E3: Digital strategy

Answer: D. This contrast illustrates a key insight about data as a strategic resource: simply possessing data does not itself confer advantage — the advantage arises from the organisational capability to extract insight from it and translate that insight into strategic action, such as personalisation, demand forecasting, and dynamic pricing. The retailer has the raw data but has not developed the analytical and operational capability to exploit it strategically, which is precisely the gap the competitor has closed. This directly contradicts the idea that possessing data alone guarantees equivalent advantage regardless of use — the scenario is a direct counter-example, since both companies apparently have similar underlying data. Basic sales reporting is not inherently superior to sophisticated analytical use — if anything, the scenario suggests the opposite, given the competitor's demonstrated strategic advantage. Data-driven analytical capability is a well-recognised potential source of sustainable competitive advantage in current strategic management thinking, particularly where it is difficult for rivals to replicate quickly.

Answer: A. Framing cybersecurity purely as a technical, IT-department matter understates its true nature: a significant cyber incident can inflict strategic-level damage — reputational harm affecting customer trust, regulatory penalties, operational disruption to core business processes, and erosion of stakeholder confidence — consequences that extend well beyond the technical domain and squarely into matters the board is responsible for overseeing as part of its strategic and risk governance duties. Treating cyber risk as having no strategic consequence contradicts the well-documented pattern of major cyber incidents causing lasting reputational and financial damage across many organisations. Adequate technical staffing and budget address the operational and preventive dimension of cyber risk but do not substitute for board-level oversight of the strategic implications and governance response should an incident occur. Cyber risk affects organisations across virtually all sectors that rely on digital systems and data, not solely technology companies, given how pervasive digital dependency has become.

Answer: B. Adopting technology primarily because competitors have done so, without first clarifying the specific strategic problem it is meant to solve, risks substantial wasted investment — the technology may not fit the organisation's actual needs, existing capabilities, data readiness, or customer requirements, and may simply replicate a competitor's approach without delivering an equivalent benefit given differences in context. This directly contradicts the assumption that imitative adoption automatically guarantees an equivalent competitive benefit — benefit depends on how well the technology is matched to the organisation's own specific strategic needs and its capability to exploit it, not merely on possessing the same tool as a rival. Good practice generally holds that strategic purpose should shape technology selection, not the reverse — technology should be chosen to serve a clearly identified strategic need, rather than strategy being retrofitted around whatever technology has been adopted. Keeping pace with competitors can be one relevant consideration, but it is not sufficient justification on its own without a clear strategic rationale specific to the adopting organisation.

Answer: C. A comprehensive approach to digital workforce transformation spans multiple interconnected actions: attracting and retaining digital talent (which the narrow initiative partially addresses), but also upskilling and reskilling the existing workforce, evolving leadership approaches and organisational culture to support digital ways of working, and enabling flexible labour models — a handful of senior technical hires alone addresses only one narrow slice of this fuller picture and leaves the broader organisational transformation largely untouched. Relying on recruitment alone risks creating pockets of technical expertise that remain isolated from a broader culture and leadership context that has not itself evolved to support digital ways of working, limiting the transformation's real impact. Digital transformation clearly does have a substantial and central people dimension, not merely a technology-purchasing dimension, contrary to the third option. Existing staff represent a large proportion of organisational capability and are a critical, not irrelevant, part of building genuine digital capability at scale, since new hires alone typically cannot transform an entire organisation's ways of working.

Answer: D. Effective digital transformation planning requires automation initiatives to be planned alongside a clear redesign of roles and responsibilities — deliberately identifying and directing freed staff capacity towards higher-value activities such as analysis, business partnering, or strategic support — rather than assuming this reallocation will happen automatically or by default. Automation typically reduces the volume of routine transactional work rather than eliminating the need for staff altogether, particularly where the freed capacity can be redirected to work requiring judgement, analysis and human interaction that automation cannot yet replicate — so role redesign remains necessary, not unnecessary. The scenario explicitly shows that capacity was not redirected efficiently without deliberate intervention — confusion and underutilisation resulted precisely because no redesign occurred, directly contradicting an assumption of automatic self-organisation. Evaluating automation purely on technical efficiency, while ignoring its workforce implications, is exactly the narrow framing that produced the confusion and underutilisation described in the scenario.

