We Chose Not To
The risk did not change in March; only our willingness to accept it did.
The Nine Days
In the second week of March, I watched an organisation give its entire workforce secure remote access in nine days. The same capability had been sitting in its transformation portfolio for the better part of two years — a flexible-working programme with a steering committee that met each quarter, a phased roadmap, a business case redrafted four times, and a status that had been amber for six reporting cycles running. Then the buildings closed, and the thing the roadmap had scheduled for the following winter was live before the end of the month.
I have turned those nine days over in my mind for most of the year, because they are an accusation. Nothing new was invented in March. The technology that carried thousands of people home already existed and had existed for a decade. The money was found from budgets that had, the previous quarter, been declared fully committed. The security concerns that had held the programme at amber were not resolved so much as accepted. What changed was not our capability. What changed was that the option of not doing it had been taken off the table.
That is the uncomfortable thing this year has taught anyone honest about transformation. For a decade we have explained the slowness of change with a vocabulary of constraint — legacy systems, regulatory caution, budget cycles, the need to bring people with us. Then, for three months in the spring, the constraints were held constant and only the necessity changed, and we moved at a speed we had spent years insisting was impossible. The barrier, it turned out, was rarely the thing we had named.
What Actually Compressed
It is worth being precise about what got faster, because the wrong lesson is easy to draw and is already being drawn. The engineering did not compress. Standing up remote access for a large workforce still took the same number of competent people doing the same competent work; it simply happened without interruption. What compressed was everything around the work — the deciding, the assuring, the waiting for the next meeting in the diary.
Consider where the old programme’s time had actually gone. Very little of the eighteen months had been spent building anything. It had been spent circulating. A paper would be drafted for the steering committee, which met in eight weeks. The committee would ask a reasonable question, which required a further analysis, which would return to the committee that met eight weeks after that. The information-security lead, entirely reasonably, would not sign off remote access at scale without a full risk assessment, and the full risk assessment sat behind other work. None of this was obstruction. Every individual delay was defensible. In aggregate they added up to eighteen months of a capability the organisation could have had at any point it decided it wanted it.
In March the organisation replaced that machinery with a single daily call — the incident structure many of us stood up that spring, gold command in all but name — that had the authority to decide and the obligation to decide today. The information-security lead was on that call. The risk assessment did not suddenly complete; instead the same lead, looking at the same risks, documented them, named the compensating controls, and accepted what could not be eliminated. The risk did not change in March; only our willingness to accept it did.
The delay had never been the price of doing the work. It had been the price of deferring the decision — and we had been paying it, quarter after quarter, without ever putting it on the business case.
This is the distinction that matters and the one most easily lost. An organisation’s speed of change is governed far less by its technical capacity than by its decision latency — the time between a course of action becoming sensible and someone with authority actually committing to it. Governance, as most of us had built it, was not a mechanism for making good decisions quickly. It was a mechanism for distributing the discomfort of decisions across enough people and enough time that no individual had to own the risk. The pandemic did not make our governance better. It made it get out of the way.
The Uncomfortable Arithmetic
Follow that thought to its conclusion and it stops being comfortable. If the capability was always available, and the money could always be found, and the risk was always acceptable to someone willing to accept it — then every month the programme spent at amber was a month the organisation had chosen not to have the thing. The delay was not imposed on us by reality. The delay was the decision, taken tacitly, rechosen at every meeting where we agreed to look at it again next quarter.
We told ourselves a story in which transformation was hard and slow because the world made it so. This year has made that story difficult to keep telling. The world did not become more amenable in March; if anything it became far more hostile. And yet the change went faster. The honest reading is that a great deal of what we had been calling complexity was in fact reluctance wearing complexity’s clothes — the entirely human preference for not being the person who signed the form, not owning the outcome if the new way failed, not spending the political capital required to overrule a reasonable objection.
There is a real cost hidden in that reluctance, and we almost never book it. When a capability that would save money or reduce risk is deferred for eighteen months, the organisation bears eighteen months of the old cost and the old risk. That is a number. It rarely appears anywhere, because the discipline of the business case is all pointed forward at the cost of acting and almost never at the accumulating cost of waiting. If the last year has a single lesson for how we govern change, it may simply be that the cost of delay deserves a line of its own.
But That Was Triage, Not Transformation
The strongest objection to everything I have said is also the most important to take seriously, because it is largely correct. It runs like this: what happened in March was not transformation at all. It was triage. Much of what was thrown up in nine days was brittle — remote access hardened later, processes digitised in name while the real work-arounds ran on people’s goodwill, controls accepted under duress that will have to be rebuilt properly. The reason considered transformation takes longer is that it is done properly, with the security review and the change management and the testing that a crisis simply skips. Mistake the speed of the emergency for a template, this objection says, and you are storing up a reckoning of technical debt and exhausted people.
I accept almost all of that, and it changes less than it appears to. Yes, a good deal of the spring’s work was triage and will need to be done again with more care. But notice what that concedes and what it does not. It concedes that the crisis version was rough. It does not touch the claim, which is not about quality but about latency. The eighteen months the original programme consumed were not eighteen months of careful engineering that the crisis recklessly skipped. They were eighteen months of circulation, waiting, and deferral — and that is what disappeared in March, not the testing. The lesson is emphatically not “always move at emergency speed and accept the debt.” It is narrower and more durable: most of the time between sensible and done is not being spent on rigour. It is being spent on the avoidance of a decision, and that portion is pure loss.
So the two positions are not really opposed. One says the crisis shortcuts were dangerous; the other says the peacetime delays were mostly hollow. Both can be true, and if both are true the task is not to choose emergency governance over careful governance. It is to learn to tell, in the ordinary run of things, which of our delays are buying us real assurance and which are only buying us time before we have to decide.
Before the Committees Reconvene
I am writing this in the middle of the second wave, with the buildings shut again and a long, grey winter ahead, and — for the first time — a little genuine hope arriving from the laboratories, though no one can yet say when it turns into anything we can feel. That mixture of exhaustion and hope is exactly the condition in which the wrong lesson gets locked in. When the pressure finally lifts, the strongest organisational instinct will be to exhale and restore the familiar — to let the daily call lapse back into the quarterly committee, to file the year under exceptional and carry on as before. The gains of this year are not held in any system we built. They are held in a way of deciding, and ways of deciding are the easiest thing in the world to quietly abandon.
If there is anything worth defending as we go back, it is not the crisis machinery itself — no one should want to run a business from gold command indefinitely. It is the single discipline that machinery forced on us: the habit of asking, of any delay, what it is actually protecting. That is a question we can ask in calm conditions, and it is the practical residue of the whole miserable year.
When a change is deferred from here on, the honest test is to sort the reasons into two piles:
- Delays that price a real risk — the assurance genuinely not yet done, the dependency that genuinely must land first, the harm a rushed decision would genuinely cause. These are the cost of doing the thing properly, and they are worth paying.
- Delays that price only discomfort — the wait for a consensus that will never fully arrive, the reluctance to be the one who owns the outcome, the deferral dressed as diligence. These buy nothing but the postponement of a decision, and this year proved we can stop buying them.
Almost everything we call the pace of change lives in that second pile, and until this year we could pretend otherwise. We can pretend it no longer. The pandemic did not give us a new capability for transformation; it took away, for a few months, our permission to avoid it, and showed us what we do when the avoidance is removed. The question that will define the next few years is not whether we can change at speed. We have the answer, and it is written in those nine days. The question is whether, once no one is forcing our hand, we will keep choosing to.