IT governance: deciding what gets funded and who answers for it

A three-hundred-person services company approves its technology budget every November, in forty minutes. The head of technology presents the costs, finance asks about the two or three that went up, an even percentage is cut across the board and the budget is approved. Nobody asks what the company bought with the previous budget. And nobody could answer, because the place where that answer would be written does not exist.

Three years later that company has four systems that do similar things, two contracts that renew themselves and a project that has been ninety per cent done for fourteen months. None of the three is a technical problem. All three come from the same absence: nobody defined who decides what, on what criteria, and who answers for it. That is technology governance, and it is neither a committee nor a certification.

A system ages by itself; a plan does not appear by itself

The United States Government Accountability Office, the GAO, reviewed eleven critical federal systems in July 2025. Eight used obsolete programming languages and seven ran with known vulnerabilities. But the figure that matters is another one: only three of the eleven had a documented modernisation plan (GAO-25-107795). In that group, the lack of a plan was more common than any of the technical problems the plan would have to solve.

A plan appears when someone has the authority to ask for it and the obligation to review it. That someone is rarely in technology. It is whoever signs the budget.

Governing is not managing

A committee discussing which laptop supplier to hire is managing, even if it is called a governance committee. The ISO/IEC 38500 standard, in its 2024 edition, describes what those who govern do with three verbs: evaluate, direct and monitor. Underneath sits management, which plans, builds and operates. It is not a lower rung: it is different work.

The practical test fits in one line. If the decision can change the budget, the accepted risk or who answers for it, it is governance. If it only changes how something already decided gets done, it is management, and it does not need the chief executive in the room.

The decisions nobody owns

When a decision has no owner, it still gets made. Whoever has the urgency closest makes it: the supplier who needs to close the quarter, the department that secured its own budget, the engineer who solved Friday’s problem with the tool they already knew. That is why the first exercise is not drawing an organisation chart, but listing the concrete technology decisions and writing a person’s name next to each one. For example:

• Which system is the official one when two hold the same data.
• Who approves a purchase above which amount, and when that amount was last reviewed.
• Who accepts the risk of operating with an open security finding.
• Who can stop an initiative that is already under way.

The lines left blank, or with two names, are the governance model still missing. A department does not answer the phone, and neither does a vacant post.

Three pots and a written proportion

Approving the budget line by line is the surest way not to govern it, because the discussion concentrates on what can be compared with last year, which is what already exists. The same GAO report notes that federal agencies spend about eighty per cent of their technology budget operating and maintaining what they already have. It is a government and not a mid-sized company, but the mechanics carry over intact: the budget for change is whatever is left after sustaining.

The alternative is to split the budget into three pots: sustain what works today, improve existing processes, and bet on what could change how the company makes money. The right proportion depends on each company. What does not depend is that it has to be written down before the money is allocated, because sustaining is the only pot whose costs arrive on their own, with an invoice and a date.

Stopping in time

A gate is a point fixed in advance at which someone decides, against a written condition, whether the initiative continues, is corrected or stops. What sets it apart from a progress report is that at the gate the answer can be no.

The UK National Audit Office reviewed the transformation programme of National Savings & Investments, the state savings bank, in November 2025. By the date it should have been finished, it had spent one hundred and eleven million pounds without modernising a single live service (NAO, HC 1379). A cost overrun is spotted by looking at the invoice. This is not spotted by looking at anything, because nobody had the obligation to check that there was a result.

The cheapest moment to stop is before the contract is signed. After signing, the conversation is no longer about whether the initiative works but about how much it costs to get out, and in that conversation the company negotiates from behind.

What to do this month

• Take the list of decisions to the committee and write next to each one who makes it today, not who should.
• Put the proportion between sustain, improve and bet in writing before the next budget is allocated.
• Require every new initiative to arrive with its baseline measured and with the condition that would trigger stopping it.

Technology governance is not proven by approving well. It is proven by stopping in time, and that requires having written down beforehand the condition for stopping, back when it did not hurt yet.