Who Owns IT Governance at a Mid-Sized Insurer?
A 1,200-employee specialty insurer has grown through acquisitions. IT is split across three units: core policy administration, digital channels, and a recently acquired claims platform. The CIO reports to the CFO, while each business unit funds its own IT projects. The board's audit committee has just seen an internal audit report noting duplicate software licences, an unreconciled disaster-recovery test, and business managers commissioning SaaS tools without security review. The CEO asks you, as incoming lead IT governance manager, whether the answer is to centralise all IT under the CIO and freeze discretionary spend. The CFO supports centralisation; business unit heads resist, arguing that their projects are closer to customers. The board wants a recommendation before the next quarterly meeting, with no additional headcount and a six-month horizon.
1. Using ISO/IEC 38500, diagnose the governance failure. Which principles are most relevant, and why is a centralisation mandate not the same as governance?
Read the worked answer
ISO/IEC 38500 distinguishes governance from management. The board governs by evaluating, directing and monitoring; management plans, builds and runs. Centralising IT under the CIO is an operating-model choice, not a governance fix, and it would not by itself create clear decision rights or accountability.
The most relevant principles are:
- Responsibility: accountability for IT outcomes is fragmented across business units, the CIO and the CFO. Nobody owns the duplicate licences or the unreconciled DR test.
- Strategy: unit-level projects are funded without a group view of capability and risk.
- Conformance: SaaS purchases bypass security and regulatory review; the DR evidence is not reliable.
- Human behaviour: business heads resist because centralisation threatens autonomy and customer responsiveness, so a mandate would produce compliance theatre.
A better diagnosis is that decision rights, risk acceptance and performance reporting are unclear. The board should set the governance framework and require transparency, while allowing local delivery within guardrails. That preserves business closeness and fixes accountability.
2. Draft the board-level decision the CEO should take at the next meeting. State what is evaluated, what is directed, and what evidence will be monitored.
Read the worked answer
At the next meeting the CEO should take a decision that is explicitly an EDM decision, not a reorganisation announcement.
Evaluate: the current decision-rights map, the top five IT risks (duplicate licences, DR, unvetted SaaS, acquisition integration, key-person dependency), the cost of fragmentation, and options: full centralisation, federated guardrails, or a shared-services model. Include business-unit evidence, not only CFO preference.
Direct: approve a six-month governance remediation: a decision-rights matrix distinguishing group-owned standards from local delivery choices; a mandatory SaaS intake with security and privacy review; a funded DR remediation with a retest date; a licence baseline and consolidation target; and a requirement that every material IT investment has a named business owner and benefits baseline. Do not freeze all spend; freeze only non-compliant exceptions.
Monitor: quarterly metrics - percentage of IT spend visible to group, SaaS exceptions closed, DR test result, licence savings, project benefits variance, and audit findings. Assign assurance to internal audit.
This addresses the CFO's concern without making centralisation the objective. The board retains accountability; management owns execution.