly careful person you might say something like:

I don't have any tolerance for risk at all because I never take risks.

Beware of this kind of thinking.

Because every effort involves risk.

Every time I buy something online, there's a chance I'm going to hate it and will at least have lost the time and trouble of waiting for it, sending it back, and searching for something else.

Insisting you have no tolerance for risk is about the same as insisting you don't care about ROI.

Here's the thing:

Because every effort involves a risk, it's simply not helpful to insist that you have no tolerance for it, or that failure is not an option. Failure is always an option.

The question to ask is how much risk you can tolerate — how much you're willing to invest, in effort and other resources, for the chance of succeeding, knowing that you also have a chance of failing.

Answering that question will allow you both to move forward towards your desired outcome, and to limit the negative impact of missing the mark.

All the best,
A.

P.S. The quote above is taken from Douglas Hubbard’s How to Measure Anything, from a person he describes as “a midlevel manager at an insurance company client of mine.” Great book. Very recommend.

HIPAA and CiviCRM?

Friend-of-the-list Kimberly wrote in today with this question (shared with permission):

Hi Allen,

I just had a potential client ask me about HIPAA compliance. I've read some stuff on the stack exchange and the only thing I can see that might be a problem is that CiviCRM doesn't track when users open records.

I also know that a lot of people don't understand HIPAA so this person may not understand what she needs to be HIPAA compliant.

Can she use CiviCRM if she needs a HIPAA compliant database?

Kim

Here’s my answer:

Hi Kim,

> Can she use CiviCRM if she needs a HIPAA compliant database?

In short, yes she could. But there's a lot of work involved, and it's not a very well-worn path (i.e., I can't think of anyone who's said they're doing it or have done it, though I have seen some say they were going to try it).

The thing is, CiviCRM is a general-purpose CRM system serving the typical needs of non-profits and other community-driven organizations, whereas HIPAA compliance has — as you probably know — a set of strict requirements that a) aren't built right into CiviCRM, and b) are about more than the software itself.

I imagine most organizations, faced with the challenge of complying with a set of complex federal rules, would rather just shell out the money to an EMR system vendor that specializes in that kind of thing. That approach is expensive, but can feel very comforting.

In general:

- CiviCRM itself doesn't (and really can't) make any claims of "HIPAA compliance" as a simple yes-or-no question. CiviCRM's native data fields (name, address, etc.) aren't designed to track HIPAA-protected data (e-PHI), and it can't know which custom fields are intended to contain such data; therefore you'll need to take specific action to make sure such data is properly protected.

- I myself don't claim authoritative knowledge of HIPAA requirements, but hopefully you or the client have (or are establishing) a relationship with someone who can provide that expertise. This is important because, while a CiviCRM expert can help you ensure that CiviCRM is configured in a way that supports compliance, HIPAA compliance itself includes much more than that.

- That said, it is conceivable that one could configure CiviCRM in a way that helps to enforce HIPAA compliance in the client's unique staff workflows, based on their unique HIPAA compliance plan. This probably would call for some custom extension development to fill in requirements that CiviCRM can't meet out-of-the-box.

- As you mention, CiviCRM doesn't keep track of "who viewed which records." What's more, there are any number of ways to view constituent data in CiviCRM: searches, reports, direct viewing of individual constituent records, etc. So the tracking of "who has viewed what data" is not just a question of "who viewed which contstituent record", but "who viewed specific fields, activities, or other records, whether in search results, or reports, or some other way."

This of course will leave you with a few questions to explore:

1. What data to be tracked in CiviCRM would be covered by the HIPAA compliance requirements?

2. Has the client already formulated staff policies regarding HIPAA compliance in the management of that data, or are they still on their way to creating those policies?

3. Is the client already using other system(s) to track HIPAA-protected data? Will those systems be linked to CiviCRM in some automated way? If so, there's probably some custom work to be done to create that integration, and that of course will need to be designed with the appropriate security requirements in mind.

I've had similar questions from several different clients over the years. All of them have decided to use some external vendor-provided system to ensure HIPAA compliance of protected data, and then to separately maintain CiviCRM as a CRM tracking the "usual" stuff like mailings, memberships, activities, etc.

I won't says there's not a business case for doing this in CiviCRM, but so far, I haven't seen anyone who dug in on the numbers and decided they had such a business case.

To sum up:

Yes, they could use CiviCRM to track patient data that's protected under HIPAA, but there's probably a lot of work to be done in order to ensure that data is properly protected according to the organization's own HIPAA compliance plan. I'd recommend a careful cost/benefit analysis before diving in.

Hope this helps!

All the best,
Allen

Would you like some help with a question about CiviCRM, or CRM strategy in general? Send it my way, and I’ll give you my most thoughtful reply. (I won’t share it with the list without asking you first, and it’s always fine to say “no.”)

