Helvetia Health: Governing a 147-Initiative Digital Portfolio
Helvetia Health is a health insurer with 2.1m members and EUR 5.4bn premium. Its digital portfolio contains 147 active initiatives and EUR 180m of annual spend, sponsored by 11 different executives. There is no single prioritisation: 38 initiatives are labelled 'regulatory must-do', 24 have no written business case, and the PMO reports that only 31% delivered their stated benefits last year. Average elapsed time from idea to funding decision is seven months, and several business units have started funding 'shadow' work from operating budgets to avoid the process. The regulator has issued a finding that the insurer cannot evidence adequate control over change risk in systems supporting claims and member data. The board has set up a Digital Investment Committee and asked you to design strategic governance: decision rights, funding model, risk appetite and performance measurement - without creating a bureaucracy that makes the shadow work worse.
1. Design the decision rights and tiered governance for the digital portfolio. Address explicitly how you would resolve the control-versus-speed tension.
Read the worked answer
Tier by risk and value, not by sponsor seniority. Three tiers: (1) small, low-risk experiments below a delegated threshold - for example under EUR 250k with no member-data or regulatory impact - where the product owner decides and notifies the portfolio office; (2) medium initiatives requiring a value-stream or portfolio board decision with a ten-working-day service level; (3) high-risk or high-value initiatives above roughly EUR 3m, or with material regulatory, customer or technology impact, decided by the Digital Investment Committee and reported to the board risk committee.
Decision rights must be explicit: who proposes, who decides, who must be consulted (risk, compliance, security, architecture) and by when, and who is informed. Name one accountable executive per initiative and cap the number any executive may sponsor - eleven sponsors for 147 initiatives means nobody is accountable.
The control-versus-speed tension is resolved structurally, not by exhortation. Speed comes from delegation thresholds, standard templates that are short enough to complete, decision service levels with automatic escalation, and a fast track for genuine regulatory obligations. Control comes from evidence standards proportionate to tier, mandatory post-implementation reviews for tier 2 and 3, and a decision log the regulator can inspect. Fast does not mean undocumented; it means documented once, at the right depth.
2. Recommend a funding model that fixes the current problems, including how to treat the 38 'regulatory must-do' initiatives and the shadow spend.
Read the worked answer
Replace annual project funding with a portfolio split into two envelopes. The first is a ring-fenced run-and-regulatory envelope, sized and validated with compliance rather than with sponsors; the 38 'must-do' items should be individually verified and re-baselined, because in practice a large share of self-labelled regulatory work is discretionary change with a compliance label attached. Genuine obligations are funded first, in full, with compliance owning their priority.
The second is a change and innovation envelope released in quarterly tranches against stage gates, with value streams holding rolling budgets so they can reallocate within an agreed envelope without returning for approval.
For the 24 initiatives without a business case: require a one-page case within 30 days or park them; the act of parking frees capacity and signals that the rules have changed.
Shadow spend should be legitimised rather than banned. Banning it drives it further underground and removes visibility entirely. Create a small, fast experiment fund with light reporting available to business units, and make the official route faster than the workaround - otherwise the workaround wins on cycle time, which is exactly what has happened at seven months to funding.
Finally, publish the whole portfolio, including the experiment fund, so the board sees one number rather than eleven versions.
3. Define the risk appetite and measurement set you would put to the board, and explain how these would satisfy the regulator without strangling experimentation.
Read the worked answer
Risk appetite should be expressed as tolerances by category. Regulatory and conduct: zero tolerance for unauthorised change to claims and member-data systems; all changes evidenced, no exceptions without logged approval. Financial: a defined annual loss tolerance for the innovation envelope. Delivery: an explicit expectation that a proportion of experiment spend - perhaps 20% - will fail and be stopped, which the board must state publicly or teams will not take risk. Technology and data: tolerances set by system criticality, covering availability, recovery and data protection.
Measurement set: benefit realisation rate by value stream; time from idea to funding decision; percentage of portfolio with an approved case; share of spend traceable to strategic priorities; experiment-to-scale conversion; change failure rate; regulatory findings open and closed; and post-implementation review completion.
Regulator evidence is largely a by-product of this design: the decision log, tiered risk assessments, testing and change records, exception register and post-implementation reviews demonstrate control over change risk in claims and member-data systems. The key is that evidence is generated by the governance process rather than assembled retrospectively.
Experimentation is protected because low-risk work is delegated and deliberately exempt from tier 3 evidence requirements - the control burden is concentrated where the risk actually sits.