Every risk framework I have worked with has a list of controls. Approvals. Segregation of duties. Access reviews. Monitoring. Not one of them lists the control most organizations actually rely on when a new technology shows up: waiting.
Waiting feels responsible. Nobody gets blamed for a tool that was never switched on. But waiting is not a control. It cannot be tested. It has no owner. And it does not stop the technology from arriving. It only stops the organization from deciding about it.
How does fear end up making the decision?
By default, and by whoever moved first. Here is what I have watched happen in boardrooms and executive teams for 25 years. A new system is in front of the leadership team. Half the room wants it. Half the room wants more information. Nobody is assigned to make the call, so the meeting ends with a request for another deck.
Meanwhile the technology is already in the building. A department bought a license. A manager started using the free version. A vendor added the feature to a platform the organization already runs. By the time the leadership team meets again, the decision has been made, by default, by whoever moved first.
That is the pattern. Nobody owns the decision, so fear makes it. And the decisions fear makes are the ones no control ever reviewed.
What does a real control look like?
A decision with an owner, a budget, a deadline and a review. I led a board-mandated cybersecurity program for a $4B health system that had to close its urgent gaps within a year, on a $1.5 million budget. A regulator had made the risk unavoidable. The board did not respond with a freeze. It responded with a decision: a named owner, a budget, a deadline and a review. The urgent gaps closed within the year, and the organization was fully compliant a year later.
Fear said stop. The control said go, with conditions. That difference is the whole job.
The risk person in the room has a reputation for slowing things down, and sometimes earns it. But the risk person’s real job is to be the one who can say yes with conditions, because they are the one who knows what the conditions should be.
What three questions replace fear?
Before any technology decision, ask three questions.
What is its job? Write down what the tool is allowed to decide and what it is not.
Who manages it? One name. Not a committee.
When do we review it? A date, and the two or three things you will look at.
That is treating new technology like a new hire. A job description, a manager, a probation period, a review. Nobody would hire a person without them. Most organizations adopt technology without any of them.
Is deciding early reckless?
It is the opposite. Go slow to go fast. The organizations that adopt well are not the ones with the longest evaluation. They are the ones that decide early, with conditions, and then watch for the ripple: what moved, what broke, who complained, what the vendor changed. That is a control. Fear is not.