All the best,
A.

Bad stuff happens

Part 1: Someone close to me was recently in a major car accident.

Out of nowhere, smashed into by another car, woke up in the hospital with no memory of the whole thing.

Hundreds of thousands of dollars in hospital bills.

Funny thing, she had been meaning to renew her health insurance, which had lapsed a couple of months earlier.

Never got around to it.

Oops.

Part 2: Just this morning I spoke with a buddy whose friend passed away unexpectedly a few weeks ago.

He’d had health issues for a while, but was feeling fine.

One day he was loading luggage into his car after a hotel stay, and just keeled over.

Heart attack.

The end.

Funny thing, he had been meaning to renew his life insurance, which had lapsed a few months earlier.

Never got around to it.

Oops.

Here’s the thing:

You never know when something terrible is going to happen. That's why we have contingency plans.

• Are you taking daily backups of your CRM data and your website?
  Have you checked those backups lately?
  Have you tried restoring from them to be sure they work?

• Do you have a plan for who will take over if one of your critical staff is suddenly in critical condition (or worse)?

Bad stuff happens.

Keeping up with your contingency plans is a big part of ensuring that the bad stuff is only as bad as it has to be.

All the best,
A.

“Engagement metrics” that actually matter

Open rates and click rates have a problem, and it’s getting worse.

• Have you noticed that your open rates have spiked — or plummeted — for no apparent reason?

• Or that some users seem to have clicked every single link in every email message (however unlikely that would be)?

Problems like this are the result of privacy protections that are being implemented by a growing number of popular mail processors, like Gmail and Apple Mail.

What gives?

I won't bother digging into the mechanics of how it works, but the practical effect is that it makes your open rates and click rates significantly less reliable.

And this is not just affecting CiviCRM emails. The big-bucks platforms like MailChimp and Constant Contact are struggling with the same issues.

I, and some other CiviCRM specialists, have ideas about ways we could improve the situation for CiviCRM, but it's an arms race. Against heavily resourced companies like Apple and Google.

None of us are likely to out-maneuver those tech giants anytime soon.

What to do?

One very smart thing to do here is to stop placing so much emphasis on open rates and click rates.

For one thing, those numbers have always been more of a relative measure than an absolute one.

(A 60% open rate doesn't mean that 60% of your recipients opened the email; but it probably does mean that more people opened that email than the one with the 20% open rate.)

But more importantly, they’re just very meaningful in your mission.

Your organization and your people don't really benefit from opening an email or clicking a link.

The benefit happens when they take a more meaningful action: donating, registering, renewing, joining.

So: .

Let the click and open rates continue to be what they've always been: relative general indicators.

And then, use more meaningful metrics to gauge who is actually making progress in their relationship with you.

Because making progress in the relationship is the kind of engagement you really care about.

All the best,
A.

Alert: Please double-check your CiviCRM forms

If you're using Google's "I'm not a robot" reCAPTCHA on your CiviCRM forms, you might want to give them a test drive.

In the past few days, several sites have reported that the reCAPTCHA always fails. That means nobody can complete the form. Instead they get this failure message:

Please correct the following errors in the form fields below:
Please go back and complete the CAPTCHA at the bottom of this form.

Yuck.

Fortunately, this doesn't affect sites which are:

• Using the very latest CiviCRM version, because version 5.77.0 (released today), fixes this problem.

• Using the Form Protection extension, which already avoids this issue.

Is this a bug in CiviCRM?

Not really. It seems that Google recently changed something on their side, and CiviCRM just had to catch up.

Does this affect your site?

You can find out very easily like so:

1. First, be sure you're logged out of your site.

2. Next, visit a contribution page or event registration form that shows the “I'm not a robot” checkbox.

3. Submit the form just as any of your site visitors would, of course being sure to check “I'm not a robot.“

If the form submits without the error message I mentioned above, you're fine. If you see that error message though, you’ll want to take some steps to fix it.

How can you address this problem?

Any of these fixes will do:

1. Upgrade to the newest CiviCRM version, 5.77.0. (or, if you're part of the ESR program, take the latest ESR update, which also fixes this issue.)

2. OR: install and configure the Form Protection extension, which side-steps this problem in its own way.

3. If you don't like those options, you can have a developer patch your current CiviCRM version with the code fix, which is here.

Here's the thing:

Anti-bot-spam measures such as reCAPTCHA are valuable and important, but obviously you don't want them blocking everybody, which is what’s happened here.

Any active web-driven software package can encounter incompatibilities like this one. CiviCRM is no different.

What's great, though, is that CiviCRM came out with a fix for this within a matter of days.

That's one thing I love about open source software, and about the CiviCRM community in particular. Nothing is ever perfect, but CiviCRM is pretty darn good.

