The Importance of IT Governance in Today’s Digital World

The symptom is a re-litigated decision, not a missing policy

The recognisable failure is not an absent document. It is a decision that keeps coming back. A platform choice settled in spring is reopened in autumn because a new commercial director asks why, and nobody can produce the reasoning, only the outcome. The organisation pays for the same analysis twice and gets a worse answer the second time, because the original constraints have been forgotten.

Governance, stripped of its committee vocabulary, is the machinery that makes a decision stay decided: who was entitled to make it, what evidence they were required to see, what they concluded, and what would have to change for it to be revisited. Everything else is administration.

Decision rights before committees

Most governance effort goes into forums. The scarcer artefact is a plain statement of decision rights: for each class of decision, who decides, who must be consulted, and who is merely informed.

The expensive ambiguity is almost never in the first of those. Businesses generally know who signs. What they do not agree on is who must be consulted, and this is where governance actually earns its keep: a supplier chosen without the data owner consulted, an integration approved without operations consulted, a pricing rule changed without finance consulted. Each of those is a decision made by an authorised person that was still wrong.

Attach an evidence requirement to each class too. “Architecture review completed” and “the architect was in the meeting” are not the same control.

Risk appetite has to be operational to mean anything

“We have a low appetite for cyber risk” is not a governance statement. Nobody has ever been able to act on it. An operational risk appetite states the conditions under which a decision leaves the team and goes up: the class of data involved, the number of customers affected, whether the change is reversible, whether it touches money movement, whether it creates a new external interface.

Irreversibility deserves particular weight, and is commonly overlooked. A decision that can be unwound in a week can be made quickly and cheaply. A decision that embeds itself in reporting, contracts or master data cannot be unwound at all in practice, and should attract scrutiny out of proportion to its cost.

Ownership attaches to assets, not to job titles

Systems, datasets, suppliers, integrations and risks each need a named owner. The common mistake is to record ownership against a role (“Head of Operations”), which produces the appearance of accountability and none of the substance, because roles change hands without anyone rereading what the role owned.

The mechanism that actually fails is quiet. Someone leaves, their responsibilities are redistributed by conversation rather than by record, and eighteen months later an integration nobody owns fails during a month-end. Nothing was neglected deliberately. Ownership simply evaporated between two people who each assumed the other had it.

The cheap fix is to make the ownership register part of the leaver and mover process rather than the annual review. Ownership should be handed over explicitly, like a laptop.

Where the conventional advice is wrong

The standard prescription is more governance. In scaling businesses the more accurate diagnosis is usually uniform governance: the same approval path for a marketing tool as for a change to the general ledger. Uniformity feels fair and is quietly corrosive, because it teaches capable people that the process is theatre, and they route around it for everything, including the decisions that mattered.

Tiering is the answer, with an honest caveat. Proper tiering depends on data classification, which most growing businesses have not done and will not do quickly. Until then, use irreversibility and money movement as workable proxies. They are imperfect, and they are dramatically better than treating every decision identically.

Standards are scaffolding, not the building

ISO 27001, Cyber Essentials and the NIST Cybersecurity Framework all exist to give structure to work that would otherwise be improvised. That is genuine value: they supply a vocabulary, a sequence and an external deadline, and the deadline is often the most useful part.

What they do not supply is a conclusion about your risk. A management-system certification demonstrates that you have a system for managing controls and that it was operating at the time of assessment. It is evidence of process discipline, not of safety, and a business that treats the certificate as the objective will build controls sized for the auditor rather than for the threat.

Used well, a standard is a scaffold you can take down. Used badly, it becomes the permanent shape of the organisation. Cyber governance and ISO 27001 work is worth doing proportionately, or not at all.

Governance is what investors and acquirers are actually reading

In a funding round or a sale process, the technology questions are rarely about capability. They are about legibility: can this business explain what it runs, who decided it, what it costs and what it is exposed to, without a two-week scramble?

The difference between a business that answers in a day and one that answers in a fortnight is not the quality of its systems. It is whether decisions, ownership and controls were recorded as a by-product of normal work or have to be reconstructed retrospectively. Reconstructed evidence is always weaker, and buyers know it.

The smallest version that works

Governance introduced as a programme tends to die as one. It survives when it is small enough to be maintained by people with other jobs.

• A one-page decision record per significant decision: context, options discarded, choice, owner, revisit trigger.
• An asset and ownership register tied to the joiner, mover and leaver process.
• Two or three escalation thresholds based on irreversibility and money movement.
• A standing agenda item where risks are closed or explicitly accepted by a named person. An accepted risk is a governance outcome, an ignored one is not.

That is enough to stop decisions being remade, and it is usually where a fractional CIO starts, because everything more ambitious depends on it.