Digital transformation starts behind the website. A rebuilt storefront is the part of a programme a customer can see, and it is the part most easily funded. This piece is about small firms in the Caribbean that sell through their own websites and take card payments there. Calling that work a digital transformation matters, because a business that believes it has already transformed stops spending on the parts it never touched.
A digital strategist with a wide following in Trinidad and Tobago published a column presenting one small company's website rebuild as a digital transformation. What follows is my reading of the project as that column described it.
What the column described
The scope, as I read it, covered the storefront and the tools sitting immediately around it. The work itself was real. The pieces were these.
- A WordPress and WooCommerce storefront, replacing the previous site
- New hosting for it
- An online payment gateway connected to the checkout
- A local delivery service wired into the same checkout
- A CRM, used to send newsletters
- Analytics and search tooling
- Training so staff could publish their own content
One result was reported: a page-speed score, which measures how quickly the site's web pages load in a browser. It says nothing about orders won, hours saved, or work the company now does differently. A score like that is a build check, and build checks belong in the handover document rather than in the results column.
What digital transformation means
MIT Sloan Management Review defines digital transformation as the use of technology to radically improve the performance or reach of an enterprise, across customer relationships, internal processes and value propositions. The framework behind that definition was built from interviews with 157 executives at 50 large companies in 15 countries. It places the change in three areas: customer experience, operational processes and business models.
Two of those three areas sit where no customer looks. The same research reports that no company in its sample had fully transformed all nine elements of the framework. It also reports that digital activity on its own does not deliver. The firms that pull ahead are the ones that pair that activity with strong leadership, and the more mature ones outperform the rest.
Where the rebuild stops short
As the column describes it, the core of that business was untouched. Project work, estimating, scheduling and service contracts ran the way they ran before. Those are operational processes, one of the three areas the MIT framework counts. A storefront in front of unchanged estimating and scheduling alters what a buyer sees at the start and leaves what happens after the order exactly where it was.
The integrations, on the same reading, stop at the website. The payment gateway talks to the checkout, the delivery service talks to the checkout, and the checkout talks to nothing behind it. Orders do not reach accounting. Stock levels are not shared. The CRM, a system for managing customer relationships across their whole life with the company, is being run as a mailing list.
No business outcome was measured. Not revenue through the new channel, not order handling time, not repeat purchase rate, not cost to serve. Without a baseline taken before the build, none of those can be claimed after it. A programme that cannot point to a number in the accounts has produced a new website, which is a good thing to have produced.
The site takes card payments, and that carries an obligation the column did not raise. The PCI Security Standards Council, the body founded by the major card brands that writes the security rules for handling card data, reports a sharp rise in e-skimming, where card details are stolen from the checkout page, the web page where a customer enters them, as they are typed. Platforms have grown more complex and more dependent on external scripts, and scripts running in the shopper's browser are now a major target for attackers after card data.
PCI DSS version 4.x, the current edition of the Payment Card Industry Data Security Standard that card brands require merchants to meet, answers this in two requirements. Requirement 6.4.3 says the scripts running on a checkout page must be authorised, inventoried and integrity-checked. Requirement 11.6.1 covers detecting tampering with those web pages. Both reach the security-impacting HTTP headers a server sends the browser. The guidance covers any entity taking e-commerce payments, including sites that only embed a payment iframe.
Worth doing, wrongly labelled
The work was worth doing, and the regional figures say why. Small and medium-sized firms in Latin America and the Caribbean provide 61% of employment while producing 29% of gross domestic product, so a worker in a small firm produces far less than one in a large company. The UN Economic Commission for Latin America and the Caribbean, the regional development body known as ECLAC, points to digitalisation as one lever for closing that productivity gap.
ECLAC ties the gap in part to credit. Small firms struggle to finance new technology into their production processes, and that constraint is part of what separates their productivity from that of large companies. ECLAC also makes the returns conditional on common standards, shared regulation and broadband investment by both the public and private sectors. Those conditions sit largely outside any one company's control and belong in a plan as dependencies.
The rebuild earned the money spent on it, and the storefront a Caribbean small firm sells through is worth building well. The label is where it misses. Calling a storefront a transformation sets the finish line at the web page a customer sees, and the next round of budget follows the label. Estimating and scheduling, the link from checkout to accounting and stock, a measured outcome, and the script controls on the checkout page are the work the word promises, and each needs an owner and a date in the same plan as the redesign.