Risk management has traditionally depended on information.
- Collect more.
- Monitor more.
- Retain more.
- Analyse more.
- Identify patterns.
- Spot anomalies.
- Create audit trails.
The logic seems obvious:
The more an organisation can see, the better equipped it is to manage risk.
But there is a problem.
Everything an organisation can see can also become something it has to protect, govern, justify and take responsibility for.
So perhaps there are actually two sides to the risk equation.
Information can help us manage risk.
But possessing that information can also create risk.
When visibility becomes a liability
Consider how much organisational effort now exists because information has been collected.
- Cybersecurity protects it.
- Governance controls it.
- Compliance governs its use.
- Legal teams consider the obligations surrounding it.
- Risk teams assess the consequences of losing or misusing it.
- Technology teams maintain the systems containing it.
The organisation collects information partly to manage risk, then acquires an entirely new category of risk because it possesses that information.
That raises an interesting leadership question:
Have we confused visibility with control?
What if assurance didn’t require observation?
Imagine needing to establish that something is valid without needing to know everything about the person behind it.
An organisation might need to establish that:
- A right exists.
- An obligation has been fulfilled.
- A transaction is legitimate.
- Permission has been granted.
- A condition has been satisfied.
But does establishing those facts necessarily require continuous visibility into the individual?
That distinction is central to provider-blind governance.
Instead of proving legitimacy by accumulating information around people, governance can begin to focus on proving the things that actually matter.
For a greenfield organisation
A new organisation has an unusual opportunity.
It can decide what evidence it genuinely requires before building systems that automatically collect everything else.
Instead of beginning with:
What information should we capture?
leaders can begin with:
What do we actually need to prove?
That difference could influence technology, compliance, customer experience, governance and the organisation’s overall risk exposure.
The objective is not removing accountability.
It is designing accountability more precisely.
For existing organisations
The challenge is inevitably greater.
Years of technology and operational processes may already connect governance with observation.
- Logs.
- Profiles.
- Histories.
- Monitoring.
- Analytics.
- Customer records.
Removing these indiscriminately would make little sense.
The more useful adoption question is:
Which forms of visibility are genuinely necessary to manage risk, and which exist because our systems have always provided them?
That creates a practical starting point.
Every piece of information can be considered against two dimensions:
What risk does having this information help us manage?
and
What risk does possessing this information create?
Leaders can then begin to examine the balance between the two.
From oversight to verifiable assurance
This is where the ICCA proposition becomes more interesting than simply a privacy argument.
Provider blindness challenges the assumption that good governance necessarily requires seeing everything.
Where something can be structurally validated without revealing the person or behaviour behind it, the organisation may not need observation to establish assurance.
That potentially changes the role of governance.
Instead of:
Observe everything and identify what went wrong.
the longer-term ambition becomes:
Design the system so that only valid actions can occur within clearly defined boundaries.
Policy and oversight still have roles.
But architecture becomes part of governance itself.
The executive question
For leadership teams, the question is therefore not:
How can we see more?
It is:
What is the minimum we need to know to govern effectively?
And then comes the more challenging question:
Could knowing less actually reduce our overall exposure while preserving accountability?
That is the adoption question behind ICCA: Enterprise Risk and Governance of Provider-Blind Data Systems.
It asks leaders to reconsider a deeply embedded organisational assumption:
Perhaps better governance doesn’t always require greater visibility. Perhaps it requires greater certainty about the things that actually matter.
The underlying ICCA work is openly shared under a Creative Commons Attribution-ShareAlike 4.0 licence, encouraging discussion, challenge, adaptation and further development.
The paper describes the architectural and governance model. This article asks what adopting that model could mean for enterprise risk, accountability and organisational leadership.
#ICCA #EnterpriseRisk #Governance #RiskManagement #DigitalTrust #Leadership #DataGovernance #DigitalTransformation #CyberRisk #CreativeCommons
