Trusted challenge ≠ obstruction

Across an organisations dynamic technology landscape, CIO’s are responsible for decisions that shape the future of their organisations. Yet, the greatest risk in major technology programmes can often arise not from flawed architectures, but from the absence of independent scrutiny.

When uncomfortable questions are left unasked, assumptions go unchallenged and “Looks good to me” becomes the default response, the likelihood of hidden risks escalates.

The Evolving CIO Envirionment

CIOs today operate in an environment defined by:

• Continuous transformation
• Cloud and platform dependency
• Increasing regulatory scrutiny
• Cyber and operational resilience risk
• Accelerating adoption of AI and data driven services

Decisions must be made rapidly and often amid delivery pressures with commercial constraints. In such contexts, alignment can be mistaken for assurance, while challenge is perceived as friction.

However, effective challenge is not an impediment, it is:

• A safeguard
• Risk management
• Governance in action
• Leadership protection

Challenge as a Foundation for Psychological Safety

When delivered properly, independent challenge does more than ensure compliance or architectural purity. It creates psychological safety at the executive level empowering CIO’s to make informed decisions checking their choices first.

Psychological safety is the absence of interpersonal fear. Feeling psychologically safe allows people to perform their best at home, school and work. – Source: McKinsey & Co

The Hidden Risks of Unquestioned Agreement

Some architectural failures can stem not from poor technology choices, but from unchallenged assumptions embedded in delivery decisions. This pattern can be observed in large scale transformation programmes. For example:

• An architecture that introduces long term cost or platform dependency risk
• A transformation roadmap that assumes unrealistic sequencing or delivery capacity
• A resilience model that satisfies design documentation but fails operationally
• A security control set that meets audit requirements but weakens real-world defence
• A data platform that scales technically but fails organisationally

These risks rarely appear as explicit defects, but can emerge later when change becomes expensive, delivery slows or operational resilience is compromised.

• The Standish Group CHAOS Report highlights project failure is more often linked to governance and decision quality than technical capability.
• The UK National Audit Office identifies weak challenge and oversight as root causes of public sector programme failure.

What is missing is not skill or effort, but independent perspective. The quality that fundamentally improves decision making.

Trusted Challenge: Not a Barrier, But an Enabler

Many CIOs can hesitate to introduce external challenge, fearing delays, undermined teams, or governance friction. These concerns are valid, but trusted challenge operates differently:

• Clarifies decisions without delaying them
• Identifies risks early rather than escalating later
• Strengthens delivery confidence
• Supports internal teams, not second guesses them
• Enables leadership accountability without constraining autonomy

This approach aligns with modern governance guidance.

Assurance should be “proportionate to the service phase and scale” and “based on mutual trust” and “open and transparent.” Source: GOV.UK

The National Cyber Security Centre (NCSC) highlights independent review as a cornerstone of system resilience in the Cyber Assessment Framework. Trusted challenge is a control mechanism that protects delivery, not hinders it.

Psychological Safety: An Executive Imperative

Psychological safety is often discussed for engineering teams, but its most crucial application is at the leadership level. CIOs make decisions involving:

• Multi-year financial commitments
• Operational resilience exposure
• Regulatory and compliance risk
• Cyber security accountability
• Organisational credibility

These decisions are rarely reversible without cost. Yet, many CIOs can lack a safe space to test them. Internal stakeholders may optimise for timelines, protect programme commitments, avoid challenging senior direction or minimise perceived risk. External suppliers may favour their own solutions, emphasise benefits over trade-offs, and align with commercial incentives. Neither environment consistently offers neutral challenge.

Independent architectural challenge fosters psychological safety, not emotional comfort, but decision confidence.

Research from Google Project Aristotle demonstrates psychological safety is the strongest predictor of team effectiveness. At executive level, leaders perform better when challenge is safe.

Limitations of Internal Teams

Internal architects are highly capable, but their ability to provide independent challenge is limited by predictable system behaviours such as:

• Delivery Pressure: Schedule constraints make questioning assumptions seem like delay
• Organisational Hierarchy: Challenging senior decisions carries reputational and career risk
• Ownership Bias: Teams defend solutions they designed
• Commercial Alignment: Stakeholders are committed to specific outcomes

These constraints are not cultural failures, but systemic realities in complex organisations.

