The GRC Blog

Travel Cooking Kits and My Personal Lesson in Research and Decision-Making

Let me share a personal story about the time I designed eco-friendly travel cooking kits–only to have potential customers think they were trendy tampons.

During my time as a cybersecurity consultant, I spent weeks traveling across the country for client projects. Back-to-back trips would wreak havoc on my eating habits. Rather than relying on room service or restaurant meals, I found myself gravitating toward AirBnBs for kitchen access, but it was difficult to find basic cooking supplies like olive oil, herbs, and spices in a size that made sense for just a few days worth of meals.

So, I decided to create a solution. I designed a compact, eco-friendly travel kit  that held small, individual packets of seasonings–olive oil, salt, paprika, black pepper–ideal for travelers who prefer to cook. I thought that since I was part of the target demographic that had a need for this product, and it was something I would pick up off the shelf and purchase if I was grocery shopping on the road, that many others would think the same. Market research told a different story.

Marketing Fail: Spicy Tampons?

We ran a digital marketing campaign on Facebook for the product in order to gauge interest and get metrics on which demographics might be the most likely to purchase. It did not take long for comments to start rolling in.

“Are these spicy tampons?”

“You can tell this company has no women on their marketing team.”

It was clear that my product design was sending the wrong message. Every day, multiple times a day, I was getting comments asking whether my travel-sized seasoning kits were spicy tampons. Not only that, but the data generated by the campaign was starting to tell a different story about who was engaging with the product in a positive way. It wasn’t business travelers that were most interested, but people who loved to cook while they were camping or hiking and needed a lightweight way to carry cooking supplies on the go.

Bias in Business Decisions

Reflecting on my product’s failure, I came across a Harvard Business Review article, Why Good Leaders Make Bad Decisions. As neither a camper nor a person who purchases tampons on a regular basis, the possibility that my product might appeal more to people hiking than health conscious consultants and be mistaken for a menstrual product just wasn’t on my brain’s “bingo card”. Furthermore, I’d fallen in love with the design of my product and thought it was one of the coolest aspects about it. My emotional attachment to what I’d created, along with my own personal experiences (or lack thereof) had made me biased towards decisions that reinforced my own beliefs and memories. In order to make a better decision after the market research campaign concluded, I was going to have to take the unbiased conversations I was having in the Facebook comment section and use the hard data the campaign was providing me to adjust my strategy.

Of course, my story is something that happens every day in the business world. Executives use analytics across various functions throughout the business to make better strategic decisions. There are many good reasons why this is done, but the authors of Why Good Leaders Make Bad Decisions call out a good one:

“For important decisions, we need a deliberate, structured way to identify likely sources of bias—those red flag conditions—and we need to strengthen the group decision-making process.

The simple answer is to involve someone else—someone who has no inappropriate attachments or self-interest. This could be Rita’s boss, the head of human resources, a headhunter, or a trusted colleague. That person could challenge her thinking, force her to review her logic, encourage her to consider options, and possibly even champion a solution she would find uncomfortable.”

How GRC Teams Influence Strategic Decision-Making

It’s common for GRC teams to spend more time influencing business decisions than actually making them. The disagreements and tense conversations that may result from this can often be seen as a negative thing, or something that needs to be fixed. In many situations, however, these conversations are critical for supporting better strategic security decision-making.

GRC teams bring a detached view when evaluating security decisions, allowing for more objective assessments.

Whether it’s through an internal audit function, or a third party audit, there is value in getting an outside perspective on how controls are implemented within an environment. Even having another person ask questions who hasn’t been involved in the implementation or design of a control and provide another opinion can be used to test the strength of an idea or concept.

Embracing disagreements can encourage more confident decision making.

Have you ever gotten into a debate with someone and left the conversation with even more points that support why you were right in the first place? Disagreements can be healthy, and either provide additional perspectives that need to be taken into consideration when making a final decision or provide the confidence needed to move forward. This is especially relevant when making decisions related to preparing for an audit or determining the best way to remediate identified risks.

The processes that are developed as part of a GRC program supports more structured decision-making.

Through policies, risk assessments, and control documentation, GRC programs provide natural stage gates to support decision-making processes. The structure that comes with integrating GRC processes into the operations of the broader information security team creates a natural set of safeguards to hold up a magnifying glass to decisions that are either being made or have been made in the past.

GRC teams can be utilized to both collect and analyze data that supports strategic decision making.

Data is critical to making strategic decisions, and although you’re bound to collect a lot of it in every corner of an information security program, GRC teams are instrumental in gathering and analyzing data to provide strategic insights that help businesses make more informed decisions.

Final Thoughts

Just as I had to adjust my marketing strategy based on unbiased feedback and data, organizations must utilize their GRC teams to avoid bias and support strategic decision-making. Whether you’re developing a product or evaluating security controls, getting an outside perspective can lead to better outcomes.

How have your GRC teams helped support better strategic decision making in your organization?