Governance Guardrails vs. Shadow Cloud at a Financial Services Firm
Atlas Capital has 12 business units, 4,000 employees, and 14 critical services. About 30% of cloud spend now occurs outside procurement: business units buy SaaS with local budgets and connect it to customer data. Six ITSM tools are in use, the risk register has not been refreshed in seven months, and the last internal audit raised four findings on incomplete change records. The governance board meets quarterly and reviews a 60-page project dashboard, not operational risk. Incident MTTR is six hours. The CIO proposes central approval for every cloud purchase to regain control. Business leaders warn this will slow customer-facing work and push more spend underground. The audit committee wants evidence that risk is being managed, not just that approvals are counted. The organization needs a governance response that fits the VeriSM operating model rather than a single central gate.
1. Explain the difference between governance and management in the VeriSM operating model and assess whether central approval for all cloud spend is an appropriate governance response.
Read the worked answer
Governance sets direction, risk appetite, policies, and decision rights, and then assures that management is working within them. Management executes day-to-day planning, delivery, and operation. The CIO's proposal is a management control-an approval step-not a governance design. It may reduce visible cloud spend but will not create the assurance the audit committee wants, because it does not define risk tiers, data rules, or accountability. It also encourages shadow spending when business units need speed. A better governance response defines which cloud purchases are low-risk and pre-approved, which require security and data review, and which need executive sign-off because they touch critical services or regulated data. It also mandates visibility: all spend and integrations must be registered. The measure of success is not the number of approvals but the percentage of cloud spend that is visible, classified, and within risk appetite, plus fewer audit findings. Central approval for everything would centralize a decision that should be federated by risk.
2. Design a federated governance arrangement with specific decision rights and escalation triggers. What should the executive board review?
Read the worked answer
Create an executive governance board that meets monthly and owns risk appetite, critical-service definitions, and policy exceptions. Under it, establish domain councils for customer data, payments, and corporate systems. Decision rights: product teams can select and configure low-risk SaaS within a pre-approved catalog and budget threshold; domain councils approve integrations with customer data and medium-risk vendors; the executive board approves critical-service changes, regulated-data processing, and exceptions. Escalation triggers should include any connection to a critical service, any regulated data, spend above a set threshold, unresolved security findings, and repeated incidents. The board should review a one-page risk dashboard: percentage of cloud spend visible, open audit findings, critical-service incidents, exception aging, and MTTR-not a 60-page project list. This is federated governance: clear guardrails and accountability, with management autonomy inside them. It addresses shadow spend by making the legitimate path faster and the exceptions visible.