Chief Information Officer / India
The completed transaction still needed an explanation
- Computing and service-system experience
- 21 years
- Career begins July 2005
- IT colleagues
- 19
- Led through three managers
- Annual IT operating expense
- ₹5.2 crore
- ₹1.1 crore approved capital expenditure
Decisions & consequences
01Keeping six duplicate outreach entries open for review
We examined records from eighty-four outreach visits and found six duplicate entries. The entries had reached the centre system, but successful transmission did not resolve how they related to records already present. A tempting response was to merge entries with matching fields. The support team favoured a matching rule to reduce the review queue. Clinical director Rehana Veshmali wanted professional review first. I backed that slower route, preserving uncertainty until clinical owners could decide what the records represented.
We allocated ₹36 lakh to synchronisation and reconciliation work. The technical work made record origins and review status clearer, while the service process assigned responsibility for the disputed cases. Clinical colleagues retained the decision about record relationships; IT supported the evidence and the route through which a decision was recorded. The distinction mattered because a similarity between fields was not enough for my team to determine the professional meaning of an entry.
The six identified duplicates were reviewed and reconciled through that process. The outcome applied to the known cases in the eighty-four-visit review. We did not claim that every future outreach entry would be unique or that the change established a clinical benefit. We also kept the sync result separate from the reconciliation result, so a technical completion could not silently close an unresolved record question.
The case changed the way I discussed connectivity with service leaders. An interrupted connection is a technical condition, but the uncertainty left after reconnection may require a different kind of authority. A useful system preserves enough history for that authority to act. I would ask the same question of another distributed service: when two plausible records arrive, who is entitled to decide their relationship, and how does the system show that the decision is still pending? Removing a warning is not the same as answering the question that caused it.
A reminder review began with who could read the phone
We reviewed communication preferences across ninety-six accounts. Thirty-one raised concerns about a phone being shared with other people. A delivery report would not have revealed that context. The system could show that a message reached the device while saying very little about who might read it or whether the wording suited the person's circumstances.
Service colleagues initially preferred the familiar reminder wording because it was easy to explain. I argued for changing it after the shared-phone findings, accepting revised scripts and additional explanation work. We funded a ₹22 lakh redesign of notifications and preference handling. The changes used more neutral wording and made communication choices clearer in the service process. People using the service contributed to the review, while clinical, service and qualified privacy colleagues considered the responsibilities within their own remit. IT implemented the agreed design and preserved the distinction between a preference record and a broader legal determination.
The work addressed the concerns identified in that ninety-six-account review. It did not prove that every person had the same needs, that a shared phone was inherently unacceptable or that a single design settled all applicable privacy requirements. We retained a route for revisiting choices because a household arrangement or preferred channel can change. The communication account needed to show more than whether a notification had been sent.
I learned to start with the recipient's situation before treating a channel as a stable technical attribute. A telephone number can be accurate while our assumption about its use is wrong. That is a useful question for directors considering a digital service: what does the company know about the circumstances in which its communication will be received? The answer should inform the design without turning every person into a fixed category. The review gave us a specific improvement and a continuing responsibility to listen, rather than a reason to declare the communication problem permanently solved.
Revoking access that no manager could currently sponsor
A review of eighteen remote vendor accounts found seven without a current internal owner. The accounts existed for support work, but we could not establish a responsible manager who could confirm their continuing purpose. I treated that as a control problem requiring action, while keeping it separate from an allegation that a supplier had misused access.
The support manager wanted to leave the accounts available until a future contract review to avoid interrupting urgent work. I chose a current sponsorship check instead, accepting additional coordination of support requests. The seven ownerless accounts were revoked through the controlled process. We allocated ₹18 lakh to improve sponsorship records, review arrangements and the route for requesting legitimate support access. Managers needed to know what they were sponsoring, and technical colleagues needed a reliable way to determine when the permission should be reconsidered. A contract on file did not provide that answer by itself.
The result was the removal of those seven ownerless accounts from the reviewed population. We did not claim that the action prevented a specific attack or established that all remaining access was risk-free. The other accounts still required continuing review under the revised arrangements. We also examined how urgent support would be obtained, because an impractical formal route can encourage people to look for a less visible alternative.
My lesson was about responsibility over time. Permission often outlives the circumstances in which it was first granted. A manager changes role, a supplier's task ends or a support arrangement is redesigned, while the account remains technically available. The governance question is whether the company has a current reason and owner for that availability. I would report the population checked, the exceptions found and the action taken, alongside the next review obligation. That gives a board a more useful account than presenting the removal of a small set of accounts as evidence that a broad security ambition has been achieved.
Testing whether the restored record carried its attachments
Our recovery exercise covered seven datasets. The application opened and the core database checks completed, but two datasets had missing attachment references. Service owners could not treat that result as a complete recovery of the context they expected. The technical team proposed closing the infrastructure portion and handling references as ordinary support work. I recognised the completed technical checks but kept the overall service objective open, accepting a later sign-off while the missing context was addressed.
We funded ₹49 lakh of corrective work. The response addressed the references and the way the recovery exercise checked them. Service owners helped define the evidence required for a usable result, rather than receiving a technical success statement after the test had already been declared complete. The work also clarified the scope of the exercise so that the next result could be described accurately.
On the repeat, all seven datasets passed the agreed checks at the tested point. That was a meaningful improvement over the first exercise. It did not establish that every future recovery would succeed, that every possible dataset had been tested or that the organisation could ignore subsequent changes. We recorded the result with its scope and retained the need for further exercises as systems and service requirements changed.
The case reinforced my view that recovery is a claim about a usable service, not merely a running application. Different records depend on different supporting context, and the people who use them should help define what must survive. A board does not need to inspect every attachment, but it should understand how management knows the recovery test was representative of the stated objective. I would ask which service decision could still fail after the technical checks turn green. That question can expose an incomplete test without dismissing the technical work that has already been done well.