Modern governance frameworks, TOGAF® Standard — Architecture Governance and ISO/IEC 42010 — Systems and Software Architecture Description, recommend independent review to improve decision quality and reduce architectural risk.

The Functions of the Independent Architectural Challenger

An independent architectural challenger is not an auditor, delivery consultant, governance function or design authority substitute. Their role is distinct and critical:

• Structured Skeptic: Systematically tests assumptions using architectural reasoning and risk analysis
• Risk Translator: Connects technical decisions to business, operational, and regulatory consequences
• Decision Stress Tester: Explores failure scenarios before they occur
• Confidence Builder: Provides evidence-based validation for leadership decisions
• Governance Enabler: Supports CIO accountability without delivery friction

This role is especially valuable at architectural inflection points such as:

• Major platform/vendor selection
• Cloud/data migration
• AI adoption
• Transformation planning
• Resilience/security redesign
• Programme recovery

Measurable Organisational Benefits

Independent challenge delivers tangible organisational value, not just theoretical assurance. Key advantages include:

• Better Decisions: Assumptions are rigorously tested before commitment
• Earlier Risk Visibility: Design weaknesses are surfaced early and affordably
• Stronger Delivery Confidence: Teams proceed with validated direction
• Reduced Programme Volatility: Risks are addressed proactively
• Improved Governance Assurance: Leadership decisions are robust and defensible
• Reduced Executive Isolation: CIOs gain a trusted, credible perspective outside organisational politics
• Psychological Safety: Leaders can explore uncertainty without undermining authority

Confident leadership decisions are rarely made in isolation. They are made with trusted challenge.

A Safe External Sounding Board for CIOs

Every CIO needs a confidential, technically credible and commercially neutral space to ask critical questions:

• Are we missing a systemic risk?
• What assumption is most fragile?
• Where is vendor influence shaping architecture?
• What could fail under operational stress?
• Is this decision defensible under regulatory scrutiny?

Such conversations do not happen in governance boards, programme reviews, supplier workshops, or steering committees. They occur with a safe external sounding board whose focus is decision quality.

Who Can Act as an Independent Architectural Challenger?

Independent architectural challenge is defined less by job title and more by capability, independence and trust.

Not every architect (or consultancy) can perform this role effectively and not every form of external review provides meaningful challenge.

For CIOs, the key question is not “Who has architecture expertise?” but “Who can provide credible challenge without organisational or commercial bias?”

Advisior Role	Reason
Enterprise Architects with Cross-Organisational Experience	Senior Enterprise Architects who have operated across multiple organisations or industries are often well positioned to provide independent challenge.
Chief Architects or Technical Authorities from Outside the Delivery Chain	Architectural leaders who are not responsible for delivery outcomes can provide valuable independent challenge.
External Architecture Specialists and Advisory Practitioners	External architecture specialists often provide the highest degree of independence—particularly when they are not responsible for implementation delivery.
Independent Assurance and Review Functions	Independent Assurance and Review Functions

The Real Requirement Is Independence of Thought

The defining characteristic of an effective architectural challenger is not organisational position. It is independence of thought.

That independence comes from three conditions:

Condition	Reason
No Delivery Ownership	The challenger is not responsible for delivering the solution.
No Commercial Incentive	The challenger does not benefit from a specific architectural outcome.
No Organisational Constraint	The challenger can raise risks without political or reputational pressure.

If a CIO wants to determine whether someone can act as an independent architectural challenger, one practical question usually reveals the answer: “Can this person tell me that we are wrong and remain trusted afterward?”

• If the answer is yes: you have an independent challenger.
• If the answer is uncertain: you have governance, but not challenge.

The independent challenger does not replace internal expertise, but strengthens decisions before they become costly commitments.

The most effective CIOs do not avoid challenge, they design for it.

Further Reading

• What is psychological safety? – McKinsey & Co
• Lessons Learned from Major Programmes – National Audit Office
• Lessons learned: Resetting major programmes – National Audit Office
• Cyber Assessment Framework – NCSC
• Project Aristotle – Google
• Architecture Governance – TOGAF® Standard
• Systems and Software Architecture Description – ISO/IEC 42010

Navigating Ambiguity: Embracing Uncertainty in Leadership

Why Late Engagement Harms Enterprise Architecture