All the best,
A.

Just ask one person

Something else from the 988 Suicide Help Line story.

Remember, they're trying to pick some hold music that will help callers stay on the line long enough to reach a counselor.

They’ve narrowed it down to four choices, and now they want some input on which one is best.

So how did they do it?

They walked around on the National Mall in Washington DC, and asked people at random.

From the RadioLab episode:

STEPHANIE [TECH LEAD FOR 988]: ... we had people listen live through our phones and vote on which one they liked the best. ... and by and large everyone really agreed on the same music choice. ...

[NARRATOR]: With one massive caveat.

STEPHANIE: ... we're limited to talk to nine people.

[SHOW HOST 1]: That's ridiculous!

[SHOW HOST 2]: That's it? Like, the mental health of millions of people depends on these nine strangers on the mall?

Yeah.

Nine people.

Doesn't sound like much, does it?

But you know what?

One of the show hosts took the same method to New York's Time Square

... and asked about twice as many people

... and got the same results.

Here's the thing:

Sample size in survey-based research is a big complicated topic that I won't get into here.

For extremely precise and rigorous research, you'll want a sample between 100 and 1000 people.

But do you really need that “extremely precise and rigorous?” if you're starting with virtually zero information, asking even a handful of people can be very useful to point you in the right direction.

Or, as Steve Krug puts it in his book, Don’t Make Me Think: A Common Sense Approach to Web Usability, “Testing one user is 100% better than testing none.”

I’ll go one further: Mathematically speaking, testing two users is 100% better than testing one. But testing one user is infinitely better than testing none.

All the best,
A.

36,000 missed opportunities, recovered

A couple of years ago the "988" Suicide & Crisis Lifeline decided to address a problem: too many people hanging up while on hold waiting for a counselor.

We all hate being put on hold. The dorky hold music, the apathetic machine voice droning, "Your call is important to us, please continue to hold.”

Yep, that's what they had. You can hear it yourself if you like (link below). I listened, and I figure I'd probably hang up too.

So what did they do?

They began a concerted effort to improve the hold experience: surveying folks to help pick the best music; hiring a professional voice actor; carefully rewriting and revising their script; live A/B testing to measure whether it would make a difference at all.

The result? The number of people who hang up during the hold-time has decreased by about 36,000 callers per year.

Full disclosure, that's only a small percentage of the total hang-up number. But it's 36-thousand people.

What can we learn here?

When people call 988, there's one very clear next step that we want them to take in the journey. It is to stay on the line and connect to someone who cares, who can help.

The staff at 988 knew what the next step was in the journey.

They identified a problem that was preventing people from taking that next step.

And with relatively little effort, they found a way to help 36,000 people make progress in that journey.

Here's the thing:

When you know what the next step is, and you start looking at where people are missing it, you're in a good position to come up with ways to help them over whatever hurdle they’re facing. Whether it’s your service receipients, your donors, even your staff.

The required effort may not be as much as you think.

But must stay focused on the journey, so you can see when folks are getting left behind — and help them move forward with you.

All the best,
A.

P.S. I heard about this on the RadioLab podcast episode, “Hold On.” You can listen to it here, including the remarkably annoying “before” hold experience.

… and when to quit

Yesterday I told you about an organization that did a great job knowing where to invest in their systems.

They also did another very cool thing:

They canceled one of their fundraising programs.

Every year at their big annual gala, they have several ways for people to give. This one was a drawing of sorts.

For 50 bucks, you'd get a nice bottle of wine or spirits. Sometimes a very nice bottle, but of course you wouldn't know what you were going to get.

It was fun. And it pulled in several thousand dollars, reliably, every time.

But it had two big drawbacks:

1. Those bottles had to come from somewhere, and the simple cash value of those donations was not dramatically less than the total amount raised.

2. More importantly, it was a lot of work for their staff. Acquiring, curating, packaging, transporting and setting up. Really, a lot of work.

So this year, they're scrapping it.

Are they just going to lose those several thousand dollars this year? No, there are plenty of other giving opportunities, and gala attendees who want to help will still want to help.

What they will lose is a lot of tedious effort for their staff.

Here's the thing:

The total measurable outcome is important. Several thousand is not to be sneezed at.

But the cost is worth counting. And that cost is not always in dollars.

When the expected outcome (whether in funds raised, or in lives reached) is not much more than the expected cost, it's worth asking if there might be a better way.

All the best,
A.

They knew where to invest

A service organization that I support recently implemented a system to send their clients automated SMS reminders about upcoming counseling appointments.

The business rationale was simple and sound:

They receive some income from various sources for each completed appointment. Not so for each missed appointment, which incurs the same the costs in staff time, facilities maintenance, and the rest.