Answer: A. The central strategic consideration is whether the proposed data use aligns with customer expectations, complies with applicable data protection law (such as GDPR-type regimes), and manages the significant reputational and trust risks that arise from using data in ways customers did not reasonably anticipate based on the stated privacy policy — data ethics and privacy are strategic governance matters with real consequences for brand trust and legal exposure, not merely a technical or operational question. Technical feasibility establishes what is possible, not what is appropriate or permissible — many technically feasible uses of data would be inappropriate, illegal, or damaging to trust if pursued without regard to these broader considerations. Cost is not the primary or sole relevant consideration when customer trust, legal compliance and reputational risk are at stake. Competitor behaviour does not establish that a practice is legally compliant or ethically appropriate — matching a competitor's approach provides no defence against legal or reputational consequences if the underlying practice itself is problematic.

Answer: B. A digital maturity assessment establishes a realistic picture of the organisation's current starting point — its existing capabilities and specific gaps across people (skills, culture, leadership), processes (how work currently gets done), and technology (current systems and infrastructure) — which allows a transformation programme to be scoped and sequenced appropriately, rather than assuming a generic starting point that may not reflect the organisation's actual readiness. Organisations differ substantially in their starting capability, culture and existing technology investments, so assuming an identical baseline across all organisations would risk designing a transformation programme poorly matched to the specific gaps that actually need to be closed. Digital maturity assessments typically evaluate all three dimensions — people, process and technology — together, since digital transformation success depends on progress across all three, not technology infrastructure in isolation. Proceeding directly to the most advanced technology without first assessing organisational readiness risks exactly the kind of adoption-without-fit problem seen when technology outpaces the organisation's actual capability to use it effectively.

Answer: C. This scenario demonstrates that cyber risk extends beyond an organisation's own internal controls to encompass its extended digital ecosystem — suppliers, partners and any third party with system access represent a potential attack vector, since an interconnected digital environment is only as secure as its weakest connected link. Effective strategic risk management therefore requires due diligence on third-party security practices before granting access, along with ongoing monitoring and contractual security requirements, not merely a focus on internal controls alone. The scenario is a direct counter-example to the claim that third parties introduce no risk — the breach originated precisely through such a connection. Strong internal controls do not guarantee complete protection when a connected third party provides an alternative route into the organisation's systems, undermining the idea that internal controls alone are automatically sufficient. While contractual and legal liability questions may exist between the parties, the company that suffered the breach still bears real strategic, reputational and regulatory consequences regardless of where legal responsibility for the underlying weakness ultimately sits.

Answer: D. This scenario illustrates the importance of defining clear, measurable objectives and success criteria for digital initiatives from the outset — a vague aspiration such as 'becoming more digital' provides no basis for meaningful evaluation, which is precisely the difficulty the board now faces two years and a substantial investment later. Digital initiatives, like any other strategic investment, can and should be evaluated for the value delivered, whether through direct financial metrics, customer or operational KPIs, or other measures appropriate to the specific initiative's stated objectives — the claim that they are inherently unmeasurable is a common excuse rather than an accurate description, and one this scenario is designed to illustrate the cost of accepting. A vague goal is not equally effective as a specific, measurable one precisely because it cannot support the kind of evaluation the board is now unable to perform. Digital transformation programmes are not exempt from ordinary strategic control principles — objective-setting, monitoring and evaluation apply to digital investments just as they do to any other significant strategic commitment of organisational resources.

