Titles such as vCIO, fractional CIO and technology adviser do not by themselves establish a person's responsibilities or independence. Read the engagement and ask who employs or pays the adviser.
Make commercial interests visible
- Who pays for the advice, and who approves the roadmap?
- Does compensation depend on products, projects or services you buy?
- Which recommendations could create resale margin or further work?
- How are conflicts disclosed and managed?
A direct answer helps you understand the arrangement. Disclosure does not by itself remove a conflict or establish independent judgment.
Examine recommendations, not just spending cuts
Select recommendations over a defined period and record their purpose, supporting evidence, alternatives, costs and expected outcomes. Include decisions to retain or retire systems as well as proposals to spend.
A lack of cost-reduction proposals does not establish bias. A growing business may need more capacity, and retaining an apparently unused item may have a documented reason. Equally, a saving is not automatically a sound decision if it transfers risk or leaves required work undone.
| Question | What to record |
|---|---|
| What problem does this address? | The business need and supporting evidence. |
| What alternatives were considered? | Options, including deferral where appropriate, and their consequences. |
| What commercial interest exists? | Relevant resale, referral or implementation interests. |
| Who decides and follows up? | Decision owner, agreed action and the evidence used to assess the result. |
Before you use a provider-drafted IT budget in a decision
Ask the provider to mark each budget line by who would receive the money: the provider itself, for example for managed services, projects or resold products, or a third party. For each third-party line, ask whether the provider would earn a margin, referral fee or implementation work from it.
The Canadian Centre for Cyber Security's baseline controls for small and medium organizations recommend that organizations identify their IT and IT security spending as raw numbers and as a percentage of total expenditures. The guidance notes that these figures include outsourcing costs. If you use that framing, ask your finance lead to compare the provider's totals with your own accounts for the same period.
The same guidance recommends that organizations list which systems and assets are in scope for the baseline controls and give a rationale for any exclusions. Using that idea for your budget, ask whether the draft names the systems it covers and any it leaves out, and who decided on those exclusions.
The Cyber Centre's guidance on contracting with managed service providers says that reducing the risks of using service providers is a responsibility shared between the organization and the provider. It adds that organizations remain ultimately responsible for protecting their systems and the confidentiality, integrity and availability of their data. It recommends that organizations that outsource IT infrastructure have an open dialogue with their provider. Ask who in your organization agreed the assumptions behind each major line.
Questions to ask in the next review
- What evidence supports this recommendation for our environment?
- What changes if we defer it, retain the current arrangement or choose another approach?
- Which assumptions and dependencies could change the expected benefit?
- How will we check whether the intended outcome was achieved?
Agree reporting and disclosure expectations under the actual engagement. Do not infer dishonesty from a question that needs further investigation or from a commercial term that has not yet been explained.
When a separate review can help
If leadership needs an external view, first identify the decision and the evidence to examine. Discuss who has advised on the work already and any limits to the reviewer's independence.
The Actually Review examines evidence within an agreed scope. Actually Leadership describes technology leadership as a separate engagement; responsibilities and potential self-review questions should be explicit.
For wider delivery questions, use the provider-evaluation guide. The ten-question checklist includes a starting question about who reviews the work.
