Governance Designed for a Department That No Longer Exists
Photo: Internet Archive Book Images, No restrictions, via Wikimedia Commons
There is a quiet fiction at the heart of most enterprise IT governance: that there exists, somewhere in the organization, a department called IT, and that decisions about technology flow through it. Twenty years ago, this was largely true. Today, at any American company that has adopted product operating models, cross-functional squads, or platform engineering, it is a fiction — and governance structures built on it are failing in ways that show up as stalled releases, orphaned decisions, and risk nobody owns.
The Model That Time Forgot
The classic governance stack — architecture review board, change advisory board, project steering committee — was engineered for an era when technology change moved in quarterly release cycles and sat inside a walled department with a help desk and a capital budget. Control points made sense when change was centralized, infrequent, and slow.
Compare that with a modern product organization: dozens of teams deploying daily, infrastructure consumed as self-service cloud services, and business units commissioning their own tooling. The review board still meets biweekly. The change advisory board still convenes. But the decisions that matter are no longer made in those rooms — they are made in sprint planning sessions and pull requests, far from anyone accountable for enterprise risk.
Where Governance Breaks
In our assessments, the failure points recur with remarkable consistency.
Orphaned decision rights. When a reorganization dissolves the application development group into product lines, who now approves a new data platform? Frequently, nobody knows. The authority existed in a job title that no longer exists. Decisions then default to whoever is most senior in the room — which is governance by hierarchy, not by design.
Approval theater. Teams route requests through legacy review boards to satisfy policy, while the substantive choices — framework selection, data handling, third-party integrations — are made before the board ever sees them. The governance process becomes a rubber stamp applied retroactively.
Risk without a home. Security, privacy, and regulatory obligations assume a central chokepoint for enforcement. When technology decisions are distributed, obligations fragment with them. The audit findings that follow are rarely about bad intentions; they are about structural gaps.
Rightsizing Oversight for the Product Era
The remedy is not more governance, nor the libertarian fantasy of none. It is governance recalibrated to where decisions actually occur.
Move from gating to guardrails. Replace pre-approval gates with automated policy enforcement — paved-road platforms, codified security baselines, policy-as-code. Teams retain autonomy within boundaries that are technically enforced rather than procedurally policed.
Assign decision rights explicitly. Every consequential technology decision class — data classification, vendor selection, architectural patterns — should have a named owner documented in a decision-rights register, updated at every reorganization. If a reorg cannot produce this register, the reorg is incomplete.
Govern the platform, not the projects. Central oversight should concentrate on the shared capabilities all teams depend on: identity, data infrastructure, security tooling. Team-level choices within those platforms need far less scrutiny than the platforms themselves.
Tie governance cadence to change cadence. Quarterly boards reviewing daily deployments is arithmetic nonsense. Continuous delivery requires continuous, automated oversight — with human review reserved for the genuinely consequential.
An Uncomfortable Conclusion
Legacy governance persists not because it works but because dismantling it requires someone to admit the org chart it was built on is gone. Enterprises that make this admission — and redesign oversight around distributed decision-making — ship faster and carry less unmanaged risk. Those that do not will keep holding meetings about decisions that stopped being theirs to make years ago.