Answer: C. Developing new value-added services — aggregation across multiple manufacturers, logistics, or localised support — that a single manufacturer's own direct platform cannot easily replicate gives the distributor a basis to remain relevant even as direct-to-consumer channels grow, repositioning rather than simply competing head-on. Cutting prices to match a manufacturer's direct pricing addresses only one dimension of competition and ignores that the distributor may still have genuine service-based advantages worth developing instead of, or alongside, price; competing purely on price against a manufacturer that has removed a layer of margin is also a structurally difficult position to sustain. Lobbying for regulatory restriction is a slow, uncertain and largely reactive strategy that does nothing to strengthen the distributor's own value proposition in the meantime, and is not guaranteed to succeed. Acquiring a manufacturer is one possible strategic option in principle, but treating it as the only viable response, regardless of cost or fit, ignores the more direct and typically lower-risk option of repositioning around genuinely valued services.

Answer: D. A proportionate, risk-based governance approach — lighter-touch review for low-risk experiments, more rigorous oversight where sensitive data or critical systems are involved — allows an organisation to move quickly on lower-stakes initiatives while still protecting itself against the kind of failures that motivated the concern in the first place, rather than treating speed and governance as a strict trade-off. Prioritising speed purely because an initiative has a senior sponsor ignores the initiative's actual risk profile, which is what should drive the level of oversight applied, not the seniority of whoever is backing it. Applying uniform, maximum governance rigour to every initiative regardless of its risk profile would slow down genuinely low-risk experimentation unnecessarily, which is itself a poor outcome, not a safe default. Outsourcing digital initiatives to third-party vendors does not eliminate governance responsibility — the organisation remains accountable for outcomes (including data breaches or compliance failures) even where a vendor performs the underlying work, so this does not resolve the underlying tension at all.

Answer: A. Leadership suited to the pace and uncertainty of digital environments typically requires comfort with ambiguity, a willingness to experiment and iterate rapidly based on emerging evidence, and the ability to make reasonable decisions with incomplete information — since waiting for complete certainty in a fast-changing digital context often means missing the window in which a decision would have been valuable. Insisting on exhaustive information and complete certainty before deciding is often poorly suited to the pace of digital change, where conditions evolve faster than a fully certain picture can typically be assembled. Rigid, uniformly hierarchical decision-making for every digital initiative regardless of scale can slow response times in ways that are particularly costly in fast-moving digital contexts, where smaller or lower-risk decisions often benefit from faster, more distributed decision-making. Appropriately delegating decision-making authority to teams closer to fast-moving digital initiatives — rather than avoiding delegation altogether — is generally considered a hallmark of effective digital-age leadership, since central leadership often cannot process every fast-moving decision at the pace required.

Answer: B. Deploying an algorithm whose decisions cannot be adequately explained creates real and material risks: regulatory risk (many jurisdictions increasingly require explainability for automated decisions with significant effects on individuals, such as credit decisions), reputational risk (customers denied credit with no clear explanation may reasonably feel unfairly treated), and fairness risk (an unexplainable model could be encoding biased patterns that go undetected without the ability to interrogate its logic) — meaning organisations deploying such systems need governance mechanisms specifically addressing explainability, auditability and the ability to challenge or review automated decisions. The assumption that algorithms are inherently objective and therefore need no explanation or oversight is a significant and well-documented misconception — algorithms can encode and perpetuate bias present in their training data or design, which is precisely why explainability and oversight matter. This is a strategic and governance matter with real consequences for regulatory compliance, customer trust and organisational reputation, not merely a narrow technical IT concern to be resolved without board-level attention. Regulatory and customer expectations regarding explanation of automated decisions affecting individuals have become an active and growing compliance concern in many jurisdictions, directly contradicting a claim that no such entitlement or concern exists.

Answer: C. This scenario illustrates vendor or technology lock-in risk — where deep embedding of a proprietary platform across core operations creates high switching costs that leave the organisation with limited practical alternatives even when the original vendor's terms deteriorate, effectively reducing the company's negotiating leverage and strategic flexibility over time. Evaluating switching costs, data portability provisions, and clear exit terms before committing to a platform — rather than only after the relationship has become deeply embedded — can help preserve future flexibility and negotiating leverage, reducing the risk of becoming captive to a single vendor's future pricing and service decisions. Cloud platform adoption is not inherently strategically risk-free — lock-in is a well-documented and material risk specifically associated with deep, proprietary technology dependence, directly contradicting a claim of no risk. Lock-in risk affects organisations of essentially any size that become deeply dependent on a specific vendor's proprietary technology, not smaller companies exclusively — large organisations with substantial technical resources have also experienced significant lock-in problems in practice. Expecting complete foresight of every future price or service change at the time of the original decision sets an unrealistic standard — the more realistic and actionable lesson is to build in safeguards (switching cost awareness, portability, exit terms) precisely because complete future certainty is not achievable.