With a goal of increasing their "kept appointments" rate by mere a 6%, they knew that by reaching the goal they would more than cover the cost of the SMS reminders system.

I heard today that within just a couple of months of launching the new system, they've met and surpassed that goal.

It's a win.

And there are two simple reasons it worked:

1. They had a clear and measurable goal that aligned with both their mission (serving their clients) and their business concerns (funding the mission).

2. They knew what the next step was for their clients, and they found a way to help them take that next step.

Of course, it’s not always so easy.

When you're a service organization that provides free and low-cost counseling to children and families in distress, it may seem obvious that for many of them, the next step is to show up for counseling.

Your situation is probably different.

For the people you care about, the people with whom you're trying to build relationships in support of your mission, the next step may not be so obvious.

Maybe you haven't identified the journey that you want them to be on.

But with some careful thought, you can. For many of them, probably for most of them, there is a reasonable next step, and a reasonable set of actions you can take to guide them there.

That's the value of well-thought constituent journeys:

• If you can identify the journey, you can identify the next steps.

• If you can identify the next steps, you can find ways to help them get there.

• If you can identify those ways, then you can set goals for them that are in line with both your mission and your business concerns.

Here’s the thing:

Your people are waiting to progress in their relationship with your mission.

It's up to you show them how to do it.

All the best,
A.

Video tutorials for CiviCRM

Ever feel a little overwhelmed by some feature in CiviCRM?

If you haven't yet, you probably will. There's a lot of wonderful, complex stuff in there.

Video tutorials might help.

Sure, no off-the-shelf training program is going to tell you exactly everything you need to know in every situation.

But for getting a good understanding of the concept, and of how a set of features is intended to work, video can be a great format. It's usually much more easily absorbed than written documentation.

If you agree, you should check out CiviAcademy, a new offering from the creators of CiviCRM, which they call…

Bite-sized tutorials to help you maximize CiviCRM.

Easy to understand video tutorials that will take you from an absolute newbie to a CiviNinja in no time!

... high-level, fast-paced instruction designed for users of CiviCRM ... showcasing major features and common customizations.

I've mentioned this before, and have been excitedly awaiting its release.

Well, now it's here.

Give it a look, and consider where it might help you and your team master this robust set of CRM functionality.

All the best,
A.

“When a measure becomes a target …

... it ceases to be a good measure."

If you care about reaching your goals, this matters.

It's a common expression of what's called "Goodhart's law.”

If you know anyone with kids in public schools, you might have heard this as a common critique of standardized testing regimes and “teaching to the test.” It goes like this:

• Tests are meant as an assessment of learning.

• That assessment value is lost when teachers focus on helping kids pass the tests instead of helping them to learn the material itself.

By "teaching to the test," we've changed the goal. It's no longer "helping kids understand history." It's now, "helping kids pass history tests."

Why this matters to you:

Goals matter. Goals motivate us. Goals help us assess our progress and improve our methods.

We believe that if we do more of X, we can accomplish more of Y. Say, if we increase newsletter subscriptions, we can (somehow) stimulate more potential donors to give.

A long as we remember that increased subscrber count is not really valuable in itself, it can be one of several useful metrics in our strategy to increase donations. But on its own, it's not a meaningful target.

Indeed, is even "increased donations" a goal in itself? Even that is probably just a step on the path to your real mission of changing lives.

Here's the thing:

"Lives changed" is hard to measure. "Subscriber count" and "donation total" are easy.

The metrics are useful, and important, and worth your attention.

But only in the context of the real goal.

All the best,
A.

Reducing “bus factor” risk

A low bus factor creates risk for your mission-critical programs and projects. (Yeah, I talked about this yesterday.)

In other words, if only one person understands how your systems really work, losing that one person (say they get hit by a bus) can stop you in your tracks.

So how to increase that bus factor, and how to reduce the risk?

Some common recommendations are:

• Reducing complexity, so it's easier for people to understand the systems.

• Maintaining thorough documentation, so complex systems can be understood.

• Cross-training, so there are more people with a working knowledge of the system.

These are indeed great. I do recommend them.

But it's also worth considering where your irreplaceable "bus-factor people" are positioned in your organization.

Are they internal to the organization, people who are invested in the organization and the mission?

Or instead, are they outside the organization — external contractors and service providers — who will have any number of other concerns competing for their attention?

Which of those is riskier? Which is more likely to become unavailable, and to be unable to pass on their knowledge to a successor?

I'm pretty sure your internal staff are the safer bet here.

Here's the thing:

When you need specialized expertise, it's smart to pull in an outside expert. Often, it's your only good option.

But what's not smart is relying on that outside expert to be the only one who fully understands some critical part of your systems.

Because when you do that, you're really not in control of your own systems, however strongly you might feel that you are.

All the best,
A.