Keep the intended transaction intact when the system changes

In 2018 I approved a purchasing integration that retried a request when the earlier response had not arrived. The receiving process treated the repeated submission as a new order. Seventeen duplicate purchase orders, carrying ₹34 lakh combined face value, were created before the problem was isolated. They were cancelled before goods were supplied against them. The enterprise incurred ₹13 lakh to repair the integration and reconcile the affected process.

My approval had accepted technical persistence without sufficiently examining commercial intent. A missing response did not establish that the first request had failed. Equally, two requests with similar contents could sometimes represent two legitimate purchases. The design needed a way to preserve the identity and disposition of the intended action, with a business process for uncertainty, rather than simply repeating work or suppressing every apparent match.

We stopped the affected flow while purchasing and IT established which commitments were intended and which were duplicates. Purchasing retained authority over cancellation and supplier communication. My responsibility was the systems design, the investigation and the resources needed for correction. I did not describe the ₹34 lakh as money lost, because the case did not involve supply or payment against those cancelled orders. Nor did I call cancellation a saving. The repair expenditure remained a separate cost.

The decision changed our review of automated transactions. We asked what the buyer meant to do, what the system knew about the earlier attempt and how a repeated transmission would be treated. The correction was not evidence that every later integration was sound, and the absence of duplicate delivery did not make the original approval harmless. I retained the case because it shows a leadership error in the question I accepted: whether communication would eventually succeed, without enough attention to what business action success would repeat.

Our 2022 recovery rehearsal reached a technical restoration milestone at hour six. The agreed business flow, involving the authorised people and the connected records needed to transact, completed at hour twenty-nine from the same starting point. Reporting six hours alone would have suggested a degree of operating readiness the exercise had not established. This was a planned rehearsal, not a live attack or an actual factory outage.

I asked that both milestones remain in the executive account. The difference was not twenty-nine additional hours after restoration; it was twenty-three further hours within a total elapsed period of twenty-nine. That distinction mattered when colleagues discussed the scope of recovery. We needed to know which dependencies remained after the systems were available and which process owners had to participate in proving that work could resume.

We funded a ₹71 lakh recovery programme to address the dependencies exposed by the rehearsal. I coordinated the systems work with operating owners, while Shalini Neqvashi retained responsibility for operating priorities. The programme's approval did not establish a later recovery time. A further exercise would need its own conditions and evidence before we could claim a changed result.

The trade-off was to retain a less reassuring but more useful account. Technical teams had achieved an important milestone, and that achievement did not need to be dismissed. It needed to be placed beside the business work still incomplete. I wanted the board discussion to examine the enterprise's ability to transact under the tested conditions, rather than infer that ability from a restored screen.

The case gave us a more precise basis for recovery planning. It did not prove readiness for every disruption, nor did a rehearsal reproduce all the uncertainty of an actual incident. My contribution was to insist that the reported endpoint correspond to the question management and directors believed they were asking.

A 2023 offline inventory pilot began with a shared balance of twelve units. Two disconnected requests sought eight and seven units respectively. Each could appear acceptable when considered against the earlier balance, but together they required fifteen units, three more than the common starting position. Across 160 reviewed request pairs, twenty-two had conflicts requiring resolution. The exercise exposed a decision problem before production use.

I held the pilot after ₹39 lakh had been spent. The immediate question was not how quickly the devices would reconnect, but what their local acceptance had promised while they could not see one another's actions. Faster synchronisation might shorten the uncertainty without deciding which commitment should prevail. Stores and production colleagues needed an explicit policy for provisional action and reconciliation.

The example did not represent a physical stock loss or an actual short shipment to a customer. We preserved it as a pilot result, with the population of request pairs clearly stated. Twenty-two conflicting pairs did not mean twenty-two missing items, and the three-unit excess in the illustrated pair did not describe every conflict. Those limits prevented the test account from becoming a fictional operating incident.

My team examined the transaction behaviour while operating owners considered what could be committed safely and who could resolve competing requests. I did not make a stock-allocation policy solely as a software decision. The held pilot and its incurred expenditure remained visible while that work continued.

The case changed what we expected from an offline feature demonstration. Being able to record an action without a connection was only part of the requirement. The enterprise also needed to understand what that action meant when another participant was working from the same earlier state. We would not present an attractive local experience as a complete shared operating promise until its unresolved commitments had a credible treatment.

In 2024 we reviewed 120 entries made through shared factory terminals. Forty-four could not be attributed to an individual from the available records. The terminal and its common login identified a point of access but did not establish which person had made those entries. That was an accountability limitation, not evidence that all forty-four entries were unauthorised or fraudulent.

We funded a ₹48 lakh identity and usability programme. I wanted the review to include the practical conditions of the work: how people approached the terminal, changed shifts and completed a task. A control that appeared sound in an office demonstration could encourage sharing or workarounds if it did not fit the actual setting. Operating colleagues therefore participated alongside IT.

We also separated entry from approval. Knowing who typed a record did not establish that the same person had authority to approve the resulting commercial or operating action. The programme had to preserve those different responsibilities rather than attach a person's name to an entry and treat the entire decision as settled. Relevant process owners retained their approval rules.

The trade-off was to address a real weakness without inventing a misconduct story. We did not infer motives from missing attribution, and we did not claim that acquiring new identity tools had already corrected every entry. The sample described the evidence available at review; later improvement would require its own assessment.

My contribution was to connect technical identity with a usable operating practice and a clear account of authority. I wanted staff to understand what their action recorded and managers to know what the record could support. The result at this stage was an approved programme and a clearer distinction among terminal, actor and approver, with the original uncertainty retained rather than retrospectively filled by assumption.

A 2025 supplier-exit review examined 26 scheduled jobs supporting our business systems. Seven still depended on a vendor service identity. Closing the contract or removing named human users would not by itself establish how those jobs would continue, who would own them or under what permission they could run. We needed an operating transfer, not just an administrative end date.

We approved a ₹32 lakh transfer programme. The review connected each affected job with its business purpose, accountable owner and the conditions needed for authorised execution. Technical teams examined dependencies, while commercial and process owners assessed the relevant permissions and responsibilities. Possession of a credential did not establish a right to continue every use after the relationship changed.

I did not describe the seven jobs as malicious access or evidence of a breach. The finding concerned dependency and ownership in an exit plan. Nor did we assume that every job should simply be copied to a new account. Some work could require different treatment once its purpose and contractual conditions were understood. Those decisions belonged with the appropriate owners.

The trade-off was to fund and sequence a transfer rather than treat contract closure as proof that the technology relationship had ended cleanly. The programme budget was not a completed continuity outcome. We retained the work needed to establish that authorised jobs could operate under their new ownership without hiding old dependencies behind a renamed identity.

This case broadened my view of supplier exit. A list of people and a termination date can miss unattended work that remains part of the enterprise's daily activity. The CIO needs to make that work visible in a form operating and commercial colleagues can examine. The objective is a defensible transfer of responsibility and execution, not merely a technically successful login under a different name.