Answer: D. This scenario directly illustrates that compensation alone is often insufficient to win the competition for scarce digital talent — where salaries are similar across competing employers, other elements of the value proposition, such as flexible working culture and genuine opportunities for skills development and career growth, can become decisive differentiators in candidates' actual choices, which is precisely what the scenario describes happening to this company's detriment. The scenario is a direct counter-example to the idea that salary is always the single decisive factor — candidates are shown choosing competitors despite similar pay, specifically because of culture and development factors, which the company is currently failing to match. Since salaries are described as already similar, the company's priority based on this evidence should focus on culture and development opportunities, not necessarily on raising compensation further, which the scenario does not indicate would address the actual gap identified. Talent shortages in competitive digital labour markets are closely linked to the broader employee value proposition — working culture, flexibility and development opportunities — not to pay alone, directly contradicting a claim of no relationship.

Answer: A. This scenario illustrates that legacy technology constraints can materially limit an organisation's practical strategic agility — even a well-conceived, decisively championed strategic response to a new opportunity can be significantly slowed or constrained if the underlying systems needed to implement it are costly and slow to modify, which is precisely why technology modernisation is increasingly treated by many organisations as a strategic priority in its own right, deserving board-level attention, rather than being relegated to a purely operational or back-office IT concern disconnected from strategic decision-making. The claim that legacy systems never affect strategic opportunity pursuit directly contradicts the scenario, which explicitly shows exactly this constraint playing out. Strategic agility depends on both leadership decisiveness and the practical capability to implement decisions quickly, including the underlying technology infrastructure — the scenario demonstrates that decisiveness alone cannot overcome a genuine infrastructure constraint. Abandoning the opportunity altogether is a disproportionate response when phased modernisation, workarounds, or targeted new-system builds alongside legacy infrastructure may allow at least partial or gradually improving pursuit of the opportunity, rather than requiring complete abandonment as the only option.

Answer: B. This scenario illustrates a genuine digital resilience and business continuity gap: heavy operational dependence on a small number of digital systems, combined with the absence of a developed and tested plan for maintaining critical functions if those systems become unavailable, leaves the organisation significantly exposed to severe operational disruption in the event of a cyber incident, technical failure, or major outage — precisely the kind of event that a well-designed and tested continuity plan is meant to prepare an organisation to withstand. No system, however well-maintained, can be assumed to be permanently available and immune to disruption — outages, cyber incidents and technical failures are recognised, realistic risks for any organisation with significant digital dependence, not a purely theoretical concern. Business continuity planning is relevant across virtually all sectors that depend on digital systems for core operations, not limited to financial services, given how broadly digital dependence has spread across industries. A documented but untested plan carries real residual risk, since gaps, outdated assumptions, or unworkable procedures often only surface when a plan is actually exercised — testing is a critical, not optional, component of genuine continuity preparedness.

Answer: B. This decision typically involves a genuine trade-off: centralising digital decision-making at group level can improve consistency across the organisation, capture economies of scale in technology investment and procurement, and support more coherent group-wide risk and security control, while decentralising decision-making to individual business units can improve responsiveness to each unit's specific needs, local market context and differing levels of digital maturity — the appropriate balance typically depends on the organisation's specific context, including just how varied the different units' actual needs and maturity levels genuinely are. Claiming no meaningful trade-off exists, and that full centralisation and full decentralisation always produce identical outcomes, ignores the substantial and well-documented differences in outcomes these two approaches tend to produce in practice. Neither a blanket rule of always fully centralising, nor always fully decentralising, adequately reflects the genuine contextual trade-offs involved — most organisations in practice adopt some considered balance between the two rather than an extreme position at either end, calibrated to their specific circumstances.

