Meridian Group: Decision Rights in a Federated Conglomerate
Meridian Group is a diversified holding company with seven business units and $480 million in revenue. Consolidated IT spend is $62 million, but 38% sits in business-unit budgets outside the CIO's control. A recent internal audit found 14 unsanctioned SaaS tools, three of which store customer personal data, no single sign-on coverage for them, and no enterprise application inventory. Each business-unit president holds a profit-and-loss target and resists what they call 'central IT bureaucracy'; two have threatened to escalate to the board if the CIO gains approval authority. The board has asked the CIO to deliver 'one IT strategy' within twelve months while preserving business responsiveness. The CIO has a small architecture team of five people and no formal decision-rights framework. The audit committee meets in eight weeks and expects a remediation plan.
1. Design the IT decision-rights model the CIO should propose. Specify which decisions move to the center, which stay federated, and what input rights business units retain. Justify each choice against Meridian's structure.
Read the worked answer
Do not default to an IT monarchy. With seven P&Ls and 38% of spend outside the CIO, an authority grab would trigger the escalation two presidents have already threatened and would push more procurement underground.
Recommend a federal model for enterprise-shared decisions and a duopoly for business applications:
- Federal (central IT leads, BU input): identity and single sign-on, network, cloud platform standards, security policy, customer-data governance, and architecture principles. These carry enterprise risk and scale economics; the three PII-bearing SaaS tools show the cost of fragmentation.
- Duopoly (BU leads, central IT approval on standards): application selection and configuration for BU-specific processes. The BU funds and owns the outcome; architecture and security hold a compliance veto, not a taste veto.
- Business monarchy: local operating procedures and process design.
- Threshold rule: investments above $250k or involving customer data go to an enterprise IT investment council chaired by the CFO, with the CIO as technical adviser. This gives the board a single view without giving the CIO line authority over BU budgets.
Codify the model in a one-page matrix with named roles, required inputs, and an escalation path to the CEO. The purpose is predictable decisions, not centralization. The matrix also gives the audit committee something concrete to test.
2. The audit committee wants the shadow-SaaS exposure reduced before the next board meeting. What sequence of actions would you take, and what would you deliberately not do yet?
Read the worked answer
Sequence matters because the exposure is data risk, not procurement tidiness.
- Declare a two-week amnesty with no retrospective punishment for disclosure. A ban would drive the remaining tools further out of sight and destroy the inventory's completeness.
- Discover technically, not by survey alone. Pull SSO logs, expense data, and network egress to reconcile against the 14 known tools. Expect the true count to be higher.
- Triage by data class and contract. The three PII tools are the immediate problem: confirm data residency, retention, breach notification, and whether a data processing agreement exists. For the rest, classify by business criticality and contract lock-in.
- Offer a fast sanctioned path. Stand up an approved-software catalogue and a 10-day exception review. If the sanctioned alternative takes three months, shadow IT returns.
- Close or migrate the PII tools and report that specifically to the audit committee.
What not to do yet: do not attempt a big-bang consolidation, do not strip BU budgets, and do not promise full application inventory coverage in eight weeks. Those moves trade short-term appearance for long-term resistance. The board should hear a risk-based plan with named owners, not a cleanup fantasy.
3. Propose three governance effectiveness measures the board should track and explain what each would reveal that a spend-variance report would not.
Read the worked answer
1. Percentage of IT spend made under a documented decision right. Spend variance shows totals by budget line; it does not show whether the money was approved through the agreed model. A high variance under this measure reveals that the matrix exists on paper only.
2. Median time-to-decision for investment requests, by threshold. This exposes whether governance is a bottleneck. If the council takes 70 days for a $300k request, business units will route around it, and the board will see the symptom later as more shadow procurement.
3. Exception rate and repeat-exception rate. The count of approved exceptions is healthy; the count of the same exception recurring signals that the standard is wrong or unenforceable. A spend report cannot distinguish a one-off integration need from a systematically unusable standard.
Optionally add application inventory coverage as a leading indicator, since the current baseline is zero. Report all four quarterly with trend lines and a short narrative on causes. The board's question should shift from 'how much did we spend?' to 'are decisions being made where we said they would be, and how fast?' That is the governance outcome the audit committee is actually testing.