What is a digital transformation strategy? Lessons from a $10M pivot

In May 2017, The Body Shop — a heritage retailer with shelves full of lotions and a CRM that, frankly, belonged in 2004 — committed £10 million over three years to a digital transformation initiative. Eleven countries got a mobile-first e-commerce site, twenty more were queued behind them, a personalized skincare diagnostic tool went live, and online sales that had just grown 19% were projected to reach a 20% share of the business. The press release called it a "strategy." Stripped of the comms varnish, it was a directional bet that a company built on mall foot traffic could survive a world that had quietly moved the mall into a phone.

I have watched announcements like this for two decades. Most of them are not what their PR departments claim. So let me translate, because the phrase "what is a digital transformation strategy" has been so thoroughly abused by consultancies and TED talks that it now means roughly whatever the speaker had for breakfast. The real definition is sharper, leaner, and considerably less photogenic.

What "digital strategy" actually means (and what it doesn't)

Strip away the buzzwords and you land where MIT's Center for Information Systems Research has been standing for years: a digital strategy is a business strategy inspired by the capabilities of accessible digital technologies, designed to deliver integrated business capabilities that can flex with the market. Three things make one actually work, and you can hang a frame on them.

A digital strategy is a business strategy wearing a software jacket. The jacket is optional. The strategy is not.

First, it focuses on one clear competitive strength. Not seven. Not a "transformation of everything." One. The Body Shop's bet was essentially a single decision: own the digital relationship with a values-driven beauty customer, before someone else did. Everything else — the mobile site, the diagnostic tool, the localized payment options — was infrastructure in service of that one bet. If your initiative has three or four "strategic priorities" of equal weight, you don't have a strategy. You have a wish list with a budget.

Second, it is directional, not a fixed end-state. This is the bit boards hate, because boards love the comfort of a five-year plan that ends with a number. A real digital strategy is a heading, not a destination. You commit to the direction, then you adapt as the market tells you what's working. The honest answer on The Body Shop's 2017 initiative is that independent, current evidence of whether it hit its long-term financial targets is thin, and I refuse to dress thin evidence up as a verdict. Anyone who tells you otherwise is selling something.

Third, it has to be enabled by digital capabilities that exist or can be realistically developed. "Realistically" is doing the work in that sentence. If your grand strategy depends on hiring a machine-learning team that doesn't exist, building a data layer that isn't there, and changing a culture that won't move, you have a slide deck, not a strategy. The Body Shop was pragmatic: the technology they were buying was mobile commerce, localized payments, and a recommendation engine. All known quantities. The hubris in transformation programs almost always lives in the gap between the roadmap and the operating reality.

Two flavors, and confusing them will burn your budget

MIT's framework makes a useful cut that most strategy decks miss entirely. There is a difference between a digital customer-engagement strategy — which changes how you go to market — and a digitized-solutions strategy — which changes what you actually sell. They look similar on a Gantt chart. They are not the same. Conflating them is where strategy becomes mirage and budget becomes wreckage.

The Body Shop case lives firmly in the first column. They were not inventing a new product. They were rebuilding the front door. A lot of "transformation" programs I have watched die on the vine were the second column being run with a first-column budget and a first-column timeline. If you are reformulating what the company actually sells, you need to budget like it. The friction between these two is where most five-year plans become three-year apologies.

Direction beats destination: why roadmaps are overrated

The single most expensive mistake in any digital strategy is the false precision of a fixed roadmap. McKinsey's 2022 survey on digital strategy and investment — fielded between January 25 and February 4 of that year, with 1,331 senior respondents — looked at three transformation types: building a digital-ready core (cloud, open interfaces), strategically changing the core business with technology (AI, digital customer interactions), and building a separate digital business. The companies that were actually pulling ahead were the ones who treated the roadmap as a hypothesis, not a contract.

The same analysis found that stronger economic performers were disproportionately doing three things:

1. Pursuing strategic differentiation in customer engagement and innovation rather than chasing parity with the rest of their category.

2. Building proprietary AI, data, and software assets rather than renting commodity versions of the same.

3. Integrating tech-savvy leadership and talent directly into the operating model, not parked in an innovation sidecar.

Notice what is conspicuously absent: breathless adoption of the trendiest vendor. The pattern was the opposite. Winners were compounding a specific advantage, not chasing the news cycle. The losers were the ones whose strategy deck was a 2023 Forrester Wave re-pasted into a 2025 board pack.

The companies winning the digital game are not the ones with the best slides. They are the ones with the most legible theory of how their business makes money, plus the discipline to defend it.

If your "transformation" looks like a vendor showcase, you have already lost. The strategy is the wedge. The technology is what you use to drive it in.

Risk management: the part nobody budgets for, until they must

Here is the unsexy part, and I have to be honest: I find it miraculous how often enterprises will spend eight figures on a digital ambition and then treat risk management as a binder in a corner office. The U.S. National Institute of Standards and Technology published version 2.0 of its Cybersecurity Framework on February 26, 2024. It is voluntary, it is for any size of organization in any sector, and it organizes cybersecurity risk around six functions:

• Govern — the policies, roles, and risk decisions that set the whole apparatus in motion
• Identify — what you have, what you depend on, where the exposure lives
• Protect — the controls that keep the bad day from being a worse day
• Detect — the instrumentation that tells you something is happening
• Respond — the muscle memory to act when the alarm goes off
• Recover — the architecture to get back to business without lying about it

That is not a checklist. That is a control system.

And if your transformation involves AI — and at this point, whose does not — there is a companion. NIST's AI Risk Management Framework Core runs on four functions: Govern, Map, Measure, and Manage, and it is explicit that AI risk management has to be continuous across the lifecycle. Testing before deployment is non-negotiable. Monitoring in production is non-negotiable. None of this is federal law. It is the difference between a strategy that survives a bad quarter and one that ends up in front of regulators with a class-action chaser.

I keep coming back to leverage. You can lever an operating model, you can lever a customer relationship, you can lever a balance sheet. You cannot lever risk. You can only price it, plan for it, and respond to it when it shows up — which it will, usually on a Friday afternoon.

A frank word on the £10 million question

So back to The Body Shop. Was their 2017 plan a strategy? Yes, narrowly. It had a clear competitive focus — owning the direct digital relationship with a values-conscious beauty buyer — it was directional, and it used technology that existed. The budget, £10 million over three years, was modest for the ambition, and the absence of any independent, current ROI data on whether the long-term financial targets were met is precisely why I am not going to tell you it was a triumph or a flop. Anyone who claims certainty either has an agenda or a press release.

What I will tell you is the test that matters, and it is the test I apply to every one of these programs. Three questions. Numbered, because the board loves a numbered list.

1. Did it change how the business makes money, or just how the business looks?

2. Is the competitive advantage the strategy was meant to build still legible three years later — or has it been quietly absorbed into "table stakes"?

3. When the next market shock hits, does the operating model bend, or does it snap?

The Body Shop's 2017 initiative was designed to bend, and that was its single best quality. The rest of the verdict belongs to the people who own the next three years of execution.

The bottom line

A digital transformation strategy is not a software project. It is a business strategy that uses digital capability as its primary lever, aimed at a single competitive strength, executed directionally rather than as a fixed plan, and managed with the kind of risk discipline that keeps it alive when the headlines turn. The Body Shop's £10 million bet in 2017 was a real example of one. It is not a model. It is a mirror.

If your board is calling a vendor purchase a "strategy," you have permission — from me, personally, and at no charge — to roll your eyes. Then go write the strategy. The technology will wait. It always does.