Answer: A. Introducing a capable digital tool alone is often insufficient — genuine adoption typically also requires building manager trust in and understanding of the tool, along with cultural and process changes that meaningfully embed its use in actual decision-making practice, which is exactly what appears to be missing in this scenario. Framing adoption as depending mainly on technical sophistication overlooks the scenario's own detail — the tool is described as capable, yet managers still are not genuinely engaging with its outputs, showing that technical quality alone did not drive adoption. Managers combining their own judgement with a tool's recommendations is not, by itself, evidence of misuse; thoughtful judgement alongside data-driven input is often exactly what good decision-making looks like — the problem described is managers ignoring or only superficially engaging with the tool, not managers exercising judgement alongside it. Concluding the tool provides no benefit at all overstates the scenario, which illustrates a gap in adoption and embedding, not evidence that the tool itself, if genuinely adopted, could provide no value.

Answer: B. Good strategic governance practice during a live cyber incident with conflicting initial information suggests the board should aim for a proportionate, carefully coordinated response — balancing genuine stakeholder and regulatory expectations for timely transparency against the real risk of communicating inaccurate or incomplete information before the facts are reasonably well established, which could itself cause confusion, reputational harm, or the need for embarrassing subsequent correction. Immediately issuing a detailed public statement based on unverified, conflicting initial information risks exactly this kind of error, potentially compounding the incident's reputational impact if key facts later prove different from the initial statement. Refusing to communicate at all until the incident is completely and fully resolved ignores genuine stakeholder, customer and often regulatory expectations for timely, appropriately measured updates during an ongoing incident, which can itself damage trust and, in many jurisdictions, may also risk regulatory non-compliance with breach notification requirements. Given the strategic, reputational and often regulatory significance of a major cyber incident affecting customer data, board-level oversight and involvement in the response — including communications strategy — is generally considered appropriate governance practice, not a matter to be delegated entirely to operational IT without any board-level engagement.

Answer: C. This choice illustrates a genuine and commonly faced strategic trade-off: adopting an open industry standard can support easier interoperability with partners and competitors, participation in industry-wide network effects, and potentially faster ecosystem-wide adoption, while a proprietary standard offers the company greater control over its own technology direction and the potential for meaningful differentiation, but risks isolating the company from broader industry connectivity and imposing higher integration costs or friction on partners and customers who need to work with a non-standard system. Claiming no meaningful trade-off exists ignores these genuinely different strategic consequences that open versus proprietary approaches tend to produce in practice, well documented across various technology-standard battles in different industries. Neither a blanket preference for proprietary standards in every situation, nor a blanket preference for open standards in every situation, adequately reflects the genuine context-dependent trade-offs involved — the right choice depends on factors such as the value of interoperability in the specific industry, the company's relative market power, and how much genuine differentiation value the proprietary approach could realistically capture and sustain in that particular competitive context.

Answer: B. Starting with a smaller, well-chosen pilot where early success is genuinely achievable and visible can build organisational confidence in the broader transformation effort, generate practical learning and lessons that can be applied to subsequent, larger-scale phases, and create momentum and internal buy-in — including from initially sceptical stakeholders who may be more easily persuaded by a demonstrated early success than by an untested, larger promise — that supports the more challenging and complex phases of transformation still to come. While sequencing can sometimes take longer to reach full, organisation-wide coverage than a single simultaneous programme in principle, it frequently offers real advantages in terms of reduced risk, organisational learning, and genuine buy-in that can improve the overall likelihood of ultimate success — the claim of no advantage whatsoever ignores these well-recognised benefits of a staged approach. A single, all-encompassing simultaneous transformation is not always more reliable — large-scale, simultaneous programmes attempted without prior learning or organisational buy-in have a well-documented history of significant failure risk, precisely the risk that a staged, sequenced approach is designed to help mitigate. Sequencing and pilot testing are commonly and effectively used by organisations of many different sizes, including large and complex ones, where the scale and complexity involved often make a staged approach even more valuable, not less, than in a smaller organisation.