This grew out of my thinking about the proper place for Security
and IT in organisations and my disatisfaction with the current fad of
outsourcing, that didn't seem to have any logic to it.

Well, I believe an organisation, in reality, only has three
layers:

• 
  

  The Core

  
  
• 
  

  The Capabilities and Resources

  
  
• The Service Functions

So what do I see as the difference between these? The Core is what
is the exclusive parts of the organisation, i.e. the parts that can't
be outsourced, nor can they be absent in any way, as there wouldn't
be any organisation if they were absent (of course, smaller
organisations may have both the strategy and marketing part in one
person, usually called the owner, but they are always present).

The Strategy creates the reason for the organisation to exist and
decides what the reasons for its continued existance are dependent
on. As a side effect of this, it also defines the culture that is
prevalent in the organisation and is responsible for handling the
stakeholders and their (maybe) conflicting interests.

The Marketing defines what customers to go after and with what
tools (price, market coverage, distribution, sales force, etc) and
with what kind of products (today and in the future). Also
responsible for the communication of the organisation, both to
internal and external parties.

These two combined creates the Core:

The next part is the parts of the organisation that are essential,
but doesn't really need to be an integral part of the organisation
(as can be seen on the current outsourcing trend) but that most Core
members want to have control over to ensure the smooth functioning
and the capability of making fast changes (in theory at least).

Finance may seem to be the most entrenched C&R as it is
normally demanded of regulatory parties (like the IRS, the SEC,
etc.), but it usually not mentioned that it must be executed by
employees (in fact, a number of smaller companies uses
accounting/auditing third-parties and subsidaries to larger
organisations are usually handled by the parent organisations finance
function). What may be seen as hard to outsource is the controlling
and the RM functions, but as many organisations can't even agree on
what controlling means/entails and very few have explicit RM
functions, I see this as mostly an academic discussion (especially as
auditing is done by third-parties and you can find RM companies that
can probably do a better job than inhouse staff). Of course, this is
usually never outsourced in larger organisations due to the need to
have total control of the financial situation by the Core members
(and the lack of status if it is not done inhouse), even though it
easily could be done.

The Operations C&R is one of the most versatile and
all-encompassing parts of the organisation, as it is usually
different between organisations. A Telecom company sees the
maintenance of the network and billing systems as part of operations,
while a Law firm sees the case handling and legal research as
operations or a Manufacturer usually sees manufacting, logistics, and
procurement (aka supply chain) as Operations. All of them usually
sees back-end support as being part of operations (and some also see
the customer-facing support as part of operations, even though I
personally sees that as Marketing). In short, Operations is usually
seen as as core parts of the organisation, but as can be seen by the
many telecom and computer companies (and also many traditional
manufacturers) it is very easy to outsource Operations to other
companies (even to other countries) as long as the Core remains
intact within the organisation.

IT is another part that is a C&R within the organisation, as
most organisations can't function without IT support (as can also,
silly enough, be seen in the number of CIOs in management teams).
Interestingly enough, it is currently a trend to outsource the IT
function, which also means that it is very hard to control what
happens with it and that the appropriate support exists to make it a
valuable C&R for the organisation. This is of course true of all
outsourcing (which is usually done by refering to “economics of
scale” and “cost cutting”) but as it is usually done by
management that by outsourcing its own capabilities only shows that
they no longer can control the outsourced function, it seldom lasts
very long, until the one or two changes in management makes it
insourced (at great expense for the organisation) again.

Human Resources (HR) is the last, and most neglected, C&R of
organisations (in fact, many SMEs don't even have HR functions and
some larger organisations even calls their payroll people for HR).As
payroll and benefits handling (like accounting) easily can be
outsourced and staff handling easily (as in can be easily done, but
is usually a very bad idea) can be handed off to the
middle-management to handle as well as giving staffing planning to
the functional or divisional managers to control (which usually means
they have to hire HR staff anyway). In my view, HR can be a great
tool (especially marketing wise) and correctly used, a great C&R.

