Dispensation at the Payments Deadline
Meridian Bank's payments programme is six weeks from a regulatory cut-off. The solution team has designed an on-premise message broker because its latency tests failed against the approved cloud event hub. The hub has been the mandated target standard for 14 months, and three exceptions are already live. The Architecture Board meets monthly; the next quorum is in three weeks. The programme director asks the Chief Architect to 'approve it now and document it afterwards'. Two board members have already objected, and a post-implementation compliance review is scheduled. The Chief Architect has delegated authority only for low-risk, reversible deviations.
1. What governance route should the Chief Architect take, and what must any approval contain?
Read the worked answer
Informal approval is not a governance route. The correct mechanism is a time-bound dispensation granted by the Architecture Board, or by the chair under a documented urgent-action procedure if quorum cannot be assembled. Because the Chief Architect's delegation covers only low-risk reversible deviations, a regulatory-critical, standard-breaking broker choice is outside it. The dispensation should record: the precise standard being waived; why latency tests failed; risk and compensating controls; the affected architecture contract; an expiry/review date; a remediation or convergence plan; and a requirement for post-implementation compliance review. It should be entered in the governance log and reported to the Board. 'Document afterwards' reverses accountability: the decision must be documented before implementation, even if some evidence is completed later.
2. How should the architect handle the programme director and the objecting board members?
Read the worked answer
Separate the regulatory deadline from the architecture decision. Tell the programme director that the fastest defensible path is an out-of-cycle Board decision or chair's action with conditions, not an unrecorded approval. Give the objecting members the risk assessment and proposed compensating controls in advance; record their dissent and the rationale in the minutes. Brief the regulator-facing owner on the residual risk. If the Board refuses, escalate through the CIO or sponsor rather than approve unilaterally. Also vary the architecture contract so the programme's obligations match the dispensation, and schedule the compliance review. This preserves transparency and keeps the deadline decision auditable.