IT Governance Frameworks

Most digital transformations don't fail because of the tech. They fail because of the 'silent resistance.' Here is how we solved for that at a 20,000 FTE multinational. I used to Chair the Infrastructure Change Control Board (ICCB), a brainchild of their visionary MD. It was a perfect governance measure at a time when GRC practices were still maturing in the Indian corporate scene. ICCB did the following things right : ✅ Cross-Functional Representation : Including members from Sales, Transitions, HR, Security, Finance and Legal in addition to IT & Infra, it ensured that enterprise interdependencies were deliberated ✅ Risk based Tiered Ranking : Change requests mapped to the operational risk rating framework, thereby following a standard tiering methodology (eg Significant, Minor, Emergency) with associated actions, implementation schedules, controls ✅ Post Implementation Reviews : Regular status review of approved changes to ensure adherence to schedule, sign-offs, dependency checks and also analysis of delayed / failed projects. It was a classic case on how governance, done right, doesn't slow things down, but enhances efficiency by advance planning and analysis of the required steps and cross-dependencies, thereby reducing "rework" caused by failed changes. Why are the above important? Most of us have seen enthusiastically designed automation or transformational programs - technically sound, strategically aligned, having the governance structure in place and budget allocated - failing to execute.   The Real Barrier? The Human Element. It’s rarely a lack of skill. It’s often 'Silent Resistance' born from: ▪️Communication Gap : Often the leadership fail to communicate or explain the link of the 'why' of #automation to the broader business vision ▪️ Anxiety : There's angst of a probable downsizing due to automation, specially with AI projects, that stall adoption ▪️Exclusionary Engagement : When the support functions feel detached, they (quietly) deter implementation. Board & executive level success factors for transformation / automation programs include : ✔️ Communication Plan - customized to, but covering all stakeholders ✔️ Training - as a capability builder where people learn to improve through continuous usage, rather than passing an one-time assessment test ✔️ Accountability - Identify champions within each business function to guide, monitor, provide feedback and ensure successful adoption ✔️ Support - Set up a team to act on feedback and regularly report back improvements to the relevant governance council. ✨ An effective change management process is the bridge that can shift a departmental initiative into an 'Institutional Process'. What's your biggest hurdle in driving cultural acceptance for large-scale automation? Let's discuss in the comments.   #ChangeManagement #StakeholderEngagement #technology #DigitalTransformation #BoardGovernance

Most digital councils look important on the org chart. In reality, many are ceremonial rubber‑stamp forums with excellent catering and zero impact. If a governing council doesn’t have three things, it will not enable real digital innovation: 1️⃣ Autonomy: the right to decide, not just “recommend” If every decision has to bounce between functional heads and the C‑suite, you don’t have governance – you have a bureaucracy. A serious council can: →Approve investments up to a clear threshold →Kill or pivot projects that aren’t working →Reallocate resources between teams No autonomy = no speed. Just more PowerPoints. 2️⃣ Accountability: Whose neck is on the line? With autonomy comes responsibility. The council must be the single point of authority for digital transformation – whether the work sits in finance, sales, IT or marketing. That means: → Defining what success looks like up front → Reviewing a balanced scorecard and milestones in every meeting → Assigning named owners to corrective actions If it’s everyone’s responsibility, it’s no one’s responsibility. 3. Structure: small enough to decide, big enough to be taken seriously! There is a simple pattern: → The bigger the council, the slower the decisions and the fuzzier the accountability. Keep it: → Lean in size → Cross‑functional enough to avoid silos → Empowered to decide in the room, without “taking it offline” to ten other executives Otherwise, you get groupthink, time‑boxed monologues, and “let’s revisit this next month”. If a steering committee can’t: ❌ Say “yes” and “no” to money, ❌ Name who owns outcomes, and ❌ Make decisions in the room, …then it’s not a governance body. It’s a very expensive calendar invite.

