You work in a small office that's part of a big organization, and the experts at Headquarters just issued a new regulation. Everyone has to comply. You don't have the budget to implement the whole thing, but you could do half of it with no trouble. Should you do that half, just to show good faith? Isn't half a loaf better than none?
Not so fast. It all depends.
Of course sometimes that's the right thing to do. Implement Part One now, and make a plan to implement Part Two next year when you can afford it. Communicate with the people at Headquarters so everyone understands the situation, and make incremental progress.
But evaluate every situation on its own. Sometimes implementing half a loaf will undermine you, and you would do better to wait till you can do the whole thing at once.
I was in exactly this situation once, years ago. I was working for a small, entrepreneurial startup that had just been acquired by a global company. The global company had a lot of systems and regulations that we had to learn in a hurry.
One bundle of regulations addressed security. Every office and every plant worldwide—except ours—issued employee badges. Those badges let you into the building at your site. If there were restricted areas at your site, your badge could be fine-tuned to let you into exactly the areas you were allowed to access. If you went to work in a new location, your badge could be reprogrammed to open the doors at the new location instead. It was a complex, interconnected system.
We had none of that.
And right away, visitors started to comment.
"What, no badges? How can you work for Big Company without badges?"
"Gosh, the next time I need a new printer I'll just fly out here and take one from your office since your security is so lax."
"Does Headquarters know that you guys don't have badges?"
Someone in my department decided we should do something right away. She started scheduling appointments for everyone in our office to have a picture taken, and ordered a box of badge blanks. She was halfway through taking all the pictures before I had a chance to sit down with her and ask what she was thinking.
"Well everyone keeps saying we need badges. I figured I could make badges, and then our guests would be happy."
"But badges are just part of the picture," I reminded her. "What about the electronic keys and the huge IT infrastructure that links us into the rest of Big Company worldwide? Where is the budget for that going to come from, and who is going to implement it?"
"I thought we could do that later."
That was the key. She figured half a loaf is better than none, and in a different case she might have been right. But in this specific case, it didn't work, and couldn't possibly work.
I told her, "Think a minute. Suppose it is the day after you issue badges to everyone, and explain they are mandatory. How are you going to enforce them?"
"What?"
"Say that Frank forgets his badge at home. But he can still get into the building, right? Because the badge isn't an electronic key, so it isn't hooked into the security system. Did you think we were going to hire guards to stand at the door and stop people without badges?"
"No."
"That's right. There's no budget for that. Only then what happens is that everyone realizes the rule about wearing badges has no teeth. They can openly ignore it, with no consequences. And then the next time we have to implement a new rule from Big Company, it'll be twice as hard."
"So what do you want me to do? Should I run around the building every day to check that people have their badges on?"
"No. What I want is for us to wait and do nothing until we can afford to implement the whole package all at once."
That's what we did, and it took a couple of years until the electronic entry system became a high enough priority for our management to pay for it. In the meantime, Big Company understood that we were non-compliant with that specific set of security requirements, and treated the situation as a known risk to be managed. Mostly it didn't take a lot of attention, and we all went about our business just fine. When the day finally came, we did everything at once; we were fully integrated into Big Company's IT infrastructure; and, yes, we got our badges.
Every case is different. There is no substitute for thinking through all the details to understand what happens if you take this option or that one. But sometimes it is simpler just to be noncompliant—fully above-board, so that you are known to be non-compliant—than to get tangled in the complexities of trying to do something halfway.









