Chief Information Officer / India
The convenient technical answer needed another question
- A continuing thermal service
- Seven industrial clients
- 310 company employees and ₹176 crore FY26 service fees
- Defined information responsibility
- 36 IT colleagues
- Four leads, ₹6.8 crore FY2026–27 expense and separate ₹2.7 crore change programme
- Applications to enterprise judgement
- 30 years
- Five appointments from July 1996; CIO since January 2022
Decisions & consequences
01Reconsidering the permissions carried by a copied customer workspace
In 2023 we reviewed 240 documents held in a customer collaboration service. Forty-eight had been available outside the intended customer group because a reused workspace pattern retained broader permissions. I had approved the pattern as a way to simplify administration. The technical reuse was convenient, but the permission it carried had not been reconsidered for each setting. That was an error in the management definition of completion as well as in implementation.
The immediate proposal was to correct the groups and announce the issue resolved. I supported prompt containment, but not the conclusion that a configuration repair settled what had happened. Logs showed access to fourteen of the forty-eight documents. For thirty-four, no access event was observed in the available evidence. Those categories did not establish that the latter documents had never been accessed or that all consequences were known. Qualified security, legal and customer-relationship owners needed to assess the incident, preserve relevant evidence and decide the appropriate communications and actions.
We funded ₹58 lakh for the response, review and changes. My team worked on the access arrangement and the evidence it could supply. The responsible specialists assessed the obligations and consequences; I did not substitute a technology sign-off for their conclusions. Customer material was not reproduced in the review's public account. Technical director Yusuf Dorzemi also helped distinguish collaboration documents from plant-control authority, so the response did not create an unsupported claim about operating systems outside the affected service.
The revised arrangement required an explicit audience decision when a customer workspace was established. Review used suitable test material and the responsible business owners instead of relying on the appearance of the folder structure. The corrected permissions addressed the identified availability problem, while incident assessment and any resulting customer obligations followed their own process. We did not claim that the cost represented prevented losses or that the absence of a known consequence proved an absence of exposure.
The change reduced the convenience of copying a familiar pattern without further discussion. I accepted that cost because reuse should preserve useful structure, not silently extend authority. My own lesson was to ask which business decision a template makes on behalf of its next user. A process can be technically repeatable and still require a fresh judgement about whose information belongs within it.
Keeping a usage peak separate from the software entitlement being proposed
A 2024 software proposal priced a service for 280 named users at ₹1.8 crore annually. Our usage report showed a peak of fifty-two simultaneous users. The difference prompted a suggestion that we could purchase only enough seats for the peak and share access across the larger population. That would have treated two distinct concepts as interchangeable. The proposal's named-user basis required examination of actual terms and individual requirements, not an assumption drawn from concurrency alone.
Procurement wanted a faster negotiation and reasonably questioned whether the initial requirement was inflated. Finance wanted the commercial opportunity examined rather than dismissed as a technical matter. I agreed that the 280-person request needed scrutiny. I opposed using the usage peak as an entitlement conclusion before the supplier and our legal and commercial owners had clarified the arrangement. Technology could explain who used the service and for which tasks, but it could not create permission to share accounts by changing the way a chart was labelled.
The assessment cost ₹46 lakh. We reviewed the work associated with each proposed user and the service options available under the actual proposal. The resulting requirement identified 213 people needing the paid tier and sixty-seven whose work could use another approved route. Those groups totalled the original 280. The result did not mean that fifty-two licences were sufficient, that every occasional user required the same tier or that the remaining route was interchangeable with full access. Each decision needed a defined use and an authorised basis.
We took the narrower requirement back into commercial discussion. The ₹1.8 crore annual figure remained the original quote, not money already spent or a realised saving. I did not multiply a reduced headcount by an assumed unit price and report the difference as cash released. Actual terms, service scope and later expenditure would determine the financial account. The assessment itself remained a cost even if the negotiation eventually produced a better arrangement.