In investor-backed fintech platforms under performance pressure, where CEOs sponsor transformation programmes, a common misconception is that digital transformation is a one-off initiative with a defined start and finish. In practice, treating it this way creates a sharp delivery peak followed by a decline in ownership, with limited capability left behind to sustain or evolve what has been built. Technology may go live, but without embedded change, governance, and continuous improvement mechanisms, the organisation reverts to prior behaviours and operating models. In a previous role, I led a delivery function comprising Programme Managers, Project Managers, Business Analysts and PMO across a multi-phase transformation that had initially been structured as a discrete programme. The challenge was that, once initial milestones were achieved, there was no clear transition into business-as-usual ownership, and improvements began to fragment across teams. I restructured the approach to establish transformation as a continuous delivery capability rather than a time-bound initiative. This included aligning programme leadership with operational ownership, introducing governance that supported ongoing prioritisation, and ensuring that business engagement and benefits tracking were maintained beyond initial go-live. This allowed delivery teams to operate within a sustained framework where change, optimisation, and iteration were part of the operating rhythm rather than dependent on ad hoc initiatives. At this level, transformation is not something an organisation completes — it is something it builds the capability to continue. For others operating in this space, I've love to know your thoughts. Do connect with me too.

Why Deregulation Won't Stop the Need for Digital Governance Skills In HR and Recruitment, we often view digital governance (privacy, AI ethics, and data security) as a compliance burden driven strictly by the legal landscape. We assume that if the regulations disappeared, the pressure would vanish (hello, potential delay in EU AI Act High Risk rules..) However, the latest data suggests the opposite. According to the Organizational Digital Governance Report 2025 by the IAPP, 87% of organisations would continue to invest in and support digital governance activities even in a deregulated environment. Why would businesses maintain these strict standards voluntarily? The drivers have shifted from legal necessity to brand survival. The top two factors motivating organisations to deliver on digital governance are now impact on reputation (87%) and consumer expectations (79%). What does this mean for HR leaders? If governance is no longer just about avoiding fines, but about maintaining trust, the responsibility moves closer to the People function. We are moving away from governance as a legal checklist and towards governance as a cultural competency. Three key takeaways for your talent strategy: Training is an Innovation Driver: 32% of respondents cited workforce training as a primary incentive for digital innovation. We must equip our teams not just with technical skills, but with the ethical frameworks to make decisions that protect the organisation’s reputation. Adaptability is Essential: 60% of organisations take a global approach to governance but with variations based on local requirements. Your talent pipeline needs leaders who can navigate a fragmented regulatory map, balancing global standards with local nuance. Risk is Now Reputational: With 'Technological Risk' cited by 62% of organisations as a motivator, our recruitment processes for technical roles must assess candidates for their understanding of risk and ethics, not just their coding ability. As we integrate AI deeper into our workforce, the question is not "is this legal?", but "does this align with the reputation we are trying to build?".

Beyond Burning The RedTape: Whilst the first horizon of digitalization in governance has largely been rooted in efficiency—reducing bureaucracy, minimizing friction, and streamlining data processes—it remains embedded in the same underlying thesis of governance. It has undeniably improved user experience and outcomes, but it has not fundamentally changed the way governance operates. However, we are now reaching the limits of this approach. This efficiency-driven model is not sufficient to meet the real 21st-century challenges we face—challenges defined by systemic turbulence, deep uncertainty, and a new class of General Purpose Technologies. What digitalization is actually enabling, if we choose to see it, is a new thesis on governance—one that moves beyond efficiency to open up entirely new architectures of governance. This shift allows for parametric governance (where rules dynamically adjust based on real-world conditions), contingent governance (where policies evolve based on changing contexts), and outcome-oriented governance (where governance is judged by systemic impact rather than compliance with static rules). More importantly, digital governance in its current capacity is also opening up a framework for machine-assisted, learning-oriented governance—where rules are continuously evolving and adapting, with transparent, natural-language storytelling explaining how and why these rules are changing. Fundamentally, this thesis of governance breaks the binary logic that currently dominates the debate. The old paradigm forces us to choose between more governance to control markets or deregulation as a means to free markets from governance altogether. But this binary is obsolete. What we actually need is a third pole—one where governance itself is radically transformed to operate within a landscape of large-scale turbulence, rapid innovation, and fundamental uncertainty. For the first time, we now have the bureaucratic capacities to evolve governance continuously, responsively, and dynamically. This is the race we must take: to establish a third pole of governance—one that is no longer about rigid control or its absence, but about designing governance that is contingently variant, structurally adaptive, and capable of learning in real time. If we fail to do this, we remain trapped in 20th-century governance models, unable to respond meaningfully to the complexity of the 21st century. #WorldGovernanceSummit.

