1. Assess a process, not your organisation’s prestige
Operational maturity describes how consistently a team can understand its environment, make decisions and verify outcomes. It is not the number of tools purchased. An organisation can have sophisticated endpoint management while still relying on informal messages for licence ownership or employee departures.
This five-stage framework is illustrative, not a certified industry standard. Assess specific processes such as application renewal, device assignment and offboarding separately. Use recent examples, identify the evidence behind each judgement and record uncertainty. Do not average away a high-risk weakness because another process works well.
- Choose three recurring processes and involve the people who actually perform them.
- For each process, examine a normal case, an exception and an unresolved case.
- Record the current stage, operational consequence, next improvement and accountable owner.
2. Stage one: Fragmented
Information lives in disconnected tools, spreadsheets and individual memory. Staff repeatedly ask who owns an application, whether a device was returned or which employee a subscription belongs to. The immediate impact is investigation time and inconsistent decisions, not merely untidy records.
At this stage, focus on making one process visible. Create a shared inventory of the records it needs and name a person responsible for maintaining each category. Preserve unknowns instead of filling gaps with assumptions. A small reliable register is more useful than an ambitious but untrusted catalogue.
- Can someone other than the usual operator complete the process?
- Where do people look first, and how often do they find contradictory answers?
- Next step: document one handover and review the next few cases together.
3. Stage two: Documented
The team has repeatable steps, named owners and a shared understanding of required records. However, people still copy information between systems and manually check whether documents reflect reality. Procedures reduce dependence on memory, but they can become stale without an owner and a review trigger.
Select authoritative sources for specific fields rather than declaring one spreadsheet authoritative for everything. For example, HR may own employment status while IT owns device assignment. Define how discrepancies are raised and resolved, including who can approve a correction.
- Are responsibilities and exceptions written down and used in practice?
- Can you identify who last checked a record and against which source?
- Next step: connect one high-value source and test matching, missing fields and conflicting values before extending coverage.
4. Stage three: Connected
Relevant systems exchange data, and relationships between people, devices, applications and expenditure are easier to inspect. This reduces repeated lookup work, but connected does not mean complete. Missing permissions, unmatched identities and delayed updates can still produce an incomplete operational picture.
Lojycal can connect workplace records and workflows across supported systems. Provider-specific capabilities, credentials, mappings and plan or role gates determine what is available in a particular workspace. An integration path is not proof that the connection is configured or that every operation is supported.
- Can you explain each important field’s source and freshness?
- Are failed updates and unmatched records visible to an accountable person?
- Next step: define approval boundaries, exception queues and verification requirements for one connected workflow.
5. Stage four: Governed
Processes have explicit decision rights, permission boundaries, review points and evidence requirements. The team distinguishes a requested action from an approved action and a verified outcome. Exceptions have owners rather than remaining indefinitely in a shared queue.
For example, a departure process might require a confirmed employment change, review of assigned assets and provider-specific verification of supported access changes. A missing application connection remains an unresolved task, not evidence that access has been removed. Policies and collected evidence still require human review.
- Can reviewers reconstruct who decided what, using which information?
- Are role restrictions and approval responsibilities appropriate to the risk?
- Next step: monitor exception age, rework and verification failures to discover where the governed process still breaks down.
6. Stage five: Continuously improved
The team uses observed outcomes to refine processes without weakening controls. It reviews recurring exceptions, removes unnecessary handovers and tests changes within a limited scope. The objective is sustainable reliability, not automation of every decision or elimination of human judgement.
Compare similar cases over time using a defined baseline. Track task handling time separately from waiting time, error rates and unresolved work. Include investigation and correction effort so that a faster initial action does not hide downstream rework. Any improvement claim should state the sample and measurement period.
Reassess after material changes to systems, responsibilities or risk. Choose the next investment according to the most consequential weakness, not the highest attainable stage. A documented, well-owned process may be the right immediate target before adding further connections.
- Are changes supported by measured outcomes rather than impressions?
- Next step: assign one improvement experiment, an owner and a review point, then retain or revise it based on evidence.