My lesson was to examine what a purchasing measure counts before using a technically correct usage statistic to challenge it. A low simultaneous peak may reveal something useful about demand, but it does not answer every question about entitlement or the work different people need to perform. I would now ask for the role-based requirement and the proposed commercial basis together, so a negotiation begins with a defensible account instead of a convenient subtraction.
Retaining the old service when the export preserved files but lost their relationships
A 2025 supplier transition covered 160 project records and 1,200 attachments. The first export contained the expected files, and technical checks confirmed that the attachments were present. The programme proposed closing the old service on that basis. Business review found a different problem: fourteen projects lacked dependable relationships linking the transferred material to the relevant project context. The files existed, but users could not yet interpret every project account with the confidence the transfer required.
The migration sponsor wanted to avoid paying for overlapping services and argued that colleagues could reconstruct the remaining relationships when necessary. That was a plausible short-term choice, but its cost and uncertainty belonged in the decision. I asked the project owners to define what they needed to understand after the transition and which unresolved relationships affected that work. My team could preserve and map the records; it could not determine an engineering document's meaning or approved status solely from a filename or its position in the export.
We retained ₹42 lakh migration expense and authorised ₹18 lakh for a bounded period of overlap while the remaining work was examined. Across the original 160 projects, 146 had a dependable transferred relationship account and fourteen remained unresolved. All 1,200 attachments were present. These were separate statements, not competing definitions of whether the project was successful. The report kept the unresolved set visible and did not declare the old service unnecessary simply because the byte-level transfer had completed.
Qualified project and technical owners retained interpretation of the underlying material. Legal and commercial colleagues examined rights, retention and the conditions for leaving the supplier arrangement. The overlap did not become an indefinite decision to retain everything, nor did it authorise a change to the meaning of the original documents. It supplied time and access for a defined unfinished task, with a further exit decision required once that task and the relevant obligations were understood.
I would now test a representative project account before agreeing the final migration acceptance criteria. Counting records and checking file integrity are necessary, but the company is buying continuity of useful information rather than a pile of attachments. The inconvenient result in this case was an extra overlap cost and a delayed completion announcement. It was preferable to transferring the effort of reconstructing fourteen projects to the people who discovered the missing context after the old service had already been closed.
Restricting a research assistant after confident answers cited superseded material
We funded a ₹54 lakh research-assistant pilot in 2026 to help colleagues find and interpret approved enterprise reference material. The demonstration produced fluent answers with citations, and I initially treated the visible source links as a strong basis for confidence. Qualified reviewers examined ninety-six questions before a broader release. Fifty-eight answers had current supporting sources, twenty-two relied on superseded material and sixteen lacked adequate support for the answer given. The appearance of a citation had not settled its relevance or authority.
The programme sponsor proposed a clearer disclaimer and a wider launch, arguing that colleagues already knew to exercise judgement. Yusuf Dorzemi objected to any suggestion that the tool could issue operating instructions merely because it retrieved engineering-related material. I supported narrowing the use. The question was not whether employees were thoughtful people. It was whether the proposed service encouraged reliance beyond what its source handling and evaluation supported, particularly when an answer sounded more settled than its basis.
We retained the pilot cost and limited the next stage to research assistance with human review and an explicit source-status account. The system was not authorised to control plant, prescribe technical work or replace the responsible specialist's decision. Unsupported answers and superseded sources remained findings in the evaluation; they were not removed to improve the apparent result. The fifty-eight supported answers also did not establish that every future question would be answered correctly or that the service had passed a comprehensive assurance assessment.
The narrower proposition was less impressive than the original demonstration. It required users to examine the material behind an answer and required the programme to keep working on what the source collection actually represented. We had not established a quantified productivity return or a later defect rate at the October review. I kept those gaps in the management account instead of treating adoption or the money already spent as evidence that a wider use was justified.
My mistake was to allow the presence of citations to stand in for review of their meaning. I would now ask qualified users to challenge the answer's basis before the demonstration establishes an expectation of authority. A research aid can be useful within a narrower role, but that role must follow the evidence. It should not be enlarged by the confidence of the language in which the system presents its result.