Federated logistics group with 63 SaaS applications and local approval autonomy
Nordwind Logistics operates in 14 countries with 9,000 staff. Local managing directors can approve SaaS spend up to €150,000 without group IT review. The group CIO sets architecture standards but has no veto. An inventory finds 63 SaaS applications, 22 holding customer or employee personal data; 11 were unknown to group IT. Three store data in countries the group's data protection officer considers high risk; two have no documented exit plan. The board's digital transformation committee has approved a 'cloud-first' strategy but has never seen the application inventory or a data residency map. A customer complaint about cross-border data access has reached the board. The group general counsel asks how governance should be tightened without stopping local responsiveness. Local managing directors say central review adds six weeks to procurement and they will lose contracts.
1. Apply Evaluate, Direct and Monitor to this federated model. What should be centralized and what should remain local?
Read the worked answer
Evaluate belongs at group level for the things that create group-wide risk: data classification, data residency, security baselines, architecture principles and vendor exit. Direct should set a delegated authority framework that distinguishes local discretion from group-level decisions. Local managing directors can evaluate business fit and choose vendors within a pre-approved catalogue and a low threshold. Group functions must direct the non-negotiables: any application holding personal data, any cross-border data flow, any contract above a threshold, and any system without an exit plan. Monitor should be a live register, not an annual inventory. The judgment is not 'centralize everything' or 'let locals move fast'. It is to centralize the risk appetite and the exceptions, and decentralize decisions that fit within pre-approved boundaries. The six-week delay claim should be tested; a well-designed fast-track review for low-risk SaaS can take days, not weeks.
2. Design a delegated authority framework with at least three tiers and the conditions attached.
Read the worked answer
A three-tier framework: Tier 1, under €25,000, no personal data, standard contract and a pre-approved vendor - local managing director approves and records in the register within five working days. Tier 2, €25,000 to €150,000, or any personal data - local approves commercially, but group IT, security and the DPO must review data residency, security and exit before signature; target ten working days with a deemed-approval escalation. Tier 3, above €150,000, or high-risk data, or non-standard contract - group CIO and DPO recommend, and the group digital committee or board delegate approves. Conditions at every tier: data classification, DPIA where required, exit and data-return plan, security assessment, and registration before go-live. The thresholds should be reviewed after 12 months. The purpose is to make the safe path the fast path, not to add a central bottleneck.
3. How should the board assure itself that the new framework is working within 12 months?
Read the worked answer
The board should monitor leading and lagging indicators. Leading: percentage of new SaaS recorded in the register before go-live; median review time by tier; percentage of contracts with exit plans; number of exceptions granted. Lagging: percentage of the 63 applications with a completed DPIA; data residency exceptions; security incidents linked to unsanctioned SaaS; audit sample findings; local satisfaction with the process. The board should commission an independent sample audit after six months, not rely on the register's completeness. Escalation triggers: any unregistered application holding personal data, any high-risk data flow without DPO sign-off, review time above the service target for two consecutive months, or a data incident. Reporting should go to the digital committee quarterly and to the full board annually, with the group CIO and DPO jointly accountable for the framework and local managing directors accountable for compliance in their entities.