How should digitally native retailers decide which store functions to centralise and which to keep flexible as they expand into brick-and-mortar?

Digitally native retailers should keep the operating model that made them agile online, while being selective about what moves into stores. The article points to outsourcing tasks such as order management, fraud protection, fulfillment, customer support, and tax management so teams can stay focused on merchandising and customer relationships. That approach supports faster scaling, easier experimentation, and a more consistent digital-first customer experience.

How to Decide What Belongs in Stores and What Stays Centralised

digitally native retailer usually scale best when stores inherit only the functions that truly need physical presence, local judgment, or face-to-face service. Core coordination, especially order handling, fraud review, fulfillment orchestration, customer support, and tax handling, can often stay centralised so the store model does not become a second, slower operating system. That keeps the business easier to experiment with and less likely to fragment by location.

The practical test is whether a function creates local value or only local duplication. If central control preserves speed, consistency, and visibility without degrading the in-store experience, it is a strong candidate to stay centralised. If the function depends on immediate customer interaction, merchandising nuance, or store-specific trade-offs, it is better left flexible so teams can adapt to the location and customer mix.

For retailers that rely on software-driven operations, the same principle applies to supporting controls around transactions and customer data. Centralising high-volume, policy-heavy work can reduce variation, but it also increases the need for strong process design and auditability. That is why teams should think in terms of operating boundaries, not just org charts: what is standardised globally, what is delegated locally, and what evidence shows the boundary is working.

Where Flexibility Matters More Than Standardisation

Stores usually need latitude in areas where customer expectations change by geography, channel mix, or store format. Merchandising, associate workflow, local promotions, and service recovery often require discretion that cannot be fully scripted from headquarters. A rigid model can improve control on paper but weaken conversion, staff judgment, and the retailer’s ability to learn from the store environment.

Flexibility is most valuable when the cost of a local mistake is limited and the upside of experimentation is high. By contrast, if a process touches cash movement, sensitive customer data, or tax treatment, flexibility should be narrower and guarded by clear policy. The goal is not to centralise everything, but to centralise the parts where inconsistency creates avoidable risk or operational drag.

NHI Mgmt Group’s Ultimate Guide to Non-Human Identities notes that 97% of NHIs carry excessive privileges, which is a useful reminder that scale often turns convenience into overreach. For retailers, the analogue is simple: every local exception should be justified by a customer or operational need, not by habit.

Risk and Threat Considerations

The main risk in expansion is not that stores become less digital, but that they become inconsistently controlled. If order management, fraud checks, fulfillment exceptions, or tax handling are split across too many local variations, the retailer can create control gaps, duplicate work, and a weaker audit trail. Centralising too much can create a different risk, where stores lose the agility needed to serve customers well.

Failure mechanism: Fragmented ownership leads to inconsistent approvals, unclear escalation paths, and hidden exceptions that are hard to monitor across locations. Over-centralisation can fail in the opposite direction by creating bottlenecks, stale rules, and store teams that bypass the intended process to keep service moving.

Impact: The retailer can see slower experimentation, higher operational cost, more returns or fulfillment mistakes, and greater exposure to fraud, tax errors, or customer dissatisfaction. In a multi-store environment, small control drift can scale quickly into a systemic operating-model problem.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.OC-01 — Organizational Context	Retail operating-model choices must fit business context and service model.
	PR.AC-4 — Access Permissions are Managed	Retail stores need managed permissions when functions are split between central and local teams.
	GV.RM-03 — Risk Prioritization	The answer depends on prioritising which functions create the most operational and control risk.
Recommendation — Define which store functions remain central based on business context and customer service priorities. Manage store permissions so local flexibility does not become uncontrolled access. Prioritise centralisation for functions that create the highest operational and control risk.
CIS Controls v8	6 — Access Control Management	Centralised control of sensitive store operations reduces inconsistent approvals and exceptions.
	5 — Account Management	Store expansion increases the need to manage who can act locally and under what authority.
Recommendation — Restrict sensitive store workflows with centrally governed access and approval paths. Review local operating permissions regularly and revoke unnecessary store-level authority.
OWASP Non-Human Identity Top 10	NHI-01 — Secrets and Credential Management	Centralising transaction and support functions requires strong control of credentials and exceptions.
	NHI-05 — Excessive Privilege	Flexible store models can drift into overbroad authority without guardrails.
Recommendation — Centralise and monitor credentials used for store operations, fulfillment and support systems. Limit store roles to the minimum permissions needed for local service delivery.

Practitioner Guidance

What to prioritise: Separate functions into three buckets: centrally governed, locally flexible, and hybrid. The first bucket should include decisions where consistency, risk control, or transaction integrity matters most. The second should cover customer-facing work that benefits from store judgment. The hybrid middle is where you define guardrails, not a free-for-all.

Decision rule: If a process can be executed the same way across all stores without harming customer experience, centralise it. If the process depends on local context, retain flexibility but constrain it with policy, escalation thresholds, and reporting so exceptions are visible rather than informal.

What to measure: Track store-level exception rates, turnaround time, customer satisfaction, and the volume of manual overrides. If centralisation increases workarounds or slows service, the model is too rigid. If flexibility creates inconsistent outcomes or audit noise, it is too loose.

Practitioner takeaway: The best expansion model is usually selective centralisation, not wholesale standardisation. Keep the control-heavy work central, keep the customer-sensitive work local, and make the boundary explicit enough that the organisation can scale without losing either speed or discipline.