A Framework That Fits: Manufacturing Group in 14 Countries
A global industrial manufacturer operates in 14 countries with 22,000 employees and nine ERP instances following acquisitions. A recent internal audit gave a qualified opinion: local IT teams apply different change-management rules, group-level IT policies are 400 pages long and last updated four years ago, and no one can show which IT risks the board has accepted. The board has mandated one IT governance framework by year-end. You have 1.5 full-time staff, no budget for a large consultancy, and a previous attempt that copied a well-known commercial framework produced binders that business units ignored. Country managing directors guard autonomy, and the group CIO is new. The audit committee wants measurable progress in two quarters, not a policy library.
1. How should you establish the framework so it is adopted rather than shelved? Sequence the first two quarters.
Read the worked answer
Adoption depends on making the framework a decision system, not a document set.
Q1 - establish the minimum: start from ISO/IEC 38500 principles and the EDM model. Document the governance charter, decision rights (group vs country vs business unit), risk appetite and acceptance route, investment thresholds, exception process, and a single inventory of material IT risks. Retire or consolidate the 400-page policy set into a short set of mandatory standards plus local procedures. Co-design with country IT and business representatives; do not import a full process framework.
Q2 - implement and prove: pilot in two countries with different ERP instances. Test the decision rights on live investments, run a risk-acceptance case, and publish a one-page board dashboard. Train managing directors on their accountability, not on process detail. Use internal audit to test adoption.
Continual improvement: set a six-month review cycle, capture exceptions and incidents as learning inputs, and report maturity against a simple scale. The audit committee should see adoption and behaviour change, not policy counts.
2. What should continual improvement mean in practice here, and which metrics would you put in front of the audit committee?
Read the worked answer
Continual improvement should be a managed cycle, not an annual document refresh. Use plan-do-check-act: set governance objectives, implement changes, measure adoption and outcomes, then adjust.
For the audit committee, use a small set of balanced metrics:
- Adoption: percentage of material IT investments that passed the decision-rights gate; percentage of countries using the common risk register.
- Effectiveness: time from investment proposal to decision; percentage of benefits baselines met; number of risk acceptances reviewed and expired.
- Conformance: repeat audit findings; change-management exceptions; policy exceptions closed on time.
- Culture: reported near-misses; percentage of business units with a named IT accountability owner.
Avoid counting policies issued or training hours completed. Those measure activity, not governance. Also require an annual independent assurance review and a board discussion of the top three governance weaknesses. Improvement is demonstrated when exceptions fall and decisions speed up, not when the framework gets larger.
3. Country managing directors resist. How do you use the principles of responsibility and human behaviour to handle this?
Read the worked answer
Use responsibility to make accountability explicit and human behaviour to make it workable.
- Separate group-owned decisions (enterprise architecture standards, security, regulatory, group vendors) from local decisions (delivery sequencing, local support, small experiments). Country MDs keep autonomy where it is legitimate.
- Put the split in writing and have the board approve it. Ambiguity is what they are resisting.
- Tie compliance to something they value: faster approvals, fewer duplicate audits, shared supplier leverage.
- Engage the two most influential MDs as co-designers and pilot hosts; peer evidence is stronger than a group mandate.
- Escalate only genuine breaches of the agreed split, not disagreements about local choice.
If a MD refuses, the board should treat that as a conformance issue with a named owner and a date, not as a reason to redraft the framework.