Insurer with no board IT agenda: governance or management failure?
Meridian Mutual is a mid-sized general insurer with 1,800 staff and £340 million in gross written premium. Its nine-person board includes one director with a technology background. The board has no standing IT agenda item; the audit committee receives a three-page IT update twice a year, prepared by the CIO. The CIO reports to the CFO and chairs the IT steering committee. There is no board-approved IT strategy - the only plan is the CIO's 40-page departmental roadmap. Last quarter, the core claims platform failed for four hours, delaying 11,000 claims and triggering a regulatory notification. The root cause was an unsupported database version; the upgrade had been deferred twice for budget reasons. Board minutes record the outage as 'IT noted'. The board now asks whether it has been governing IT adequately and what must change before the next renewal cycle.
1. Was the outage a governance failure, a management failure, or both? Justify your answer using the distinction between governance and management in ISO/IEC 38500.
Read the worked answer
Both, but the governance failure is the more important finding. ISO/IEC 38500 defines governance of IT as the system by which the current and future use of IT is directed and controlled; management is the execution of that direction. The board did not evaluate the risk of an unsupported platform, did not direct an accountable owner or risk appetite for core-system resilience, and did not monitor availability or remediation. Those are governance omissions. The deferral of the database upgrade was a management decision, but it became a governance issue because no escalation route forced the risk into board view. The board is not expected to choose database versions. It is expected to ensure that someone is accountable, that the risk is visible, and that assurance exists. Treating the outage as 'IT noted' collapses that distinction and leaves the same gap in place.
2. Identify which of the six ISO/IEC 38500 principles are most exposed and explain the evidence for each.
Read the worked answer
Responsibility is most exposed: the CIO chairs the steering committee, reports to the CFO, and no board member owns IT on the board's behalf. Strategy is exposed because there is no board-approved IT strategy, only a departmental roadmap. Performance is exposed because the board sees a three-page update twice a year and no availability, incident or remediation metrics. Conformance is exposed because the regulatory notification was handled operationally without board oversight of compliance obligations. Acquisition is also weak: the upgrade deferral was a budget decision without a documented risk trade-off. Human behaviour is less clearly breached on the evidence, though the absence of claims-handler input into the roadmap would matter. The pattern is not six separate failures; it is a missing governance system, which is why responsibility and strategy should be fixed first.
3. Recommend a minimum viable governance structure and reporting set for the board, with three specific artefacts.
Read the worked answer
A minimum viable structure keeps accountability with the full board and uses a committee only as a working mechanism. Three artefacts: first, a one-page IT strategy and risk appetite approved by the board, covering availability of core systems, data protection and investment limits; second, a delegated authority matrix that says who may approve which IT spend and risk acceptance, with the CIO as accountable executive but not sole assurance; third, a quarterly assurance dashboard with incidents, availability, overdue remediation, audit findings, benefits realized and regulatory matters. The board should also require an annual independent review of core-system resilience. Reporting lines matter: the CIO can remain under the CFO, but the board needs direct access to the CIO and to internal audit. The test is not whether the board sees more paper; it is whether the board can evaluate risk, direct action and monitor results.