- From Policy to Digital Execution - I share this not only as Acting Commissioner General of the Internal Revenue Commission, but as a Head of Tax Administration navigating one of the most consequential shifts in public finance management. With the launch of our Digital Transformation Strategy 2026–2028, aligned to the Organisation for Economic Co-operation and Development Tax Administration 3.0 principles and PNG’s Medium Term Development Plan IV, we have moved from discussion to execution. Modern tax administration is not about collecting returns. It is about designing systems where compliance happens naturally. Leading administrations are embedding tax rules into banking platforms, accounting software, and digital marketplaces — consistent with the OECD Tax Administration 3.0 framework, where tax becomes part of the taxpayer’s natural systems. For Papua New Guinea, this means: • Moving from paper-heavy processes to machine-readable rules • Integrating with financial institutions and digital service providers • Using data analytics for real-time compliance monitoring This is not automation for its own sake. It is about reducing friction, strengthening voluntary compliance, and building trust. Digital reform is not an ICT project. True transformation is: • Strategy-led • Governance-anchored • Business-driven • People-enabled By 2028, we are targeting: • 90% of taxpayer interactions digitised • 80% of tax processes embedded in natural systems • 100% of staff digitally trained • 50% improvement in taxpayer satisfaction These are institutional performance commitments. In developing economies, revenue growth cannot rely solely on higher rates. It requires broadening the tax base, detecting non-compliance earlier, simplifying compliance for honest taxpayers, and leveraging data across government. Digital maturity strengthens revenue performance and system integrity. When systems are predictable and automated, discretion reduces — and so does risk. Technology can be procured. Skills can be trained. Mindset change requires leadership. Digital transformation is institutional reform. The question is no longer whether to transform — but whether we are prepared to lead with discipline and clarity. #PNGIRC #DigitalTransformation #RevenueReform #Leadership #Governance

Lately, I’ve been part of several executive conversations about technology onboarding and modernization. Different sectors. Different systems. But the same underlying tension. The challenge isn’t finding solutions. It’s leading through the decision responsibly. Too often, organizations approach major technology investments as procurement events. A tool is identified. A budget is justified. A contract is signed. But sustainable modernization is not a purchasing decision. It’s a governance commitment. When onboarding technology at enterprise scale, leadership must ask: • Who will own this long after implementation? • How does it integrate into the broader architecture? • What internal capability must mature alongside it? • How does it advance mission, not just functionality? • What accountability structure ensures it delivers measurable value? Innovation without structure creates complexity. Structure without vision creates stagnation. Trusted leadership holds both. Modern CIOs are not just technology adopters. We are stewards of risk, architects of alignment, and protectors of long-term integrity. The real work is not installing systems. It’s building clarity, accountability, and trust around them. That is what sustains organizations. #TrustedCIO #TechnologyLeadership #Governance #DigitalTransformation #PublicSectorIT #ExecutiveLeadership #NextGenCIO

