Do the Thing

Sometimes even the best ideas stumble at the finish line.

We spend so much time talking about a problem, discussing priorities, proposing solutions, and even creating Proof of Concepts that the project starts to feel done before it can make real impact. We need to have the ownership, as a team and as an individual, to make sure we’re delivering the risk reduction impact we want to have. This doesn’t happen if we stop before we deploy. One of my favorite aspects of the Shopify culture is the willingness to go fast and break things in order to move the needle quickly.

There’s a tradeoff to be had here. Go too fast without planning and we make mistakes and introduce issues that could have been prevented. Go too slow and we fail to reduce risk or to have impact for our developers. It is important to Get Shit Done without fear of failure.

The tool isn’t the impact, the remediation is the impact. If we spend a quarter developing a tool, but it doesn’t find vulnerabilities, or doesn’t protect our company then the value and impact is never realized. It doesn’t “count” until it moves the security needle and we can demonstrate that impact through data.

Sometimes it can feel like everything is an urgent priority. Teams have plenty of work to do which it makes it crucial that we choose to focus on both important and urgent projects. Once we’ve selected the right work, we can be confident that we should move quickly to deliver that value.

The Eisenhower Matrix, popularized by Stephen Covey, often attributed to Eisenhower himself, is a great mechanism to help prioritize tasks. This ranks each piece of work on two axes: Important and Urgent.

• Important and Urgent: Do it now. These are things like responding to incidents or impending risks. These trump project work, better to plug the hole in the boat than to learn to be a better sailor when you’re sinking.
• Important, not Urgent: Plan for it. These are usually bigger projects that will move the needle, think big projects that will make you and the team more efficient, or longer term incident followup items. We can’t be long term successful without these.
• Urgent, not Important: Assess it against your current work, consider if it needs to be done and tackle it appropriately.
  • Urgent tasks might come from your boss, skip, or even CEO, understand the task and have an opinionated conversation about the priority.
  • Sometimes we do things because the boss says so, this is OK, and even important, but they should be infrequent and we should always have our own opinions.
  • Finally there are tasks that are important, but aren’t important for you to do, in this case delegate.
• Neither: Delete that task with urgency.

It’s easiest to demonstrate impact through meaningful metrics. Sometimes we measure things at a point in time to show progress toward a goal (burndown charts), and sometimes we try to create durable goals that represent the health of a project, team, or goal. There are numerous books and posts discussing what makes a good metric. A good metric:

• Is easy to understand: don’t require a table of contents to interpret
• Drives the right incentives:
• Increase or decrease will always have the same interpretation: Define if we want this going up, down, or staying the same.
• Is resilient to outside events. If the metric is a ratio consider how the numerator and denominator may change.
• Is automatable, easy to measure and calculate: complex or manual processes are not durable

I love it when storytelling and metrics come together. You can do this by following this process:

1. Use your gut/intuition/judgement to find something that can be improved
2. Rank it using the Eisenhower Matrix
3. Find a metric that measures that thing
4. Come up with a plan to improve that thing. Focus on fixing the problem, not moving the metric
5. Execute your plan
6. Use the same metric when you’re done to demonstrate and measure impact

This process lets you tell the story of: I am concerned we aren’t handling this as well as we could be. This task is both important and urgent based on these things. I measure that we are currently only doing XX/ZZ things. I proposed we fix this by doing ABC. I delivered ABC and we can see we are now doing YY/ZZ things, a XX% improvement!

Ship the remediation, measure the before-and-after, demonstrate impact. That’s the story I want to tell.