The question is no longer what to decide: it’s who should.

A decision worth a second opinion usually sits between two of these rather than inside one, which is why it is hard to judge from the inside. Each entry says what he has been accountable for, and what tends to go wrong when that side is missing.

In practice they arrive together, which is what makes a stall hard to diagnose from inside. A regulator’s question arrives with a commercial deadline attached. An investment decision turns on whether the thing can in fact be delivered. A business model that worked at one size quietly stops working at the next. A sound plan still fails if nobody changes what they do. The useful question is not which department is at fault, but which of these the decision actually turns on.

The people who ask are usually chief executives, and heads of strategy, operations and growth. Chief technology and information officers ask too, often about the same problem from the other side. None of them needs to be technical to have the conversation, and nobody is answered in jargon.

Most of the work is strategy and commercial judgement, and that does not reduce neatly to a list. What does reduce to a list is the narrower kind of request that arrives already shaped, usually about risk. It is worth understanding because of what it costs a company in decisions deferred: these are the four things that most often stop a board from approving one, or stall it after approval.

Most organisations meet this as four separate budget lines: a security team worried about exposure, a compliance team asked how an artificial intelligence system decides, a finance team unable to explain a cloud bill, and a programme team mid-migration. They are usually treated as four problems, by four suppliers, which is four times the cost and none of the answer.

They are one event. A boundary that once held no longer does, and the institution has taken on risk it cannot yet measure. Which is why they recur: fixing any one of them separately leaves the cause in place.

The air gap is eroding; networks built never to touch the internet now do. The datacentre perimeter dissolved into cloud and took cost visibility with it. The deterministic system gave way to models whose decisions resist the old kinds of audit. Transformation is the deliberate act of moving a boundary and hoping the consequences were understood.

Assessing that gap is the work. In one of the four it goes further: the air gap can be given back. Its value was never the wall but the silence behind it: a scan that found nothing, because nothing was listening. Arrange access so the protected machine reaches outward and never waits for a connection, and that silence returns without the isolation. That is air-gap zero trust network access, and it is the practical half of the first doctrine.

None of this is a technology hobby. Unmeasured risk is what makes a board defer a decision, and a decision deferred for a year is a year of growth, or stability, or protection that the company does not get. Naming the exposure precisely is usually what lets the decision go ahead.

He publishes the reasoning behind the advice, so it can be read and argued with before any engagement begins. Two of the four are about technology; one is about cost, and one is about why sound decisions fail to take hold.

Four stages. Most engagements do not run all of them, and the first exists partly to establish which are needed.