If you don’t set high expectations and hold decisionmakers accountable to the consequences of their decisions, why would you expect the quality of their decisions to be high rather than merely expedient?
It sounds like the pay for that position should be high enough to compensate for the risk, and that the penalty for failure should be consequential enough that only people with the talent, skills, and judgment to be confident in their decisions would take the job.
The financial people have skin in the game in the form of this kind of personal legal liability, and that seems to keep the financial shenanigans mainly on the “obscure but within the letter of the law” side of the line no matter what kind of pressure the CEO might bring to bear to cook the books.
When security and technical governance are a cost center and compliance is optional (or, at worst, a potential PR threat)—and when privacy has no concrete value but data does—wouldn’t it be bad business not to monetize the data and be quiet about it so as to minimize the PR threat?
It sounds like the pay for that position should be high enough to compensate for the risk, and that the penalty for failure should be consequential enough that only people with the talent, skills, and judgment to be confident in their decisions would take the job.
The financial people have skin in the game in the form of this kind of personal legal liability, and that seems to keep the financial shenanigans mainly on the “obscure but within the letter of the law” side of the line no matter what kind of pressure the CEO might bring to bear to cook the books.
When security and technical governance are a cost center and compliance is optional (or, at worst, a potential PR threat)—and when privacy has no concrete value but data does—wouldn’t it be bad business not to monetize the data and be quiet about it so as to minimize the PR threat?