The Board Bypass on a Cloud ERP and Loyalty Platform
Northwind Retail Group operates 420 stores and a loyalty program with 3.8 million active members. At the March board meeting, the CIO presents a proposed five-year, €18 million contract for a cloud ERP and loyalty platform. The CFO has already signed a non-binding letter of intent; the vendor is sole-source, and production data would reside in a country where the group has no operations. The proposal contains no quantified business case, no independent risk assessment, and no exit plan. The audit committee first learned of the project when a loyalty outage affected checkout for six hours. The board charter delegates IT spending below €25 million to the CFO, but the charter also says the board governs “significant strategic IT risk.” The CEO wants the board to “rubber-stamp” the deal at the next meeting so the vendor can start in eight weeks.
1. Is this primarily a governance failure or a management failure? Identify the missing Evaluate, Direct and Monitor activities and explain why the CFO’s signature does not settle the matter.
Read the worked answer
Conclusion: It is both, but the board-level failure is decisive. Management owns procurement execution; the governing body owns governance and cannot treat a delegated signature as absolution.
Evaluate: The board did not evaluate strategic fit, options, total cost, data-residency risk, vendor lock-in, or the absence of an exit plan. A letter of intent does not remove the need for a decision gate.
Direct: It did not direct a delegated authority framework, require a business case, or set conditions for signature. The €25 million delegation is a spending threshold, not a transfer of accountability for significant strategic risk.
Monitor: It learned only after an outage, so there was no reporting on project risk, benefits, or conformance with the charter.
The CEO’s eight-week timetable is schedule pressure, not a governance rationale. The board should pause signature, require an independent options appraisal and risk assessment, and record a decision with conditions. That is judgement, not a technical architecture decision.
2. Which ISO/IEC 38500 principles are most implicated, and what binding directives should the board issue before any contract is signed?
Read the worked answer
Most implicated: Responsibility - unclear decision rights between the CFO, CIO, board, and audit committee. Strategy - no demonstrated link to the retail and loyalty strategy. Acquisition - sole-source, no options analysis, no exit plan, weak probity. Conformance - the charter’s significant-strategic-IT-risk clause was bypassed. Performance may also be implicated because benefits are unquantified.
Binding directives before signature: (1) suspend the letter of intent until board approval; (2) require a quantified business case with alternatives and whole-life cost; (3) require data-residency, security, and vendor-lock-in assessment; (4) require an exit and transition plan; (5) clarify delegation - the CFO may negotiate, but the board approves significant strategic IT commitments; (6) set stage-gate reporting to the board.
The board should not select the vendor, but it must direct the conditions and monitor compliance. If the vendor refuses, the board should be willing to walk away. That is the test of governance, not whether the contract is popular with the CEO.