Redesigning Decision Rights in an Outsourced Transit Authority

The symptom is not too much governance; it is governance placed at the wrong level. The authority approves changes by effort hours, a proxy that has little to do with service risk. Fourteen CAB meetings a month and a 22% failure rate show that approval is not producing control. VeriSM separates governance, which sets direction and guardrails, from management, which makes service decisions within them.

Redesign decision rights by risk and reversibility. Low-risk standard changes should be pre-approved with automated checks. Medium-risk changes should be approved by a service or platform owner against defined criteria. High-risk changes, including payment and safety impacts, should go to a joint authority-vendor board. Emergency changes need a fast path with retrospective review, not prior approval by everyone. The vendor should receive delegated authority for named service categories, with audit rights and outcome metrics. The contract may need a side letter or change control, but the first step is an agreed decision-rights matrix and a 60-day trial on two service lines. Success means shorter lead time, fewer emergency changes and no rise in failed changes.

Compose the mesh with the vendor inside it, not outside as a contractual exception. Resources include a joint service owner, a vendor delivery lead, shared data on availability and changes, and a single backlog for the contactless rollout. Environment includes the seven-year contract, payment scheme rules, fare-gate safety and the 99.95% availability target. Emerging technology includes contactless terminals, tokenization and monitoring. Management practices include the vendor delivery method, the authority risk process and a lightweight change standard.

The contract remains an environment constraint; the mesh does not override it. Map every decision to the contract clause and identify where delegated authority is already allowed. For gaps, negotiate a side letter covering pre-approved change categories, data sharing and joint incident command. The contactless rollout should be run as a product with a service owner, a pilot at three stations and a rollback plan. Integration works when the vendor attends the same service review and shares the same outcome measures. A mesh that excludes the vendor will fail at the first outage, because 70% of operational decisions sit there.

Replace approval counts with outcome and risk metrics: change success rate, lead time from ready to release, percentage of standard changes pre-approved, emergency change ratio, mean time to restore, availability against 99.95%, and audit findings closed on time. Add a service outcome for the contactless rollout: successful taps per station, payment failure rate and customer complaints. Also track decision latency by decision type, because the problem is waiting, not volume.

Reasoning: approval volume measures activity, not control. A lower failure rate with faster lead time is better evidence that risk is understood. Pair lagging metrics with leading indicators such as percentage of changes with automated tests, rollback readiness and post-implementation review completion. Report by service, not by department, and review trends monthly with the vendor. Keep a small set, perhaps six metrics, so the CFO and audit can see control without recreating the old queue. Governance is working when risky changes get more scrutiny and low-risk changes get less, and when the service meets its availability target.