Important business decisions increasingly cross several specialist boundaries at once.
Take a fairly ordinary example. An organisation wants to introduce an AI-enabled service using customer information and technology supplied by a third party.
Security will probably have questions about the architecture and supplier. Privacy needs to understand how personal information will be used. The proposed use of AI brings another set of risks and governance concerns. Procurement, legal and operations may all have legitimate concerns of their own.
This is sensible. Each discipline brings expertise that the others cannot simply replace.
The challenge comes later, when the organisation has to turn those separate assessments into one decision.
The ICO’s accountability guidance says organisations are responsible for complying with UK GDPR and must be able to demonstrate that compliance. In practice, that includes keeping records and being able to justify decisions.
The NCSC’s Cyber Governance Code of Practice approaches cyber from a different position. It is voluntary guidance, but it places critical governance actions with directors. The supporting Cyber Security Toolkit for Boards covers areas including risk management, strategy, incident planning, assurance and oversight, and is intended to support discussion between leadership and technical specialists.
These are different forms of guidance with different purposes and legal weight. The interesting governance problem appears when evidence from different specialist processes has to support the same organisational decision.
Specialist evidence has boundaries
I’ve spent much of my career around risk, security, assurance and governance. In my experience, one recurring problem is that evidence tends to arrive shaped around the discipline that produced it.
That is normally appropriate. I want a security assessment to tell me something useful about security. I don’t expect a DPIA to answer every operational concern surrounding a project, and a supplier assessment has its own scope.
Leadership, however, has to deal with the initiative as a whole.
If I were being asked to support the introduction of that AI-enabled service, I would want the specialist work in front of me. I would also want to understand how the pieces affect the decision we are actually making.
Perhaps the supplier has passed the required security assessment, but the service creates a dependency that operations is uncomfortable with. The proposed use of personal information may be supportable, but only on assumptions that need to remain true after launch. An AI risk assessment may identify manageable technical risks while another function has concerns about how the service will affect customers.
Those differences are useful information. I would rather have a genuine disagreement visible than lose it as several specialist assessments are summarised for a decision.
Problems arise when those differences remain inside separate assessments and reach the decision-maker without anyone showing how they interact.
Another assessment may not be the answer
When uncertainty remains, organisations often ask for more assurance.
Sometimes another assessment is exactly what is required because evidence is missing or a specialist judgement genuinely needs more work. At other times, most of the information already exists but has not been assembled around the decision.
Five reports can contain plenty of evidence while still leaving a leadership team to work out which assumptions matter, where the assessments overlap, what remains uncertain and who will own the consequences once the initiative is operating.
I find it more useful at that point to work backwards from the decision.
I want to understand what we are proposing to do and why, which evidence actually matters to that decision, and where material assumptions or specialist judgements differ. The remaining uncertainty needs to be visible, along with its owner and anything that might cause the organisation to reconsider the decision later.
These are ordinary governance concerns. They don’t replace specialist assessments or ask leadership to reproduce specialist judgement.
Their purpose is to make that specialist work usable when an organisational decision has to be made.
Good governance can remove friction
In my experience, governance can easily become a sequence of gates. A project moves between security, privacy, procurement, legal and other functions, with each asking reasonable questions from its own perspective. Work can circulate while teams request information held elsewhere or operate from different assumptions about what has already been agreed.
Bringing the important evidence and assumptions together can change that.
A privacy concern can be considered alongside the proposed use before a technical design has hardened. An operational dependency can be discussed while supplier assurance is still being evaluated. A genuine disagreement between specialists can be put in front of the person authorised to resolve it while the different professional judgements remain visible.
That may expose a reason to stop, identify a change that makes the proposal supportable, or show that the available evidence is already sufficient and allow a decision to move.
References
- Information Commissioner’s Office — Guide to accountability and governance
- National Cyber Security Centre — Cyber Governance Code of Practice
- National Cyber Security Centre — Cyber Security Toolkit for Boards
- Department for Science, Innovation and Technology — Cyber Governance Code of Practice: government response to the call for views