Northbridge Mutual: Who Actually Decides?
Northbridge Mutual is a regional insurer with 3,800 employees and about $620 million in revenue. Its IT budget is $48 million, but a spend analysis shows 31% of technology spending now sits in business units outside the CIO's line. A discovery exercise found 47 SaaS subscriptions, 12 of which store customer data and never went through a security review; two business units have each built a separate customer data warehouse. The IT steering committee has 22 members and averages 9 attendees at its quarterly meetings. Internal audit's latest report states there is 'no enterprise-wide process for prioritizing technology investment,' and the board has asked for a 12-month corrective plan. The new CIO reports to the CFO, not the CEO, and has been told there is no headcount available. One business unit head has already said publicly that central governance would 'slow us down.'
1. Diagnose the underlying governance failure and specify the decision rights you would change. Be concrete about who decides what.
Read the worked answer
Diagnosis. The evidence describes an intake-and-authority problem, not a decentralization problem. 47 subscriptions with 12 unreviewed means there is no single entry point for demand. Two duplicate warehouses means no conformance check exists. 9 of 22 attending means the committee is a briefing forum, not a decision body. Centralizing everything would fix conformance and break speed - the business unit head's objection is legitimate, and ignoring it will be used against you.
Separate three decision types and assign each explicitly:
- Intake: any technology request above $25,000, or any tool touching customer data, enters through one portal regardless of funding source. This alone would have caught the 12 unreviewed subscriptions.
- Funding: business units may approve up to $50,000 within a pre-agreed annual envelope and a pre-approved catalogue; the CIO approves $50,000–$500,000; an investment committee of five (CEO, CFO, CIO, one BU head, one risk officer) approves above $500,000. Thresholds are what make federated spending safe.
- Architecture conformance: the architecture function holds a veto on standards and data integration, but with a published 10-working-day decision SLA and automatic escalation to the CIO on breach, so it cannot become the new bottleneck.
Use the reporting line you have. The CIO reports to the CFO, and the CFO already controls the money. Co-sign a delegation-of-authority schedule with the CFO rather than spending political capital on a reporting-line change in year one - the authority matters more than the org chart.
2. Sequence the first six months given no additional headcount and a CFO sponsor.
Read the worked answer
Order by dependency, not by visibility.
Months 1–2 - establish facts and mandate. Publish the spend and subscription inventory you already hold. Get the CFO to sign the delegation of authority. Reduce the steering committee to nine decision-makers with a one-page charter. No new staff required; this is a memo and a meeting cadence.
Months 2–3 - open the front door. Stand up a lightweight intake form and an approved-tool catalogue using existing service management staff. Do not build a portal; a spreadsheet-backed workflow that ships in three weeks beats a platform that ships in nine months. The point is that 'there was no process' stops being true.
Months 3–5 - triage the 12 unreviewed subscriptions. Run a security and data review on each. Expect to retire three to five, consolidate four to six into enterprise agreements, and formally accept the rest with a named owner. This produces early savings that fund the governance work and gives the CFO a visible win to defend.
Months 5–6 - decide on the duplicate warehouses. Commission a one-page options paper (consolidate / federate through a shared semantic layer / leave and accept the cost). Route it to the investment committee, not the steering committee, so it becomes a funding decision rather than a debate.
Do not start with a policy document. Policies written before the process exists get ignored, and you have no headcount to enforce them.
3. What four measures would you report quarterly to the board, and what would you deliberately avoid measuring?
Read the worked answer
Each measure must be tied to a behaviour you are trying to change.
- Share of technology spend under a documented decision - from 69% to at least 90% within 12 months. This is the headline and it answers the audit finding directly.
- Intake coverage and cycle time - number of requests entering the front door, and median days from request to decision. Publish the cycle time, because it is the direct counter-argument to 'governance slows us down.' If your median is 30 days, you have lost that argument regardless of what the policy says.
- Live architecture exceptions - count of exceptions to standards, each with an owner and an expiry date. A rising count with no expiry dates means the veto is being bypassed informally and the register has become decorative.
- Duplicate or overlapping tools by category - from 47 subscriptions to a target per category. Cheap to measure, easy for a board to grasp, and it moves quickly enough to show progress inside two quarters.
Avoid a composite 'governance maturity score.' It is self-assessed, it moves slowly, and it will not survive a board's first question about whether spending is actually under control. Also avoid counting meetings held or policies published - those measure activity, not control.