Federated IT in a 14-Unit Group: Framing a Governance Opinion Before the CFO Has Decided the Answer
At Harlow Group, a diversified manufacturer with 14 business units and revenue of EUR 3.1 billion, IT spend is 6.4% of revenue against a peer median of 3.9%. Each unit selects, contracts, and operates its own ERP, CRM, and payroll platforms; the group CIO has 22 staff and no budget authority over the units. A recent inventory found 31 ERP instances, 240 SaaS subscriptions with 18 overlapping collaboration tools, and 41% of IT vendor invoices lacking a matching purchase order. One unit runs a regulated medical-device business with data-residency obligations that differ from the rest of the group. The board audit committee has asked internal audit whether IT is governed effectively. The group CFO has already announced a 15% IT cost-reduction target and wants the report to support centralising all IT procurement under the group CIO.
1. Define the audit objective and the evidence you would gather, showing why the duplication alone does not answer the governance question.
Read the worked answer
Objective. The question is not whether duplication exists; it plainly does. The question is whether decision rights, accountability, and oversight produce IT outcomes aligned with the group's objectives at an acceptable cost and risk. Frame the engagement against governance domains: strategic alignment, value delivery, risk management, resource optimisation, and performance measurement. Each must be evidenced separately.
Evidence to obtain.
- A decision-rights map: who approves IT spend, architecture exceptions, vendor selection, and data-residency decisions, and at what threshold.
- Budget and approval flows for a sample of IT contracts, including the 41% without matching purchase orders, to see whether the gap is a control failure or a policy that permits after-the-fact ordering.
- Portfolio and demand records: is there any forum that sees all units' IT demand, and does it reject anything?
- Architecture standards and exception logs: how many units have formally approved deviations, and who approved them?
- Contract terms for overlapping tools: exit costs, minimum commitments, and termination dates, which determine whether consolidation is even feasible in the cost-reduction window.
- The regulated unit's obligations, to test whether some differentiation is legitimate rather than wasteful.
Why duplication is not self-proving. Thirty-one ERP instances may reflect genuine differences in regulatory regime, plant acquisition history, or localisation that a single instance cannot serve without greater total cost. The auditor must distinguish duplication arising from absent decision rights (a governance failure) from duplication arising from documented, justified exceptions (a governance success with an expensive outcome). Only the first supports a centralisation recommendation; the second supports a standards-and-exceptions recommendation.
2. How should the auditor handle the CFO's request that the report support centralising all IT procurement under the group CIO?
Read the worked answer
The request must be declined as framed, and the refusal should be practical rather than principled-sounding.
Independence and role. An auditor may report that current arrangements create unmanaged risk and that cost reduction requires clarity about who decides what. An auditor may not pre-select an organisational design and then assemble evidence for it, and should not design or implement the target operating model. Writing the report to a predetermined conclusion converts the function into an advocate and destroys its usefulness to the audit committee, which will need an objective view precisely because the change is contested.
What the report can legitimately say. Evidence-based statements such as: no forum has visibility of group-wide IT demand; 41% of invoices lack matching commitments, indicating spend outside any approval path; architecture exceptions are granted without a documented authority; and the resulting portfolio carries overlapping commitments that constrain the 15% target. Each is a finding about control, not about structure.
Present options with criteria. Set out two or three models, for example full centralisation of procurement, a federated model with group-set standards and unit-level execution, and a category-management model for high-spend commodities. Assess each against cost, speed of response, regulatory fit, and control strength. Note explicitly that centralisation trades local responsiveness and may slow the regulated unit's compliance changes, which is a risk the committee should weigh rather than a defect the auditor should suppress.
Escalation. If pressure continues, the auditor documents the request and the response and informs the audit committee chair. The committee, not the CFO, owns the engagement scope.
3. Recommend a small set of governance metrics the audit committee could use to track whether the situation improves, and justify each.
Read the worked answer
Metrics should be few, hard to game, and tied to the specific findings. Six is enough; more becomes reporting theatre.
Percentage of IT spend transacted under an approved portfolio decision, by unit. Directly measures whether demand is visible to any governing forum. It addresses the root cause rather than the symptom.
Percentage of IT vendor invoices with a matching purchase order or contract reference. A leading indicator of spend outside approved channels; the current figure is 41%, so the baseline and trajectory are both clear.
Number of applications per business capability, with a target ceiling. Captures duplication without pretending that all duplication is waste; the medical-device unit's justified exceptions are shown as approved rather than hidden.
Count of architecture exceptions granted, with approver and expiry. Measures whether deviation is governed or merely tolerated, and forces expiry so exceptions do not become permanent.
IT cost as a percentage of revenue alongside IT cost per unit of output. A ratio alone invites cutting spend that carries risk; pairing it with a value measure prevents the 15% target from being met by deferring necessary work.
Percentage of units with a signed-off IT risk acceptance for their local platforms. Shifts accountability to unit leadership, which is the substance of the governance issue.
Each should have a named owner, a defined calculation method, and a quarterly reporting cadence. Avoid composite maturity scores as the primary board metric: they move slowly and conceal which control failed.