Transformation programmes tend to have very visible beginnings and endings. That is inherent in the idea of a programme.
There is a business case, a sponsor, a programme team, consultants, workshops, steering committees, milestones and usually a substantial amount of reporting.
The new framework has been approved. Policies have been published. Processes have been documented. Training has been completed. Actions have been closed. The audit finding has been addressed.
The programme is declared successful.
But I think the more interesting question comes later.
How much of it is still working twelve months after everybody has moved on?
That is where sustainable organisational change becomes much harder.
Delivery is not adoption
It is relatively easy to create a good governance framework.
That doesn't mean implementing one is easy. It can involve a lot of work: understanding the organisation, defining responsibilities, designing controls, changing processes, configuring systems, resolving difficult issues and persuading different functions to work together.
But these are still things a transformation programme can deliver.
The harder part is getting the organisation to continue doing them when the programme is no longer there to drive the activity.
A policy can be published. A process can be launched. A RACI can allocate responsibility. A committee can be established. A dashboard can turn green.
None of those things necessarily tells us whether behaviour has changed.
Delivery is not adoption. And adoption is not sustainability.
I've seen this distinction matter repeatedly across security, risk, privacy, resilience and governance.
During a programme there is energy around the subject. Senior management is interested. Resources are available. People attend meetings because somebody is tracking the actions.
Then normal business resumes. Priorities compete. People move roles. New systems arrive. Suppliers change.
The person who really understood the process, policy, standard or framework leaves.
A deadline suddenly matters more than the governance step that was supposed to happen before it.
That is when we discover whether the change was genuinely embedded.
Culture will make or break it
Culture can sometimes sound like the softer part of transformation.
I don't see it that way.
You can write an excellent policy and still have a poor control environment.
You can design a watertight governance process and find that everybody works around it.
You can tell people that the business owns risk while maintaining an operating model in which every difficult decision is quietly pushed towards Security, Legal, Compliance or the DPO.
The written framework may say one thing.
The organisation's behaviour tells you what is actually true.
That is why culture matters.
Do people raise problems early, when there are still choices, or wait until the decision is effectively irreversible?
Can specialists challenge a proposal without immediately being characterised as blockers?
Do business owners genuinely make decisions, or are specialist functions expected to make them on their behalf?
Do people understand why a control exists, or merely know which box they are supposed to tick?
And what happens when doing the right thing becomes inconvenient?
Culture is revealed in those moments.
It is also why statements such as “security is everyone's responsibility” or “privacy is embedded by design” don't tell me very much on their own.
They may be completely sincere.
The question is what the organisation has done to make them true.
Good governance should minimise unnecessary friction
There is a temptation, particularly after an incident, audit or regulatory finding, to respond by adding controls.
Another approval.
Another form.
Another committee.
Another mandatory field.
Another person who needs to sign something.
Sometimes that is exactly what is needed. Sometimes it simply creates more friction without materially improving the decision. That matters because people respond to friction.
If a governance process routinely takes weeks, requires information nobody understands and sends every decision through the same level of scrutiny regardless of risk, people will find ways around it.
They may engage late. They may minimise the issue. They may treat the process as an administrative hurdle to clear after the real decision has already been made. Or they may avoid it entirely.
None of those outcomes improves control.
The objective should be minimum friction consistent with effective governance.
Routine, well-understood activity should be straightforward. Established guardrails should allow people to make ordinary decisions without needing a specialist committee every time. More significant changes should trigger greater scrutiny. High-risk or novel decisions should bring the relevant specialists into the room early enough to influence the outcome. That requires sensible thresholds, clear decision rights and escalation routes people can actually understand.
Good governance should help the organisation make better decisions.
If governance routinely adds delay or effort without materially improving the quality of the decision, there is probably something wrong with the governance.
The business has to own the change
One of the clearest warning signs is a transformation that remains dependent on the team that created it.
If the consultant has to keep reminding people to use the process, the process has not been embedded.
If the programme manager still owns all the actions six months after go-live, ownership has probably not transferred.
