With cyber insurance and client compliance tightening, neither our Head of Operations nor our Controller wants to take accountability for IT Governance and Data Security. How do we assign and manage a critical seat that no department head wants to touch?

Question

Tyler Smith · Accepted Answer

Critical operational duties often get dropped when they fall between two established departments. Operations assumes Finance will manage cyber insurance and software compliance, while Finance assumes Operations will enforce data security and system permissions. When an unglamorous function lacks an owner, risk compounds rapidly.

To resolve this, you must follow the EOS® discipline of structure before people. Do not start by asking who wants to do the work. Start by defining the work. If IT Governance and Data Security does not warrant a standalone leadership seat, it must live as a distinct role or sub-seat inside an existing department.

Draft the five core roles for this function: vendor IT compliance, cyber policy enforcement, access permissions management, hardware lifecycle, and disaster recovery testing. Look at the logical home for these accountabilities. If the bulk of the risk relates to business continuity, systems infrastructure, and field productivity, it belongs under Operations. If it primarily involves regulatory compliance, risk management, insurance underwriting, and contract safeguards, it belongs under Finance.

Make a structural decision. Assign the sub-seat or functional accountability to one department head. Single-point accountability means one neck to choke. The leader who owns the seat does not need to perform every technical task personally; they can manage an outsourced managed service provider (MSP) or an internal analyst. But that leader owns the measurables, the Rocks, and the ultimate accountability for IT governance. You cannot allow critical risks to sit unowned on your Accountability Chart.