When technical problems become accountability problems
-
At some point, most environments stop having purely technical issues.
They start having ownership issues.
On the surface, everything can look fine:
- Policies exist
- Controls are mapped
- Risks are logged
From an engineering perspective, nothing is obviously broken.
Systems run. Changes get deployed. Issues get fixed.
But there is a different question that tends to get overlooked:
When a decision creates exposure, who actually owns that outcome?
- Not who implements the change.
- Not who maintains the system.
Who is accountable if that decision is challenged later.
That is where things usually become unclear.
Decisions are being made every day across infrastructure, security, vendors, and delivery.
But ownership is often:
- implied
- spread across teams
- or assumed to sit somewhere higher up
It works until it is tested.
And it does get tested, usually by something external:
- an audit request
- a client asking deeper questions
- an incident that needs explaining
At that point, the discussion shifts.
It is no longer about how something works.
It becomes:
“Who approved this, and why was that decision considered acceptable at the time?”
That is the part many environments are less clear on than they expect.
Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd
-
At some point, most environments stop having purely technical issues.
They start having ownership issues.
On the surface, everything can look fine:
- Policies exist
- Controls are mapped
- Risks are logged
From an engineering perspective, nothing is obviously broken.
Systems run. Changes get deployed. Issues get fixed.
But there is a different question that tends to get overlooked:
When a decision creates exposure, who actually owns that outcome?
- Not who implements the change.
- Not who maintains the system.
Who is accountable if that decision is challenged later.
That is where things usually become unclear.
Decisions are being made every day across infrastructure, security, vendors, and delivery.
But ownership is often:
- implied
- spread across teams
- or assumed to sit somewhere higher up
It works until it is tested.
And it does get tested, usually by something external:
- an audit request
- a client asking deeper questions
- an incident that needs explaining
At that point, the discussion shifts.
It is no longer about how something works.
It becomes:
“Who approved this, and why was that decision considered acceptable at the time?”
That is the part many environments are less clear on than they expect.
@phenomlab this is good. I see this happen a lot. It is unclear because usually it is a group talking and going over things and trying to plan according to the knowledge that they have with what is working and not working now. And yet some time down the road, something new comes out, something changes and now what was possible isn’t and vise versa. I have seen these kinds of situations, and I encourage taking very good notes and making them so they are always accessible to you/your team so that way a search can be done and the notes appear and you know exactly why, what, how and where the decision was made.
When I say you, I mean anyone in a position to make decisions that bring about change in whatever area it might be.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login
