Paul Berryman

Thirty years in IT, sixteen of them at CIO and director level. Every one of those senior roles has been the same job in a different setting: taking a technology function that was not serving the business and making it do so.

Twice that has meant building from the ground up. The first was a children’s services organisation I joined two weeks after a ransomware attack had destroyed its entire IT environment. There were no computing services running on the day I arrived. You learn quickly what actually mattered: which controls would have changed the outcome, which ones were theatre, and how an organisation behaves when the systems its people depend on are simply gone. The second was a build where no IT structure existed at all, which turns out to be a different kind of difficult.

Both taught the same lesson, and it is why Governance Works exists. The organisations that recover fastest, and the ones that never need to, are not the ones with the most controls. They are the ones where somebody had already decided which risks mattered and who was accountable. That is governance, and it is worth considerably more than the framework it happens to be written in.