This will give us a Core, surrounded by the C&Rs:

If we then continue down to the Service level functions of
organisations, we immediately find controversy, dependant of the
organisation and its environment. Nevertheless, I have decided to
utilise three distinct (or indistinct, dependent on your viewpoint)
parts as representatives. As an interesting side-note, both of
Sveiby's and Edvinsson's KM models state clearly that service
functions has no value (not even a KM value) to any organisation.
Please state that the next time you have a temp in the reception that
just have insulted your VIP guest...

The first is of course the Legal service, as most organisations in
any part of the world seldom find that they can live without legal
counsel (for criminal, trade, tax, contract, civil, etc, issues).
Also, some kind of legal authority is nearly always necessary for the
creation and reporting of the organisation as well as its compliance
to laws and regulations. Even though this is nearly indispensable for
any organisation, many choose to use outside counsel, either by
retainer agreements with law firms, usage of parent organisations
legal departments or by utilising ad-hoc lawyers (usual inSMEs, due
to the high costs involved). Nearly no-one (except affected legal
staff or law firms) sees this as a core part in any organisation. In
the organisations where it is used efficiently, it is usually seen as
a great service to the other parts of the organisation, and therefore
I have decided to classify it as Service function.

Where would any organisation be without the little people, or the
so-called support Infrastructure (like restaurants, receptions,
janitors, the staff that buys furniture and sees to it that the
leasing car contracts are renewed, that the photocopier has paper,
that the mail is delivered, etc.). This is the invisible part of any
organisation, and even though they are usually partly outsourced
functions (like janitors or restaurants) and partly inhouse staff.
These are the service functions that ensure that the organisation can
continue to function and concentrate on their special (usually
functional) knowledge. Sadly, a very under-rated but vital service
function in any organisation, as they usually are paid very low
salaries, which is a bit surprising, as they usually has access
everywhere.

And then we come to the Security services, which is a very strange
hybrid, as it encompasses low-paid guards to highly-paid IT-security
specialists, who all are supposed to be a minimal cost, low-impact
services that defends the organisation against all known and unknown
threats to tangible and intangible assets, usually without the assets
being defined, nor their value (if this sounds silly, it is only
because it is silly, but unfortunately true for most organisations).

This gives us the following picture of the organisation:

Below, you will find some very incomplete descriptions of what
each functions contains. I make no claim of it being all
encompassing, but I think it is a reasonable structure of most
organisations.

Strategy

• 
  

  Mission

  
  
• 
  

  Vision

  
  
• 
  

  Culture

  
  
• 
  

  Positioning

  
  
• 
  

  Stakeholder Handling

  
  

Marketing

• 
  

  Segmentation

  
  
• 
  

  Sales

  
  
• 
  

  Promotion

  
  
• 
  

  Pricing

  
  
• 
  

  Research & Development

  
  
• 
  

  Customer Support

  
  
• 
  

  Distribution

  
  
• 
  

  Communication

  
  

Finance (Resource and Capability)

• 
  

  Accounting

  
  
• 
  

  Treasury

  
  
• 
  

  Finance

  
  
• 
  

  Controlling

  
  
• 
  

  Risk Management

  
  
• 
  

  Taxes

  
  

Operations (Resource and Capability)

• 
  

  Manufacturing

  
  
• 
  

  Logistics

  
  
• 
  

  Back-end services/support

  
  
• 
  

  Procurement

  
  

IT (Resourse and Capability)

• 
  

  Desktops

  
  
• 
  

  Servers

  
  
• 
  

  Systems

  
  
• 
  

  Networks

  
  

Human Resources (Resource and Capability)

• 
  

  Staffing

  
  
• 
  

  Benefits

  
  
• 
  

  Personell Handling

  
  
• 
  

  Payroll

  
  
• 
  

  Training

  
  

Legal Services

• 
  

  Company Secretary

  
  
• 
  

  Legal Counsel

  
  
• 
  

  Contract Handling

  
  
• 
  

  Compliance

  
  

Infrastructure Services

• 
  

  Reception

  
  
• 
  

  Janitors

  
  
• 
  

  Internal Services (restaurants, etc)

  
  
• 
  

  Furniture, cars, etc.

  
  

Security Services

• 
  

  IT Security

  
  
• 
  

  Information Security

  
  
• 
  

  Physical Security

  
  
• 
  

  Safety

  
  
• 
  

  Contingency Planning