Appointment of Olumuyiwa Arowosegbe as Chief Technology Officer of Ostec Group

Organisations rarely lack good advice or good strategy. What they lack is execution. The same cycle plays out repeatedly. A risk is identified. A consultant is brought in. An assessment is carried out and a detailed report is presented to leadership. Everyone agrees with the findings. Everyone understands what needs to change. And then it joins the internal queue. It gets weighed against every other operational priority. The people expected to implement the recommendations are usually the same people already managing the environment, responding to issues and keeping the business running. So, naturally, it takes time. And six months later much of it is still sitting in a presentation. The teams understand the problem. Leadership wants to act. But the problem is structural. Real change in technology governance doesn't happen because someone wrote a good report. It happens when there is active accountability. When oversight is continuous. And when the people responsible for delivering change are supported through execution - not simply handed a list of recommendations. For many organisations, that gap between knowing what needs to change and actually making it happen is where the real exposure sits. Episode 4 of 5. Next week: what it actually looks like to close that gap. Worth sitting with: how many assessments has your organisation commissioned in the last three years - and how many were implemented in full?

Most organisations have already tried to address technology risk. They brought in advisors. They commissioned the assessment. The findings were right. And then very little happened. Why is that? Find out next Tuesday.

Speaking with technical teams across the region, there's a pattern that keeps repeating. The people closest to the technology usually know exactly where the gaps are. They've identified them. They've raised them internally. In some cases they've been raising the same issues for years. But those concerns don't always reach the boardroom in a form that leads to action. And that's becoming a much bigger issue. Regulatory pressure across Africa is increasing, and the expectations placed on organisations are changing quickly. At the same time, cyber threats have become far more sophisticated - more targeted, more patient, and increasingly focused on organisations that digitised quickly without developing governance and oversight at the same pace. Boards are beginning to ask much harder questions: If our critical systems fail, how quickly can we actually recover? Are we exposed under new regulatory frameworks? Is our environment genuinely built to scale, or have we been adding to it and patching it together over time? Many organisations are still operating with architectures and oversight models designed for a very different time. Not through carelessness - but because no one has held the formal responsibility to step outside the day-to-day operation and examine the entire structure. And here's what makes it harder still. Most organisations have already tried to address this. They've brought in advisors. Commissioned assessments. They have the reports. And very little actually changes. Episode 3 of 5. Next week: why that happens. Our COO on the execution gap. Which of those three questions would be hardest for your organisation to answer today?

Your IT team's job is to run the environment. Your vendor's job is to deliver what they sold you. Neither job is to tell your board what all of it means. That gap isn't anyone's failure. It's still a gap. Episode 2 is on our page. Next Tuesday, our CTO looks at what we're actually seeing across enterprise environments in the region; including the risks boards may be underestimating.

Last week, @Jonathan Tawiah asked who in your organisation is actually accountable for connecting technology to business risk. When we put that question to leadership teams, the answers are remarkably consistent. Some point to the IT lead or the CTO. Others point to a technology vendor or partner. Both are reasonable answers. Neither is the same thing as oversight at board level. Your IT team has a clear responsibility - keep the environment running, manage the technology, support the business. Your vendors have an equally clear one - deliver the solutions and services they've committed to. But there is a gap between them. Neither role is positioned to step outside the day-to-day environment, challenge the wider strategy, identify blind spots at executive level, and connect all of it into one clear picture of business risk. That is a different role entirely. And in many organisations it does not exist in any formal way. Not because leadership doesn't care about technology risk. They do. It's because, historically, the business model was never built that way. Risk doesn't disappear when it's hidden. It just becomes harder to see. Until something happens. Next week our CTO will discuss what's actually happening across African enterprise environments right now - including the risks boards consistently underestimate. In your organisation, who holds this? We'd be interested to hear how others have structured it. Episode 1 in the comments if you're joining midway.

Infrastructure that fails is an operational problem. Architecture that's inefficient is a financial one. Gaps in security become regulatory and reputational. The line between "a technology issue" and "a business issue" is one most organisations can no longer afford to draw. From Episode 1 of our series. Episode 2 lands Tuesday.