The New Governance Issues: AI Execution & Digital Readiness In more and more boardrooms today, I’m seeing a shift: AI execution, data governance, and digital readiness are no longer viewed as “technology matters.” Today they are increasingly viewed as governance matters. And activists have noticed. In recent months, activists have begun to probe companies on the gap between their stated digital ambitions and their actual ability to deliver measurable AI-driven value. They’re scrutinizing everything from data architecture and model-risk controls to adoption rates and ROI. In some campaigns, the pressure point isn’t compensation, it’s audit and risk oversight. For Boards and executive teams, the message is clear: If AI is truly “core” to strategy, there must be clear ownership, clear metrics, and clear evidence of execution. What I’m advising leaders today: • Treat digital and data readiness as part of enterprise risk—and review it with the same rigor you apply to financial controls. • Define 12–24-month AI value roadmaps tied to accountable owners, budgets, and hurdle rates. • Track results using business KPIs, not vanity metrics. • Strengthen model-risk governance: inventory, testing, monitoring, and documentation. • Educate the Board, especially Audit and Risk committees, so oversight keeps pace with velocity. • Ensure disclosures match reality, activists are reading between the lines. This isn’t about building flashy innovation labs. It’s about alignment, accountability, and execution, exactly the areas where governance matters most. The companies that get this right won’t just avoid activist pressure, they will accelerate value creation. #CorporateGovernance #Boards #ExecutiveLeadership #AI #DataStrategy #RiskManagement #DigitalTransformation

🚨 Most Digital Transformations Aren’t Failing… They’re Working Exactly as Designed (And that’s the real problem.) For years, we’ve blamed failed digital initiatives on technology, frameworks, budgets, skills shortages, or “resistance to change.” But here’s the uncomfortable truth: Your digital business is performing precisely how it was architected, governed, and culturally enabled to perform. - If outcomes are inconsistent… - If resilience is fragile… - If accountability is murky… - If frameworks like NIST CSF, GRC, ITSM, ISO, and AI operate in silos… That isn’t failure.......That is design intent made visible. Organizations don’t rise to the level of their strategy. They fall to the level of their governance—and the culture that enables it. 🔥 Frameworks Don’t Transform Organizations. Culture Does. Governance Does. Evidence Does. We keep throwing more tools, certifications, dashboards, and frameworks at the problem. But without a unifying governance overlay that connects them all, what we really create is: - Fragmented controls - Unverifiable outcomes - Accountability dead zones - Resilience theater - AI adoption without assurance “Check-the-box” compliance masquerading as risk management. No wonder leaders feel blindfolded while steering billion-dollar digital enterprises. 💡 Enter the Digital Value Management System (DVMS). A DVMS is not another framework. It’s the missing governance system that: - Unifies NIST CSF, GRC, ITSM, AI, ISO, COBIT, and more - Aligns culture with governance - Turns evidence into action - Delivers resilience you can prove - Assures performance you can trust - Creates accountability you can see In a world drowning in complexity, DVMS does the one thing no tool or framework can: It makes the digital business work as designed—reliably, transparently, and measurably. 🚀 The Next Era of Digital Leadership Isn’t About Technology. - It’s about governance intelligence. - It’s about culture-enabled accountability. - It’s about evidence-based assurance. - It’s about resilience by design, not by hope. If your digital investments aren’t producing the outcomes you expected, don’t blame the tools. Blame the absence of a system that connects them. ❓ Provocative Question for Digital Leaders: If you can’t prove your digital business is working as designed….Can you honestly say you’re in control of it? Comment below — I’m ready for the debate. 👇

One of the most overlooked risks in digital transformation is governance. In boardrooms, conversations about ERP, AI, cybersecurity, and ESG often stay at the altitude of budgets, timelines, and vendor selection. Meanwhile, execution teams are wrestling with process debt, cultural friction, and data integrity challenges that never quite make it into the board deck. That disconnect creates exposure. When boards don’t have clear visibility into: • Architectural dependencies • Data maturity and integrity • Process standardization gaps • Change adoption metrics • Decision-right clarity They’re not actually governing transformation... only monitoring spend. Digital transformation today isn’t an IT initiative. It’s enterprise risk management. It’s capital allocation. It’s operational resilience. And it requires a governance model that connects strategy to system architecture and cultural readiness. Organizations must define measurable non-negotiables upfront: What must improve? What risk must decrease? What capability must be institutionalized? Boards and executive teams need shared language around architecture, risk, and decision intelligence. That’s where durable value gets built.