If a control works only because one particularly diligent individual personally checks everything, it may be a good control today but it is not yet a sustainable one.
Specialists clearly have an important role. Security should challenge the security exposure and adequacy of the controls. Privacy should advise on data protection. Legal should explain the legal position. Risk and Compliance should provide appropriate oversight.
But sustainable governance cannot depend upon those functions owning every decision.
The people running the activity have to understand what they own.
And they have to be capable of making routine decisions without constantly referring everything back to the centre.
That is not weakening governance.
Done properly, it is how governance scales.
Training is necessary. Completion statistics are not enough.
Training is usually part of a transformation programme.
And it should be.
But there is a difference between training people and demonstrating that they are competent to operate the new model.
A dashboard telling me that 98% of employees completed an annual course tells me something.
It doesn't tell me whether they will recognise a real issue six months later.
The most useful training is usually much closer to the job.
A Procurement team needs to recognise when a supplier change matters.
An Engineering team needs to understand when an architectural decision changes the risk profile.
A business owner needs to understand the decisions they are accountable for.
A member of a specialist function needs to understand where advice ends and ownership begins.
Senior leaders need to understand what they should challenge rather than simply receiving another dashboard.
That is harder than publishing a policy and assigning a twenty-minute e-learning module.
But it is much closer to how organisations actually work.
And then test it
This is the part I think is too often overlooked.
We design the framework. We implement the process. We train people.
Then we assume it works.
Why?
In security we would not normally consider a technical control effective simply because somebody had documented how it was supposed to operate.
We test it.
The same principle should apply to organisational controls.
Take a sample.
Walk through the process.
Follow a real case through the process from beginning to end.
Ask somebody who wasn't involved in designing the control to explain what they would do.
Run a scenario.
Check whether an escalation actually reaches the person who is supposed to make the decision.
Look at what happened when the process encountered an awkward real-world case.
Compare the policy with operational reality.
None of this necessarily requires an enormous assurance programme.
Sometimes a relatively small amount of intelligent testing reveals far more than another governance presentation.
And importantly, testing should not just prove that a control operated once.
We should be looking for signs of control decay.
Has the process changed?
Are people still using it?
Has the business evolved while the control remained static?
Has a workaround quietly become normal practice?
Does the control still address the risk it was originally designed for?
Sustainable governance needs maintenance.
What happens when nobody is watching?
For me, this is the acid test.
It is easy to get attention immediately after an incident. It is easy to get decisions during an audit. It is easier to enforce a new process when the transformation programme is tracking every action.
The real test comes when the consultant has left, the auditor has closed the finding and the steering committee has moved on to the next priority.
Does Procurement still ask the question?
Does Engineering still recognise the trigger?
Does the business owner still understand what they own?
Does the escalation still happen?
Does somebody notice when the underlying assumptions have changed?
If the answer is yes, something meaningful has probably changed.
If the answer is no, we may have delivered a programme without changing the organisation.
Sustainable change should eventually become unremarkable
Perhaps the best sign of successful transformation is that, eventually, it stops feeling like transformation. It should feel natural, designed in and embedded.
The new process becomes the normal process. The governance meeting disappears because the necessary decisions are being made through ordinary management. People no longer talk about embedding the control because it is simply how the work gets done.
The central team is still there to advise, challenge, monitor and deal with the difficult cases, but it no longer has to push every routine decision through the system.
That is sustainable organisational change.
Not another policy.
Not another framework.
Not a successful audit.
A lasting change in how the organisation makes decisions when nobody is standing over it.
And this matters particularly in areas where law, technology, governance and day-to-day business decisions intersect.
Privacy is a particularly good example of this, and that is where I want to go next.
An organisation can have an excellent privacy policy, a capable DPO, detailed DPIAs and carefully drafted contractual clauses and still struggle if privacy is engaged too late, if ownership is unclear or if the operating model creates so much friction that people work around it.
It becomes even more difficult when cloud services, suppliers, subprocessors, cross-border access and increasingly AI mean that the processing environment is constantly changing.
Privacy is where law, governance, architecture, process and culture collide.
Personal commentary. Views are the author’s own.