Governance and resilience

What you do on your own does not survive you. Here you turn your own judgement into a system the organisation runs on: you turn a principle into a decision, bring a standard down to the ground, measure your maturity as a number, and engineer your resilience before you need it.

OPENING STORY

A two-page policy that saved an audit

Fawzooz went into a formal audit with a team. They had an eighty-page folder called "the AI policy", carefully written and approved with two signatures on it. He asked the auditor what he intended to do with it, and the man said something he has never forgotten: "I am not going to read it. I am going to ask three employees what they actually do."

And he did ask them. All three gave a different answer. One of them was using public tools to analyse client data, and was entirely untroubled about it, because "nobody ever said they were forbidden". The eighty pages were not wrong. They were unread, which is a good deal worse.

So they rewrote the whole thing in two pages: what is permitted, what is forbidden, and what requires approval. All of it in language a new engineer could understand in ten minutes. At the next audit the auditor asked three employees, and this time the three of them gave the same answer. That is the difference between a document that satisfies an auditor and a document that actually changes behaviour.

Which gives you the rule that governs this entire degree: governance is not what you wrote down; it is what people do when you are not looking.