A support team spends hours each week manually resetting user passwords. Their manager proposes immediately purchasing a self-service automation tool to handle all password resets. However, the current process contains several redundant approval steps and inconsistent verification rules that vary by department. According to the 'Optimize and automate' guiding principle, what should the team do first?