Business and technology disagree. Who decides?

The disagreement may be factual

‘Technically ready’ and ‘operationally not ready’ can both be true. Architecture, performance and defects may sit within technical tolerances while process, controls, training, data or support remain unviable. Resolving that by majority vote hides the different evidence domains.

Create a shared claim structure

Break each disputed statement into claim, evidence, uncertainty, dependency and consequence. This shows whether functions disagree about the same risk or assess different parts of the system.

The Orange Book integrates risk into decision-making and requires clear roles and accountabilities. The risk owner cannot ignore technical constraints; technology should not silently assume the business risk decision either.

Evidence to examine

Use shared exit criteria, end-to-end tests, operating and support capability, data and control evidence, known defects, workarounds, volume assumptions and an explicit residual-risk statement. Conflicting assessments need sources and decision impact.

Warning signs

Warnings include separate status packs, different definitions of ready, a go-live date without a named risk owner, or escalation that rewards only the louder function.

Questions for management

Which exact claim is disputed? What evidence would disprove it? Who accepts residual risk? Which consequences fall to operations? Which decision is reversible and which is not?

When independent review may help

Review helps when functions produce their own proof and the steering forum no longer has a shared decision basis. It does not decide which function is ‘right’; it tests which claims are sufficiently supported for the decision.