Interim Group Chief Information Officer — Controls

Four calls an interim CIO cannot delegate

No resource in a technology function is scarcer than engineering time, and none is harder to see. It does not appear on a balance sheet, it is rarely counted honestly, and it is spent by default on whoever shouts loudest or whatever was started last. The Interim Group Chief Information Officer holds executive authority, under the Chief Operating Officer, to change that, and the seat comes down to a handful of judgement calls.

The first is the legacy question. Every estate has systems kept alive because someone senior uses them or because switching them off feels risky. The appointee must decide, on evidence, where engineering capacity stops serving legacy demand, and be able to defend each decision when the affected users object. The second is the line between group and local authority: which technology decisions remain with leaders in each country, at what threshold they come to the group, and what evidence every decision must carry. The third is the fate of inherited commitments. Some will continue, some will be held and some will end, and at least one of the ones that end will be popular. The fourth is which investment cases to refuse: those that would land cost or risk on a function that never agreed to bear it, and those silent on whether anyone will use the system, which other platforms it needs and how it could fail.

Around those calls sit the duties that make them stick. The CIO signs off the technology leadership structure, settles disputes between the Chief Operating Officer and operating leaders, and decides how often the board receives progress, control exceptions and decisions still open.

Capacity redirected, controls closed

Agreement and a baseline come first, within the first ninety days. With the Chief Operating Officer, the CIO should settle where technology decisions sit, establish an honest picture of how engineering capacity is currently spent, and put a responsible person against every control exception that matters. Around month nine the redirection should be visible: capacity freed from commitments that were held or ended will have moved to the work that earns it, and technology control exceptions will be tracked through to closure rather than reported and forgotten. By month 12 a group standard for technology investment and controls should be part of how the organisation works, with escalation and board reporting running without the interim.

The kind of CIO this suits

The technology estates you have run belonged to organisations turning over $750 million or more, with 2,600 people in four countries. Your record includes regulatory remediation, digital transformation and professionalisation, and remediation is the telling one: you have redrawn decision rights, budgets and review rhythms while a regulator or auditor was watching, and you know the difference between closing a finding and fixing its cause. Your risk judgement is at level 4. Product delivery, architecture built for scale, and governance over data and AI should each sit at level 3. You have taken a disputed downside to a chief operating officer without dressing it up, and you can describe a well-liked system or project you shut down, why the evidence demanded it and where the freed engineering hours went. Stopping a technology commitment will not depend on every country agreeing, and the outcome is yours to answer for across all 12 months.

Meeting the people who will test your judgement

You start in week one with the Chief Operating Officer, one to one over video, talking through how you would decide where engineering capacity goes. Week three is a working session with the Audit Committee Chair on technology controls and how exceptions get closed. In week five, executive leaders representing each function sit with you in person to examine the operating consequences of your choices; the board's directors close the process in week seven. Each stage is followed by our response in writing within three working days.