Governance Overload at a Government Digital Agency
A government digital agency runs 40 digital services. It has a portfolio board, a change board, a risk committee, and an architecture review board; each meets monthly and requires separate submissions. Project managers use PRINCE2, delivery teams use Scrum, and operations use ITIL 4. The risk register has 300 entries but is not linked to strategic objectives. The improvement backlog has 120 items and no prioritization. A recent audit found that 25% of changes bypassed the change board, and two major incidents were traced to untested changes. Staff report governance fatigue, and average time to approve a new service is 9 weeks. The executive director wants faster decisions and better risk visibility without dismantling governance or losing audit confidence.
1. Diagnose the governance and risk management problems. Explain how the current arrangements violate principles of effective governance and risk.
Read the worked answer
Problems:
- Duplicated, siloed boards: portfolio, change, risk, and architecture each demand separate submissions. This creates wait time and inconsistent decisions; it is governance for control’s sake, not value.
- Framework tribalism: PRINCE2, Scrum, and ITIL 4 are used in separate domains without an integrated operating model. Teams comply with formats rather than manage risk.
- Risk register not linked to strategy: 300 entries with no prioritization means risk visibility is an illusion; the board cannot see which risks threaten objectives.
- Improvement backlog without prioritization: 120 items means no clear improvement path; effort is spread and benefits are unclear.
- Change bypass: 25% bypass the change board because the process is too slow. The two untested-change incidents show that control is failing where it matters.
Violations: Effective governance should be proportionate, transparent, and aligned to objectives. Here it is bureaucratic, slow, and disconnected from risk. Risk management should inform decisions, not just record entries. The current model encourages shadow work.
2. Design an integrated governance and risk model that supports speed and control. Include decision rights, risk appetite, and change enablement.
Read the worked answer
Integrated governance: replace four boards with one portfolio and risk board supported by delegated decision rights. Set thresholds: low-risk changes and improvements approved within teams; medium-risk by a product/portfolio lead; high-risk by the board. Architecture uses guardrails and exception-based review.
Risk appetite: define appetite statements for availability, data protection, and change risk. Link the risk register to strategic objectives and reduce it to the top risks with owners, indicators, and treatment plans. Use risk appetite to decide what can be delegated.
Change enablement: adopt standard, normal, and emergency change types. Standard changes are pre-authorized with automated evidence; normal changes are risk-assessed proportionately; emergency changes have a fast path with retrospective review. Record all changes in one tool for audit.
Improvement prioritization: score the 120 improvement items by value, risk reduction, and effort; fund a small number each quarter.
Reasoning: Speed and control improve together when decision rights match risk. The board focuses on high-risk decisions, while teams handle low-risk work with guardrails.
3. How would you use measurement, continual improvement, and organizational change management to embed the new model?
Read the worked answer
Measurement: use a balanced scorecard: time to approve new services, percentage of changes by type and bypass rate, risk treatment progress, incident rate from untested changes, improvement backlog cycle time, and stakeholder confidence. Report to the integrated board monthly.
Continual improvement: create a prioritized improvement register with a clear value hypothesis for each item. Use small experiments and retrospectives; publish results. Link improvements to the risk appetite and strategic objectives so the backlog does not grow unchecked.
Organizational change management: build a coalition of board chairs, delivery leads, and audit. Communicate the problem and the new decision rights clearly. Train teams on the integrated process and risk appetite. Use champions in each service. Address governance fatigue by removing duplicate submissions. Gather feedback after 60 days and adjust. Reinforce with leadership behavior: leaders should use the new thresholds and not escalate low-risk decisions.
Reasoning: DPI requires governance, measurement, and change to be connected. If the new model is imposed without OCM, staff will bypass it as they did before. Measurement proves it is faster and safer; OCM makes it stick.